@geoly-ai/social-hub-cli 0.3.16 → 0.3.18

package/skills/reddit-voc-volume/scripts/reddit_voc_volume.py

@@ -145,7 +145,7 @@ SOCIAL_HUB_REQUIRED_SKILLS = ("social-hub-cli", "social-hub-shared")
 HUB_DEFAULT_POLL_TIMEOUT_SEC = 600.0
 HUB_POLL_BACKOFF_SEC = (5.0, 10.0, 20.0, 30.0)
 HUB_INTELLIGENCE_TIMEOUT_SEC = 30.0
-COLLECTOR_VERSION = "2.12.31"
+COLLECTOR_VERSION = "2.12.32"
 ACQUISITION_POLICIES = ("hub-first", "hub-only", "self-first")
 DEFAULT_FLAIR_FILTER_PAGES = ("", "hot", "new", "top")
 
@@ -3285,7 +3285,7 @@ def arctic_search_posts(
     return [arctic_post_item(r) for r in rows if isinstance(r, dict)]
 
 
-_ARCTIC_BASE36_ID_RE = re.compile(r"^[0-9a-z]+$", re.I)
+_ARCTIC_BASE36_ID_RE = re.compile(r"^[0-9a-z]{1,32}$", re.I)
 
 
 def normalize_reddit_post_id(target: str) -> str:
@@ -3300,14 +3300,17 @@ def normalize_reddit_post_id(target: str) -> str:
         parsed = urllib.parse.urlparse(raw)
         host = (parsed.hostname or "").lower().rstrip(".")
         if host == "redd.it" or host.endswith(".redd.it"):
-            candidate = parsed.path.strip("/").split("/", 1)[0]
+            path_parts = parsed.path.strip("/").split("/")
+            candidate = path_parts[0] if len(path_parts) == 1 else ""
         elif host == "reddit.com" or host.endswith(".reddit.com"):
             match = re.search(r"/comments/([0-9a-z]+)(?:/|$)", parsed.path, re.I)
             candidate = match.group(1) if match else ""
         else:
             raise ValueError(f"unsupported post URL host: {host or '<missing>'}")
-    elif "/comments/" in raw:
+    elif re.match(r"^/?(?:r/[^/]+/)?comments/", raw, re.I):
         match = re.search(r"/comments/([0-9a-z]+)(?:/|$)", raw, re.I)
+        if match is None:
+            match = re.search(r"^comments/([0-9a-z]+)(?:/|$)", raw, re.I)
         candidate = match.group(1) if match else ""
     else:
         candidate = raw[3:] if raw.lower().startswith("t3_") else raw
@@ -3361,6 +3364,18 @@ def normalize_comment_parent_id(parent_id: str | None, *, allow_top_level: bool
     return f"t1_{normalize_reddit_comment_id(raw)}"
 
