@openclaw/feishu 2026.5.7 → 2026.5.10-beta.1

package/dist/{monitor.account-CUZxYkjE.js → monitor.account-88yMtLAU.js}

@@ -2,17 +2,18 @@ import { t as buildFeishuConversationId } from "./conversation-id-DWS3Ep2A.js";
 import { i as resolveReceiveIdType } from "./targets-JMFJRKSe.js";
 import { n as createFeishuThreadBindingManager } from "./thread-bindings-BmS6TLes.js";
 import { _ as buildFeishuCommentTarget, f as isRecord$3, h as readString$2, l as encodeQuery, m as parseCommentContentElements, p as normalizeString, s as resolveFeishuRuntimeAccount, u as extractReplyText, v as normalizeCommentFileType } from "./accounts-Ba3-WP1z.js";
-import { i as decodeFeishuCardAction, n as buildFeishuCardActionTextFallback, r as createFeishuCardInteractionEnvelope } from "./card-interaction-BfRLgvw_.js";
-import { i as resolveFeishuGroupConfig, n as isFeishuGroupAllowed, o as resolveFeishuReplyPolicy, r as resolveFeishuAllowlistMatch, t as hasExplicitFeishuGroupConfig } from "./policy-D6c-wMPl.js";
+import { c as decodeFeishuCardAction, o as buildFeishuCardActionTextFallback, s as createFeishuCardInteractionEnvelope } from "./send-result-BVFTskB_.js";
+import { a as resolveFeishuGroupSenderActivationIngressAccess, i as resolveFeishuGroupConversationIngressAccess, n as resolveFeishuDmIngressAccess, r as resolveFeishuGroupConfig, s as resolveFeishuReplyPolicy, t as hasExplicitFeishuGroupConfig } from "./policy-DrLgxWF_.js";
 import { t as getFeishuRuntime } from "./runtime-CG0DuRCy.js";
 import { a as getFeishuUserAgent, i as createFeishuWSClient, n as createEventDispatcher, r as createFeishuClient } from "./client-DBVoQL5w.js";
 import { c as getChatInfo, i as createCommentTypingReactionLifecycle, t as deliverCommentThreadText } from "./drive-C5eJLJr7.js";
-import { buildAgentMediaPayload, createReplyPrefixContext, evaluateSupplementalContextVisibility, filterSupplementalContextItems, loadSessionStore, normalizeAgentId, resolveChannelContextVisibilityMode, resolveSessionStoreEntry } from "./runtime-api.js";
-import { _ as shouldSuppressFeishuTextForVoiceMedia, a as sendCardFeishu, c as sendStructuredCardFeishu, d as extractMentionTargets, f as isFeishuBroadcastMention, g as sendMediaFeishu, h as downloadMessageResourceFeishu, i as resolveFeishuCardTemplate, l as parsePostContent, m as isFeishuGroupChatType, n as getMessageFeishu, p as isMentionForwardRequest, r as listFeishuThreadMessages, s as sendMessageFeishu, u as buildMentionedCardContent, v as normalizeFeishuExternalKey } from "./send-DowxxbpH.js";
+import { buildAgentMediaPayload, createReplyPrefixContext, evaluateSupplementalContextVisibility, loadSessionStore, normalizeAgentId as normalizeAgentId$1, resolveChannelContextVisibilityMode, resolveSessionStoreEntry } from "./runtime-api.js";
+import { _ as normalizeFeishuExternalKey, a as sendCardFeishu, c as sendStructuredCardFeishu, d as isFeishuBroadcastMention, f as isMentionForwardRequest, g as shouldSuppressFeishuTextForVoiceMedia, h as sendMediaFeishu, i as resolveFeishuCardTemplate, l as parsePostContent, m as downloadMessageResourceFeishu, n as getMessageFeishu, p as isFeishuGroupChatType, r as listFeishuThreadMessages, s as sendMessageFeishu, u as extractMentionTargets } from "./send-DKHEQrzH.js";
 import { i as waitForAbortableDelay, r as raceWithTimeoutAndAbort } from "./probe-BNzzU_uR.js";
 import { a as feishuWebhookRateLimiter, c as wsClients, i as botOpenIds, l as fetchBotIdentityForMonitor, n as FEISHU_WEBHOOK_MAX_BODY_BYTES, o as httpServers, r as botNames, s as recordWebhookStatus, t as FEISHU_WEBHOOK_BODY_TIMEOUT_MS } from "./monitor.state-DYM02ipp.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, stripReasoningTagsFromText } from "openclaw/plugin-sdk/text-runtime";
