@m1heng-clawd/feishu 0.1.9 → 0.1.11

package/src/media.ts

@@ -1,6 +1,7 @@
 import type { ClawdbotConfig } from "openclaw/plugin-sdk";
 import { createFeishuClient } from "./client.js";
 import { resolveFeishuAccount } from "./accounts.js";
+import { getFeishuRuntime } from "./runtime.js";
 import { resolveReceiveIdType, normalizeFeishuTarget } from "./targets.js";
 import fs from "fs";
 import path from "path";
@@ -353,10 +354,12 @@ export async function sendFileFeishu(params: {
   cfg: ClawdbotConfig;
   to: string;
   fileKey: string;
+  msgType?: "file" | "media";
   replyToMessageId?: string;
   accountId?: string;
 }): Promise<SendMediaResult> {
   const { cfg, to, fileKey, replyToMessageId, accountId } = params;
+  const msgType = params.msgType ?? "file";
   const account = resolveFeishuAccount({ cfg, accountId });
   if (!account.configured) {
     throw new Error(`Feishu account "${account.accountId}" not configured`);
@@ -376,7 +379,7 @@ export async function sendFileFeishu(params: {
       path: { message_id: replyToMessageId },
       data: {
         content,
-        msg_type: "file",
+        msg_type: msgType,
       },
     });
 
@@ -395,7 +398,7 @@ export async function sendFileFeishu(params: {
     data: {
       receive_id: receiveId,
       content,
-      msg_type: "file",
+      msg_type: msgType,
     },
   });
 
@@ -440,23 +443,6 @@ export function detectFileType(
   }
 }
 
-/**
- * Check if a string is a local file path (not a URL)
- */
-function isLocalPath(urlOrPath: string): boolean {
-  // Starts with / or ~ or drive letter (Windows)
-  if (urlOrPath.startsWith("/") || urlOrPath.startsWith("~") || /^[a-zA-Z]:/.test(urlOrPath)) {
-    return true;
-  }
-  // Try to parse as URL - if it fails or has no protocol, it's likely a local path
-  try {
-    const url = new URL(urlOrPath);
-    return url.protocol === "file:";
-  } catch {
-    return true; // Not a valid URL, treat as local path
-  }
-}
-
 /**
  * Upload and send media (image or file) from URL, local path, or buffer
  */
@@ -470,6 +456,11 @@ export async function sendMediaFeishu(params: {
   accountId?: string;
 }): Promise<SendMediaResult> {
   const { cfg, to, mediaUrl, mediaBuffer, fileName, replyToMessageId, accountId } = params;
+  const account = resolveFeishuAccount({ cfg, accountId });
+  if (!account.configured) {
+    throw new Error(`Feishu account "${account.accountId}" not configured`);
+  }
+  const mediaMaxBytes = (account.config?.mediaMaxMb ?? 30) * 1024 * 1024;
 
   let buffer: Buffer;
   let name: string;
@@ -478,26 +469,12 @@ export async function sendMediaFeishu(params: {
     buffer = mediaBuffer;
     name = fileName ?? "file";
   } else if (mediaUrl) {
-    if (isLocalPath(mediaUrl)) {
-      // Local file path - read directly
-      const filePath = mediaUrl.startsWith("~")
-        ? mediaUrl.replace("~", process.env.HOME ?? "")
-        : mediaUrl.replace("file://", "");
-
-      if (!fs.existsSync(filePath)) {
-        throw new Error(`Local file not found: ${filePath}`);
-      }
-      buffer = fs.readFileSync(filePath);
-      name = fileName ?? path.basename(filePath);
-    } else {
-      // Remote URL - fetch
-      const response = await fetch(mediaUrl);
-      if (!response.ok) {
-        throw new Error(`Failed to fetch media from URL: ${response.status}`);
-      }
-      buffer = Buffer.from(await response.arrayBuffer());
-      name = fileName ?? (path.basename(new URL(mediaUrl).pathname) || "file");
-    }
+    const loaded = await getFeishuRuntime().media.loadWebMedia(mediaUrl, {
+      maxBytes: mediaMaxBytes,
+      optimizeImages: false,
+    });
+    buffer = loaded.buffer;
+    name = fileName ?? loaded.fileName ?? "file";
   } else {
     throw new Error("Either mediaUrl or mediaBuffer must be provided");
   }
@@ -518,6 +495,14 @@ export async function sendMediaFeishu(params: {
       fileType,
       accountId,
     });
-    return sendFileFeishu({ cfg, to, fileKey, replyToMessageId, accountId });
+    const isMedia = fileType === "mp4" || fileType === "opus";
+    return sendFileFeishu({
+      cfg,
+      to,
+      fileKey,
+      msgType: isMedia ? "media" : "file",
+      replyToMessageId,
+      accountId,
+    });
   }
 }