 
+def _arctic_comment_rows(payload: Any, *, endpoint: str) -> list[dict[str, Any]]:
+    """Require the documented ``{"data": object[]}`` comment response shape."""
+    if not isinstance(payload, dict) or not isinstance(payload.get("data"), list):
+        raise ArcticError(f"arctic_comments_{endpoint}_malformed_payload: expected data[]")
+    rows = payload["data"]
+    if any(not isinstance(row, dict) for row in rows):
+        raise ArcticError(
+            f"arctic_comments_{endpoint}_malformed_payload: data must contain object rows"
+        )
+    return rows
+
+
 def arctic_comment_item(
     row: dict[str, Any],
     *,
@@ -3372,10 +3387,15 @@ def arctic_comment_item(
 ) -> dict[str, Any]:
     """Map an Arctic comment row without truncating its archived body."""
     body = row.get("body")
+    if body is not None and not isinstance(body, str):
+        raise ArcticError("arctic_comments_malformed_comment: body must be a string or null")
     body_text = body if isinstance(body, str) else ("" if body is None else str(body))
     body_status = classify_body(body_text)
     measurable = body_status not in ("Removed", "Deleted")
-    comment_id = str(row.get("id") or "").removeprefix("t1_").lower()
+    try:
+        comment_id = normalize_reddit_comment_id(str(row.get("id") or ""))
+    except ValueError as exc:
+        raise ArcticError(f"arctic_comments_malformed_comment: {exc}") from exc
     permalink = str(row.get("permalink") or "")
     if permalink.startswith("/"):
         permalink = f"https://www.reddit.com{permalink}"
@@ -3434,63 +3454,93 @@ def flatten_arctic_comment_tree(payload: Any) -> tuple[list[dict[str, Any]], lis
     roots = payload.get("data")
     if any(not isinstance(node, dict) for node in roots):
         raise ArcticError("arctic_comments_tree_malformed_payload: data must contain object nodes")
-    nodes = roots
     items: list[dict[str, Any]] = []
     collapsed: list[dict[str, Any]] = []
-    order = 0
-
-    def walk(children: list[dict[str, Any]], *, depth: int, path: list[int], parent_id: str | None) -> None:
-        nonlocal order
-        for sibling_index, node in enumerate(children):
-            kind = str(node.get("kind") or "")
-            data = node.get("data")
-            if not isinstance(data, dict):
-                raise ArcticError("arctic_comments_tree_malformed_payload: node.data must be an object")
-            node_path = [*path, sibling_index]
-            node_order = order
-            order += 1
-            if kind == "more":
-                child_ids = [
-                    normalize_reddit_comment_id(str(value))
-                    for value in (data.get("children") or [])
-                    if str(value or "").strip()
-                ]
-                collapsed.append(
-                    {
-                        "kind": "more",
-                        "id": data.get("id"),
-                        "parent_id": data.get("parent_id") or parent_id,
-                        "count": data.get("count"),
-                        "children": child_ids,
-                        "depth": depth,
-                        "tree_order": node_order,
-                        "sibling_index": sibling_index,
-                        "tree_path": node_path,
-                    }
+    seen_comment_ids: set[str] = set()
+    # Iterative preorder traversal: a valid 25,000-comment chain must not hit
+    # Python's recursion limit merely because the archived thread is deep.
+    stack: list[tuple[dict[str, Any], int, list[int], str | None, int]] = [
+        (node, 0, [sibling_index], None, sibling_index)
+        for sibling_index, node in reversed(list(enumerate(roots)))
+    ]
+
+    while stack:
+        node, depth, node_path, parent_id, sibling_index = stack.pop()
+        kind = str(node.get("kind") or "")
+        data = node.get("data")
+        if not isinstance(data, dict):
+            raise ArcticError("arctic_comments_tree_malformed_payload: node.data must be an object")
+        node_order = len(items) + len(collapsed)
+        if kind == "more":
+            raw_child_ids = data.get("children")
+            if raw_child_ids is None:
+                raw_child_ids = []
+            if not isinstance(raw_child_ids, list):
+                raise ArcticError(
+                    "arctic_comments_tree_malformed_payload: more.children must be an array"
                 )
-                continue
-            if kind != "t1":
-                raise ArcticError(f"arctic_comments_tree_malformed_payload: unexpected kind={kind or '<empty>'}")
-
-            replies = _arctic_tree_children(data.get("replies"))
-            item = arctic_comment_item(
-                data,
-                depth=depth,
-                tree_order=node_order,
-                sibling_index=sibling_index,
-                tree_path=node_path,
-                tree_parent_id=parent_id,
+            try:
+                child_ids = [normalize_reddit_comment_id(str(value)) for value in raw_child_ids]
+            except ValueError as exc:
+                raise ArcticError(
+                    f"arctic_comments_tree_malformed_payload: invalid more child ID: {exc}"
+                ) from exc
+            collapsed.append(
+                {
+                    "kind": "more",
+                    "id": data.get("id"),
+                    "parent_id": data.get("parent_id") or parent_id,
+                    "count": data.get("count"),
+                    "children": child_ids,
+                    "depth": depth,
+                    "tree_order": node_order,
+                    "sibling_index": sibling_index,
+                    "tree_path": node_path,
+                }
+            )
+            continue
+        if kind != "t1":
+            raise ArcticError(
+                f"arctic_comments_tree_malformed_payload: unexpected kind={kind or '<empty>'}"
+            )
+
+        replies = _arctic_tree_children(data.get("replies"))
+        item = arctic_comment_item(
+            data,
+            depth=depth,
+            tree_order=node_order,
+            sibling_index=sibling_index,
+            tree_path=node_path,
+            tree_parent_id=parent_id,
+        )
+        if item["id"] in seen_comment_ids:
+            raise ArcticError(
+                f"arctic_comments_tree_malformed_payload: duplicate comment ID {item['id']}"
             )
+        seen_comment_ids.add(item["id"])
+        try:
             item["child_ids"] = [
-                str(child.get("data", {}).get("id") or "").removeprefix("t1_").lower()
+                normalize_reddit_comment_id(str(child["data"].get("id") or ""))
                 for child in replies
                 if child.get("kind") == "t1" and isinstance(child.get("data"), dict)
             ]
-            items.append(item)
-            current_parent = str(data.get("name") or (f"t1_{item['id']}" if item.get("id") else "")) or None
-            walk(replies, depth=depth + 1, path=node_path, parent_id=current_parent)
+        except ValueError as exc:
+            raise ArcticError(
+                f"arctic_comments_tree_malformed_payload: invalid child comment ID: {exc}"
+            ) from exc
+        items.append(item)
+        current_parent = str(data.get("name") or f"t1_{item['id']}")
+        for child_index, child in reversed(list(enumerate(replies))):
+            stack.append(
+                (
+                    child,
+                    depth + 1,
+                    [*node_path, child_index],
+                    current_parent,
+                    child_index,
+                )
+            )
 
