sintbot 1.4.5 → 1.4.7

package/CHANGELOG.en.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "1.4.7",
+    "date": "2026-11-09",
+    "name": "/stop no longer pauses the group",
+    "items": [
+      {
+        "t": "Fix: /stop during a task could pause the whole group",
+        "d": "/stop removes the task's reply card, and Feishu then reports that removal as a recall. When it arrived while \"stopped\" was still being sent, it was treated as a fault: the group was paused until an administrator released it, and later /model and /new were refused. The recall now waits for that reply to finish and the group keeps serving."
+      },
+      {
+        "t": "Fix: recalling a queued message could pause the group",
+        "d": "Recalling a message while its \"queued\" notice was still being sent also paused the whole group; the message is now cancelled once the notice has been sent."
+      }
+    ]
+  },
+  {
+    "version": "1.4.6",
+    "date": "2026-11-09",
+    "name": "A rejected Codex resume no longer holds the group",
+    "items": [
+      {
+        "t": "Fix: a group held when Codex rejected a resume",
+        "d": "When Codex refused to continue the previous conversation before doing any work (for example a damaged Codex session history on the machine, or a conversation whose record is gone), the whole group was paused until an administrator released it. Now the group gets one \"the last turn did not finish, please send it again\" notice, keeps serving, and starts a new conversation, so resending works."
+      },
+      {
+        "t": "Fix: a queued message stalled the group after a start failure",
+        "d": "When the model could not start (program missing or resume rejected), messages queued behind it each get a resend notice; before, the next new message was treated as a busy group and the whole group was paused."
+      }
+    ]
+  },
   {
     "version": "1.4.5",
     "date": "2026-11-09",

package/CHANGELOG.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "1.4.7",
+    "date": "2026-11-09",
+    "name": "/stop 后群不再被暂停",
+    "items": [
+      {
+        "t": "修复：任务进行中发 /stop，群可能被整个暂停",
+        "d": "/stop 会删掉这条任务的回复卡片，飞书随后把这次删除当作一次撤回通知回来；若它恰好在「已停止」还在发送时到达，此前会被当成故障，群被暂停、要管理员人工解封，后面的 /model、/new 也都不响应。现在会等那条回复发完再处理，群照常服务。"
+      },
+      {
+        "t": "修复：撤回排队中的消息时群可能被暂停",
+        "d": "在「已排队」提示还在发送时撤回那条消息，此前也会让整群暂停；现在等提示发完再取消那条消息。"
+      }
+    ]
+  },
+  {
+    "version": "1.4.6",
+    "date": "2026-11-09",
+    "name": "Codex 续接被拒不再挂群",
+    "items": [
+      {
+        "t": "修复：Codex 续接被拒时整群挂起",
+        "d": "Codex 还没开始干活就拒绝接着之前的对话（比如本机 Codex 的会话历史损坏，或那段对话的记录已不存在）时，此前整个群会被暂停，要管理员人工解封。现在只回一条「上一轮没有完成，请重新发送」，群照常服务，并自动开始新的一段对话，重发即可。"
+      },
+      {
+        "t": "修复：任务没能启动时，排在后面的消息让群卡住",
+        "d": "模型没能启动（找不到程序或续接被拒）时，排在后面的消息也各收到一条重发提醒；此前之后的新消息会被当成「群里有任务」而整群暂停。"
+      }
+    ]
+  },
   {
     "version": "1.4.5",
     "date": "2026-11-09",

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.5 with an AI assistant
+# Install SintBot 1.4.7 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.5 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.7 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.5
+# Install SintBot 1.4.7
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.5` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.5`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.7` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.7`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.5
+# 用 AI 助手安装 SintBot 1.4.7
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.5。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.7。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.5
+# 安装 SintBot 1.4.7
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.5` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.5` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.7` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.7` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.5
+  version=1.4.7
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {

package/src/agent/codexapp.js

@@ -66,11 +66,12 @@ function runTurn(opts = {}) {
   const {
     bin = 'codex', prompt, provider = {}, model, workdir, sessionId,
     permissionMode, autocompactTokens, appendSystemPrompt, codexApp, codexProjectDocFallback, extraEnv,
-    onEvent, onDurableEvent, onSteerReady, onSteerLanded, onTurnAccepted, signal, log = () => {},
+    onEvent, onDurableEvent, onSteerReady, onSteerLanded, onTurnAccepted, onSpawnFailed, signal, log = () => {},
     softStopGraceMs = 10000, spawnFn = spawn,
   } = opts
   if (!prompt) return Promise.reject(new Error('runTurn: prompt required'))
   if (onDurableEvent !== undefined && typeof onDurableEvent !== 'function') return Promise.reject(new TypeError('onDurableEvent must be a function'))
+  if (onSpawnFailed !== undefined && typeof onSpawnFailed !== 'function') return Promise.reject(new TypeError('onSpawnFailed must be a function'))
 
   return new Promise((resolve, reject) => {
     const env = { ...process.env, ...(extraEnv || {}) }
@@ -104,6 +105,12 @@ function runTurn(opts = {}) {
     let retriedEffort = false
     let pendingTurnStart = false
     let acceptedTurnId = null
+    // Pre-turn rejection witness: the server answered initialize or the
+    // thread request with an RPC error before any turn/start was written and
+    // before any durable event. Only the child's own close completes it.
+    let turnStartWritten = false
+    let durableEmitted = false
+    let preTurnRejection = null
     const deferredTurnNotices = []
     let deferredInit = null
     const earlyCompleted = new Map()
@@ -119,6 +126,7 @@ function runTurn(opts = {}) {
     const emit = (ev) => {
       if (!ev) return
       if (!onDurableEvent) { legacyEmit(ev); return }
+      durableEmitted = true
       durableWork = durableWork.then(async () => {
         let timer
         try {
@@ -210,6 +218,37 @@ function runTurn(opts = {}) {
       killChild()
       settle(() => reject(error))
     }
+    // A durable turn whose initialize or thread request the server itself
+    // rejected never wrote turn/start and emitted nothing, so no model turn
+    // and no tool ran. Stop reading, let the child exit, and report the
+    // narrow witness only from the child's close event.
+    const canWitnessPreTurnRejection = (error) => !!onDurableEvent && !!onTurnAccepted &&
+      !!onSpawnFailed && error?.codexRpcError === true && !turnStartWritten &&
+      !pendingTurnStart && !acceptedTurnId && !activeTurnId && !durableEmitted &&
+      !aborted && !completed && !durableFailed && !settled && !childCloseObserved
+    const rejectBeforeTurn = (error) => {
+      preTurnRejection = error
+      durableFailed = true
+      completed = true
+      deactivate()
+      try { child.stdin.end() } catch {}
+      child.stdout.resume?.()
+      killChild()
+    }
+    const witnessPreTurnRejection = () => settle(() => {
+      const message = String(preTurnRejection?.message || 'Codex RPC error')
+      let acknowledged
+      try {
+        acknowledged = onSpawnFailed({ backend: 'codex-app-server', code: 'THREAD_REJECTED',
+          turnStarted: false, closed: true })
+      } catch (witnessError) { reject(closedError(witnessError)); return }
+      if (acknowledged !== true) {
+        reject(closedError(new Error('Codex pre-turn rejection witness was not confirmed synchronously')))
+        return
+      }
+      log(`codex app-server rejected the thread before any turn started: ${message.slice(0, 300)}`)
+      reject(closedError(Object.assign(new Error(message), { code: 'AGENT_THREAD_REJECTED' })))
+    })
     const onAbort = () => {
       aborted = true
       deactivate()
@@ -250,6 +289,7 @@ function runTurn(opts = {}) {
         isResume: !!sessionId, prompt, appendSystemPrompt, codexApp,
         model, providerModel: provider.model, effort, workdir: workdir || process.cwd(), permissionMode })
       pendingTurnStart = true
+      turnStartWritten = true
       let turn
       try { turn = await request(turnRequest.method, turnRequest.params) }
       finally { pendingTurnStart = false }
@@ -328,6 +368,7 @@ function runTurn(opts = {}) {
     // 这段回调不在任何 Promise 链里,抛错会直接带走整个进程 ⇒ 核心失败只结束当前轮。
     // 已完成的轮 fatal 会直接返回,结果不受影响。
     const handleLine = (raw) => {
+      if (preTurnRejection) return // the turn never started; later output is discarded
       // 对方主动发来的请求同时带 id 和 method:id 是对方的号段,可能与我们的请求相撞,绝不能当响应处理;
       // 不回应它就会一直等,这一轮挂到超时。无人值守,按协议一律拒绝。
       if (raw.id != null && raw.method) {
@@ -338,7 +379,7 @@ function runTurn(opts = {}) {
       }
       if (raw.id != null) {
         const p = requests.get(raw.id)
-        if (p) { requests.delete(raw.id); raw.error ? p.fail(Object.assign(new Error(raw.error.message || 'Codex RPC error'), { codexRpcRejected: [-32600, -32601, -32602].includes(raw.error.code) })) : p.ok(raw.result) }
+        if (p) { requests.delete(raw.id); raw.error ? p.fail(Object.assign(new Error(raw.error.message || 'Codex RPC error'), { codexRpcError: true, codexRpcRejected: [-32600, -32601, -32602].includes(raw.error.code) })) : p.ok(raw.result) }
         return
       }
       if (onTurnAccepted && pendingTurnStart && !acceptedTurnId) {
@@ -431,6 +472,7 @@ function runTurn(opts = {}) {
       }
     }
     child.stdout.on('data', (chunk) => {
+      if (preTurnRejection) return // keep the pipe flowing so the child's close is observed
       if (!onDurableEvent) { processChunk(chunk).catch(fatal); return }
       child.stdout.pause?.()
       streamWork = streamWork.then(() => processChunk(chunk)).catch(failDurableEvent).finally(() => {
@@ -456,11 +498,15 @@ function runTurn(opts = {}) {
     })
     child.on('close', (code) => {
       childCloseObserved = true
+      if (preTurnRejection) { witnessPreTurnRejection(); return }
       if (onDurableEvent) streamWork.then(() => durableWork).then(() => { if (!durableFailed) completeClose(code) }, failDurableEvent)
       else completeClose(code)
     })
     start().catch((error) => {
-      if (onDurableEvent) { failDurableEvent(error); return }
+      if (onDurableEvent) {
+        if (canWitnessPreTurnRejection(error)) { rejectBeforeTurn(error); return }
+        failDurableEvent(error); return
+      }
       if (onTurnAccepted && !acceptedTurnId && !settled) {
         aborted = true
         completed = true