package/src/monitor.ts

@@ -1,6 +1,11 @@
 import * as Lark from "@larksuiteoapi/node-sdk";
 import * as http from "http";
-import type { ClawdbotConfig, RuntimeEnv, HistoryEntry } from "openclaw/plugin-sdk";
+import {
+  type ClawdbotConfig,
+  type RuntimeEnv,
+  type HistoryEntry,
+  installRequestBodyLimitGuard,
+} from "openclaw/plugin-sdk";
 import type { ResolvedFeishuAccount } from "./types.js";
 import { createFeishuWSClient, createEventDispatcher } from "./client.js";
 import { resolveFeishuAccount, listEnabledFeishuAccounts } from "./accounts.js";
@@ -18,6 +23,8 @@ export type MonitorFeishuOpts = {
 const wsClients = new Map<string, Lark.WSClient>();
 const httpServers = new Map<string, http.Server>();
 const botOpenIds = new Map<string, string>();
+const FEISHU_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
+const FEISHU_WEBHOOK_BODY_TIMEOUT_MS = 30_000;
 
 async function fetchBotOpenId(
   account: ResolvedFeishuAccount,
@@ -191,7 +198,27 @@ async function monitorWebhook({ params, accountId, eventDispatcher }: Connection
   log(`feishu[${accountId}]: starting Webhook server on port ${port}, path ${path}...`);
 
   const server = http.createServer();
-  server.on("request", Lark.adaptDefault(path, eventDispatcher, { autoChallenge: true }));
+  const webhookHandler = Lark.adaptDefault(path, eventDispatcher, { autoChallenge: true });
+  server.on("request", (req, res) => {
+    const guard = installRequestBodyLimitGuard(req, res, {
+      maxBytes: FEISHU_WEBHOOK_MAX_BODY_BYTES,
+      timeoutMs: FEISHU_WEBHOOK_BODY_TIMEOUT_MS,
+      responseFormat: "text",
+    });
+    if (guard.isTripped()) {
+      return;
+    }
+
+    void Promise.resolve(webhookHandler(req, res))
+      .catch((err) => {
+        if (!guard.isTripped()) {
+          error(`feishu[${accountId}]: webhook handler error: ${String(err)}`);
+        }
+      })
+      .finally(() => {
+        guard.dispose();
+      });
+  });
   httpServers.set(accountId, server);
 
   return new Promise((resolve, reject) => {

package/src/onboarding.ts

@@ -5,45 +5,104 @@ import type {
   DmPolicy,
   WizardPrompter,
 } from "openclaw/plugin-sdk";
-import { addWildcardAllowFrom, DEFAULT_ACCOUNT_ID, formatDocsLink } from "openclaw/plugin-sdk";
+import {
+  addWildcardAllowFrom,
+  DEFAULT_ACCOUNT_ID,
+  formatDocsLink,
+  normalizeAccountId,
+  promptAccountId,
+} from "openclaw/plugin-sdk";
 
-import { resolveFeishuCredentials } from "./accounts.js";
+import {
+  listFeishuAccountIds,
+  resolveDefaultFeishuAccountId,
+  resolveFeishuAccount,
+  resolveFeishuCredentials,
+} from "./accounts.js";
 import { probeFeishu } from "./probe.js";
 import type { FeishuConfig } from "./types.js";
 
 const channel = "feishu" as const;
+let onboardingDmPolicyAccountId: string | undefined;
 
-function setFeishuDmPolicy(cfg: ClawdbotConfig, dmPolicy: DmPolicy): ClawdbotConfig {
-  const allowFrom =
-    dmPolicy === "open"
-      ? addWildcardAllowFrom(cfg.channels?.feishu?.allowFrom)?.map((entry) => String(entry))
-      : undefined;
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      feishu: {
-        ...cfg.channels?.feishu,
-        dmPolicy,
-        ...(allowFrom ? { allowFrom } : {}),
-      },
-    },
-  };
+function resolveOnboardingAccountId(cfg: ClawdbotConfig, accountId?: string | null): string {
+  const raw = accountId?.trim();
+  if (raw) {
+    return normalizeAccountId(raw);
+  }
+  return resolveDefaultFeishuAccountId(cfg);
+}
+
+function resolveDmPolicyAccountId(cfg: ClawdbotConfig, accountId?: string | null): string {
+  return resolveOnboardingAccountId(cfg, accountId ?? onboardingDmPolicyAccountId);
 }
 
