sintbot 1.4.6 → 1.4.8

package/CHANGELOG.en.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "1.4.8",
+    "date": "2026-11-10",
+    "name": "Console interjections, upgrade notices, group messaging skills",
+    "items": [
+      {
+        "t": "Fix: a message sent while the previous reply was still being delivered was refused with \"wrapping up, please resend\"",
+        "d": "A message arriving at the moment a reply, card or the stop confirmation was still on its way to Feishu used to be refused. It now waits for that delivery and is handled in arrival order; a message sent right after /stop is answered normally."
+      },
+      {
+        "t": "New: the console can post a line into an idle group",
+        "d": "A line written in the console is posted to the group as the administrator and handled as an ordinary group message, with the reply in the group. A busy, held or upgrading group is refused with the reason; resubmitting the same line is not processed twice."
+      },
+      {
+        "t": "New: a version notice card in each group after an upgrade",
+        "d": "On the first start after an upgrade, each serving group receives one card listing what changed. Not sent on a first install or a downgrade; can be turned off in the console."
+      },
+      {
+        "t": "New: the agent in a group can send messages, notice cards and files, read history, reply, edit and recall",
+        "d": "The agent gains group skills: send messages, notice cards, files and images, read the group history, reply to, edit and recall its own messages, download group files and add reactions."
+      }
+    ]
+  },
+  {
+    "version": "1.4.7",
+    "date": "2026-11-09",
+    "name": "/stop no longer pauses the group",
+    "items": [
+      {
+        "t": "Fix: /stop during a task could pause the whole group",
+        "d": "/stop removes the task's reply card, and Feishu then reports that removal as a recall. When it arrived while \"stopped\" was still being sent, it was treated as a fault: the group was paused until an administrator released it, and later /model and /new were refused. The recall now waits for that reply to finish and the group keeps serving."
+      },
+      {
+        "t": "Fix: recalling a queued message could pause the group",
+        "d": "Recalling a message while its \"queued\" notice was still being sent also paused the whole group; the message is now cancelled once the notice has been sent."
+      }
+    ]
+  },
   {
     "version": "1.4.6",
     "date": "2026-11-09",

package/CHANGELOG.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "1.4.8",
+    "date": "2026-11-10",
+    "name": "控制台插话、升级公告、群消息技能",
+    "items": [
+      {
+        "t": "修复：上一条回复还在发送时发新消息，会被回「正在收尾，请稍后重发」",
+        "d": "回复、卡片或「已停止」还在发往飞书的那一瞬间到达的新消息，此前会被拒收。现在会等那次发送完成，再按到达顺序处理；/stop 后紧接着发的消息也照常回答。"
+      },
+      {
+        "t": "新增：控制台可以给空闲的群插话",
+        "d": "在控制台写一句话，会以管理员的名义发进群里，按一条普通群消息处理，回复也在群里。群正忙、待人工处理或升级中时不发，并说明原因；重复提交同一句不会处理两次。"
+      },
+      {
+        "t": "新增：升级后在各群发一张版本公告卡",
+        "d": "版本升级后首次启动，向每个在服务的群发一张卡片，列出这一版的更新。首次安装和降级不发；可以在控制台关闭。"
+      },
+      {
+        "t": "新增：群里的 Agent 可以发消息、发通知卡、发文件、读历史、回复、编辑和撤回",
+        "d": "Agent 在群里能用的技能多了：发消息、通知卡、文件和图片，读群历史，回复、编辑、撤回自己发的消息，下载群文件，加表情回应。"
+      }
+    ]
+  },
+  {
+    "version": "1.4.7",
+    "date": "2026-11-09",
+    "name": "/stop 后群不再被暂停",
+    "items": [
+      {
+        "t": "修复：任务进行中发 /stop，群可能被整个暂停",
+        "d": "/stop 会删掉这条任务的回复卡片，飞书随后把这次删除当作一次撤回通知回来；若它恰好在「已停止」还在发送时到达，此前会被当成故障，群被暂停、要管理员人工解封，后面的 /model、/new 也都不响应。现在会等那条回复发完再处理，群照常服务。"
+      },
+      {
+        "t": "修复：撤回排队中的消息时群可能被暂停",
+        "d": "在「已排队」提示还在发送时撤回那条消息，此前也会让整群暂停；现在等提示发完再取消那条消息。"
+      }
+    ]
+  },
   {
     "version": "1.4.6",
     "date": "2026-11-09",