package/src/c2multigroupservice.js

@@ -324,7 +324,18 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       return { ignored: true, reason: `unsupported-${source}` }
     }
   }
-  function recall(event) {
+  // A reply or card update awaiting its platform response blocks the durable
+  // authority only for that moment. The bot's own card deleted by /stop or
+  // /skip comes back as a recall exactly then, and a person may recall a
+  // queued message while its queue notice is still on its way. The recall
+  // waits for that effect to settle; only an authority closed for good after
+  // the recall is a fault. The platform does not await this result, so the
+  // wait never rejects.
+  const RECALL_WAIT_MS = 60_000
+  const RECALL_POLL_MS = 25
+  const closedForGood = runtime => (runtime?.closed ?? runtime?.blocked) === true
+  const effectInFlight = runtime => runtime?.blocked === true && runtime?.closed === false
+  function recall(event, waitedMs = 0) {
     if (suspended.has(event?.chatId)) return { ignored: true, reason: 'group-held' }
     if (maintenance) return { ignored: true, reason: 'upgrading' }
     if (!allowed(event?.chatId)) return { ignored: true }
@@ -333,8 +344,20 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       held()
       binding = bindings.get(event.chatId)
       if (!started || stopPromise || !binding) return { ignored: true, reason: 'ingress-closed' }
+      if (effectInFlight(binding.runtime)) {
+        if (waitedMs >= RECALL_WAIT_MS) {
+          log(`group ${event.chatId}: recall not applied; an outbound effect stayed in flight`)
+          return { ignored: true, reason: 'recall-effect-in-flight' }
+        }
+        return new Promise(resolve => setTimeout(resolve, RECALL_POLL_MS))
+          .then(() => recall(event, waitedMs + RECALL_POLL_MS))
+          .catch(error => {
+            log(`group ${event.chatId}: deferred recall failed: ${reasonOf(error)}`)
+            return { ignored: true, reason: 'recall-failed' }
+          })
+      }
       const handled = binding.engine.handleRecall?.(event) === true
-      if (binding.runtime?.blocked) throw new Error('Recall closed its durable authority')
+      if (closedForGood(binding.runtime)) throw new Error('Recall closed its durable authority')
       return handled ? { handled: true } : { ignored: true, reason: 'unsupported-or-inactive-recall' }
     } catch (error) {
       if (!binding || !writerHeld() || !started || stopPromise) return fatal(error)

