@openclaw/feishu 2026.3.11 → 2026.3.13

package/src/onboarding.ts

@@ -370,6 +370,37 @@ export const feishuOnboardingAdapter: ChannelOnboardingAdapter = {
           },
         };
       }
+      const currentEncryptKey = (next.channels?.feishu as FeishuConfig | undefined)?.encryptKey;
+      const encryptKeyPromptState = buildSingleChannelSecretPromptState({
+        accountConfigured: hasConfiguredSecretInput(currentEncryptKey),
+        hasConfigToken: hasConfiguredSecretInput(currentEncryptKey),
+        allowEnv: false,
+      });
+      const encryptKeyResult = await promptSingleChannelSecretInput({
+        cfg: next,
+        prompter,
+        providerHint: "feishu-webhook",
+        credentialLabel: "encrypt key",
+        accountConfigured: encryptKeyPromptState.accountConfigured,
+        canUseEnv: encryptKeyPromptState.canUseEnv,
+        hasConfigToken: encryptKeyPromptState.hasConfigToken,
+        envPrompt: "",
+        keepPrompt: "Feishu encrypt key already configured. Keep it?",
+        inputPrompt: "Enter Feishu encrypt key",
+        preferredEnvVar: "FEISHU_ENCRYPT_KEY",
+      });
+      if (encryptKeyResult.action === "set") {
+        next = {
+          ...next,
+          channels: {
+            ...next.channels,
+            feishu: {
+              ...next.channels?.feishu,
+              encryptKey: encryptKeyResult.value,
+            },
+          },
+        };
+      }
       const currentWebhookPath = (next.channels?.feishu as FeishuConfig | undefined)?.webhookPath;
       const webhookPath = String(
         await prompter.text({

package/src/outbound.test.ts

@@ -29,12 +29,16 @@ vi.mock("./runtime.js", () => ({
 import { feishuOutbound } from "./outbound.js";
 const sendText = feishuOutbound.sendText!;
 
+function resetOutboundMocks() {
+  vi.clearAllMocks();
+  sendMessageFeishuMock.mockResolvedValue({ messageId: "text_msg" });
+  sendMarkdownCardFeishuMock.mockResolvedValue({ messageId: "card_msg" });
+  sendMediaFeishuMock.mockResolvedValue({ messageId: "media_msg" });
+}
+
 describe("feishuOutbound.sendText local-image auto-convert", () => {
   beforeEach(() => {
-    vi.clearAllMocks();
-    sendMessageFeishuMock.mockResolvedValue({ messageId: "text_msg" });
-    sendMarkdownCardFeishuMock.mockResolvedValue({ messageId: "card_msg" });
-    sendMediaFeishuMock.mockResolvedValue({ messageId: "media_msg" });
+    resetOutboundMocks();
   });
 
   async function createTmpImage(ext = ".png"): Promise<{ dir: string; file: string }> {
@@ -181,10 +185,7 @@ describe("feishuOutbound.sendText local-image auto-convert", () => {
 
 describe("feishuOutbound.sendText replyToId forwarding", () => {
   beforeEach(() => {
-    vi.clearAllMocks();
-    sendMessageFeishuMock.mockResolvedValue({ messageId: "text_msg" });
-    sendMarkdownCardFeishuMock.mockResolvedValue({ messageId: "card_msg" });
-    sendMediaFeishuMock.mockResolvedValue({ messageId: "media_msg" });
+    resetOutboundMocks();
   });
 
   it("forwards replyToId as replyToMessageId to sendMessageFeishu", async () => {
@@ -249,10 +250,7 @@ describe("feishuOutbound.sendText replyToId forwarding", () => {
 
 describe("feishuOutbound.sendMedia replyToId forwarding", () => {
   beforeEach(() => {
-    vi.clearAllMocks();
-    sendMessageFeishuMock.mockResolvedValue({ messageId: "text_msg" });
-    sendMarkdownCardFeishuMock.mockResolvedValue({ messageId: "card_msg" });
-    sendMediaFeishuMock.mockResolvedValue({ messageId: "media_msg" });
+    resetOutboundMocks();
   });
 