package/bin/sintbot-v2.js

@@ -273,6 +273,8 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
         endMaintenance: () => service.endMaintenance(), expectedGroups: () => service.bindings.size,
         registries: c2updates.registriesFromEnv(),
         fetchImpl: require('../src/core/proxy').getProxyFetch() || globalThis.fetch,
+        // The same store as the startup announcement below.
+        setAnnouncementBaseline: version => store.setLastVersion(version),
         autoCheck: uiEnabled, log: message => process.stderr.write(`C2 update · ${message}\n`) })
     }
     const stop = reason => { void service.stop(reason, 0).then(finish) }
@@ -286,6 +288,11 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
         getConfig: () => cfg, getBindings: () => service.bindings,
         getHeld: () => service.held, getCapacity: () => capacity.snapshot(),
         getConnHealth: () => liveTransport?.platform.connHealth?.() || {},
+        // Console injection enters through the same ingress as a group
+        // message, posted and answered with that group's own adapter.
+        getPlatform: chatId => liveTransport?.platform.forChat(chatId) || null,
+        routeMessage: (msg, adapter) => service.routeMessage(msg, adapter),
+        isServing: () => service.serving, isFrozen: () => service.inMaintenance,
         assertWriterLock, ...configControl, updater,
         log: message => process.stderr.write(`Console · ${message}\n`) })
       await new Promise((resolve, reject) => {
@@ -305,6 +312,19 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     for (const item of started.held || []) {
       process.stderr.write(`SintBot group ${item.chatId} is held: ${item.reason}\n`)
     }
+    // Groups hear about a version change once, as a notice card. A console
+    // upgrade to this version that cannot connect every group is rolled back
+    // by the switch process, so that start announces nothing and leaves the
+    // baseline as it was.
+    const version = require('../package.json').version
+    const switchJob = started.held?.length ? updater?.status().job : null
+    if (!(switchJob?.state === 'switching' && switchJob.to === version)) {
+      const announce = require('../src/upgradeannounce')
+      announce.announceUpgradeOnStart({ store, cfg, platform: liveTransport?.platform,
+        changelog: announce.readChangelog(), currentVersion: version,
+        heldGroups: (started.held || []).map(item => item.chatId),
+        log: message => process.stderr.write(`SintBot · ${message}\n`) })
+    }
     // A console upgrade that switched to this version is done once every
     // group is connected; then the daily version check starts.
     if (!started.held?.length) updater?.confirmStarted()
@@ -353,6 +373,7 @@ Usage:
   sintbot init [--config <absolute path>] [--data-dir <absolute path>]
   sintbot start [--config <absolute path>] [--data-dir <absolute path>] [--preflight] [--ui] [--ui-host <address>] [--ui-port <port>] [--no-open]
   sintbot incident seal --group <oc_…> [--config <absolute path>] [--data-dir <absolute path>] [--reason <text>]
+  sintbot feishu <action> [arguments…] [--chat <oc_…>] [--config <path>]
   sintbot version
   sintbot help
 
@@ -360,6 +381,8 @@ Supports explicit Feishu groups using Codex or Claude Code. Start runs in the fo
 Initialization is for a new installation only; existing journals are never reset.
 Console shows live groups, binds groups and switches models or projects of idle groups;
 in a group, /model lists or switches models. Unsupported actions stay disabled.
+feishu sends to a group without the service (send-msg · send-notice · send-file · send-image ·
+history · reply · edit · recall · download · react); sintbot feishu --help lists the arguments.
 Canvas, scheduled tasks, terminal chat and other platforms are unavailable.
 A group whose last result cannot be proven is held alone; the other groups keep serving.
 Restart first: a journal that can recover reopens on its own. If the group is still held,
@@ -387,10 +410,22 @@ async function main(argv = process.argv.slice(2)) {
     process.exitCode = outcome === 'done' ? 0 : 1
     return
   }
-  if (!['init', 'start', 'incident'].includes(sub)) {
+  if (!['init', 'start', 'incident', 'feishu'].includes(sub)) {
     throw new Error(`${sub} is unavailable in this release; use sintbot help`)
   }
   if (process.platform !== 'darwin') throw new Error('this release supports macOS only')
+  if (sub === 'feishu') {
+    // The agent's group skills. Each call uses the app credentials directly;
+    // the service need not run. Text after the action may itself start with
+    // '-', so only the first two positions can ask for help.
+    const feishuCli = require('../src/feishucli')
+    if (rest.slice(0, 2).some(arg => arg === '--help' || arg === '-h')) {
+      process.stdout.write(feishuCli.feishuUsage('sintbot'))
+      return
+    }
+    await feishuCli.runFeishuAction(rest)
+    return
+  }
   if (sub === 'incident') {
     const [action, ...args] = rest
     if (rest.some(arg => arg === '--help' || arg === '-h')) { process.stdout.write(HELP); return }