-function setFeishuAllowFrom(cfg: ClawdbotConfig, allowFrom: string[]): ClawdbotConfig {
+function upsertFeishuAccountConfig(
+  cfg: ClawdbotConfig,
+  accountId: string,
+  patch: Partial<FeishuConfig>,
+): ClawdbotConfig {
+  const normalizedAccountId = normalizeAccountId(accountId);
+  const feishuCfg = cfg.channels?.feishu as FeishuConfig | undefined;
+
+  if (normalizedAccountId === DEFAULT_ACCOUNT_ID) {
+    return {
+      ...cfg,
+      channels: {
+        ...cfg.channels,
+        feishu: {
+          ...feishuCfg,
+          ...patch,
+        },
+      },
+    };
+  }
+
+  const existingAccount = feishuCfg?.accounts?.[normalizedAccountId];
   return {
     ...cfg,
     channels: {
       ...cfg.channels,
       feishu: {
-        ...cfg.channels?.feishu,
-        allowFrom,
+        ...feishuCfg,
+        enabled: true,
+        accounts: {
+          ...feishuCfg?.accounts,
+          [normalizedAccountId]: {
+            ...existingAccount,
+            enabled: existingAccount?.enabled ?? true,
+            ...patch,
+          },
+        },
       },
     },
   };
 }
 
+function setFeishuDmPolicy(
+  cfg: ClawdbotConfig,
+  dmPolicy: DmPolicy,
+  accountId?: string,
+): ClawdbotConfig {
+  const resolvedAccountId = resolveDmPolicyAccountId(cfg, accountId);
+  const account = resolveFeishuAccount({ cfg, accountId: resolvedAccountId });
+  // Feishu channel config does not support "disabled" as a dmPolicy value.
+  const effectiveDmPolicy = dmPolicy === "disabled" ? "pairing" : dmPolicy;
+  const allowFrom =
+    effectiveDmPolicy === "open"
+      ? addWildcardAllowFrom(account.config.allowFrom)?.map((entry) => String(entry))
+      : undefined;
+  return upsertFeishuAccountConfig(cfg, resolvedAccountId, {
+    dmPolicy: effectiveDmPolicy,
+    ...(allowFrom ? { allowFrom } : {}),
+  });
+}
+
+function setFeishuAllowFrom(cfg: ClawdbotConfig, allowFrom: string[], accountId?: string): ClawdbotConfig {
+  const resolvedAccountId = resolveOnboardingAccountId(cfg, accountId);
+  return upsertFeishuAccountConfig(cfg, resolvedAccountId, { allowFrom });
+}
+
 function parseAllowFromInput(raw: string): string[] {
   return raw
     .split(/[\n,;]+/g)
@@ -54,10 +113,14 @@ function parseAllowFromInput(raw: string): string[] {
 async function promptFeishuAllowFrom(params: {
   cfg: ClawdbotConfig;
   prompter: WizardPrompter;
+  accountId?: string;
 }): Promise<ClawdbotConfig> {
-  const existing = params.cfg.channels?.feishu?.allowFrom ?? [];
+  const accountId = resolveDmPolicyAccountId(params.cfg, params.accountId);
+  const existing = resolveFeishuAccount({ cfg: params.cfg, accountId }).config.allowFrom ?? [];
+  const accountLabel = accountId === DEFAULT_ACCOUNT_ID ? "default" : accountId;
   await params.prompter.note(
     [
+      `Account: ${accountLabel}`,
       "Allowlist Feishu DMs by open_id or user_id.",
       "You can find user open_id in Feishu admin console or via API.",
       "Examples:",
@@ -83,7 +146,7 @@ async function promptFeishuAllowFrom(params: {
     const unique = [
       ...new Set([...existing.map((v) => String(v).trim()).filter(Boolean), ...parts]),
     ];
-    return setFeishuAllowFrom(params.cfg, unique);
+    return setFeishuAllowFrom(params.cfg, unique, accountId);
   }
 }
 