   it("forwards replyToId to sendMediaFeishu", async () => {
@@ -292,10 +290,7 @@ describe("feishuOutbound.sendMedia replyToId forwarding", () => {
 
 describe("feishuOutbound.sendMedia renderMode", () => {
   beforeEach(() => {
-    vi.clearAllMocks();
-    sendMessageFeishuMock.mockResolvedValue({ messageId: "text_msg" });
-    sendMarkdownCardFeishuMock.mockResolvedValue({ messageId: "card_msg" });
-    sendMediaFeishuMock.mockResolvedValue({ messageId: "media_msg" });
+    resetOutboundMocks();
   });
 
   it("uses markdown cards for captions when renderMode=card", async () => {

package/src/probe.test.ts

@@ -8,6 +8,22 @@ vi.mock("./client.js", () => ({
 
 import { FEISHU_PROBE_REQUEST_TIMEOUT_MS, probeFeishu, clearProbeCache } from "./probe.js";
 
+const DEFAULT_CREDS = { appId: "cli_123", appSecret: "secret" } as const; // pragma: allowlist secret
+const DEFAULT_SUCCESS_RESPONSE = {
+  code: 0,
+  bot: { bot_name: "TestBot", open_id: "ou_abc123" },
+} as const;
+const DEFAULT_SUCCESS_RESULT = {
+  ok: true,
+  appId: "cli_123",
+  botName: "TestBot",
+  botOpenId: "ou_abc123",
+} as const;
+const BOT1_RESPONSE = {
+  code: 0,
+  bot: { bot_name: "Bot1", open_id: "ou_1" },
+} as const;
+
 function makeRequestFn(response: Record<string, unknown>) {
   return vi.fn().mockResolvedValue(response);
 }
@@ -18,6 +34,64 @@ function setupClient(response: Record<string, unknown>) {
   return requestFn;
 }
 
+function setupSuccessClient() {
+  return setupClient(DEFAULT_SUCCESS_RESPONSE);
+}
+
+async function expectDefaultSuccessResult(
+  creds = DEFAULT_CREDS,
+  expected: Awaited<ReturnType<typeof probeFeishu>> = DEFAULT_SUCCESS_RESULT,
+) {
+  const result = await probeFeishu(creds);
+  expect(result).toEqual(expected);
+}
+
+async function withFakeTimers(run: () => Promise<void>) {
+  vi.useFakeTimers();
+  try {
+    await run();
+  } finally {
+    vi.useRealTimers();
+  }
+}
+
+async function expectErrorResultCached(params: {
+  requestFn: ReturnType<typeof vi.fn>;
+  expectedError: string;
+  ttlMs: number;
+}) {
+  createFeishuClientMock.mockReturnValue({ request: params.requestFn });
+
+  const first = await probeFeishu(DEFAULT_CREDS);
+  const second = await probeFeishu(DEFAULT_CREDS);
+  expect(first).toMatchObject({ ok: false, error: params.expectedError });
+  expect(second).toMatchObject({ ok: false, error: params.expectedError });
+  expect(params.requestFn).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(params.ttlMs + 1);
+
+  await probeFeishu(DEFAULT_CREDS);
+  expect(params.requestFn).toHaveBeenCalledTimes(2);
+}
+
+async function expectFreshDefaultProbeAfter(
+  requestFn: ReturnType<typeof vi.fn>,
+  invalidate: () => void,
+) {
+  await probeFeishu(DEFAULT_CREDS);
+  expect(requestFn).toHaveBeenCalledTimes(1);
+
+  invalidate();
+
+  await probeFeishu(DEFAULT_CREDS);
+  expect(requestFn).toHaveBeenCalledTimes(2);
+}
+
+async function readSequentialDefaultProbePair() {
+  const first = await probeFeishu(DEFAULT_CREDS);
+  return { first, second: await probeFeishu(DEFAULT_CREDS) };
+}
+
 describe("probeFeishu", () => {
   beforeEach(() => {
     clearProbeCache();
@@ -44,28 +118,16 @@ describe("probeFeishu", () => {
   });
 
   it("returns bot info on successful probe", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "TestBot", open_id: "ou_abc123" },
-    });
+    const requestFn = setupSuccessClient();
 
