@larksuite/openclaw-lark 2025.7.15-beta.0

package/src/core/tool-scopes.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Tool Scopes 配置
+ *
+ * 定义所有工具动作所需的飞书权限映射。
+ *
+ * ## 维护方式
+ *
+ * ⚠️ 此文件采用**手动维护**，新增或修改工具时需同步更新。
+ *
+ * ### 新增工具动作
+ *
+ * 1. 在 `ToolActionKey` 类型中添加新键：
+ *    ```typescript
+ *    export type ToolActionKey =
+ *      | "feishu_calendar_event.create"
+ *      | "feishu_new_tool.action"  // 新增
+ *    ```
+ *
+ * 2. 在 `TOOL_SCOPES` 对象中添加对应配置：
+ *    ```typescript
+ *    export const TOOL_SCOPES: ToolScopeMapping = {
+ *      "feishu_new_tool.action": [
+ *        "required:scope:here"
+ *      ],
+ *    };
+ *    ```
+ *
+ * 3. 运行 TypeScript 类型检查验证一致性：
+ *    ```bash
+ *    cd openclaw/feishu && npx tsc --noEmit
+ *    ```
+ *
+ * ### 如何确定所需 Scope
+ *
+ * 1. **查阅飞书开放平台 API 文档**：https://open.feishu.cn/document
+ * 2. **使用 feishu-oapi-search skill**：在 Claude Code 中搜索 API 文档
+ * 3. **参考类似工具**：查看功能相近的工具的 scope 配置
+ * 4. **实际测试**：观察 API 调用的错误码（LARK_ERROR.APP_SCOPE_MISSING/99991672=应用缺权限，LARK_ERROR.USER_SCOPE_INSUFFICIENT/99991679=用户缺授权）
+ *
+ * 最后更新: 2026-03-03
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_SCOPES = exports.REQUIRED_SCOPE_DESCRIPTIONS = exports.REQUIRED_APP_SCOPES = exports.TOOL_SCOPES = void 0;
+exports.filterSensitiveScopes = filterSensitiveScopes;
+// ===== 数据 =====
+/**
+ * Tool Scope 数据
+ *
+ * 每个工具动作所需的飞书权限列表（Required Scopes）
+ *
+ * ## 数据说明
+ *
+ * - 空数组 `[]` 表示该工具动作不需要任何权限
+ * - 多个权限表示需要同时拥有所有权限（AND 关系）
+ * - 所有 scope 都是 user scopes（用户级权限）
+ *
+ * ## 示例
+ *
+ * ```typescript
+ * TOOL_SCOPES["feishu_calendar_event.create"]
+ * // 返回: ["calendar:calendar.event:create", "calendar:calendar.event:update"]
+ * ```
+ *
+ * @see {@link ToolActionKey} 所有可用的工具动作键
+ */
+exports.TOOL_SCOPES = {
+    'feishu_bitable_app.create': ['base:app:create'],
+    'feishu_bitable_app.get': ['base:app:read'],
+    'feishu_bitable_app.list': ['space:document:retrieve'],
+    'feishu_bitable_app.patch': ['base:app:update'],
+    'feishu_bitable_app.copy': ['base:app:copy'],
+    'feishu_bitable_app_table.create': ['base:table:create'],
+    'feishu_bitable_app_table.list': ['base:table:read'],
+    'feishu_bitable_app_table.patch': ['base:table:update'],
+    'feishu_bitable_app_table.batch_create': ['base:table:create'],
+    'feishu_bitable_app_table_record.create': ['base:record:create'],
+    'feishu_bitable_app_table_record.update': ['base:record:update'],
+    'feishu_bitable_app_table_record.delete': ['base:record:delete'],
+    'feishu_bitable_app_table_record.batch_create': ['base:record:create'],
+    'feishu_bitable_app_table_record.batch_update': ['base:record:update'],
+    'feishu_bitable_app_table_record.batch_delete': ['base:record:delete'],
+    'feishu_bitable_app_table_record.list': ['base:record:retrieve'],
+    'feishu_bitable_app_table_field.create': ['base:field:create'],
+    'feishu_bitable_app_table_field.list': ['base:field:read'],
+    'feishu_bitable_app_table_field.update': ['base:field:read', 'base:field:update'],
+    'feishu_bitable_app_table_field.delete': ['base:field:delete'],
+    'feishu_bitable_app_table_view.create': ['base:view:write_only'],
+    'feishu_bitable_app_table_view.get': ['base:view:read'],
+    'feishu_bitable_app_table_view.list': ['base:view:read'],
+    'feishu_bitable_app_table_view.patch': ['base:view:write_only'],
+    'feishu_calendar_calendar.list': ['calendar:calendar:read'],
+    'feishu_calendar_calendar.get': ['calendar:calendar:read'],