@@ -105,31 +168,24 @@ async function noteFeishuCredentialHelp(prompter: WizardPrompter): Promise<void>
 function setFeishuGroupPolicy(
   cfg: ClawdbotConfig,
   groupPolicy: "open" | "allowlist" | "disabled",
+  accountId?: string,
 ): ClawdbotConfig {
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      feishu: {
-        ...cfg.channels?.feishu,
-        enabled: true,
-        groupPolicy,
-      },
-    },
-  };
+  const resolvedAccountId = resolveOnboardingAccountId(cfg, accountId);
+  return upsertFeishuAccountConfig(cfg, resolvedAccountId, { enabled: true, groupPolicy });
 }
 
-function setFeishuGroupAllowFrom(cfg: ClawdbotConfig, groupAllowFrom: string[]): ClawdbotConfig {
-  return {
-    ...cfg,
-    channels: {
-      ...cfg.channels,
-      feishu: {
-        ...cfg.channels?.feishu,
-        groupAllowFrom,
-      },
-    },
-  };
+function setFeishuGroupAllowFrom(
+  cfg: ClawdbotConfig,
+  groupAllowFrom: string[],
+  accountId?: string,
+): ClawdbotConfig {
+  const resolvedAccountId = resolveOnboardingAccountId(cfg, accountId);
+  return upsertFeishuAccountConfig(cfg, resolvedAccountId, { groupAllowFrom });
+}
+
+function setFeishuDomain(cfg: ClawdbotConfig, domain: "feishu" | "lark", accountId?: string): ClawdbotConfig {
+  const resolvedAccountId = resolveOnboardingAccountId(cfg, accountId);
+  return upsertFeishuAccountConfig(cfg, resolvedAccountId, { domain });
 }
 
 const dmPolicy: ChannelOnboardingDmPolicy = {
@@ -137,22 +193,30 @@ const dmPolicy: ChannelOnboardingDmPolicy = {
   channel,
   policyKey: "channels.feishu.dmPolicy",
   allowFromKey: "channels.feishu.allowFrom",
-  getCurrent: (cfg) => (cfg.channels?.feishu as FeishuConfig | undefined)?.dmPolicy ?? "pairing",
-  setPolicy: (cfg, policy) => setFeishuDmPolicy(cfg, policy),
+  getCurrent: (cfg) => {
+    const accountId = resolveDmPolicyAccountId(cfg);
+    return resolveFeishuAccount({ cfg, accountId }).config.dmPolicy ?? "pairing";
+  },
+  setPolicy: (cfg, policy) => setFeishuDmPolicy(cfg, policy, onboardingDmPolicyAccountId),
   promptAllowFrom: promptFeishuAllowFrom,
 };
 
 export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
   channel,
-  getStatus: async ({ cfg }) => {
-    const feishuCfg = cfg.channels?.feishu as FeishuConfig | undefined;
-    const configured = Boolean(resolveFeishuCredentials(feishuCfg));
+  getStatus: async ({ cfg, accountOverrides }) => {
+    const override = accountOverrides?.feishu?.trim();
+    const accountIds = override
+      ? [resolveOnboardingAccountId(cfg, override)]
+      : listFeishuAccountIds(cfg);
+    const accounts = accountIds.map((accountId) => resolveFeishuAccount({ cfg, accountId }));
+    const configuredAccounts = accounts.filter((account) => account.configured);
+    const configured = configuredAccounts.length > 0;
 
     // Try to probe if configured
     let probeResult = null;
-    if (configured && feishuCfg) {
+    if (configuredAccounts[0]) {
       try {
-        probeResult = await probeFeishu(feishuCfg);
+        probeResult = await probeFeishu(configuredAccounts[0]);
       } catch {
         // Ignore probe errors
       }
@@ -162,7 +226,16 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
     if (!configured) {
       statusLines.push("Feishu: needs app credentials");
     } else if (probeResult?.ok) {
-      statusLines.push(`Feishu: connected as ${probeResult.botName ?? probeResult.botOpenId ?? "bot"}`);
+      const probeAccountId = configuredAccounts[0]?.accountId ?? DEFAULT_ACCOUNT_ID;
+      const accountNote = probeAccountId === DEFAULT_ACCOUNT_ID ? "" : ` [${probeAccountId}]`;
+      statusLines.push(
+        `Feishu${accountNote}: connected as ${probeResult.botName ?? probeResult.botOpenId ?? "bot"}`,
+      );
+      if (!override && configuredAccounts.length > 1) {
+        statusLines.push(`Feishu: ${configuredAccounts.length} account(s) configured`);
+      }
+    } else if (!override && configuredAccounts.length > 1) {
+      statusLines.push(`Feishu: configured (${configuredAccounts.length} account(s), connection not verified)`);
     } else {
       statusLines.push("Feishu: configured (connection not verified)");
     }
@@ -176,11 +249,31 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
     };
   },
 