-    const result = await probeFeishu({ appId: "cli_123", appSecret: "secret" }); // pragma: allowlist secret
-    expect(result).toEqual({
-      ok: true,
-      appId: "cli_123",
-      botName: "TestBot",
-      botOpenId: "ou_abc123",
-    });
+    await expectDefaultSuccessResult();
     expect(requestFn).toHaveBeenCalledTimes(1);
   });
 
   it("passes the probe timeout to the Feishu request", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "TestBot", open_id: "ou_abc123" },
-    });
+    const requestFn = setupSuccessClient();
 
-    await probeFeishu({ appId: "cli_123", appSecret: "secret" }); // pragma: allowlist secret
+    await probeFeishu(DEFAULT_CREDS);
 
     expect(requestFn).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -77,19 +139,16 @@ describe("probeFeishu", () => {
   });
 
   it("returns timeout error when request exceeds timeout", async () => {
-    vi.useFakeTimers();
-    try {
+    await withFakeTimers(async () => {
       const requestFn = vi.fn().mockImplementation(() => new Promise(() => {}));
       createFeishuClientMock.mockReturnValue({ request: requestFn });
 
-      const promise = probeFeishu({ appId: "cli_123", appSecret: "secret" }, { timeoutMs: 1_000 });
+      const promise = probeFeishu(DEFAULT_CREDS, { timeoutMs: 1_000 });
       await vi.advanceTimersByTimeAsync(1_000);
       const result = await promise;
 
       expect(result).toMatchObject({ ok: false, error: "probe timed out after 1000ms" });
-    } finally {
-      vi.useRealTimers();
-    }
+    });
   });
 
   it("returns aborted when abort signal is already aborted", async () => {
@@ -106,14 +165,9 @@ describe("probeFeishu", () => {
     expect(createFeishuClientMock).not.toHaveBeenCalled();
   });
   it("returns cached result on subsequent calls within TTL", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "TestBot", open_id: "ou_abc123" },
-    });
+    const requestFn = setupSuccessClient();
 
-    const creds = { appId: "cli_123", appSecret: "secret" }; // pragma: allowlist secret
-    const first = await probeFeishu(creds);
-    const second = await probeFeishu(creds);
+    const { first, second } = await readSequentialDefaultProbePair();
 
     expect(first).toEqual(second);
     // Only one API call should have been made
@@ -121,76 +175,37 @@ describe("probeFeishu", () => {
   });
 
   it("makes a fresh API call after cache expires", async () => {
-    vi.useFakeTimers();
-    try {
-      const requestFn = setupClient({
-        code: 0,
-        bot: { bot_name: "TestBot", open_id: "ou_abc123" },
-      });
-
-      const creds = { appId: "cli_123", appSecret: "secret" }; // pragma: allowlist secret
-      await probeFeishu(creds);
-      expect(requestFn).toHaveBeenCalledTimes(1);
-
-      // Advance time past the success TTL
-      vi.advanceTimersByTime(10 * 60 * 1000 + 1);
+    await withFakeTimers(async () => {
+      const requestFn = setupSuccessClient();
 
-      await probeFeishu(creds);
-      expect(requestFn).toHaveBeenCalledTimes(2);
-    } finally {
-      vi.useRealTimers();
-    }
+      await expectFreshDefaultProbeAfter(requestFn, () => {
+        vi.advanceTimersByTime(10 * 60 * 1000 + 1);
+      });
+    });
   });
 