-    walk(nodes, depth=0, path=[], parent_id=None)
     return items, collapsed
 
 
@@ -3516,7 +3566,13 @@ def arctic_comments_tree(
         user_agent=user_agent,
         tracker=tracker,
     )
-    return flatten_arctic_comment_tree(payload)
+    items, collapsed = flatten_arctic_comment_tree(payload)
+    expected_link_id = f"t3_{post_id}"
+    if any(str(item.get("link_id") or "").lower() != expected_link_id for item in items):
+        raise ArcticError(
+            "arctic_comments_tree_malformed_payload: comment link_id does not match requested post"
+        )
+    return items, collapsed
 
 
 def arctic_search_comments(
@@ -3548,14 +3604,17 @@ def arctic_search_comments(
         tracker=tracker,
         keep_empty_params={"parent_id"} if parent_id == "" else None,
     )
-    rows = payload.get("data")
-    if not isinstance(rows, list):
-        return []
-    return [
-        arctic_comment_item(row, tree_order=index)
-        for index, row in enumerate(rows)
-        if isinstance(row, dict)
-    ]
+    rows = _arctic_comment_rows(payload, endpoint="search")
+    items = [arctic_comment_item(row, tree_order=index) for index, row in enumerate(rows)]
+    expected_link_id = f"t3_{post_id}"
+    if any(str(item.get("link_id") or "").lower() != expected_link_id for item in items):
+        raise ArcticError(
+            "arctic_comments_search_malformed_payload: comment link_id does not match requested post"
+        )
+    item_ids = [str(item["id"]) for item in items]
+    if len(item_ids) != len(set(item_ids)):
+        raise ArcticError("arctic_comments_search_malformed_payload: duplicate comment IDs")
+    return items
 