 import { ensureConfiguredBindingRouteReady, resolveConfiguredBindingRoute, resolveRuntimeConversationBindingRoute } from "openclaw/plugin-sdk/conversation-runtime";
+import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-message";
 import { createChannelPairingController, createChannelPairingController as createChannelPairingController$1 } from "openclaw/plugin-sdk/channel-pairing";
 import { resolveAgentOutboundIdentity } from "openclaw/plugin-sdk/outbound-runtime";
 import fs from "node:fs";
@@ -20,16 +21,17 @@ import os from "node:os";
 import path from "node:path";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import * as Lark from "@larksuiteoapi/node-sdk";
-import { createChannelReplyPipeline } from "openclaw/plugin-sdk/channel-reply-pipeline";
 import { createPersistentDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 import { applyBasicWebhookRequestGuards } from "openclaw/plugin-sdk/webhook-ingress";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveSendableOutboundReplyParts, resolveTextChunksWithFallback, sendMediaWithLeadingCaption } from "openclaw/plugin-sdk/reply-payload";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
+import { resolveChannelConfigWrites } from "openclaw/plugin-sdk/channel-config-writes";
 import { DEFAULT_GROUP_HISTORY_LIMIT, buildPendingHistoryContextFromMap, clearHistoryEntriesIfEnabled, recordPendingHistoryEntryIfEnabled } from "openclaw/plugin-sdk/reply-history";
 import { resolveDefaultGroupPolicy, resolveOpenProviderRuntimeGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
-import { resolveOpenDmAllowlistAccess, safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { formatReasoningMessage } from "openclaw/plugin-sdk/agent-runtime";
 import { logTypingFailure } from "openclaw/plugin-sdk/channel-feedback";
 import { formatChannelProgressDraftLineForEntry, isChannelProgressDraftWorkToolName } from "openclaw/plugin-sdk/channel-streaming";
 import * as http from "node:http";
@@ -550,7 +552,14 @@ function resolveFeishuMessageDedupeKey(event) {
 * This creates a unique agent instance with its own workspace for each DM user.
 */
 async function maybeCreateDynamicAgent(params) {
-	const { cfg, runtime, senderOpenId, dynamicCfg, log } = params;
+	const { cfg, runtime, senderOpenId, dynamicCfg, configWritesAllowed, log } = params;
+	if (!configWritesAllowed) {
+		log(`feishu: config writes disabled, not creating agent for ${senderOpenId}`);
+		return {
+			created: false,
+			updatedCfg: cfg
+		};
+	}
 	const existingBindings = cfg.bindings ?? [];
 	if (existingBindings.some((b) => b.match?.channel === "feishu" && b.match?.peer?.kind === "direct" && b.match?.peer?.id === senderOpenId)) return {
 		created: false,
@@ -639,17 +648,30 @@ function resolveUserPath(p) {
 	return p;
 }
 //#endregion
+//#region extensions/feishu/src/agent-config.ts
+const DEFAULT_AGENT_ID = "main";
+function normalizeAgentId(value) {
+	return (value ?? "").trim().toLowerCase() || DEFAULT_AGENT_ID;
+}
+function resolveFeishuConfigReasoningDefault(cfg, agentId) {
+	const id = normalizeAgentId(agentId);
+	return cfg.agents?.list?.find((entry) => normalizeAgentId(entry?.id) === id)?.reasoningDefault ?? cfg.agents?.defaults?.reasoningDefault ?? "off";
+}
+//#endregion
 //#region extensions/feishu/src/reasoning-preview.ts
 function resolveFeishuReasoningPreviewEnabled(params) {
-	if (!params.sessionKey) return false;
+	const configDefault = resolveFeishuConfigReasoningDefault(params.cfg, params.agentId);
+	if (!params.sessionKey) return configDefault === "stream";
 	try {
-		return resolveSessionStoreEntry({
+		const level = resolveSessionStoreEntry({