package/src/core/c2durableruntime.js

@@ -683,9 +683,19 @@ class C2DurableRuntime {
     } catch (error) { this.close(); throw error }
 
     let phase = 'attempting'
+    // Two host witnesses prove that no model turn began: the exec child never
+    // spawned (no pid), or the App Server rejected initialize/thread before
+    // any turn/start and its child has already closed.
+    const runnerNotStartedWitness = failure => {
+      const keys = failure && typeof failure === 'object' ? Object.keys(failure).sort() : []
+      return (isDeepStrictEqual(keys, ['backend', 'code', 'pid']) &&
+          failure.backend === 'codex-exec' && failure.code === 'ENOENT' && failure.pid === null) ||
+        (isDeepStrictEqual(keys, ['backend', 'closed', 'code', 'turnStarted']) &&
+          failure.backend === 'codex-app-server' && failure.code === 'THREAD_REJECTED' &&
+          failure.turnStarted === false && failure.closed === true)
+    }
     const onSpawnFailed = (failure) => {
-      if (phase !== 'attempting' || failure?.backend !== 'codex-exec' ||
-          failure.code !== 'ENOENT' || failure.pid !== null ||
+      if (phase !== 'attempting' || !runnerNotStartedWitness(failure) ||
           !isDeepStrictEqual(witness.jobReceiptIds, [receiptId]) ||
           !isDeepStrictEqual(witness.batchReceiptIds, [receiptId]) ||
           verifyGeneration({ chatId, receiptId, turnToken, generation }) !== true ||

package/src/core/v2engine.js

@@ -1754,7 +1754,8 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
       if (controller && rt.v2Controller === controller) rt.v2Controller = null
       const proofId = `sbot-c2-runner-not-started-v1:${receiptId}:${generation}`
       const eventId = `sbot-c2-runner-not-started-commit-v1:${receiptId}:${turnToken}:${generation}`
-      const provenNotStarted = !accepted && error?.code === 'AGENT_BIN_MISSING' &&
+      const provenNotStarted = !accepted &&
+        ['AGENT_BIN_MISSING', 'AGENT_THREAD_REJECTED'].includes(error?.code) &&
         this.durableV2Journal?.lookupRunnerNotStarted(proofId)?.dispatchEffectId === effectId &&
         this.durableV2Journal?.hasEvent(eventId) === true
       if (provenNotStarted) {
@@ -1765,6 +1766,33 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
           authority.close()
           throw new Error('C2 v2 unstarted runner receipt remains unsettled')
         }
+        // Recovery also settles messages queued behind this turn, each with its
+        // own confirmed notice. Forget their bodies and the local queue so the
+        // next message is admitted as idle, not as a busy follow-up. A queue
+        // the recovery left in place has no dispatcher here: fail closed.
+        const durableQueue = authority.snapshot().state.lanes.queue?.[chatId]?.queue || []
+        if (durableQueue.length) {
+          authority.close()
+          throw new Error('C2 v2 unstarted runner left queued receipts unsettled')
+        }
+        try {
+          for (const id of rt.v2QueueReceiptIds || []) this.durableV2Payloads.dropConfirmed(id)
+        } catch (dropError) { authority.close(); throw dropError }
+        rt.v2QueueReceiptIds = []
+        // A resume the server itself rejected leaves the saved thread unusable
+        // (missing rollout, unreadable history). As /new on this now idle and
+        // settled group: the next message starts a fresh session instead of
+        // meeting the same rejection again.
+        if (error.code === 'AGENT_THREAD_REJECTED' && this.store.getSession(chatId)) {
+          let locked = false
+          try { locked = this.durableV2AssertWriterLock?.() === true } catch {}
+          if (!locked) {
+            authority.close()
+            throw new Error('C2 v2 rejected-session reset lost single-writer lock')
+          }
+          this.store.resetSessionAndStats(chatId)
+          this.log(`group ${chatId}: Codex rejected the saved session before any turn; the next message starts a new session`)
+        }
         rt.v2RunnerGeneration = null
         rt.v2RunningJobs = null
         rt.v2DispatchEffect = null