 
 def arctic_comments_by_ids(
@@ -3570,12 +3629,24 @@ def arctic_comments_by_ids(
         user_agent=user_agent,
         tracker=tracker,
     )
-    rows = payload.get("data")
-    by_id = {
-        str(row.get("id") or "").removeprefix("t1_").lower(): row
-        for row in (rows if isinstance(rows, list) else [])
-        if isinstance(row, dict)
-    }
+    rows = _arctic_comment_rows(payload, endpoint="ids")
+    by_id: dict[str, dict[str, Any]] = {}
+    for row in rows:
+        try:
+            item_id = normalize_reddit_comment_id(str(row.get("id") or ""))
+        except ValueError as exc:
+            raise ArcticError(f"arctic_comments_ids_malformed_payload: {exc}") from exc
+        if item_id in by_id:
+            raise ArcticError(
+                f"arctic_comments_ids_malformed_payload: duplicate comment ID {item_id}"
+            )
+        by_id[item_id] = row
+    unexpected_ids = sorted(set(by_id).difference(comment_ids))
+    if unexpected_ids:
+        raise ArcticError(
+            "arctic_comments_ids_malformed_payload: unexpected comment IDs "
+            + ",".join(unexpected_ids[:10])
+        )
     items = [
         arctic_comment_item(by_id[comment_id], tree_order=index)
         for index, comment_id in enumerate(comment_ids)
@@ -4991,6 +5062,7 @@ def main() -> int:
         missing_ids: list[str] = []
         items: list[dict[str, Any]] = []
         tree_fetch_succeeded = False
+        tree_limit_reached = False
         try:
             if retrieval_mode == "ids":
                 items, missing_ids = arctic_comments_by_ids(
@@ -5022,6 +5094,9 @@ def main() -> int:
                     tracker=tracker,
                 )
                 tree_fetch_succeeded = True
+                # At the exact cap, absence of `kind=more` is not proof that the
+                # upstream did not truncate. Completeness must remain fail-closed.
+                tree_limit_reached = len(items) >= limit
         except ArcticError as exc:
             errors.append(f"arctic_comments_failed:{exc}"[:300])
         if missing_ids:
@@ -5038,6 +5113,11 @@ def main() -> int:
                 f"评论树含 {len(collapsed)} 个 kind=more 折叠节点；"
                 "tree_complete=false，collapsed[].children 保留尚未展开的评论 ID。"
             )
+        if tree_limit_reached:
+            notes.append(
+                f"评论数已触达本次 tree limit={limit}；即使没有 kind=more，也不能证明树完整，"
+                "tree_complete=false。"
+            )
         fetched_at = utc_now_iso()
         canonical_source = f"https://www.reddit.com/comments/{post_id}/" if post_id else None
         fingerprint = hashlib.sha256(
@@ -5081,7 +5161,12 @@ def main() -> int:
                 "sort": args.sort or ("asc" if retrieval_mode == "search" else None),
             },
             "count": len(items),
-            "tree_complete": tree_fetch_succeeded and not collapsed if retrieval_mode == "tree" else None,
+            "tree_complete": (
+                tree_fetch_succeeded and not collapsed and not tree_limit_reached
+                if retrieval_mode == "tree"
+                else None
+            ),
+            "tree_limit_reached": tree_limit_reached if retrieval_mode == "tree" else None,
             "collapsed_count": len(collapsed),
             "collapsed": collapsed,
             "body_stats": {
@@ -5099,6 +5184,9 @@ def main() -> int:
                 "requested_limit": len(comment_ids) if retrieval_mode == "ids" else limit,
                 "effective_limit": len(comment_ids) if retrieval_mode == "ids" else limit,
                 "http_requests": tracker.count,
+                "truncated": bool(collapsed or tree_limit_reached)
+                if retrieval_mode == "tree"
+                else False,
                 "rate_limited": tracker.rate_limited,
             },
             "fetched_at": fetched_at,