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.6 with an AI assistant
+# Install SintBot 1.4.8 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.6 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.8 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.6
+# Install SintBot 1.4.8
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.6` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.6`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.8` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.8`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 
@@ -107,7 +107,7 @@ Messages sent while a task runs are added to that task in Codex groups (`codexSt
 
 With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group (a paused group shows Needs attention), stops tasks, starts a new conversation for an idle group, binds new groups, switches the model or project folder of an idle group, and adds or configures models. For LAN access, set a console password in its settings first, then enable LAN access.
 
-Settings → Software updates checks for new releases. In the foreground setup above it shows the upgrade steps: press Ctrl-C and wait for exit, rerun the one-line installer, then start again with the same command. If your own launchd agent starts SintBot, Upgrade now waits until every group is idle and settled, installs the new version into `~/.local/share/sintbot/releases/<version>` and switches the agent to it; if the new version does not connect every group within 90 seconds, the previous one is restored. A window shows each step, reconnects by itself while the service restarts and can be left running in the background. Upgrades are not announced in groups.
+Settings → Software updates checks for new releases. In the foreground setup above it shows the upgrade steps: press Ctrl-C and wait for exit, rerun the one-line installer, then start again with the same command. If your own launchd agent starts SintBot, Upgrade now waits until every group is idle and settled, installs the new version into `~/.local/share/sintbot/releases/<version>` and switches the agent to it; if the new version does not connect every group within 90 seconds, the previous one is restored. A window shows each step, reconnects by itself while the service restarts and can be left running in the background. On the first start after an upgrade, each serving group gets one card listing what changed; to turn this off, clear "Announce upgrades in groups" under Settings → Software updates.
 
 You can also add a group without the console: add it to the configuration, stop the service and run `start` again; the new group is registered automatically. Bound groups cannot be removed or renamed by editing the configuration.
 

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.6
+# 用 AI 助手安装 SintBot 1.4.8
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.6。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.8。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.6
+# 安装 SintBot 1.4.8
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.6` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.6` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.8` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.8` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 
@@ -107,7 +107,7 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 
 带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态（暂停的群显示「需要处理」）、停止任务、给空闲的群开新会话、绑定新群、给空闲的群切换模型或项目目录、添加和设置模型。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
 
-「设置 → 软件更新」会检查新版本。按上面前台方式运行时，卡片给出升级步骤：按 Ctrl-C 等待退出，重新运行一行安装命令，再用原来的命令启动。如果用你自己的 launchd 后台任务启动 SintBot，「现在升级」会等所有群空闲、记录结清后，把新版本装到 `~/.local/share/sintbot/releases/<版本>` 并切换过去；新版本 90 秒内没连上全部群会自动换回旧版。升级时窗口逐步显示进度，服务重启时页面自动重连，也可以放到后台继续。升级不在群里播报。
+「设置 → 软件更新」会检查新版本。按上面前台方式运行时，卡片给出升级步骤：按 Ctrl-C 等待退出，重新运行一行安装命令，再用原来的命令启动。如果用你自己的 launchd 后台任务启动 SintBot，「现在升级」会等所有群空闲、记录结清后，把新版本装到 `~/.local/share/sintbot/releases/<版本>` 并切换过去；新版本 90 秒内没连上全部群会自动换回旧版。升级时窗口逐步显示进度，服务重启时页面自动重连，也可以放到后台继续。升级后首次启动会在每个在服务的群发一张版本公告卡，列出这一版的更新；不想播报就在「设置 → 软件更新」取消「升级后向群里播报」。
 