 			store: loadSessionStore(params.storePath, { skipCache: true }),
 			sessionKey: params.sessionKey
-		}).existing?.reasoningLevel === "stream";
+		}).existing?.reasoningLevel;
+		if (level === "on" || level === "stream" || level === "off") return level === "stream";
 	} catch {
 		return false;
 	}
+	return configDefault === "stream";
 }
 //#endregion
 //#region extensions/feishu/src/streaming-card.ts
@@ -1179,7 +1201,7 @@ function resolveCardNote(agentId, identity, prefixCtx) {
 }
 function createFeishuReplyDispatcher(params) {
 	const core = getFeishuRuntime();
-	const { cfg, agentId, chatId, replyToMessageId, skipReplyToInMessages, replyInThread, threadReply, rootId, mentionTargets, accountId, identity } = params;
+	const { cfg, agentId, chatId, replyToMessageId, skipReplyToInMessages, replyInThread, threadReply, rootId, accountId, identity } = params;
 	const sendReplyToMessageId = skipReplyToInMessages ? void 0 : replyToMessageId;
 	const effectiveReplyInThread = threadReply === true ? true : replyInThread;
 	const account = resolveFeishuRuntimeAccount({
@@ -1191,7 +1213,7 @@ function createFeishuReplyDispatcher(params) {
 		agentId
 	});
 	let typingState = null;
-	const { typingCallbacks } = createChannelReplyPipeline({
+	const { typingCallbacks } = createChannelMessageReplyPipeline({
 		cfg,
 		agentId,
 		channel: "feishu",
@@ -1329,8 +1351,7 @@ function createFeishuReplyDispatcher(params) {
 			await partialUpdateQueue;
 			if (streaming?.isActive()) {
 				statusLine = "";
-				let text = buildCombinedStreamText(reasoningText, streamText);
-				if (mentionTargets?.length) text = buildMentionedCardContent(mentionTargets, text);
+				const text = buildCombinedStreamText(reasoningText, streamText);
 				const finalNote = resolveCardNote(agentId, identity, prefixContext.prefixContext);
 				await streaming.close(text, { note: finalNote });
 				if (streamText) {
@@ -1386,14 +1407,13 @@ function createFeishuReplyDispatcher(params) {
 						text: options.fallbackText,
 						useCard: false,
 						infoKind: "final",
-						sendChunk: async ({ chunk, isFirst }) => {
+						sendChunk: async ({ chunk }) => {
 							await sendMessageFeishu({
 								cfg,
 								to: chatId,
 								text: chunk,
 								replyToMessageId: sendReplyToMessageId,
 								replyInThread: effectiveReplyInThread,
-								mentions: isFirst ? mentionTargets : void 0,
 								accountId
 							});
 						}
@@ -1407,14 +1427,13 @@ function createFeishuReplyDispatcher(params) {
 					text: fallbackText,
 					useCard: false,
 					infoKind: "final",
-					sendChunk: async ({ chunk, isFirst }) => {
+					sendChunk: async ({ chunk }) => {
 						await sendMessageFeishu({
 							cfg,
 							to: chatId,
 							text: chunk,
 							replyToMessageId: sendReplyToMessageId,
 							replyInThread: effectiveReplyInThread,
-							mentions: isFirst ? mentionTargets : void 0,
 							accountId
 						});
 					}
@@ -1434,7 +1453,11 @@ function createFeishuReplyDispatcher(params) {
 			await typingCallbacks?.onReplyStart?.();
 		},
 		deliver: async (payload, info) => {
-			const reply = resolveSendableOutboundReplyParts(payload);
+			const payloadText = payload.isReasoning && payload.text ? formatReasoningMessage(payload.text) : payload.text;
+			const reply = resolveSendableOutboundReplyParts({
+				...payload,
+				text: payloadText
+			});
 			const text = reply.text;
 			const hasText = reply.hasText;
 			const hasMedia = reply.hasMedia;
@@ -1478,14 +1501,13 @@ function createFeishuReplyDispatcher(params) {
 						text,
 						useCard: true,
 						infoKind: info?.kind,
-						sendChunk: async ({ chunk, isFirst }) => {
+						sendChunk: async ({ chunk }) => {