-  configure: async ({ cfg, prompter }) => {
-    const feishuCfg = cfg.channels?.feishu as FeishuConfig | undefined;
-    const resolved = resolveFeishuCredentials(feishuCfg);
-    const hasConfigCreds = Boolean(feishuCfg?.appId?.trim() && feishuCfg?.appSecret?.trim());
+  configure: async ({ cfg, prompter, accountOverrides, shouldPromptAccountIds }) => {
+    const feishuOverride = accountOverrides?.feishu?.trim();
+    const defaultFeishuAccountId = resolveDefaultFeishuAccountId(cfg);
+    let feishuAccountId = feishuOverride
+      ? normalizeAccountId(feishuOverride)
+      : defaultFeishuAccountId;
+    if (shouldPromptAccountIds && !feishuOverride) {
+      feishuAccountId = await promptAccountId({
+        cfg,
+        prompter,
+        label: "Feishu",
+        currentId: feishuAccountId,
+        listAccountIds: listFeishuAccountIds,
+        defaultAccountId: defaultFeishuAccountId,
+      });
+    }
+    onboardingDmPolicyAccountId = feishuAccountId;
+    const accountLabel = feishuAccountId === DEFAULT_ACCOUNT_ID ? "default" : feishuAccountId;
+    const currentAccount = resolveFeishuAccount({ cfg, accountId: feishuAccountId });
+    const resolved = resolveFeishuCredentials(currentAccount.config);
+    const hasConfigCreds = Boolean(
+      currentAccount.config.appId?.trim() && currentAccount.config.appSecret?.trim(),
+    );
     const canUseEnv = Boolean(
+      feishuAccountId === DEFAULT_ACCOUNT_ID &&
       !hasConfigCreds &&
         process.env.FEISHU_APP_ID?.trim() &&
         process.env.FEISHU_APP_SECRET?.trim(),
@@ -189,6 +282,14 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
     let next = cfg;
     let appId: string | null = null;
     let appSecret: string | null = null;
+    const appIdPrompt =
+      feishuAccountId === DEFAULT_ACCOUNT_ID
+        ? "Enter Feishu App ID"
+        : `Enter Feishu App ID for account "${accountLabel}"`;
+    const appSecretPrompt =
+      feishuAccountId === DEFAULT_ACCOUNT_ID
+        ? "Enter Feishu App Secret"
+        : `Enter Feishu App Secret for account "${accountLabel}"`;
 
     if (!resolved) {
       await noteFeishuCredentialHelp(prompter);
@@ -200,42 +301,36 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
         initialValue: true,
       });
       if (keepEnv) {
-        next = {
-          ...next,
-          channels: {
-            ...next.channels,
-            feishu: { ...next.channels?.feishu, enabled: true },
-          },
-        };
+        next = upsertFeishuAccountConfig(next, feishuAccountId, { enabled: true });
       } else {
         appId = String(
           await prompter.text({
-            message: "Enter Feishu App ID",
+            message: appIdPrompt,
             validate: (value) => (value?.trim() ? undefined : "Required"),
           }),
         ).trim();
         appSecret = String(
           await prompter.text({
-            message: "Enter Feishu App Secret",
+            message: appSecretPrompt,
             validate: (value) => (value?.trim() ? undefined : "Required"),
           }),
         ).trim();
       }
     } else if (hasConfigCreds) {
       const keep = await prompter.confirm({
-        message: "Feishu credentials already configured. Keep them?",
+        message: `Feishu credentials already configured for account "${accountLabel}". Keep them?`,
         initialValue: true,
       });
       if (!keep) {
         appId = String(
           await prompter.text({
-            message: "Enter Feishu App ID",
+            message: appIdPrompt,
             validate: (value) => (value?.trim() ? undefined : "Required"),
           }),
         ).trim();
         appSecret = String(
           await prompter.text({
-            message: "Enter Feishu App Secret",
+            message: appSecretPrompt,
             validate: (value) => (value?.trim() ? undefined : "Required"),
           }),
         ).trim();
@@ -243,54 +338,50 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
     } else {
       appId = String(
         await prompter.text({
-          message: "Enter Feishu App ID",
+          message: appIdPrompt,
           validate: (value) => (value?.trim() ? undefined : "Required"),
         }),
       ).trim();
       appSecret = String(
         await prompter.text({
-          message: "Enter Feishu App Secret",
+          message: appSecretPrompt,
           validate: (value) => (value?.trim() ? undefined : "Required"),
         }),
       ).trim();
     }
 
     if (appId && appSecret) {
-      next = {
-        ...next,
-        channels: {
-          ...next.channels,
-          feishu: {
-            ...next.channels?.feishu,
-            enabled: true,
-            appId,
-            appSecret,
-          },
-        },
-      };
+      next = upsertFeishuAccountConfig(next, feishuAccountId, {
+        enabled: true,
+        appId,
+        appSecret,
+      });
 