 不用控制台也能加群：在配置里加上新群，停止后重新 `start` 即可，新群会自动登记。已绑定的群不能通过改配置删除或改名。
 

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.6
+  version=1.4.8
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.6",
+  "version": "1.4.8",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
@@ -67,6 +67,7 @@
     "src/c2upgradeswitch.js",
     "src/cdp.js",
     "src/config.js",
+    "src/consolesay.js",
     "src/core/c2cardeffectbridge.js",
     "src/core/c2cardterminalpath.js",
     "src/core/c2durableingress.js",
@@ -84,6 +85,7 @@
     "src/core/c2runnerinput.js",
     "src/core/c2servicestartgate.js",
     "src/core/c2sessionbridge.js",
+    "src/core/c2sourceidentity.js",
     "src/core/c2sourcequarantine.js",
     "src/core/c2startuprecovery.js",
     "src/core/c2successorbridge.js",
@@ -107,11 +109,14 @@
     "src/core/v2engine.js",
     "src/core/verify.js",
     "src/design.js",
+    "src/feishucli.js",
     "src/gitrepo.js",
     "src/leftover.js",
     "src/platform/board.js",
     "src/platform/feishu.js",
     "src/platform/multi.js",
+    "src/platform/noticecard.js",
+    "src/platform/noticesend.js",
     "src/platform/slack.js",
     "src/platform/wecom.js",
     "src/platform/wecomcli.js",
@@ -133,6 +138,8 @@
     "src/ui/sessions.js",
     "src/ui/takeover.js",
     "src/updater.js",
+    "src/upgrade.js",
+    "src/upgradeannounce.js",
     "src/usage.js"
   ],
   "scripts": {

package/src/c2console.js

@@ -4,6 +4,7 @@ const path = require('node:path')
 const { createUiServer } = require('./ui/serverbase')
 const { START_PATH, CALLBACK_PATH } = require('./ui/feishulogin')
 const { assertJournalScope } = require('./c2install')
+const { createDurableConsoleSay } = require('./consolesay')
 
 // A host facade over existing v2 authorities, not a second execution engine.
 // The allowlist applies after the existing console's authentication boundary.
@@ -29,6 +30,10 @@ const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
   // one-off agent run); it does not take a group concurrency slot.
   '/api/test',
   '/api/inbox/dismiss', '/api/issues/status',
+  // Console injection, first version: an idle group only, the line shown in
+  // the group and the reply delivered there. The posted line is the platform
+  // message that drives the turn (see consolesay.createDurableConsoleSay).
+  '/api/groups/say',
   // Software updates: check and ignore anywhere; install only when launchd
   // manages this exact entry (the updater refuses every other run mode).
   '/api/update/check', '/api/update/start', '/api/update/ignore']
@@ -36,18 +41,26 @@ const SUPPORTED_RUNNERS = ['claude', 'codex']
 