 							await sendStructuredCardFeishu({
 								cfg,
 								to: chatId,
 								text: chunk,
 								replyToMessageId: sendReplyToMessageId,
 								replyInThread: effectiveReplyInThread,
-								mentions: isFirst ? mentionTargets : void 0,
 								accountId,
 								header: cardHeader,
 								note: cardNote
@@ -1496,14 +1518,13 @@ function createFeishuReplyDispatcher(params) {
 					text,
 					useCard: false,
 					infoKind: info?.kind,
-					sendChunk: async ({ chunk, isFirst }) => {
+					sendChunk: async ({ chunk }) => {
 						await sendMessageFeishu({
 							cfg,
 							to: chatId,
 							text: chunk,
 							replyToMessageId: sendReplyToMessageId,
 							replyInThread: effectiveReplyInThread,
-							mentions: isFirst ? mentionTargets : void 0,
 							accountId
 						});
 					}
@@ -1547,7 +1568,7 @@ function createFeishuReplyDispatcher(params) {
 			onReasoningStream: reasoningPreviewEnabled ? (payload) => {
 				if (!payload.text) return;
 				startStreaming();
-				queueReasoningUpdate(payload.text);
+				queueReasoningUpdate(formatReasoningMessage(payload.text));
 			} : void 0,
 			onReasoningEnd: reasoningPreviewEnabled ? () => {} : void 0,
 			onToolStart: streamingEnabled ? (payload) => {
@@ -1696,6 +1717,14 @@ function parseFeishuMessageEvent(event, botOpenId, _botName) {
 	}
 	return ctx;
 }
+const MAX_MENTION_CONTEXT_NAME_LENGTH = 80;
+function formatMentionNameForAgentContext(name) {
+	const normalized = Array.from(name, (char) => {
+		return char.charCodeAt(0) < 32 || char === "[" || char === "]" ? " " : char;
+	}).join("").replace(/\s+/g, " ").trim();
+	const bounded = normalized.length > MAX_MENTION_CONTEXT_NAME_LENGTH ? `${normalized.slice(0, MAX_MENTION_CONTEXT_NAME_LENGTH - 3)}...` : normalized;
+	return JSON.stringify(bounded || "unknown");
+}
 function buildFeishuAgentBody(params) {
 	const { ctx, quotedContent, permissionErrorForAgent, botOpenId } = params;
 	let messageBody = ctx.content;
@@ -1707,8 +1736,8 @@ function buildFeishuAgentBody(params) {
 		if (botIdHint) messageBody += `\n[System: If user_id is "${botIdHint}", that mention refers to you.]`;
 	}
 	if (ctx.mentionTargets && ctx.mentionTargets.length > 0) {
-		const targetNames = ctx.mentionTargets.map((t) => t.name).join(", ");
-		messageBody += `\n\n[System: Your reply will automatically @mention: ${targetNames}. Do not write @xxx yourself.]`;
+		const targetNames = ctx.mentionTargets.map((t) => formatMentionNameForAgentContext(t.name)).join(", ");
+		messageBody += `\n\n[System: Feishu users mentioned in the incoming message, for context only: ${targetNames}. Do not notify or mention these users solely because they are listed here.]`;
 	}
 	messageBody = `[message_id: ${ctx.messageId}]\n${messageBody}`;
 	if (permissionErrorForAgent) {
@@ -1717,42 +1746,37 @@ function buildFeishuAgentBody(params) {
 	}
 	return messageBody;
 }
-function isFetchedGroupContextSenderAllowed(params) {
-	if (!params.isGroup || params.allowFrom.length === 0) return true;
-	if (params.senderType === "app") return true;
+async function shouldIncludeFetchedGroupContextMessage(params) {
+	let senderAllowed = !params.isGroup || params.allowFrom.length === 0 || params.senderType === "app";
 	const senderId = params.senderId?.trim();
-	return !!senderId && isFeishuGroupAllowed({
-		groupPolicy: "allowlist",
-		allowFrom: params.allowFrom,
-		senderId,
-		senderName: void 0
-	});
-}
-function shouldIncludeFetchedGroupContextMessage(params) {
-	const senderAllowed = isFetchedGroupContextSenderAllowed({
-		isGroup: params.isGroup,
+	if (!senderAllowed && senderId) senderAllowed = (await resolveFeishuGroupSenderActivationIngressAccess({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		chatId: params.chatId,