       // Test connection
-      const testCfg = next.channels?.feishu as FeishuConfig;
+      const testAccount = resolveFeishuAccount({ cfg: next, accountId: feishuAccountId });
       try {
-        const probe = await probeFeishu(testCfg);
+        const probe = await probeFeishu(testAccount);
         if (probe.ok) {
           await prompter.note(
             `Connected as ${probe.botName ?? probe.botOpenId ?? "bot"}`,
-            "Feishu connection test",
+            `Feishu connection test (${accountLabel})`,
           );
         } else {
           await prompter.note(
             `Connection failed: ${probe.error ?? "unknown error"}`,
-            "Feishu connection test",
+            `Feishu connection test (${accountLabel})`,
           );
         }
       } catch (err) {
-        await prompter.note(`Connection test failed: ${String(err)}`, "Feishu connection test");
+        await prompter.note(
+          `Connection test failed: ${String(err)}`,
+          `Feishu connection test (${accountLabel})`,
+        );
       }
     }
 
     // Domain selection
-    const currentDomain = (next.channels?.feishu as FeishuConfig | undefined)?.domain ?? "feishu";
+    const currentDomain = resolveFeishuAccount({ cfg: next, accountId: feishuAccountId }).config.domain ?? "feishu";
     const domain = await prompter.select({
       message: "Which Feishu domain?",
       options: [
@@ -300,19 +391,11 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
       initialValue: currentDomain,
     });
     if (domain) {
-      next = {
-        ...next,
-        channels: {
-          ...next.channels,
-          feishu: {
-            ...next.channels?.feishu,
-            domain: domain as "feishu" | "lark",
-          },
-        },
-      };
+      next = setFeishuDomain(next, domain as "feishu" | "lark", feishuAccountId);
     }
 
     // Group policy
+    const groupPolicyAccount = resolveFeishuAccount({ cfg: next, accountId: feishuAccountId });
     const groupPolicy = await prompter.select({
       message: "Group chat policy",
       options: [
@@ -320,16 +403,20 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
         { value: "open", label: "Open - respond in all groups (requires mention)" },
         { value: "disabled", label: "Disabled - don't respond in groups" },
       ],
-      initialValue:
-        (next.channels?.feishu as FeishuConfig | undefined)?.groupPolicy ?? "allowlist",
+      initialValue: groupPolicyAccount.config.groupPolicy ?? "allowlist",
     });
     if (groupPolicy) {
-      next = setFeishuGroupPolicy(next, groupPolicy as "open" | "allowlist" | "disabled");
+      next = setFeishuGroupPolicy(
+        next,
+        groupPolicy as "open" | "allowlist" | "disabled",
+        feishuAccountId,
+      );
     }
 
     // Group allowlist if needed
     if (groupPolicy === "allowlist") {
-      const existing = (next.channels?.feishu as FeishuConfig | undefined)?.groupAllowFrom ?? [];
+      const existing =
+        resolveFeishuAccount({ cfg: next, accountId: feishuAccountId }).config.groupAllowFrom ?? [];
       const entry = await prompter.text({
         message: "Group chat allowlist (chat_ids)",
         placeholder: "oc_xxxxx, oc_yyyyy",
@@ -338,16 +425,20 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
       if (entry) {
         const parts = parseAllowFromInput(String(entry));
         if (parts.length > 0) {
-          next = setFeishuGroupAllowFrom(next, parts);
+          next = setFeishuGroupAllowFrom(next, parts, feishuAccountId);
         }
       }
     }
 
-    return { cfg: next, accountId: DEFAULT_ACCOUNT_ID };
+    return { cfg: next, accountId: feishuAccountId };
   },
 
   dmPolicy,
 
+  onAccountRecorded: (accountId) => {
+    onboardingDmPolicyAccountId = normalizeAccountId(accountId);
+  },
+
   disable: (cfg) => ({
     ...cfg,
     channels: {