+    'feishu_calendar_calendar.primary': ['calendar:calendar:read'],
+    'feishu_calendar_event.create': ['calendar:calendar.event:create', 'calendar:calendar.event:update'],
+    'feishu_calendar_event.list': ['calendar:calendar.event:read'],
+    'feishu_calendar_event.get': ['calendar:calendar.event:read'],
+    'feishu_calendar_event.patch': ['calendar:calendar.event:update'],
+    'feishu_calendar_event.delete': ['calendar:calendar.event:delete'],
+    'feishu_calendar_event.search': ['calendar:calendar.event:read'],
+    'feishu_calendar_event.reply': ['calendar:calendar.event:reply'],
+    'feishu_calendar_event.instances': ['calendar:calendar.event:read'],
+    'feishu_calendar_event.instance_view': ['calendar:calendar.event:read'],
+    'feishu_calendar_event_attendee.create': ['calendar:calendar.event:update'],
+    'feishu_calendar_event_attendee.list': ['calendar:calendar.event:read'],
+    'feishu_calendar_freebusy.list': ['calendar:calendar.free_busy:read'],
+    'feishu_task_attachment.upload': ['task:attachment:write'],
+    'feishu_task_task.create': ['task:task:write', 'task:task:writeonly'],
+    'feishu_task_task.get': ['task:task:read', 'task:task:write'],
+    'feishu_task_task.list': ['task:task:read', 'task:task:write'],
+    'feishu_task_task.patch': ['task:task:write', 'task:task:writeonly'],
+    'feishu_task_task.add_members': ['task:task:write', 'task:task:writeonly'],
+    'feishu_task_task.append_steps': ['task:task:write', 'task:task:writeonly'],
+    'feishu_task_tasklist.create': ['task:tasklist:write'],
+    'feishu_task_tasklist.get': ['task:tasklist:read', 'task:tasklist:write'],
+    'feishu_task_tasklist.list': ['task:tasklist:read', 'task:tasklist:write'],
+    'feishu_task_tasklist.tasks': ['task:tasklist:read', 'task:tasklist:write'],
+    'feishu_task_tasklist.patch': ['task:tasklist:write'],
+    'feishu_task_tasklist.add_members': ['task:tasklist:write'],
+    'feishu_task_comment.create': ['task:comment:write'],
+    'feishu_task_comment.list': ['task:comment:read', 'task:comment:write'],
+    'feishu_task_comment.get': ['task:comment:read', 'task:comment:write'],
+    'feishu_task_section.create': ['task:task'],
+    'feishu_task_section.get': ['task:task'],
+    'feishu_task_section.list': ['task:task'],
+    'feishu_task_section.patch': ['task:task'],
+    'feishu_task_section.tasks': ['task:task'],
+    'feishu_task_subtask.create': ['task:task:write'],
+    'feishu_task_subtask.list': ['task:task:read', 'task:task:write'],
+    'feishu_task_agent.register': ['task:task:write'],
+    'feishu_task_agent.update_profile': ['task:task:write', 'task:task:writeonly'],
+    'feishu_chat.search': ['im:chat:read'],
+    'feishu_chat.get': ['im:chat:read'],
+    'feishu_chat_members.default': ['im:chat.members:read'],
+    'feishu_drive_file.list': ['space:document:retrieve'],
+    'feishu_drive_file.get_meta': ['drive:drive.metadata:readonly'],
+    'feishu_drive_file.copy': ['docs:document:copy'],
+    'feishu_drive_file.move': ['space:document:move'],
+    'feishu_drive_file.delete': ['space:document:delete'],
+    'feishu_drive_file.upload': ['drive:file:upload'],
+    'feishu_drive_file.download': ['drive:file:download'],
+    'feishu_doc_media.download': ['board:whiteboard:node:read', 'docs:document.media:download'],
+    'feishu_doc_media.insert': ['docx:document:write_only', 'docs:document.media:upload'],
+    'feishu_doc_comments.list': ['wiki:node:read', 'docs:document.comment:read'],