 		allowFrom: params.allowFrom,
-		senderId: params.senderId,
-		senderType: params.senderType
-	});
+		senderOpenId: senderId,
+		senderUserId: senderId,
+		requireMention: false,
+		mentionedBot: true
+	})).senderAccess.decision === "allow";
 	return evaluateSupplementalContextVisibility({
 		mode: params.mode,
 		kind: params.kind,
 		senderAllowed
 	}).include;
 }
-function filterFetchedGroupContextMessages(messages, params) {
-	return filterSupplementalContextItems({
-		items: messages,
+async function filterFetchedGroupContextMessages(messages, params) {
+	return (await Promise.all(messages.map(async (message) => await shouldIncludeFetchedGroupContextMessage({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		chatId: params.chatId,
+		isGroup: params.isGroup,
+		allowFrom: params.allowFrom,
 		mode: params.mode,
 		kind: params.kind,
-		isSenderAllowed: (message) => isFetchedGroupContextSenderAllowed({
-			isGroup: params.isGroup,
-			allowFrom: params.allowFrom,
-			senderId: message.senderId,
-			senderType: message.senderType
-		})
-	}).items;
+		senderId: message.senderId,
+		senderType: message.senderType
+	}) ? message : void 0))).filter((message) => message !== void 0);
 }
 async function handleFeishuMessage(params) {
 	const { cfg, event, botOpenId, botName, runtime, chatHistories, accountId, processingClaimHeld = false } = params;
@@ -1873,9 +1897,8 @@ async function handleFeishuMessage(params) {
 	const groupHistoryKey = isGroup ? groupSession?.peerId ?? ctx.chatId : void 0;
 	const dmPolicy = feishuCfg?.dmPolicy ?? "pairing";
 	const configAllowFrom = feishuCfg?.allowFrom ?? [];
-	const useAccessGroups = cfg.commands?.useAccessGroups !== false;
 	const rawBroadcastAgents = isGroup ? resolveBroadcastAgents(cfg, ctx.chatId) : null;
-	const broadcastAgents = rawBroadcastAgents ? [...new Set(rawBroadcastAgents.map((id) => normalizeAgentId(id)))] : null;
+	const broadcastAgents = rawBroadcastAgents ? [...new Set(rawBroadcastAgents.map((id) => normalizeAgentId$1(id)))] : null;
 	const messageCreateTimeMs = event.message.create_time ? Number.parseInt(event.message.create_time, 10) : Date.now();
 	let requireMention = false;
 	if (isGroup) {
@@ -1900,27 +1923,17 @@ async function handleFeishuMessage(params) {
 			cfg: feishuCfg,
 			groupId: ctx.chatId
 		});
-		if (!(groupPolicy !== "disabled" && (groupExplicitlyConfigured || isFeishuGroupAllowed({
+		if ((await resolveFeishuGroupConversationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
 			groupPolicy,
-			allowFrom: groupAllowFrom,
-			senderId: ctx.chatId,
-			senderName: void 0
-		})))) {
+			groupAllowFrom,
+			groupExplicitlyConfigured
+		})).ingress.admission !== "dispatch") {
 			log(`feishu[${account.accountId}]: group ${ctx.chatId} not in groupAllowFrom (groupPolicy=${groupPolicy})`);
 			return;
 		}
-		if (effectiveGroupSenderAllowFrom.length > 0) {
-			if (!isFeishuGroupAllowed({
-				groupPolicy: "allowlist",
-				allowFrom: effectiveGroupSenderAllowFrom,
-				senderId: ctx.senderOpenId,
-				senderIds: [senderUserId],
-				senderName: ctx.senderName
-			})) {
-				log(`feishu: sender ${ctx.senderOpenId} not in group ${ctx.chatId} sender allowlist`);
-				return;
-			}
-		}
 		({requireMention} = resolveFeishuReplyPolicy({
 			isDirectMessage: false,
 			cfg,
@@ -1928,7 +1941,21 @@ async function handleFeishuMessage(params) {
 			groupId: ctx.chatId,
 			groupPolicy
 		}));
-		if (requireMention && !ctx.mentionedBot) {
+		const groupSenderActivationIngress = await resolveFeishuGroupSenderActivationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