package/skills/reddit-voc-volume/tests/test_archived_comments.py

@@ -31,11 +31,16 @@ class ArchivedCommentTests(unittest.TestCase):
         )
         self.assertEqual(voc.normalize_reddit_post_id("t3_ABC123"), "abc123")
         self.assertEqual(voc.normalize_reddit_post_id("https://redd.it/AbC123"), "abc123")
+        self.assertEqual(voc.normalize_reddit_post_id("/r/example/comments/AbC123/slug"), "abc123")
         self.assertEqual(voc.normalize_reddit_comment_id("t1_DeF456"), "def456")
         with self.assertRaisesRegex(ValueError, "comment ID"):
             voc.normalize_reddit_post_id("t1_def456")
         with self.assertRaisesRegex(ValueError, "unsupported post URL host"):
             voc.normalize_reddit_post_id("https://example.com/comments/abc123")
+        with self.assertRaisesRegex(ValueError, "malformed Reddit post ID"):
+            voc.normalize_reddit_post_id("example.com/comments/abc123")
+        with self.assertRaisesRegex(ValueError, "malformed Reddit post ID"):
+            voc.normalize_reddit_post_id("https://redd.it/abc123/extra")
         with self.assertRaisesRegex(ValueError, "maximum 500"):
             voc.parse_reddit_comment_ids([f"c{index:x}" for index in range(501)])
 
@@ -101,10 +106,70 @@ class ArchivedCommentTests(unittest.TestCase):
         self.assertEqual(out["items"][1]["tree_path"], [0, 0])
         self.assertEqual(out["items"][1]["body"], "Child comment")
         self.assertFalse(out["items"][1]["body_truncated"])
+        self.assertTrue(
+            {
+                "body",
+                "id",
+                "link_id",
+                "parent_id",
+                "author",
+                "created_utc",
+                "score",
+                "subreddit",
+            }.issubset(out["items"][1])
+        )
         self.assertFalse(out["tree_complete"])
         self.assertEqual(out["collapsed"][0]["children"], ["hidden1", "hidden2"])
         self.assertFalse(out["archive_caveats"]["score_realtime"])
 
+    def test_exact_tree_limit_is_not_reported_complete_without_more_node(self) -> None:
+        payload = {
+            "data": [
+                {
+                    "kind": "t1",
+                    "data": {
+                        "id": "only1",
+                        "link_id": "t3_post1",
+                        "parent_id": "t3_post1",
+                        "body": "At the requested cap",
+                        "replies": "",
+                    },
+                }
+            ]
+        }
+        with mock.patch.object(voc, "arctic_get", return_value=payload):
+            code, out = self.run_main("comments", "post1", "--limit", "1")
+
+        self.assertEqual(code, 0)
+        self.assertFalse(out["tree_complete"])
+        self.assertTrue(out["tree_limit_reached"])
+        self.assertTrue(out["rate_limit"]["truncated"])
+        self.assertEqual(out["collapsed"], [])
+
+    def test_tree_flattener_handles_depth_beyond_python_recursion_limit(self) -> None:
+        node = {
+            "kind": "t1",
+            "data": {"id": "c4ff", "body": "leaf", "replies": ""},
+        }
+        for index in reversed(range(1_100)):
+            node = {
+                "kind": "t1",
+                "data": {
+                    "id": f"c{index:x}",
+                    "body": "nested",
+                    "replies": {"data": {"children": [node]}},
+                },
+            }
+            node["data"]["replies"]["data"]["children"][0]["data"]["parent_id"] = (
+                f"t1_c{index:x}"
+            )
+
+        items, collapsed = voc.flatten_arctic_comment_tree({"data": [node]})
+        self.assertEqual(len(items), 1_101)
+        self.assertEqual(items[-1]["depth"], 1_100)
+        self.assertEqual(items[-1]["tree_order"], 1_100)
+        self.assertEqual(collapsed, [])
+
     def test_search_mode_forwards_supported_filters(self) -> None:
         with mock.patch.object(voc, "arctic_get", return_value={"data": []}) as get:
             code, out = self.run_main(
@@ -168,6 +233,42 @@ class ArchivedCommentTests(unittest.TestCase):
         self.assertFalse(out["tree_complete"])
         self.assertIn("arctic_comments_tree_malformed_payload", out["errors"][0])
 