+    'feishu_doc_comments.list_replies': ['wiki:node:read', 'docs:document.comment:read'],
+    'feishu_doc_comments.create': ['wiki:node:read', 'docs:document.comment:create'],
+    'feishu_doc_comments.reply': ['wiki:node:read', 'docs:document.comment:create'],
+    'feishu_doc_comments.patch': ['docs:document.comment:update'],
+    'feishu_wiki_space.list': ['wiki:space:retrieve'],
+    'feishu_wiki_space.get': ['wiki:space:read'],
+    'feishu_wiki_space.create': ['wiki:space:write_only'],
+    'feishu_wiki_space_node.list': ['wiki:node:retrieve'],
+    'feishu_wiki_space_node.get': ['wiki:node:read'],
+    'feishu_wiki_space_node.create': ['wiki:node:create'],
+    'feishu_wiki_space_node.move': ['wiki:node:move'],
+    'feishu_wiki_space_node.copy': ['wiki:node:copy'],
+    'feishu_im_user_message.send': ['im:message', 'im:message.send_as_user'],
+    'feishu_im_user_message.reply': ['im:message', 'im:message.send_as_user'],
+    'feishu_im_user_fetch_resource.default': [
+        'im:message.group_msg:get_as_user',
+        'im:message.p2p_msg:get_as_user',
+        'im:message:readonly',
+    ],
+    'feishu_im_user_get_messages.default': [
+        'im:chat:read',
+        'im:message:readonly',
+        'im:message.group_msg:get_as_user',
+        'im:message.p2p_msg:get_as_user',
+        'contact:contact.base:readonly',
+        'contact:user.base:readonly',
+    ],
+    'feishu_im_user_search_messages.default': [
+        'im:chat:read',
+        'im:message:readonly',
+        'im:message.group_msg:get_as_user',
+        'im:message.p2p_msg:get_as_user',
+        'contact:contact.base:readonly',
+        'contact:user.base:readonly',
+        'search:message',
+    ],
+    'feishu_search_doc_wiki.search': ['search:docs:read'],
+    'feishu_get_user.basic_batch': ['contact:user.basic_profile:readonly'],
+    'feishu_get_user.default': ['contact:contact.base:readonly', 'contact:user.base:readonly'],
+    'feishu_search_user.default': ['contact:user:search'],
+    'feishu_create_doc.default': [
+        'board:whiteboard:node:create',
+        'docx:document:create',
+        'docx:document:readonly',
+        'docx:document:write_only',
+        'wiki:node:create',
+        'wiki:node:read',
+        'docs:document.media:upload',
+    ],
+    'feishu_fetch_doc.default': ['docx:document:readonly', 'wiki:node:read'],
+    'feishu_update_doc.default': [
+        'board:whiteboard:node:create',
+        'docx:document:create',
+        'docx:document:readonly',
+        'docx:document:write_only',
+    ],
+    'feishu_sheet.info': ['sheets:spreadsheet.meta:read', 'sheets:spreadsheet:read'],
+    'feishu_sheet.read': ['sheets:spreadsheet.meta:read', 'sheets:spreadsheet:read'],
+    'feishu_sheet.write': [
+        'sheets:spreadsheet.meta:read',
+        'sheets:spreadsheet:read',
+        'sheets:spreadsheet:create',
+        'sheets:spreadsheet:write_only',
+    ],
+    'feishu_sheet.append': [
+        'sheets:spreadsheet.meta:read',
+        'sheets:spreadsheet:read',
+        'sheets:spreadsheet:create',
+        'sheets:spreadsheet:write_only',
+    ],
+    'feishu_sheet.find': ['sheets:spreadsheet.meta:read', 'sheets:spreadsheet:read'],
+    'feishu_sheet.create': [
+        'sheets:spreadsheet.meta:read',
+        'sheets:spreadsheet:read',
+        'sheets:spreadsheet:create',
+        'sheets:spreadsheet:write_only',
+    ],
+    'feishu_sheet.export': ['docs:document:export'],