 function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld = () => new Map(),
   assertWriterLock, validateConfig, applyConfig, beforeWrite = () => true,
-  appliedResets = () => [], now = Date.now } = {}) {
+  appliedResets = () => [], now = Date.now,
+  // Console injection reaches a group only through the service's own ingress
+  // and that group's real platform adapter. Without them it is refused.
+  getPlatform = null, routeMessage = null, isServing = () => false, isFrozen = () => false,
+  log = () => {} } = {}) {
   for (const callback of [getBindings, getCapacity, getConfig, getHeld, assertWriterLock,
-    validateConfig, applyConfig, beforeWrite, appliedResets, now]) {
+    validateConfig, applyConfig, beforeWrite, appliedResets, now, isServing, isFrozen, log]) {
     if (typeof callback !== 'function') throw new TypeError('C2 console needs live authority and configuration hooks')
   }
+  if ((getPlatform === null) !== (routeMessage === null) ||
+      getPlatform !== null && (typeof getPlatform !== 'function' || typeof routeMessage !== 'function')) {
+    throw new TypeError('C2 console injection needs both the group platform and the service ingress')
+  }
   if ([validateConfig, applyConfig, beforeWrite].some(callback => callback.constructor?.name === 'AsyncFunction')) {
     throw new TypeError('C2 console configuration hooks must be synchronous')
   }
   const startedAt = now()
   const capabilities = Object.freeze({ mode: 'durable-v2',
     reason: '此操作尚未接入当前版本的持久处理流程，未执行。',
-    summary: '实时状态、认证管理、停止任务、空闲群开新会话、绑定新群、空闲群的模型切换（Codex / Claude Code）和项目目录修改、模型的添加与设置，以及后台运行时的软件升级已接入；该群有任务或未结记录时不能修改，也不能开新会话；改模型的型号、后端或端点时，用它的群须空闲，并会开始新的一段对话。解除绑定、移除模型、控制台插话、定时任务和画布暂不可用。',
+    summary: '实时状态、认证管理、停止任务、空闲群开新会话、空闲群的控制台插话、绑定新群、空闲群的模型切换（Codex / Claude Code）和项目目录修改、模型的添加与设置，以及后台运行时的软件升级已接入；该群有任务或未结记录时不能修改，也不能开新会话或插话；改模型的型号、后端或端点时，用它的群须空闲，并会开始新的一段对话。插话会把这句话（标着「管理员」）和回复都发进群，群忙时不排队、也不加入当前任务；静默插话和不回复的插话暂不支持。解除绑定、移除模型、定时任务和画布暂不可用。',
     allowed: { GET: READ_PATHS, POST: WRITE_PATHS } })
   function held() {
     if (assertWriterLock() !== true) throw new Error('服务写入权限已失效，操作未执行')
@@ -84,6 +97,32 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
     binding.engine.store.resetSessionAndStats(chatId)
     return true
   }
+  // Console injection, first version: an open, idle group only. Checked
+  // before the line is posted, so a refused group shows nothing, and again
+  // right after; the service ingress remains the final authority.
+  function sayGate(chatId) {
+    let locked = false
+    try { locked = assertWriterLock() === true } catch {}
+    if (!locked || isServing() !== true) return 'not-serving'
+    if (getConfig().groups?.[chatId]?.paused) return 'paused'
+    if (getHeld().has(chatId)) return 'held'
+    if (isFrozen() === true) return 'upgrading'
+    const binding = bindings().get(chatId)
+    if (!binding || binding.runtime?.closed === true) return 'not-serving'
+    const rt = binding.engine?.rts?.get(chatId)
+    if (groupBusy(chatId, binding) || rt?.v2RunningJobs || rt?.v2StopControl || rt?.v2SkipWaiter ||
+        binding.journal?.snapshot()?.state?.lanes?.stopIntent?.[chatId]) return 'busy'
+    return null
+  }
+  function receiptState(chatId, receiptId) {
+    const receipts = bindings().get(chatId)?.journal?.snapshot()?.receipts
+    if (receipts?.pending?.some(item => item.id === receiptId)) return 'pending'
+    if (receipts?.completed?.some(item => item.id === receiptId)) return 'completed'
+    return null
+  }
+  const say = getPlatform ? createDurableConsoleSay({ getPlatform,
+    getGroup: chatId => getConfig().groups?.[chatId] || null,
+    gate: sayGate, route: routeMessage, receiptState, log, now }) : null
   function getLiveState() {
     const cfg = getConfig()
     const capacity = getCapacity()
@@ -107,6 +146,8 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
         waitingForCapacity: !!rt?.v2AdmissionPending,
         sinceMs: rt?.v2StartedAt ? Math.max(0, now() - rt.v2StartedAt) : 0,
         sessionId: binding?.engine?.store?.getSession(chatId) || '',
+        // Why a console injection would be refused right now (null = accepted).
+        sayBlocked: say ? sayGate(chatId) : 'not-serving',
         // A held group needs the operator: its last result is unknown.
         ...(hold ? { held: true, heldReason: hold.reason, heldSinceMs: Math.max(0, now() - hold.since) } : {}),
       }
@@ -168,6 +209,12 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
         return binding.engine.stop(chatId)
       },
       clearSession,
+      // Same signature as the legacy daemon's say; the result says honestly
+      // whether the line drove a turn ({ ok, where }) or why it did not.
+      say(chatId, text, shown, quiet, options) {
+        return say ? say(chatId, text, shown, quiet, options)
+          : Promise.resolve({ ok: false, reason: 'no-daemon' })
+      },
       // A durable stop settles later, so a busy group is never reset here:
       // the operator stops it first and starts the new session once idle.
       interrupt(chatId) {