+        malformed_more = {
+            "data": [
+                {
+                    "kind": "more",
+                    "data": {"children": "not-an-array", "parent_id": "t3_post1"},
+                }
+            ]
+        }
+        with mock.patch.object(voc, "arctic_get", return_value=malformed_more):
+            code, out = self.run_main("comments", "post1")
+        self.assertEqual(code, 1)
+        self.assertFalse(out["tree_complete"])
+        self.assertIn("more.children must be an array", out["errors"][0])
+
+    def test_search_and_ids_reject_malformed_upstream_rows(self) -> None:
+        for argv, payload, expected in (
+            (("comments", "post1", "--source", "search"), {"data": {}}, "expected data[]"),
+            (("comments", "--ids", "one1"), {"data": ["bad-row"]}, "object rows"),
+            (("comments", "--ids", "one1"), {"data": [{"id": ""}]}, "malformed Reddit comment ID"),
+            (
+                ("comments", "post1", "--source", "search"),
+                {"data": [{"id": "one1", "link_id": "t3_other", "body": "wrong post"}]},
+                "link_id does not match",
+            ),
+            (
+                ("comments", "--ids", "one1"),
+                {"data": [{"id": "one1", "body": {"unexpected": "object"}}]},
+                "body must be a string or null",
+            ),
+        ):
+            with self.subTest(argv=argv, payload=payload):
+                with mock.patch.object(voc, "arctic_get", return_value=payload):
+                    code, out = self.run_main(*argv)
+                self.assertEqual(code, 1)
+                self.assertIn(expected, out["errors"][0])
+
     def test_malformed_id_and_out_of_range_limits_fail_before_network(self) -> None:
         with mock.patch.object(voc, "arctic_get") as get, contextlib.redirect_stderr(io.StringIO()):
             with mock.patch.object(sys, "argv", [str(SCRIPT), "comments", "--ids", "t3_wrongkind"]):
@@ -179,6 +280,9 @@ class ArchivedCommentTests(unittest.TestCase):
             with mock.patch.object(sys, "argv", [str(SCRIPT), "comments", "post1", "--parent-id", "top"]):
                 with self.assertRaisesRegex(SystemExit, "2"):
                     voc.main()
+            with mock.patch.object(sys, "argv", [str(SCRIPT), "comments", "x" * 33]):
+                with self.assertRaisesRegex(SystemExit, "2"):
+                    voc.main()
             with mock.patch.object(sys, "argv", [str(SCRIPT), "comments", "--ids", "comment1", "--source", "search"]):
                 with self.assertRaisesRegex(SystemExit, "2"):
                     voc.main()

package/skills/social-hub-admin/SKILL.md

@@ -8,8 +8,10 @@ description: >-
   或管理品牌注册表、persona×brand 适配关系、trigger/avoid/rule_signal 注册表、品牌提及授权时用本 skill；
   部分既有高风险 admin 命令（settings/api-keys/members 等）需 --apply（品牌治理新命令无 --apply 选项）。
   API Key 创建/轮换是管理员资源，不是 CLI 日常登录方式。
+  另含 feishu-identities（Hub 用户 ↔ 飞书 open_id 映射的运维同步面，决定告警 @ 谁）——
+  用户说「同步飞书身份」「谁还没映射上飞书」「告警 @ 不到人」时用本 skill。
 metadata:
-  cliVersion: ">=0.3.9"
+  cliVersion: ">=0.3.18"
 ---
 