+};
+// ===== 必需的应用身份权限 =====
+/**
+ * 飞书插件运行必须开通的应用身份权限清单
+ *
+ * 这些权限是插件基础功能（消息接收、卡片交互、基本信息查询等）所必需的，
+ * 如果缺失这些权限，插件将无法正常工作。
+ *
+ * 权限分类：
+ * - im:message.* - 消息接收和发送
+ * - im:chat.* - 群聊管理
+ * - im:resource - 消息资源（图片、文件等）
+ * - cardkit:card.* - 卡片交互
+ * - application:application:self_manage - 应用自身权限查询（权限检查基础）
+ * - contact:contact.base:readonly - 通讯录基础信息
+ * - docx:document:readonly - 文档基础只读（文档链接预览等）
+ *
+ * 最后更新: 2026-03-03
+ */
+exports.REQUIRED_APP_SCOPES = [
+    'contact:contact.base:readonly',
+    'docx:document:readonly',
+    'im:chat:read',
+    'im:chat:update',
+    'im:message.group_at_msg:readonly',
+    'im:message.p2p_msg:readonly',
+    'im:message.pins:read',
+    'im:message.pins:write_only',
+    'im:message.reactions:read',
+    'im:message.reactions:write_only',
+    'im:message:readonly',
+    'im:message:recall',
+    'im:message:send_as_bot',
+    'im:message:send_multi_users',
+    'im:message:send_sys_msg',
+    'im:message:update',
+    'im:resource',
+    'application:application:self_manage',
+    'cardkit:card:write',
+    'cardkit:card:read',
+];
+/**
+ * 必需权限用途说明
+ *
+ * 描述每个必需权限的具体用途，帮助管理员理解为什么需要开通该权限。
+ */
+exports.REQUIRED_SCOPE_DESCRIPTIONS = {
+    'contact:contact.base:readonly': '获取用户基本信息（姓名、头像）',
+    'docx:document:readonly': '读取文档内容、预览文档链接',
+    'im:chat:read': '读取群聊信息、获取群成员列表',
+    'im:chat:update': '修改群聊设置（群名称、群公告等）',
+    'im:message.group_at_msg:readonly': '接收群聊中 @ 机器人的消息',
+    'im:message.p2p_msg:readonly': '接收私聊消息',
+    'im:message.pins:read': '读取消息置顶状态',
+    'im:message.pins:write_only': '置顶/取消置顶消息',
+    'im:message.reactions:read': '读取消息表情回复',
+    'im:message.reactions:write_only': '添加/删除消息表情回复',
+    'im:message:readonly': '读取消息内容、历史消息',
+    'im:message:recall': '↩撤回机器人发送的消息',
+    'im:message:send_as_bot': '以机器人身份发送消息',
+    'im:message:send_multi_users': '批量发送私聊消息',
+    'im:message:send_sys_msg': '发送系统通知消息',
+    'im:message:update': '更新/编辑已发送的消息',
+    'im:resource': '上传/下载消息资源（图片、文件等）',
+    'application:application:self_manage': '查询应用自身权限状态（诊断基础）',
+    'cardkit:card:write': '创建和更新消息卡片',
+    'cardkit:card:read': '读取消息卡片状态',
+};
+// ===== 高敏感权限 =====
+/**
+ * 高敏感权限清单
+ *
+ * 这些权限具有较高的敏感度，不应在批量授权时自动申请。
+ * 用户需要明确知晓这些权限的影响后，才能手动授权。
+ *
+ * 权限说明：
+ * - im:message.send_as_user - 以用户身份发送消息（高风险，可能被滥用发送钓鱼或垃圾消息）
+ * - space:document:delete - 删除云文档
+ * - calendar:calendar.event:delete - 删除日程
+ * - base:table:delete - 删除多维表格数据表
+ *
+ * 使用场景：
+ * - 批量授权时会自动过滤掉这些权限
+ * - 需要这些权限的功能会单独提示用户授权
+ *
+ * 最后更新: 2026-03-17
+ */
+exports.SENSITIVE_SCOPES = [
+    'im:message.send_as_user',
+    'space:document:delete',
+    'calendar:calendar.event:delete',
+    'base:table:delete',
+];
+/**
+ * 过滤掉高敏感权限
+ *
+ * 用于批量授权时排除高敏感权限，这些权限需要用户明确授权。
+ *
+ * @param scopes - 原始权限列表
+ * @returns 过滤后的权限列表（不包含高敏感权限）
+ *
+ * @example
+ * ```typescript
+ * const allScopes = ["im:message", "im:message.send_as_user", "calendar:calendar:read"];
+ * const safeScopes = filterSensitiveScopes(allScopes);
+ * // 返回: ["im:message", "calendar:calendar:read"]
+ * ```
+ */
+function filterSensitiveScopes(scopes) {
+    const sensitiveSet = new Set(exports.SENSITIVE_SCOPES);
+    return scopes.filter((scope) => !sensitiveSet.has(scope));
+}
+// ===== 统计信息 =====
+/**
+ * 工具动作总数: 96
+ * 唯一 scope 总数: 74
+ * 必需应用权限总数: 20
+ * 高敏感权限总数: 4
+ */

package/src/core/tools-config.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Default values and resolution logic for the Feishu tools configuration.