package/src/c2multigroupservice.js

@@ -39,7 +39,7 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   createTransport, createBinding, onFatal = () => {}, closeCapacity = () => {},
   quarantine = null, stopTimeoutMs = 2_000, drainTimeoutMs = 12_000,
   createRecoveryAuthority = null, holds = new Map(), sharedFault = () => null,
-  now = Date.now, log = () => {} } = {}) {
+  ingressWaitMs = 60_000, now = Date.now, log = () => {} } = {}) {
   if (!Array.isArray(routes) || !routes.length ||
       new Set(routes.map(route => route.chatId)).size !== routes.length ||
       routes.some(route => !route || typeof route.chatId !== 'string' ||
@@ -52,7 +52,8 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       [...holds.keys()].some(chatId => !routes.some(route => route.chatId === chatId)) ||
       createRecoveryAuthority !== null && typeof createRecoveryAuthority !== 'function' ||
       !Number.isSafeInteger(stopTimeoutMs) || stopTimeoutMs < 1 ||
-      !Number.isSafeInteger(drainTimeoutMs) || drainTimeoutMs < 1) {
+      !Number.isSafeInteger(drainTimeoutMs) || drainTimeoutMs < 1 ||
+      !Number.isSafeInteger(ingressWaitMs) || ingressWaitMs < 1) {
     throw new TypeError('C2 multi-group service needs explicit routes and controls')
   }
   const configured = new Map(routes.map(route => [route.chatId, route]))
@@ -248,7 +249,75 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     opening.then(() => activating.delete(route.chatId), () => activating.delete(route.chatId))
     return opening
   }
+  // A reply or card operation awaiting its platform response blocks the
+  // durable authority only for that moment: blocked, but not closed.
+  const closedForGood = runtime => (runtime?.closed ?? runtime?.blocked) === true
+  const effectInFlight = runtime => runtime?.blocked === true && runtime?.closed === false
+  // Per-group ingress order. The platform runs every inbound event on its own
+  // listener and does not await this route, so messages of one group can reach
+  // it concurrently. A message that finds its group blocked only by an
+  // in-flight effect waits for that effect (polling, bounded) instead of being
+  // refused, and every later message of that group queues behind it in arrival
+  // order until it has been handed to admission or answered. Other groups
+  // never wait, and a group with nothing waiting takes the direct path.
+  // chatId -> { tail, waiting: msgId -> count, recalled: Set of msgId }
+  const INGRESS_POLL_MS = 25
+  const AWAIT_EFFECT = Symbol('await in-flight effect')
+  const ingress = new Map()
+  const pause = () => new Promise(resolve => setTimeout(resolve, INGRESS_POLL_MS))
   function routeMessage(msg, sourceAdapter) {
+    if (!ingress.has(msg?.chatId)) {
+      const outcome = admitMessage(msg, sourceAdapter, false)
+      if (outcome !== AWAIT_EFFECT) return outcome
+      return queueMessage(msg, sourceAdapter, true)
+    }
+    return queueMessage(msg, sourceAdapter, false)
+  }
+  function queueMessage(msg, sourceAdapter, evaluated) {
+    const { chatId, msgId } = msg
+    // The bound counts from arrival, including time spent behind earlier messages.
+    const deadline = performance.now() + ingressWaitMs
+    let lane = ingress.get(chatId)
+    if (!lane) {
+      lane = { tail: Promise.resolve(), waiting: new Map(), recalled: new Set() }
+      ingress.set(chatId, lane)
+    }
+    lane.waiting.set(msgId, (lane.waiting.get(msgId) || 0) + 1)
+    let release
+    const turn = new Promise(resolve => { release = resolve })
+    const prior = lane.tail
+    lane.tail = turn
+    const admitted = (async () => {
+      try {
+        await prior
+        // A box, so the next message does not wait for this one's turn to end.
+        return await awaitAdmission(msg, sourceAdapter, lane, evaluated, deadline)
+      } finally {
+        const left = lane.waiting.get(msgId) - 1
+        if (left > 0) lane.waiting.set(msgId, left)
+        else lane.waiting.delete(msgId)
+        if (lane.tail === turn && ingress.get(chatId) === lane) ingress.delete(chatId)
+        release()
+      }
+    })()
+    return admitted.then(box => box.outcome)
+  }
+  async function awaitAdmission(msg, sourceAdapter, lane, evaluated, deadline) {
+    if (evaluated) await pause()
+    for (;;) {
+      // Never admitted, so no receipt exists: a stop or a recall meanwhile
+      // only drops this message and is no fault.
+      if (!started || stopPromise) return { outcome: { ignored: true, reason: 'ingress-closed' } }
+      if (lane.recalled.has(msg.msgId)) {
+        log(`group ${msg.chatId}: message recalled before admission`)