+			allowFrom: effectiveGroupSenderAllowFrom,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			requireMention,
+			mentionedBot: ctx.mentionedBot
+		});
+		if (groupSenderActivationIngress.senderAccess.decision !== "allow") {
+			log(`feishu: sender ${ctx.senderOpenId} not in group ${ctx.chatId} sender allowlist`);
+			return;
+		}
+		if (groupSenderActivationIngress.ingress.admission !== "dispatch") {
 			log(`feishu[${account.accountId}]: message in group ${ctx.chatId} did not mention bot`);
 			if (!broadcastAgents && chatHistories && groupHistoryKey) recordPendingHistoryEntryIfEnabled({
 				historyMap: chatHistories,
@@ -1953,25 +1980,20 @@ async function handleFeishuMessage(params) {
 		});
 		const commandProbeBody = isGroup ? normalizeFeishuCommandProbeBody(ctx.content) : ctx.content;
 		const shouldComputeCommandAuthorized = core.channel.commands.shouldComputeCommandAuthorized(commandProbeBody, cfg);
-		const storeAllowFrom = !isGroup && dmPolicy !== "allowlist" && dmPolicy !== "open" ? await pairing.readAllowFromStore().catch(() => []) : [];
-		const effectiveDmAllowFrom = [...configAllowFrom, ...storeAllowFrom];
-		const dmAllowed = resolveFeishuAllowlistMatch({
-			allowFrom: effectiveDmAllowFrom,
-			senderId: ctx.senderOpenId,
-			senderIds: [senderUserId],
-			senderName: ctx.senderName
-		}).allowed;
-		const dmAccessAllowed = dmPolicy === "open" ? resolveOpenDmAllowlistAccess({
-			effectiveAllowFrom: effectiveDmAllowFrom,
-			isSenderAllowed: (allowFrom) => resolveFeishuAllowlistMatch({
-				allowFrom,
-				senderId: ctx.senderOpenId,
-				senderIds: [senderUserId],
-				senderName: ctx.senderName
-			}).allowed
-		}).decision === "allow" : dmAllowed;
-		if (isDirect && !dmAccessAllowed) {
-			if (dmPolicy === "pairing") await pairing.issueChallenge({
+		const dmIngress = isDirect ? await resolveFeishuDmIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			dmPolicy,
+			allowFrom: configAllowFrom,
+			readAllowFromStore: pairing.readAllowFromStore,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			conversationId: ctx.senderOpenId,
+			mayPair: true,
+			...shouldComputeCommandAuthorized ? { command: { hasControlCommand: true } } : {}
+		}) : null;
+		if (isDirect && dmIngress?.ingress.admission !== "dispatch") {
+			if (dmIngress?.ingress.admission === "pairing-required") await pairing.issueChallenge({
 				senderId: ctx.senderOpenId,
 				senderIdLine: `Your Feishu user id: ${ctx.senderOpenId}`,
 				meta: { name: ctx.senderName },
@@ -1993,13 +2015,7 @@ async function handleFeishuMessage(params) {
 			else log(`feishu[${account.accountId}]: blocked unauthorized sender ${ctx.senderOpenId} (dmPolicy=${dmPolicy})`);
 			return;
 		}
-		const commandAllowFrom = isGroup ? groupConfig?.allowFrom ?? configAllowFrom : effectiveDmAllowFrom;
-		const senderAllowedForCommands = resolveFeishuAllowlistMatch({
-			allowFrom: commandAllowFrom,
-			senderId: ctx.senderOpenId,
-			senderIds: [senderUserId],
-			senderName: ctx.senderName
-		}).allowed;
+		const commandAllowFrom = isGroup ? groupConfig?.allowFrom ?? configAllowFrom : dmIngress?.senderAccess.effectiveAllowFrom ?? configAllowFrom;
 		const feishuFrom = `feishu:${ctx.senderOpenId}`;
 		const feishuTo = isGroup ? `chat:${ctx.chatId}` : `user:${ctx.senderOpenId}`;
 		const peerId = isGroup ? groupSession?.peerId ?? ctx.chatId : ctx.senderOpenId;
@@ -2026,6 +2042,11 @@ async function handleFeishuMessage(params) {
 					runtime: getFeishuRuntime(),
 					senderOpenId: ctx.senderOpenId,
 					dynamicCfg,
+					configWritesAllowed: resolveChannelConfigWrites({
+						cfg,
+						channelId: "feishu",
+						accountId: account.accountId
+					}),
 					log: (msg) => log(msg)
 				});
 				if (result.created) {