+ *
+ * Each boolean flag controls whether a particular category of Feishu-specific
+ * agent tools (document access, wiki queries, drive operations, etc.) is
+ * enabled for a given account.
+ */
+import type { ClawdbotConfig } from 'openclaw/plugin-sdk';
+import type { FeishuToolsConfig, LarkAccount } from './types';
+/**
+ * The default tools configuration.
+ *
+ * By default every non-destructive capability is enabled.  The `perm` flag
+ * (permission management) defaults to `false` because granting / revoking
+ * permissions is a privileged operation that admins should opt into
+ * explicitly.
+ */
+export declare const DEFAULT_TOOLS_CONFIG: Required<FeishuToolsConfig>;
+/**
+ * Merge a partial tools configuration with `DEFAULT_TOOLS_CONFIG`.
+ *
+ * Fields present in the input take precedence; anything absent falls back
+ * to the default value.
+ */
+export declare function resolveToolsConfig(cfg?: FeishuToolsConfig): Required<FeishuToolsConfig>;
+/**
+ * 合并多个账户的工具配置（取并集）。
+ *
+ * 工具注册是全局的（启动时注册一次），只要任意一个账户启用了某工具，
+ * 该工具就应被注册。执行时由 LarkTicket 路由到具体账户。
+ */
+export declare function resolveAnyEnabledToolsConfig(accounts: LarkAccount[]): Required<FeishuToolsConfig>;
+/**
+ * 检查工具是否应该被注册（channel 级别的 tools.deny 检查）。
+ *
+ * 从 `channels.feishu.tools.deny` 读取禁用列表，支持通配符模式。
+ *
+ * @param cfg - OpenClaw 配置对象
+ * @param toolName - 工具名称（如 `feishu_im_user_message`）
+ * @returns `true` 如果应该注册，`false` 如果应该跳过
+ *
+ * @example
+ * ```typescript
+ * // 配置示例：
+ * // channels.feishu.tools.deny: ["feishu_im_user_message", "feishu_calendar_*"]
+ *
+ * shouldRegisterTool(cfg, "feishu_im_user_message")  // false
+ * shouldRegisterTool(cfg, "feishu_calendar_event")   // false (匹配通配符)
+ * shouldRegisterTool(cfg, "feishu_task_task")        // true
+ * ```
+ */
+export declare function shouldRegisterTool(cfg: ClawdbotConfig, toolName: string): boolean;

package/src/core/tools-config.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Default values and resolution logic for the Feishu tools configuration.
+ *
+ * Each boolean flag controls whether a particular category of Feishu-specific
+ * agent tools (document access, wiki queries, drive operations, etc.) is
+ * enabled for a given account.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_TOOLS_CONFIG = void 0;
+exports.resolveToolsConfig = resolveToolsConfig;
+exports.resolveAnyEnabledToolsConfig = resolveAnyEnabledToolsConfig;
+exports.shouldRegisterTool = shouldRegisterTool;
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+/**
+ * The default tools configuration.
+ *
+ * By default every non-destructive capability is enabled.  The `perm` flag
+ * (permission management) defaults to `false` because granting / revoking
+ * permissions is a privileged operation that admins should opt into
+ * explicitly.