 # social-hub-admin
@@ -174,6 +176,50 @@ social-hub notification-channels test -t <team-id> --channel <uuid>
 
 `provider: "feishu"` 是 CLI 支持的 provider 枚举，不是飞书数据同步流程。
 
+## 飞书身份映射（feishu-identities，运维同步面）
+
+决定**告警卡片会 @ 到谁**：Hub 用户 ↔ 飞书 `open_id`。之前唯一的写入方式是
+`scripts/sync-feishu-identities.mjs`，那个脚本要求运维手里有生产 `DATABASE_URL`；
+这组命令把同一套语义搬到鉴权后面，只需要一次 `social-hub auth login`。
+
+```bash
+social-hub feishu-identities list
+social-hub feishu-identities list --status unmapped          # 谁还没映射上
+social-hub feishu-identities list --status lookup_failed     # 谁查失败了(不是"不在通讯录")
+
+# 本机 lark-cli 查 open_id → PUT 给 Hub 落库
+social-hub feishu-identities sync --app-id cli_xxx --dry-run
+social-hub feishu-identities sync --app-id cli_xxx --apply
+```
+
+**为什么查询在本机而不是服务端**：飞书 `contact` 查询目前只能用个人授权（bot 缺
+`contact:user.id:readonly`），服务端既没有应用凭据也拿不到这个身份。让 Hub 代查就意味着
+托管某个人的 refresh token，那个人离职/改密的当天全链路静默失效。所以形态是
+「本机 `lark-cli` 查 → PUT 落库」，`sync` 依赖本机装了 `lark-cli` 并已授权。
+
+### 三个状态不是同义词（读这段再动手）
+
+| 状态            | 含义                             | 对既有 open_id 的影响    |
+| --------------- | -------------------------------- | ------------------------ |
+| `resolved`      | 查到了                           | 覆盖                     |
+| `not_found`     | 飞书通讯录里**确实没这人**       | **清空**（离职语义）     |
+| `lookup_failed` | 查询本身失败，我们不知道         | **保留**上次成功解析的值 |
+| （无行）        | 从未同步过（`list` 里为 `null`） | —                        |
+
+把「没问出来」写成 `not_found` 的代价是**静默注销一个本来能收到告警的人**。
+
+### 两道护栏
+
+- **写入面只认交互式登录**：API key、服务 token、job/account 绑定的自动化 CLI token
+  一律 403。这批数据是 mention 注入的源头，不该有非人值守的写入方。
+- **防一次误操作清空全部映射**：当此前 `resolved` 的人里超过一半这次变成 `not_found`
+  时 `sync` 直接拒绝退出。登错飞书租户/授权失效正是这个形态，与「公司集体离职」
+  不可区分，必须人来拍板 —— 确认无误才加 `--force-mass-not-found`。
+
+`list` 读到的 `openId` 若形如 `ou_***` 说明**已脱敏**（判据是响应里的 `redacted`，
+不是字符串形态），原始 id 只给不受限的交互式 admin 登录；脱敏值回写会写出一个
+永远 @ 不到人的映射。
+
 ## 系统级人设库（personas）
 
 权限资源：`systemPersona`（权限矩阵中单独一行，与 `systemBrand` 类似）。

package/skills/social-hub-cli/SKILL.md

@@ -47,6 +47,7 @@ social-hub version --json
 | 图谱 / 合规 / 风控                                           | `social-hub-graph-compliance`     |
 | settings / invites / members / api-keys                      | `social-hub-admin`                |
 | brand-registry / brand-fit / trigger 注册表四眼 / brand-auth | `social-hub-admin`                |
+| 飞书身份映射同步（告警 @ 谁）                                | `social-hub-admin`                |
 | 板块情报 / KOL / insights                                    | `social-hub-intelligence`         |
 | 运营板块池 catalog / aliases / tier rules                    | `social-hub-subreddit-pools`      |
 | 通用网页抓取 / Firecrawl / scrape                            | `social-hub-scrape`               |