@@ -2131,13 +2152,28 @@ async function handleFeishuMessage(params) {
 			content: audioTranscript
 		};
 		const effectiveCommandProbeBody = audioTranscript === void 0 ? commandProbeBody : isGroup ? normalizeFeishuCommandProbeBody(audioTranscript) : audioTranscript;
-		const commandAuthorized = (audioTranscript === void 0 ? shouldComputeCommandAuthorized : core.channel.commands.shouldComputeCommandAuthorized(effectiveCommandProbeBody, cfg)) ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
-			useAccessGroups,
-			authorizers: [{
-				configured: commandAllowFrom.length > 0,
-				allowed: senderAllowedForCommands
-			}]
-		}) : void 0;
+		const commandAuthorized = (audioTranscript === void 0 ? shouldComputeCommandAuthorized : core.channel.commands.shouldComputeCommandAuthorized(effectiveCommandProbeBody, cfg)) ? isDirect && audioTranscript === void 0 && dmIngress ? dmIngress.commandAccess.authorized : isGroup ? (await resolveFeishuGroupSenderActivationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
+			allowFrom: commandAllowFrom,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			requireMention: false,
+			mentionedBot: true,
+			command: { hasControlCommand: true }
+		})).commandAccess.authorized : (await resolveFeishuDmIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			dmPolicy,
+			allowFrom: configAllowFrom,
+			readAllowFromStore: pairing.readAllowFromStore,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			conversationId: ctx.senderOpenId,
+			mayPair: false,
+			command: { hasControlCommand: true }
+		})).commandAccess.authorized : void 0;
 		let quotedMessageInfo = null;
 		let quotedContent;
 		if (ctx.parentId) try {
@@ -2146,7 +2182,10 @@ async function handleFeishuMessage(params) {
 				messageId: ctx.parentId,
 				accountId: account.accountId
 			});
-			if (quotedMessageInfo && shouldIncludeFetchedGroupContextMessage({
+			if (quotedMessageInfo && await shouldIncludeFetchedGroupContextMessage({
+				cfg,
+				accountId: account.accountId,
+				chatId: ctx.chatId,
 				isGroup,
 				allowFrom: effectiveGroupSenderAllowFrom,
 				mode: contextVisibilityMode,
@@ -2216,7 +2255,10 @@ async function handleFeishuMessage(params) {
 					rootMessageInfo = null;
 				}
 				rootMessageThreadId = rootMessageInfo?.threadId;
-				if (rootMessageInfo && !shouldIncludeFetchedGroupContextMessage({
+				if (rootMessageInfo && !await shouldIncludeFetchedGroupContextMessage({
+					cfg,
+					accountId: account.accountId,
+					chatId: ctx.chatId,
 					isGroup,
 					allowFrom: effectiveGroupSenderAllowFrom,
 					mode: contextVisibilityMode,
@@ -2276,7 +2318,10 @@ async function handleFeishuMessage(params) {
 				});
 				const senderScoped = groupSession?.groupSessionScope === "group_topic_sender";
 				const senderIds = new Set([ctx.senderOpenId, senderUserId].map((id) => id?.trim()).filter((id) => id !== void 0 && id.length > 0));
-				const allowlistedMessages = filterFetchedGroupContextMessages(threadMessages, {
+				const allowlistedMessages = await filterFetchedGroupContextMessages(threadMessages, {
+					cfg,
+					accountId: account.accountId,
+					chatId: ctx.chatId,
 					isGroup,
 					allowFrom: effectiveGroupSenderAllowFrom,
 					mode: contextVisibilityMode,
@@ -2353,12 +2398,12 @@ async function handleFeishuMessage(params) {
 				return;
 			}
 			const strategy = cfg.broadcast?.strategy === "sequential" ? "sequential" : "parallel";
-			const activeAgentId = ctx.mentionedBot || !requireMention ? normalizeAgentId(route.agentId) : null;
-			const agentIds = (cfg.agents?.list ?? []).map((a) => normalizeAgentId(a.id));
+			const activeAgentId = ctx.mentionedBot || !requireMention ? normalizeAgentId$1(route.agentId) : null;