+ */
+exports.DEFAULT_TOOLS_CONFIG = {
+    doc: true,
+    wiki: true,
+    drive: true,
+    scopes: true,
+    perm: false,
+    mail: true,
+    sheets: true,
+    okr: false,
+};
+// ---------------------------------------------------------------------------
+// Resolver
+// ---------------------------------------------------------------------------
+/**
+ * Merge a partial tools configuration with `DEFAULT_TOOLS_CONFIG`.
+ *
+ * Fields present in the input take precedence; anything absent falls back
+ * to the default value.
+ */
+function resolveToolsConfig(cfg) {
+    if (!cfg)
+        return { ...exports.DEFAULT_TOOLS_CONFIG };
+    return {
+        doc: cfg.doc ?? exports.DEFAULT_TOOLS_CONFIG.doc,
+        wiki: cfg.wiki ?? exports.DEFAULT_TOOLS_CONFIG.wiki,
+        drive: cfg.drive ?? exports.DEFAULT_TOOLS_CONFIG.drive,
+        perm: cfg.perm ?? exports.DEFAULT_TOOLS_CONFIG.perm,
+        scopes: cfg.scopes ?? exports.DEFAULT_TOOLS_CONFIG.scopes,
+        mail: cfg.mail ?? exports.DEFAULT_TOOLS_CONFIG.mail,
+        sheets: cfg.sheets ?? exports.DEFAULT_TOOLS_CONFIG.sheets,
+        okr: cfg.okr ?? exports.DEFAULT_TOOLS_CONFIG.okr,
+    };
+}
+// ---------------------------------------------------------------------------
+// Multi-account aggregation
+// ---------------------------------------------------------------------------
+/**
+ * 合并多个账户的工具配置（取并集）。
+ *
+ * 工具注册是全局的（启动时注册一次），只要任意一个账户启用了某工具，
+ * 该工具就应被注册。执行时由 LarkTicket 路由到具体账户。
+ */
+function resolveAnyEnabledToolsConfig(accounts) {
+    const merged = {
+        doc: false,
+        wiki: false,
+        drive: false,
+        perm: false,
+        scopes: false,
+        mail: false,
+        sheets: false,
+        okr: false,
+    };
+    for (const account of accounts) {
+        const cfg = resolveToolsConfig(account.config.tools);
+        merged.doc = merged.doc || cfg.doc;
+        merged.wiki = merged.wiki || cfg.wiki;
+        merged.drive = merged.drive || cfg.drive;
+        merged.perm = merged.perm || cfg.perm;
+        merged.scopes = merged.scopes || cfg.scopes;
+        merged.mail = merged.mail || cfg.mail;
+        merged.sheets = merged.sheets || cfg.sheets;
+        merged.okr = merged.okr || cfg.okr;
+    }
+    return merged;
+}
+// ---------------------------------------------------------------------------
+// Channel-level tool registration control
+// ---------------------------------------------------------------------------
+/**
+ * Check whether a string matches any of the given patterns.
+ * Supports trailing `*` as a simple wildcard (e.g., `feishu_calendar_*`).
+ */
+function matchesAnyPattern(value, patterns) {
+    for (const pattern of patterns) {
+        if (pattern === '*')
+            return true;
+        if (pattern.endsWith('*')) {
+            if (value.startsWith(pattern.slice(0, -1)))
+                return true;
+        }
+        else if (value === pattern) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * 检查工具是否应该被注册（channel 级别的 tools.deny 检查）。
+ *
+ * 从 `channels.feishu.tools.deny` 读取禁用列表，支持通配符模式。
+ *
+ * @param cfg - OpenClaw 配置对象
+ * @param toolName - 工具名称（如 `feishu_im_user_message`）
+ * @returns `true` 如果应该注册，`false` 如果应该跳过
+ *
+ * @example
+ * ```typescript
+ * // 配置示例：
+ * // channels.feishu.tools.deny: ["feishu_im_user_message", "feishu_calendar_*"]
+ *
+ * shouldRegisterTool(cfg, "feishu_im_user_message")  // false
+ * shouldRegisterTool(cfg, "feishu_calendar_event")   // false (匹配通配符)
+ * shouldRegisterTool(cfg, "feishu_task_task")        // true
+ * ```
+ */
+function shouldRegisterTool(cfg, toolName) {
+    const feishuConfig = cfg.channels?.feishu;
+    const denyList = feishuConfig?.['tools']?.['deny'];
+    if (Array.isArray(denyList) && denyList.length > 0) {
+        if (matchesAnyPattern(toolName, denyList)) {
+            return false;
+        }
+    }
+    return true;
+}

package/src/core/types.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Core type definitions for the OpenClaw Lark/Feishu channel plugin.