+        return { outcome: { ignored: true, reason: 'recalled-before-admission' } }
+      }
+      const outcome = admitMessage(msg, sourceAdapter, performance.now() >= deadline)
+      if (outcome !== AWAIT_EFFECT) return { outcome }
+      await pause()
+    }
+  }
+  function admitMessage(msg, sourceAdapter, expired) {
     const route = configured.get(msg?.chatId)
     if (route && route.paused !== true && suspended.has(msg.chatId)) {
       // A held group admits nothing; a replay of a sealed source stays silent.
@@ -275,6 +344,13 @@ function createC2MultiGroupService({ routes, assertWriterLock,
         throw new Error('C2 group ingress authority closed')
       }
       if (binding.gate.blocked) {
+        if (effectInFlight(binding.runtime)) {
+          if (!expired) return AWAIT_EFFECT
+          // Still not settled after the bound: refuse as before, no fault.
+          log(`group ${msg.chatId}: message refused; an outbound effect stayed in flight`)
+          return answerC2InputRejection({ error: rejectC2Input('C2 group effect in flight',
+            { reason: 'effect-in-flight', notice: RECOVERING_NOTICE }), msg, platform: sourceAdapter, log })
+        }
         // A turn still running under a closed authority delivers its own
         // rejection; until then this message, which has no receipt, is
         // refused. An idle closed group is closed as its own fault here.
@@ -324,17 +400,45 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       return { ignored: true, reason: `unsupported-${source}` }
     }
   }
-  function recall(event) {
+  // A reply or card update awaiting its platform response blocks the durable
+  // authority only for that moment. The bot's own card deleted by /stop or
+  // /skip comes back as a recall exactly then, and a person may recall a
+  // queued message while its queue notice is still on its way. The recall
+  // waits for that effect to settle; only an authority closed for good after
+  // the recall is a fault. The platform does not await this result, so the
+  // wait never rejects.
+  const RECALL_WAIT_MS = 60_000
+  const RECALL_POLL_MS = 25
+  function recall(event, waitedMs = 0) {
     if (suspended.has(event?.chatId)) return { ignored: true, reason: 'group-held' }
     if (maintenance) return { ignored: true, reason: 'upgrading' }
     if (!allowed(event?.chatId)) return { ignored: true }
+    // A message still waiting for admission has no receipt yet; it is
+    // dropped there instead of being admitted after its own recall.
+    const lane = ingress.get(event.chatId)
+    if (lane?.waiting.has(event.msgId)) {
+      lane.recalled.add(event.msgId)
+      return { handled: true }
+    }
     let binding
     try {
       held()
       binding = bindings.get(event.chatId)
       if (!started || stopPromise || !binding) return { ignored: true, reason: 'ingress-closed' }
+      if (effectInFlight(binding.runtime)) {
+        if (waitedMs >= RECALL_WAIT_MS) {
+          log(`group ${event.chatId}: recall not applied; an outbound effect stayed in flight`)
+          return { ignored: true, reason: 'recall-effect-in-flight' }
+        }
+        return new Promise(resolve => setTimeout(resolve, RECALL_POLL_MS))
+          .then(() => recall(event, waitedMs + RECALL_POLL_MS))
+          .catch(error => {
+            log(`group ${event.chatId}: deferred recall failed: ${reasonOf(error)}`)
+            return { ignored: true, reason: 'recall-failed' }
+          })
+      }
       const handled = binding.engine.handleRecall?.(event) === true
-      if (binding.runtime?.blocked) throw new Error('Recall closed its durable authority')
+      if (closedForGood(binding.runtime)) throw new Error('Recall closed its durable authority')
       return handled ? { handled: true } : { ignored: true, reason: 'unsupported-or-inactive-recall' }
     } catch (error) {
       if (!binding || !writerHeld() || !started || stopPromise) return fatal(error)
@@ -427,6 +531,9 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   }
   return { start, stop, routeMessage, addRoute, heldGroups, beginMaintenance, endMaintenance,
     get inMaintenance() { return maintenance },
+    // True only while the transport serves: the console may inject then and
+    // never during startup or a stop, when routing would close the service.
+    get serving() { return started && !starting && !stopPromise && !failed },
     get bindings() { return new Map(bindings) },
     get held() { return new Map([...suspended].map(([chatId, entry]) =>
       [chatId, { reason: entry.reason, source: entry.source, since: entry.since }])) } }