   it("caches failed probe results (API error) for the error TTL", async () => {
-    vi.useFakeTimers();
-    try {
-      const requestFn = makeRequestFn({ code: 99, msg: "token expired" });
-      createFeishuClientMock.mockReturnValue({ request: requestFn });
-
-      const creds = { appId: "cli_123", appSecret: "secret" }; // pragma: allowlist secret
-      const first = await probeFeishu(creds);
-      const second = await probeFeishu(creds);
-      expect(first).toMatchObject({ ok: false, error: "API error: token expired" });
-      expect(second).toMatchObject({ ok: false, error: "API error: token expired" });
-      expect(requestFn).toHaveBeenCalledTimes(1);
-
-      vi.advanceTimersByTime(60 * 1000 + 1);
-
-      await probeFeishu(creds);
-      expect(requestFn).toHaveBeenCalledTimes(2);
-    } finally {
-      vi.useRealTimers();
-    }
+    await withFakeTimers(async () => {
+      await expectErrorResultCached({
+        requestFn: makeRequestFn({ code: 99, msg: "token expired" }),
+        expectedError: "API error: token expired",
+        ttlMs: 60 * 1000,
+      });
+    });
   });
 
   it("caches thrown request errors for the error TTL", async () => {
-    vi.useFakeTimers();
-    try {
-      const requestFn = vi.fn().mockRejectedValue(new Error("network error"));
-      createFeishuClientMock.mockReturnValue({ request: requestFn });
-
-      const creds = { appId: "cli_123", appSecret: "secret" }; // pragma: allowlist secret
-      const first = await probeFeishu(creds);
-      const second = await probeFeishu(creds);
-      expect(first).toMatchObject({ ok: false, error: "network error" });
-      expect(second).toMatchObject({ ok: false, error: "network error" });
-      expect(requestFn).toHaveBeenCalledTimes(1);
-
-      vi.advanceTimersByTime(60 * 1000 + 1);
-
-      await probeFeishu(creds);
-      expect(requestFn).toHaveBeenCalledTimes(2);
-    } finally {
-      vi.useRealTimers();
-    }
+    await withFakeTimers(async () => {
+      await expectErrorResultCached({
+        requestFn: vi.fn().mockRejectedValue(new Error("network error")),
+        expectedError: "network error",
+        ttlMs: 60 * 1000,
+      });
+    });
   });
 
   it("caches per account independently", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "Bot1", open_id: "ou_1" },
-    });
+    const requestFn = setupClient(BOT1_RESPONSE);
 
     await probeFeishu({ appId: "cli_aaa", appSecret: "s1" }); // pragma: allowlist secret
     expect(requestFn).toHaveBeenCalledTimes(1);
@@ -205,10 +220,7 @@ describe("probeFeishu", () => {
   });
 
   it("does not share cache between accounts with same appId but different appSecret", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "Bot1", open_id: "ou_1" },
-    });
+    const requestFn = setupClient(BOT1_RESPONSE);
 
     // First account with appId + secret A
     await probeFeishu({ appId: "cli_shared", appSecret: "secret_aaa" }); // pragma: allowlist secret
@@ -221,10 +233,7 @@ describe("probeFeishu", () => {
   });
 
   it("uses accountId for cache key when available", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "Bot1", open_id: "ou_1" },
-    });
+    const requestFn = setupClient(BOT1_RESPONSE);
 
     // Two accounts with same appId+appSecret but different accountIds are cached separately
     await probeFeishu({ accountId: "acct-1", appId: "cli_123", appSecret: "secret" }); // pragma: allowlist secret
@@ -239,19 +248,11 @@ describe("probeFeishu", () => {
   });
 
   it("clearProbeCache forces fresh API call", async () => {
-    const requestFn = setupClient({
-      code: 0,
-      bot: { bot_name: "TestBot", open_id: "ou_abc123" },
-    });
-
-    const creds = { appId: "cli_123", appSecret: "secret" }; // pragma: allowlist secret
-    await probeFeishu(creds);
-    expect(requestFn).toHaveBeenCalledTimes(1);
+    const requestFn = setupSuccessClient();
 
-    clearProbeCache();
-
-    await probeFeishu(creds);
-    expect(requestFn).toHaveBeenCalledTimes(2);
+    await expectFreshDefaultProbeAfter(requestFn, () => {
+      clearProbeCache();
+    });
   });
 
   it("handles response.data.bot fallback path", async () => {
@@ -260,10 +261,8 @@ describe("probeFeishu", () => {
       data: { bot: { bot_name: "DataBot", open_id: "ou_data" } },
     });
 
-    const result = await probeFeishu({ appId: "cli_123", appSecret: "secret" }); // pragma: allowlist secret
-    expect(result).toEqual({
-      ok: true,
-      appId: "cli_123",
+    await expectDefaultSuccessResult(DEFAULT_CREDS, {
+      ...DEFAULT_SUCCESS_RESULT,
       botName: "DataBot",
       botOpenId: "ou_data",
     });

package/src/reactions.ts

@@ -9,6 +9,20 @@ export type FeishuReaction = {
   operatorId: string;
 };
 
+function resolveConfiguredFeishuClient(params: { cfg: ClawdbotConfig; accountId?: string }) {
+  const account = resolveFeishuAccount(params);
+  if (!account.configured) {
+    throw new Error(`Feishu account "${account.accountId}" not configured`);
+  }
+  return createFeishuClient(account);
+}
+
+function assertFeishuReactionApiSuccess(response: { code?: number; msg?: string }, action: string) {
+  if (response.code !== 0) {
+    throw new Error(`Feishu ${action} failed: ${response.msg || `code ${response.code}`}`);
+  }
+}
+
 /**
  * Add a reaction (emoji) to a message.
  * @param emojiType - Feishu emoji type, e.g., "SMILE", "THUMBSUP", "HEART"
@@ -21,12 +35,7 @@ export async function addReactionFeishu(params: {
   accountId?: string;
 }): Promise<{ reactionId: string }> {
   const { cfg, messageId, emojiType, accountId } = params;
-  const account = resolveFeishuAccount({ cfg, accountId });
-  if (!account.configured) {
-    throw new Error(`Feishu account "${account.accountId}" not configured`);
-  }
-
-  const client = createFeishuClient(account);
+  const client = resolveConfiguredFeishuClient({ cfg, accountId });
 
   const response = (await client.im.messageReaction.create({
     path: { message_id: messageId },
@@ -41,9 +50,7 @@ export async function addReactionFeishu(params: {
     data?: { reaction_id?: string };
   };
 
-  if (response.code !== 0) {
-    throw new Error(`Feishu add reaction failed: ${response.msg || `code ${response.code}`}`);
-  }
+  assertFeishuReactionApiSuccess(response, "add reaction");
 
   const reactionId = response.data?.reaction_id;
   if (!reactionId) {
@@ -63,12 +70,7 @@ export async function removeReactionFeishu(params: {
   accountId?: string;
 }): Promise<void> {
   const { cfg, messageId, reactionId, accountId } = params;
-  const account = resolveFeishuAccount({ cfg, accountId });
-  if (!account.configured) {
-    throw new Error(`Feishu account "${account.accountId}" not configured`);
-  }
-
-  const client = createFeishuClient(account);
+  const client = resolveConfiguredFeishuClient({ cfg, accountId });
 
   const response = (await client.im.messageReaction.delete({
     path: {
@@ -77,9 +79,7 @@ export async function removeReactionFeishu(params: {
     },
   })) as { code?: number; msg?: string };
 
-  if (response.code !== 0) {
-    throw new Error(`Feishu remove reaction failed: ${response.msg || `code ${response.code}`}`);
-  }
+  assertFeishuReactionApiSuccess(response, "remove reaction");
 }
 
 /**
@@ -92,12 +92,7 @@ export async function listReactionsFeishu(params: {
   accountId?: string;
 }): Promise<FeishuReaction[]> {
   const { cfg, messageId, emojiType, accountId } = params;
-  const account = resolveFeishuAccount({ cfg, accountId });
-  if (!account.configured) {
-    throw new Error(`Feishu account "${account.accountId}" not configured`);
-  }
-
-  const client = createFeishuClient(account);
+  const client = resolveConfiguredFeishuClient({ cfg, accountId });
 
   const response = (await client.im.messageReaction.list({
     path: { message_id: messageId },
@@ -115,9 +110,7 @@ export async function listReactionsFeishu(params: {
     };
   };
 
-  if (response.code !== 0) {
-    throw new Error(`Feishu list reactions failed: ${response.msg || `code ${response.code}`}`);
-  }
+  assertFeishuReactionApiSuccess(response, "list reactions");
 
   const items = response.data?.items ?? [];
   return items.map((item) => ({