+			const agentIds = (cfg.agents?.list ?? []).map((a) => normalizeAgentId$1(a.id));
 			const hasKnownAgents = agentIds.length > 0;
 			log(`feishu[${account.accountId}]: broadcasting to ${broadcastAgents.length} agents (strategy=${strategy}, active=${activeAgentId ?? "none"})`);
 			const dispatchForAgent = async (agentId) => {
-				if (hasKnownAgents && !agentIds.includes(normalizeAgentId(agentId))) {
+				if (hasKnownAgents && !agentIds.includes(normalizeAgentId$1(agentId))) {
 					log(`feishu[${account.accountId}]: broadcast agent ${agentId} not found in agents.list; skipping`);
 					return;
 				}
@@ -2368,6 +2413,8 @@ async function handleFeishuMessage(params) {
 					log(`feishu[${account.accountId}]: failed to record broadcast inbound session ${agentSessionKey}: ${String(err)}`);
 				} };
 				const allowReasoningPreview = resolveFeishuReasoningPreviewEnabled({
+					cfg,
+					agentId,
 					storePath: agentStorePath,
 					sessionKey: agentSessionKey
 				});
@@ -2385,7 +2432,6 @@ async function handleFeishuMessage(params) {
 						replyInThread,
 						rootId: ctx.rootId,
 						threadReply,
-						mentionTargets: ctx.mentionTargets,
 						accountId: account.accountId,
 						identity,
 						messageCreateTimeMs
@@ -2503,6 +2549,8 @@ async function handleFeishuMessage(params) {
 			const identity = resolveAgentOutboundIdentity(cfg, route.agentId);
 			const storePath = core.channel.session.resolveStorePath(cfg.session?.store, { agentId: route.agentId });
 			const allowReasoningPreview = resolveFeishuReasoningPreviewEnabled({
+				cfg,
+				agentId: route.agentId,
 				storePath,
 				sessionKey: route.sessionKey
 			});
@@ -2517,7 +2565,6 @@ async function handleFeishuMessage(params) {
 				replyInThread,
 				rootId: ctx.rootId,
 				threadReply,
-				mentionTargets: ctx.mentionTargets,
 				accountId: account.accountId,
 				identity,
 				messageCreateTimeMs
@@ -3941,22 +3988,19 @@ async function handleFeishuCommentEvent(params) {
 		channel: "feishu",
 		accountId: account.accountId
 	});
-	const storeAllowFrom = dmPolicy !== "allowlist" && dmPolicy !== "open" ? await pairing.readAllowFromStore().catch(() => []) : [];
-	const effectiveDmAllowFrom = [...configAllowFrom, ...storeAllowFrom];
-	const senderAllowed = resolveFeishuAllowlistMatch({
-		allowFrom: effectiveDmAllowFrom,
-		senderId: turn.senderId,
-		senderIds: [turn.senderUserId]
-	}).allowed;
-	if (!(dmPolicy === "open" ? resolveOpenDmAllowlistAccess({
-		effectiveAllowFrom: effectiveDmAllowFrom,
-		isSenderAllowed: (allowFrom) => resolveFeishuAllowlistMatch({
-			allowFrom,
-			senderId: turn.senderId,
-			senderIds: [turn.senderUserId]
-		}).allowed
-	}).decision === "allow" : senderAllowed)) {
-		if (dmPolicy === "pairing") {
+	const dmIngress = await resolveFeishuDmIngressAccess({
+		cfg: params.cfg,
+		accountId: account.accountId,
+		dmPolicy,
+		allowFrom: configAllowFrom,
+		readAllowFromStore: pairing.readAllowFromStore,
+		senderOpenId: turn.senderId,
+		senderUserId: turn.senderUserId,
+		conversationId: turn.senderId,
+		mayPair: true
+	});
+	if (dmIngress.ingress.admission !== "dispatch") {
+		if (dmIngress.ingress.admission === "pairing-required") {
 			const client = createFeishuClient(account);
 			await pairing.issueChallenge({
 				senderId: turn.senderId,
@@ -3999,6 +4043,11 @@ async function handleFeishuCommentEvent(params) {
 				runtime: core,
 				senderOpenId: turn.senderId,
 				dynamicCfg,
+				configWritesAllowed: resolveChannelConfigWrites({
+					cfg: params.cfg,
+					channelId: "feishu",
+					accountId: account.accountId
+				}),
 				log: (message) => log(message)
 			});
 			if (dynamicResult.created) {