package/src/c2updater.js

@@ -162,11 +162,24 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
   installVersion = defaultInstallVersion, verifyInstall = defaultVerifyInstall,
   spawnSwitch = defaultSpawnSwitch, hashJournals = journalHashes, isAlive = alive,
   now = Date.now, waitMs = 5_000, queueTimeoutMs = QUEUE_TIMEOUT_MS,
-  checkIntervalMs = CHECK_INTERVAL_MS, autoCheck = true, log = () => {} } = {}) {
+  checkIntervalMs = CHECK_INTERVAL_MS, autoCheck = true, setAnnouncementBaseline = null,
+  log = () => {} } = {}) {
   if (typeof currentVersion !== 'string' || !runMode || typeof runMode.mode !== 'string' ||
       typeof stateFile !== 'string' || !path.isAbsolute(stateFile) || typeof gate !== 'function') {
     throw new TypeError('C2 updater needs the version, run mode, state file and idle gate')
   }
+  if (setAnnouncementBaseline !== null && typeof setAnnouncementBaseline !== 'function') {
+    throw new TypeError('C2 updater announcement baseline must be a function')
+  }
+  // The new version announces itself in the groups on its first start; an
+  // upgrade started without announcement records the target version as the
+  // baseline first, so that start finds nothing new.
+  function baseline(version) {
+    try { setAnnouncementBaseline(version); return true } catch (error) {
+      log(`update announcement baseline: ${error?.message || String(error)}`)
+      return false
+    }
+  }
   const current = stableVersion(currentVersion)
   let data = readJSON(stateFile)
   let timer = null
@@ -205,7 +218,7 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
       currentVersion, latestVersion: latest, checkedAt: Number(data.checkedAt) || null,
       source: data.source || '', ignoredVersion: data.ignoredVersion || '',
       available: !!current && !!latest && compareVersion(latest, current) > 0 && data.ignoredVersion !== latest,
-      mode: runMode.mode, upgradeSupported, announceSupported: false,
+      mode: runMode.mode, upgradeSupported, announceSupported: !!setAnnouncementBaseline,
       job: data.job ? { ...data.job } : null,
     }
   }
@@ -243,7 +256,7 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
     return status()
   }
 
-  function startUpgrade({ version } = {}) {
+  function startUpgrade({ version, announce = true } = {}) {
     refresh()
     if (runMode.mode !== 'managed') {
       throw new Error(runMode.mode === 'dev' ? '开发版请用部署脚本升级' : '前台运行请按卡片上的步骤升级')
@@ -256,6 +269,7 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
     if (gate().includes('held')) throw new Error('有暂停的群，先处理后再升级')
     data.job = { id: `${now()}-${Math.random().toString(36).slice(2, 8)}`, state: 'queued',
       from: current, to: v, registry: data.registry || registries[0].registry,
+      announce: announce !== false,
       createdAt: now(), updatedAt: now(), message: '等所有群空闲、记录结清后升级' }
     persist()
     schedule(0)
@@ -300,6 +314,7 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
     if (settled.length) { endMaintenance(); schedule(); return status() }
     let hashes
     try { hashes = hashJournals(dataDir) } catch (error) { endMaintenance(); return fail(`无法读取群记录：${error.message}`) }
+    const silent = job.announce === false && !!setAnnouncementBaseline && baseline(job.to)
     setJob({ state: 'switching', oldEntry: runMode.entry, newEntry: entryOf(prefix), label: runMode.label,
       plist: runMode.plist, logFile: runMode.logFile, dataDir, configPath,
       expectedGroups: expectedGroups(), journals: hashes, servicePid: process.pid,
@@ -309,6 +324,8 @@ function createC2Updater({ currentVersion, runMode, stateFile, dataDir, configPa
       const pid = spawnSwitch({ entry: runMode.entry, stateFile })
       setJob({ helperPid: pid })
     } catch (error) {
+      // This version keeps running: its own start recorded it as the baseline.
+      if (silent) baseline(currentVersion)
       endMaintenance()
       return fail(`切换进程没有启动：${error.message}`)
     }