+ *
+ * Contains inferred Zod config types, domain/connection enums, identifier types,
+ * tools configuration, and account types. Messaging, outbound, and channel types
+ * live in their respective module type files.
+ */
+import type { FeishuAccountConfigSchema, FeishuConfigSchema, FeishuGroupSchema, UATConfigSchema, z } from './config-schema';
+/** Fully resolved top-level Feishu channel configuration. */
+export type FeishuConfig = z.infer<typeof FeishuConfigSchema>;
+/** Per-group configuration overrides. */
+export type FeishuGroupConfig = z.infer<typeof FeishuGroupSchema>;
+/** Per-account configuration overrides (mirrors top-level minus `accounts`). */
+export type FeishuAccountConfig = z.infer<typeof FeishuAccountConfigSchema>;
+/**
+ * The Lark platform brand.
+ * - `"feishu"` targets the China-mainland Feishu service.
+ * - `"lark"` targets the international Lark service.
+ * - Any other string is treated as a custom base URL.
+ */
+export type LarkBrand = 'feishu' | 'lark' | (string & {});
+/** How the plugin connects to Feishu to receive events. */
+export type FeishuConnectionMode = 'websocket' | 'webhook';
+/** The four ID types recognised by the Feishu API. */
+export type FeishuIdType = 'open_id' | 'user_id' | 'union_id' | 'chat_id';
+/** Per-feature toggles for the Feishu-specific tool capabilities. */
+export interface FeishuToolsConfig {
+    doc?: boolean;
+    wiki?: boolean;
+    drive?: boolean;
+    perm?: boolean;
+    scopes?: boolean;
+    mail?: boolean;
+    sheets?: boolean;
+    okr?: boolean;
+}
+/** Per-feature toggles for card footer metadata visibility. */
+export interface FeishuFooterConfig {
+    status?: boolean;
+    elapsed?: boolean;
+    tokens?: boolean;
+    cache?: boolean;
+    context?: boolean;
+    model?: boolean;
+}
+/** Common fields shared by all resolved account states. */
+interface LarkAccountBase {
+    accountId: string;
+    enabled: boolean;
+    name?: string;
+    encryptKey?: string;
+    verificationToken?: string;
+    brand: LarkBrand;
+    config: FeishuConfig;
+}
+/** An account with both `appId` and `appSecret` present. */
+export type ConfiguredLarkAccount = LarkAccountBase & {
+    configured: true;
+    appId: string;
+    appSecret: string;
+};
+/** An account that is missing `appId` and/or `appSecret`. */
+export type UnconfiguredLarkAccount = LarkAccountBase & {
+    configured: false;
+    appId?: string;
+    appSecret?: string;
+};
+/** A resolved Lark account — either fully configured or not. */
+export type LarkAccount = ConfiguredLarkAccount | UnconfiguredLarkAccount;
+/** UAT (User Access Token) configuration. */
+export type FeishuUATConfig = z.infer<typeof UATConfigSchema>;
+/** The minimum credential set needed to interact with the Lark API. */
+export interface LarkCredentials {
+    appId: string;
+    appSecret: string;
+    encryptKey?: string;
+    verificationToken?: string;
+    brand: LarkBrand;
+}
+/** Result of probing an app's connectivity / permissions. */
+export interface FeishuProbeResult {
+    ok: boolean;
+    error?: string;
+    appId?: string;
+    botName?: string;
+    botOpenId?: string;
+}
+export {};

package/src/core/types.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Copyright (c) 2026 ByteDance Ltd. and/or its affiliates
+ * SPDX-License-Identifier: MIT
+ *
+ * Core type definitions for the OpenClaw Lark/Feishu channel plugin.
+ *
+ * Contains inferred Zod config types, domain/connection enums, identifier types,
+ * tools configuration, and account types. Messaging, outbound, and channel types
+ * live in their respective module type files.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });