@openclaw/feishu 2026.5.9-beta.1 → 2026.5.10-beta.2

package/dist/api.js

@@ -2,7 +2,7 @@ import { a as parseFeishuTargetId, i as parseFeishuDirectConversationId, n as bu
 import { n as createFeishuThreadBindingManager, r as getFeishuThreadBindingManager, t as __testing } from "./thread-bindings-BmS6TLes.js";
 import { n as handleFeishuSubagentEnded, r as handleFeishuSubagentSpawning, t as handleFeishuSubagentDeliveryTarget } from "./subagent-hooks-C3UhPVLV.js";
 import { r as listEnabledFeishuAccounts } from "./accounts-Ba3-WP1z.js";
-import { a as setFeishuNamedAccountEnabled, i as feishuSetupAdapter, n as feishuSetupWizard, r as runFeishuLogin, t as feishuPlugin } from "./channel-C5kY2KFE.js";
+import { a as setFeishuNamedAccountEnabled, i as feishuSetupAdapter, n as feishuSetupWizard, r as runFeishuLogin, t as feishuPlugin } from "./channel-DCSECj4a.js";
 import { t as getFeishuRuntime } from "./runtime-CG0DuRCy.js";
 import { a as jsonToolResult, d as registerFeishuChatTools, f as createFeishuToolClient, m as resolveFeishuToolAccount, n as registerFeishuDriveTools, o as toolExecutionErrorResult, p as resolveAnyEnabledFeishuToolsConfig, s as unknownToolActionResult } from "./drive-C5eJLJr7.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, readStringValue } from "openclaw/plugin-sdk/text-runtime";

package/dist/{channel-C5kY2KFE.js → channel-DCSECj4a.js}

@@ -4,7 +4,7 @@ import { a as resolveDefaultFeishuAccountId, f as isRecord$1, i as listFeishuAcc
 import { n as createFeishuSendReceipt } from "./send-result-BVFTskB_.js";
 import { n as listFeishuDirectoryPeers, t as listFeishuDirectoryGroups } from "./directory.static-f3EeoRJd.js";
 import { t as messageActionTargetAliases } from "./security-audit-DqJdocrN.js";
-import { a as resolveFeishuGroupToolPolicy } from "./policy-D6c-wMPl.js";
+import { o as resolveFeishuGroupToolPolicy } from "./policy-DrLgxWF_.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Dm4Z_zQN.js";
 import { t as collectFeishuSecurityAuditFindings } from "./security-audit-shared-ByuMx9cJ.js";
 import { t as resolveFeishuSessionConversation } from "./session-conversation-B4nrW-vo.js";
@@ -811,7 +811,7 @@ const meta = {
 	aliases: ["lark"],
 	order: 70
 };
-const loadFeishuChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BK6_CcZk.js"), "feishuChannelRuntime");
+const loadFeishuChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-BlDkd6xR.js"), "feishuChannelRuntime");
 function toFeishuMessageSendResult(result, kind) {
 	const receipt = result.receipt ?? createFeishuSendReceipt({
 		messageId: result.messageId,
@@ -957,6 +957,28 @@ function areAnyFeishuReactionActionsEnabled(cfg) {
 	})) return true;
 	return false;
 }
+function isFeishuGroupTopicSessionKey(sessionKey) {
+	if (typeof sessionKey !== "string" || !sessionKey) return false;
+	const parsed = parseFeishuConversationId({ conversationId: sessionKey });
+	return parsed?.scope === "group_topic" || parsed?.scope === "group_topic_sender";
+}
+function resolveFeishuTopicAutoThreadAnchor(ctx) {
+	if (ctx.action !== "send") return;
+	if (!isFeishuGroupTopicSessionKey(ctx.sessionKey)) return;
+	const inbound = ctx.toolContext?.currentMessageId;
+	return typeof inbound === "string" && inbound.length > 0 ? inbound : void 0;
+}
+function buildFeishuSendReplyAnchor(ctx) {
+	if (ctx.action === "thread-reply") return {
+		replyToMessageId: resolveFeishuMessageId(ctx.params),
+		replyInThread: true
+	};
+	const autoThreadId = resolveFeishuTopicAutoThreadAnchor(ctx);
+	return {
+		replyToMessageId: autoThreadId,
+		replyInThread: autoThreadId !== void 0
+	};
+}
 function isSupportedFeishuDirectConversationId(conversationId) {
 	const trimmed = conversationId.trim();
 	if (!trimmed || trimmed.includes(":")) return false;
@@ -1213,7 +1235,7 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "send" || ctx.action === "thread-reply") {
 					const to = resolveFeishuActionTarget(ctx);
 					if (!to) throw new Error(`Feishu ${ctx.action} requires a target (to).`);
-					const replyToMessageId = ctx.action === "thread-reply" ? resolveFeishuMessageId(ctx.params) : void 0;
+					const { replyToMessageId, replyInThread } = buildFeishuSendReplyAnchor(ctx);
 					if (ctx.action === "thread-reply" && !replyToMessageId) throw new Error("Feishu thread-reply requires messageId.");
 					const presentation = normalizeMessagePresentation(ctx.params.presentation);
 					const text = readFirstString(ctx.params, ["text", "message"]);
@@ -1238,7 +1260,7 @@ const feishuPlugin = createChatChannelPlugin({
 							card,
 							accountId: ctx.accountId ?? void 0,
 							replyToMessageId,
-							replyInThread: ctx.action === "thread-reply"
+							replyInThread
 						});
 					} else if (mediaUrl) result = await sendMedia({
 						cfg: ctx.cfg,
@@ -1247,7 +1269,7 @@ const feishuPlugin = createChatChannelPlugin({
 						mediaUrl,
 						accountId: ctx.accountId ?? void 0,
 						mediaLocalRoots: ctx.mediaLocalRoots,
-						replyToId: replyToMessageId,
+						...replyInThread ? { threadId: replyToMessageId } : { replyToId: replyToMessageId },
 						...audioAsVoice === true ? { audioAsVoice: true } : {}
 					});
 					else result = await runtime.sendMessageFeishu({
@@ -1256,7 +1278,7 @@ const feishuPlugin = createChatChannelPlugin({
 						text,
 						accountId: ctx.accountId ?? void 0,
 						replyToMessageId,
-						replyInThread: ctx.action === "thread-reply"
+						replyInThread
 					});
 					return jsonActionResult({
 						ok: true,
@@ -1632,7 +1654,7 @@ const feishuPlugin = createChatChannelPlugin({
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorFeishuProvider } = await import("./monitor-YkqtEXDP.js");
+			const { monitorFeishuProvider } = await import("./monitor-BnbCJWIU.js");
 			const account = resolveFeishuRuntimeAccount({
 				cfg: ctx.cfg,
 				accountId: ctx.accountId

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as feishuPlugin } from "./channel-C5kY2KFE.js";
+import { t as feishuPlugin } from "./channel-DCSECj4a.js";
 export { feishuPlugin };

package/dist/{channel.runtime-BK6_CcZk.js → channel.runtime-BlDkd6xR.js}

@@ -313,6 +313,13 @@ function resolveReplyToMessageId(params) {
 	if (params.threadId == null) return;
 	return String(params.threadId).trim() || void 0;
 }
+function resolveFeishuMediaReplyMode(params) {
+	const trimmedReplyToId = params.replyToId?.trim() || void 0;
+	return {
+		replyToMessageId: resolveReplyToMessageId(params),
+		replyInThread: params.threadId != null && !trimmedReplyToId
+	};
+}
 async function sendCommentThreadReply(params) {
 	const target = parseFeishuCommentTarget(params.to);
 	if (!target) return null;
@@ -345,7 +352,7 @@ async function sendCommentThreadReply(params) {
 	}
 }
 async function sendOutboundText(params) {
-	const { cfg, to, text, accountId, replyToMessageId } = params;
+	const { cfg, to, text, accountId, replyToMessageId, replyInThread } = params;
 	const commentResult = await sendCommentThreadReply({
 		cfg,
 		to,
@@ -363,14 +370,16 @@ async function sendOutboundText(params) {
 		to,
 		text,
 		accountId,
-		replyToMessageId
+		replyToMessageId,
+		replyInThread
 	});
 	return sendMessageFeishu({
 		cfg,
 		to,
 		text,
 		accountId,
-		replyToMessageId
+		replyToMessageId,
+		replyInThread
 	});
 }
 const feishuOutbound = {
@@ -447,7 +456,7 @@ const feishuOutbound = {
 	...createAttachedChannelResultAdapter({
 		channel: "feishu",
 		sendText: async ({ cfg, to, text, accountId, replyToId, threadId, mediaLocalRoots, identity }) => {
-			const replyToMessageId = resolveReplyToMessageId({
+			const { replyToMessageId, replyInThread } = resolveFeishuMediaReplyMode({
 				replyToId,
 				threadId
 			});
@@ -459,6 +468,7 @@ const feishuOutbound = {
 					mediaUrl: localImagePath,
 					accountId: accountId ?? void 0,
 					replyToMessageId,
+					replyInThread,
 					mediaLocalRoots
 				});
 			} catch (err) {
@@ -469,7 +479,8 @@ const feishuOutbound = {
 				to,
 				text,
 				accountId: accountId ?? void 0,
-				replyToMessageId
+				replyToMessageId,
+				replyInThread
 			});
 			const renderMode = resolveFeishuAccount({
 				cfg,
@@ -485,7 +496,7 @@ const feishuOutbound = {
 					to,
 					text,
 					replyToMessageId,
-					replyInThread: threadId != null && !replyToId,
+					replyInThread,
 					accountId: accountId ?? void 0,
 					header: header?.title ? header : void 0
 				});
@@ -495,11 +506,12 @@ const feishuOutbound = {
 				to,
 				text,
 				accountId: accountId ?? void 0,
-				replyToMessageId
+				replyToMessageId,
+				replyInThread
 			});
 		},
 		sendMedia: async ({ cfg, to, text, mediaUrl, audioAsVoice, accountId, mediaLocalRoots, replyToId, threadId }) => {
-			const replyToMessageId = resolveReplyToMessageId({
+			const { replyToMessageId, replyInThread } = resolveFeishuMediaReplyMode({
 				replyToId,
 				threadId
 			});
@@ -508,7 +520,8 @@ const feishuOutbound = {
 				to,
 				text: [text?.trim(), mediaUrl?.trim()].filter(Boolean).join("\n\n") || mediaUrl || text || "",
 				accountId: accountId ?? void 0,
-				replyToMessageId
+				replyToMessageId,
+				replyInThread
 			});
 			const suppressTextForVoiceMedia = mediaUrl !== void 0 && shouldSuppressFeishuTextForVoiceMedia({
 				mediaUrl,
@@ -519,7 +532,8 @@ const feishuOutbound = {
 				to,
 				text,
 				accountId: accountId ?? void 0,
-				replyToMessageId
+				replyToMessageId,
+				replyInThread
 			});
 			if (mediaUrl) try {
 				const result = await sendMediaFeishu({
@@ -529,6 +543,7 @@ const feishuOutbound = {
 					accountId: accountId ?? void 0,
 					mediaLocalRoots,
 					replyToMessageId,
+					replyInThread,
 					...audioAsVoice === true ? { audioAsVoice: true } : {}
 				});
 				if (result.voiceIntentDegradedToFile && text?.trim()) await sendOutboundText({
@@ -536,7 +551,8 @@ const feishuOutbound = {
 					to,
 					text,
 					accountId: accountId ?? void 0,
-					replyToMessageId
+					replyToMessageId,
+					replyInThread
 				});
 				return result;
 			} catch (err) {
@@ -546,7 +562,8 @@ const feishuOutbound = {
 					to,
 					text: [text?.trim(), `📎 ${mediaUrl}`].filter(Boolean).join("\n\n"),
 					accountId: accountId ?? void 0,
-					replyToMessageId
+					replyToMessageId,
+					replyInThread
 				});
 			}
 			return await sendOutboundText({
@@ -554,7 +571,8 @@ const feishuOutbound = {
 				to,
 				text: text ?? "",
 				accountId: accountId ?? void 0,
-				replyToMessageId
+				replyToMessageId,
+				replyInThread
 			});
 		}
 	})

package/dist/{monitor-YkqtEXDP.js → monitor-BnbCJWIU.js}

@@ -3,7 +3,7 @@ import { l as fetchBotIdentityForMonitor } from "./monitor.state-DYM02ipp.js";
 //#region extensions/feishu/src/monitor.ts
 let monitorAccountRuntimePromise;
 async function loadMonitorAccountRuntime() {
-	monitorAccountRuntimePromise ??= import("./monitor.account-BRSlHEbU.js");
+	monitorAccountRuntimePromise ??= import("./monitor.account-88yMtLAU.js");
 	return await monitorAccountRuntimePromise;
 }
 async function monitorFeishuProvider(opts = {}) {

package/dist/{monitor.account-BRSlHEbU.js → monitor.account-88yMtLAU.js}

@@ -3,11 +3,11 @@ import { i as resolveReceiveIdType } from "./targets-JMFJRKSe.js";
 import { n as createFeishuThreadBindingManager } from "./thread-bindings-BmS6TLes.js";
 import { _ as buildFeishuCommentTarget, f as isRecord$3, h as readString$2, l as encodeQuery, m as parseCommentContentElements, p as normalizeString, s as resolveFeishuRuntimeAccount, u as extractReplyText, v as normalizeCommentFileType } from "./accounts-Ba3-WP1z.js";
 import { c as decodeFeishuCardAction, o as buildFeishuCardActionTextFallback, s as createFeishuCardInteractionEnvelope } from "./send-result-BVFTskB_.js";
-import { i as resolveFeishuGroupConfig, n as isFeishuGroupAllowed, o as resolveFeishuReplyPolicy, r as resolveFeishuAllowlistMatch, t as hasExplicitFeishuGroupConfig } from "./policy-D6c-wMPl.js";
+import { a as resolveFeishuGroupSenderActivationIngressAccess, i as resolveFeishuGroupConversationIngressAccess, n as resolveFeishuDmIngressAccess, r as resolveFeishuGroupConfig, s as resolveFeishuReplyPolicy, t as hasExplicitFeishuGroupConfig } from "./policy-DrLgxWF_.js";
 import { t as getFeishuRuntime } from "./runtime-CG0DuRCy.js";
 import { a as getFeishuUserAgent, i as createFeishuWSClient, n as createEventDispatcher, r as createFeishuClient } from "./client-DBVoQL5w.js";
 import { c as getChatInfo, i as createCommentTypingReactionLifecycle, t as deliverCommentThreadText } from "./drive-C5eJLJr7.js";
-import { buildAgentMediaPayload, createReplyPrefixContext, evaluateSupplementalContextVisibility, filterSupplementalContextItems, loadSessionStore, normalizeAgentId as normalizeAgentId$1, resolveChannelContextVisibilityMode, resolveSessionStoreEntry } from "./runtime-api.js";
+import { buildAgentMediaPayload, createReplyPrefixContext, evaluateSupplementalContextVisibility, loadSessionStore, normalizeAgentId as normalizeAgentId$1, resolveChannelContextVisibilityMode, resolveSessionStoreEntry } from "./runtime-api.js";
 import { _ as normalizeFeishuExternalKey, a as sendCardFeishu, c as sendStructuredCardFeishu, d as isFeishuBroadcastMention, f as isMentionForwardRequest, g as shouldSuppressFeishuTextForVoiceMedia, h as sendMediaFeishu, i as resolveFeishuCardTemplate, l as parsePostContent, m as downloadMessageResourceFeishu, n as getMessageFeishu, p as isFeishuGroupChatType, r as listFeishuThreadMessages, s as sendMessageFeishu, u as extractMentionTargets } from "./send-DKHEQrzH.js";
 import { i as waitForAbortableDelay, r as raceWithTimeoutAndAbort } from "./probe-BNzzU_uR.js";
 import { a as feishuWebhookRateLimiter, c as wsClients, i as botOpenIds, l as fetchBotIdentityForMonitor, n as FEISHU_WEBHOOK_MAX_BODY_BYTES, o as httpServers, r as botNames, s as recordWebhookStatus, t as FEISHU_WEBHOOK_BODY_TIMEOUT_MS } from "./monitor.state-DYM02ipp.js";
@@ -25,7 +25,7 @@ import { createPersistentDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 import { applyBasicWebhookRequestGuards } from "openclaw/plugin-sdk/webhook-ingress";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveSendableOutboundReplyParts, resolveTextChunksWithFallback, sendMediaWithLeadingCaption } from "openclaw/plugin-sdk/reply-payload";
-import { resolveOpenDmAllowlistAccess, safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
 import { resolveChannelConfigWrites } from "openclaw/plugin-sdk/channel-config-writes";
@@ -1746,42 +1746,37 @@ function buildFeishuAgentBody(params) {
 	}
 	return messageBody;
 }
-function isFetchedGroupContextSenderAllowed(params) {
-	if (!params.isGroup || params.allowFrom.length === 0) return true;
-	if (params.senderType === "app") return true;
+async function shouldIncludeFetchedGroupContextMessage(params) {
+	let senderAllowed = !params.isGroup || params.allowFrom.length === 0 || params.senderType === "app";
 	const senderId = params.senderId?.trim();
-	return !!senderId && isFeishuGroupAllowed({
-		groupPolicy: "allowlist",
-		allowFrom: params.allowFrom,
-		senderId,
-		senderName: void 0
-	});
-}
-function shouldIncludeFetchedGroupContextMessage(params) {
-	const senderAllowed = isFetchedGroupContextSenderAllowed({
-		isGroup: params.isGroup,
+	if (!senderAllowed && senderId) senderAllowed = (await resolveFeishuGroupSenderActivationIngressAccess({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		chatId: params.chatId,
 		allowFrom: params.allowFrom,
-		senderId: params.senderId,
-		senderType: params.senderType
-	});
+		senderOpenId: senderId,
+		senderUserId: senderId,
+		requireMention: false,
+		mentionedBot: true
+	})).senderAccess.decision === "allow";
 	return evaluateSupplementalContextVisibility({
 		mode: params.mode,
 		kind: params.kind,
 		senderAllowed
 	}).include;
 }
-function filterFetchedGroupContextMessages(messages, params) {
-	return filterSupplementalContextItems({
-		items: messages,
+async function filterFetchedGroupContextMessages(messages, params) {
+	return (await Promise.all(messages.map(async (message) => await shouldIncludeFetchedGroupContextMessage({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		chatId: params.chatId,
+		isGroup: params.isGroup,
+		allowFrom: params.allowFrom,
 		mode: params.mode,
 		kind: params.kind,
-		isSenderAllowed: (message) => isFetchedGroupContextSenderAllowed({
-			isGroup: params.isGroup,
-			allowFrom: params.allowFrom,
-			senderId: message.senderId,
-			senderType: message.senderType
-		})
-	}).items;
+		senderId: message.senderId,
+		senderType: message.senderType
+	}) ? message : void 0))).filter((message) => message !== void 0);
 }
 async function handleFeishuMessage(params) {
 	const { cfg, event, botOpenId, botName, runtime, chatHistories, accountId, processingClaimHeld = false } = params;
@@ -1902,7 +1897,6 @@ async function handleFeishuMessage(params) {
 	const groupHistoryKey = isGroup ? groupSession?.peerId ?? ctx.chatId : void 0;
 	const dmPolicy = feishuCfg?.dmPolicy ?? "pairing";
 	const configAllowFrom = feishuCfg?.allowFrom ?? [];
-	const useAccessGroups = cfg.commands?.useAccessGroups !== false;
 	const rawBroadcastAgents = isGroup ? resolveBroadcastAgents(cfg, ctx.chatId) : null;
 	const broadcastAgents = rawBroadcastAgents ? [...new Set(rawBroadcastAgents.map((id) => normalizeAgentId$1(id)))] : null;
 	const messageCreateTimeMs = event.message.create_time ? Number.parseInt(event.message.create_time, 10) : Date.now();
@@ -1929,27 +1923,17 @@ async function handleFeishuMessage(params) {
 			cfg: feishuCfg,
 			groupId: ctx.chatId
 		});
-		if (!(groupPolicy !== "disabled" && (groupExplicitlyConfigured || isFeishuGroupAllowed({
+		if ((await resolveFeishuGroupConversationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
 			groupPolicy,
-			allowFrom: groupAllowFrom,
-			senderId: ctx.chatId,
-			senderName: void 0
-		})))) {
+			groupAllowFrom,
+			groupExplicitlyConfigured
+		})).ingress.admission !== "dispatch") {
 			log(`feishu[${account.accountId}]: group ${ctx.chatId} not in groupAllowFrom (groupPolicy=${groupPolicy})`);
 			return;
 		}
-		if (effectiveGroupSenderAllowFrom.length > 0) {
-			if (!isFeishuGroupAllowed({
-				groupPolicy: "allowlist",
-				allowFrom: effectiveGroupSenderAllowFrom,
-				senderId: ctx.senderOpenId,
-				senderIds: [senderUserId],
-				senderName: ctx.senderName
-			})) {
-				log(`feishu: sender ${ctx.senderOpenId} not in group ${ctx.chatId} sender allowlist`);
-				return;
-			}
-		}
 		({requireMention} = resolveFeishuReplyPolicy({
 			isDirectMessage: false,
 			cfg,
@@ -1957,7 +1941,21 @@ async function handleFeishuMessage(params) {
 			groupId: ctx.chatId,
 			groupPolicy
 		}));
-		if (requireMention && !ctx.mentionedBot) {
+		const groupSenderActivationIngress = await resolveFeishuGroupSenderActivationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
+			allowFrom: effectiveGroupSenderAllowFrom,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			requireMention,
+			mentionedBot: ctx.mentionedBot
+		});
+		if (groupSenderActivationIngress.senderAccess.decision !== "allow") {
+			log(`feishu: sender ${ctx.senderOpenId} not in group ${ctx.chatId} sender allowlist`);
+			return;
+		}
+		if (groupSenderActivationIngress.ingress.admission !== "dispatch") {
 			log(`feishu[${account.accountId}]: message in group ${ctx.chatId} did not mention bot`);
 			if (!broadcastAgents && chatHistories && groupHistoryKey) recordPendingHistoryEntryIfEnabled({
 				historyMap: chatHistories,
@@ -1982,25 +1980,20 @@ async function handleFeishuMessage(params) {
 		});
 		const commandProbeBody = isGroup ? normalizeFeishuCommandProbeBody(ctx.content) : ctx.content;
 		const shouldComputeCommandAuthorized = core.channel.commands.shouldComputeCommandAuthorized(commandProbeBody, cfg);
-		const storeAllowFrom = !isGroup && dmPolicy !== "allowlist" && dmPolicy !== "open" ? await pairing.readAllowFromStore().catch(() => []) : [];
-		const effectiveDmAllowFrom = [...configAllowFrom, ...storeAllowFrom];
-		const dmAllowed = resolveFeishuAllowlistMatch({
-			allowFrom: effectiveDmAllowFrom,
-			senderId: ctx.senderOpenId,
-			senderIds: [senderUserId],
-			senderName: ctx.senderName
-		}).allowed;
-		const dmAccessAllowed = dmPolicy === "open" ? resolveOpenDmAllowlistAccess({
-			effectiveAllowFrom: effectiveDmAllowFrom,
-			isSenderAllowed: (allowFrom) => resolveFeishuAllowlistMatch({
-				allowFrom,
-				senderId: ctx.senderOpenId,
-				senderIds: [senderUserId],
-				senderName: ctx.senderName
-			}).allowed
-		}).decision === "allow" : dmAllowed;
-		if (isDirect && !dmAccessAllowed) {
-			if (dmPolicy === "pairing") await pairing.issueChallenge({
+		const dmIngress = isDirect ? await resolveFeishuDmIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			dmPolicy,
+			allowFrom: configAllowFrom,
+			readAllowFromStore: pairing.readAllowFromStore,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			conversationId: ctx.senderOpenId,
+			mayPair: true,
+			...shouldComputeCommandAuthorized ? { command: { hasControlCommand: true } } : {}
+		}) : null;
+		if (isDirect && dmIngress?.ingress.admission !== "dispatch") {
+			if (dmIngress?.ingress.admission === "pairing-required") await pairing.issueChallenge({
 				senderId: ctx.senderOpenId,
 				senderIdLine: `Your Feishu user id: ${ctx.senderOpenId}`,
 				meta: { name: ctx.senderName },
@@ -2022,13 +2015,7 @@ async function handleFeishuMessage(params) {
 			else log(`feishu[${account.accountId}]: blocked unauthorized sender ${ctx.senderOpenId} (dmPolicy=${dmPolicy})`);
 			return;
 		}
-		const commandAllowFrom = isGroup ? groupConfig?.allowFrom ?? configAllowFrom : effectiveDmAllowFrom;
-		const senderAllowedForCommands = resolveFeishuAllowlistMatch({
-			allowFrom: commandAllowFrom,
-			senderId: ctx.senderOpenId,
-			senderIds: [senderUserId],
-			senderName: ctx.senderName
-		}).allowed;
+		const commandAllowFrom = isGroup ? groupConfig?.allowFrom ?? configAllowFrom : dmIngress?.senderAccess.effectiveAllowFrom ?? configAllowFrom;
 		const feishuFrom = `feishu:${ctx.senderOpenId}`;
 		const feishuTo = isGroup ? `chat:${ctx.chatId}` : `user:${ctx.senderOpenId}`;
 		const peerId = isGroup ? groupSession?.peerId ?? ctx.chatId : ctx.senderOpenId;
@@ -2165,13 +2152,28 @@ async function handleFeishuMessage(params) {
 			content: audioTranscript
 		};
 		const effectiveCommandProbeBody = audioTranscript === void 0 ? commandProbeBody : isGroup ? normalizeFeishuCommandProbeBody(audioTranscript) : audioTranscript;
-		const commandAuthorized = (audioTranscript === void 0 ? shouldComputeCommandAuthorized : core.channel.commands.shouldComputeCommandAuthorized(effectiveCommandProbeBody, cfg)) ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
-			useAccessGroups,
-			authorizers: [{
-				configured: commandAllowFrom.length > 0,
-				allowed: senderAllowedForCommands
-			}]
-		}) : void 0;
+		const commandAuthorized = (audioTranscript === void 0 ? shouldComputeCommandAuthorized : core.channel.commands.shouldComputeCommandAuthorized(effectiveCommandProbeBody, cfg)) ? isDirect && audioTranscript === void 0 && dmIngress ? dmIngress.commandAccess.authorized : isGroup ? (await resolveFeishuGroupSenderActivationIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			chatId: ctx.chatId,
+			allowFrom: commandAllowFrom,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			requireMention: false,
+			mentionedBot: true,
+			command: { hasControlCommand: true }
+		})).commandAccess.authorized : (await resolveFeishuDmIngressAccess({
+			cfg,
+			accountId: account.accountId,
+			dmPolicy,
+			allowFrom: configAllowFrom,
+			readAllowFromStore: pairing.readAllowFromStore,
+			senderOpenId: ctx.senderOpenId,
+			senderUserId,
+			conversationId: ctx.senderOpenId,
+			mayPair: false,
+			command: { hasControlCommand: true }
+		})).commandAccess.authorized : void 0;
 		let quotedMessageInfo = null;
 		let quotedContent;
 		if (ctx.parentId) try {
@@ -2180,7 +2182,10 @@ async function handleFeishuMessage(params) {
 				messageId: ctx.parentId,
 				accountId: account.accountId
 			});
-			if (quotedMessageInfo && shouldIncludeFetchedGroupContextMessage({
+			if (quotedMessageInfo && await shouldIncludeFetchedGroupContextMessage({
+				cfg,
+				accountId: account.accountId,
+				chatId: ctx.chatId,
 				isGroup,
 				allowFrom: effectiveGroupSenderAllowFrom,
 				mode: contextVisibilityMode,
@@ -2250,7 +2255,10 @@ async function handleFeishuMessage(params) {
 					rootMessageInfo = null;
 				}
 				rootMessageThreadId = rootMessageInfo?.threadId;
-				if (rootMessageInfo && !shouldIncludeFetchedGroupContextMessage({
+				if (rootMessageInfo && !await shouldIncludeFetchedGroupContextMessage({
+					cfg,
+					accountId: account.accountId,
+					chatId: ctx.chatId,
 					isGroup,
 					allowFrom: effectiveGroupSenderAllowFrom,
 					mode: contextVisibilityMode,
@@ -2310,7 +2318,10 @@ async function handleFeishuMessage(params) {
 				});
 				const senderScoped = groupSession?.groupSessionScope === "group_topic_sender";
 				const senderIds = new Set([ctx.senderOpenId, senderUserId].map((id) => id?.trim()).filter((id) => id !== void 0 && id.length > 0));
-				const allowlistedMessages = filterFetchedGroupContextMessages(threadMessages, {
+				const allowlistedMessages = await filterFetchedGroupContextMessages(threadMessages, {
+					cfg,
+					accountId: account.accountId,
+					chatId: ctx.chatId,
 					isGroup,
 					allowFrom: effectiveGroupSenderAllowFrom,
 					mode: contextVisibilityMode,
@@ -3977,22 +3988,19 @@ async function handleFeishuCommentEvent(params) {
 		channel: "feishu",
 		accountId: account.accountId
 	});
-	const storeAllowFrom = dmPolicy !== "allowlist" && dmPolicy !== "open" ? await pairing.readAllowFromStore().catch(() => []) : [];
-	const effectiveDmAllowFrom = [...configAllowFrom, ...storeAllowFrom];
-	const senderAllowed = resolveFeishuAllowlistMatch({
-		allowFrom: effectiveDmAllowFrom,
-		senderId: turn.senderId,
-		senderIds: [turn.senderUserId]
-	}).allowed;
-	if (!(dmPolicy === "open" ? resolveOpenDmAllowlistAccess({
-		effectiveAllowFrom: effectiveDmAllowFrom,
-		isSenderAllowed: (allowFrom) => resolveFeishuAllowlistMatch({
-			allowFrom,
-			senderId: turn.senderId,
-			senderIds: [turn.senderUserId]
-		}).allowed
-	}).decision === "allow" : senderAllowed)) {
-		if (dmPolicy === "pairing") {
+	const dmIngress = await resolveFeishuDmIngressAccess({
+		cfg: params.cfg,
+		accountId: account.accountId,
+		dmPolicy,
+		allowFrom: configAllowFrom,
+		readAllowFromStore: pairing.readAllowFromStore,
+		senderOpenId: turn.senderId,
+		senderUserId: turn.senderUserId,
+		conversationId: turn.senderId,
+		mayPair: true
+	});
+	if (dmIngress.ingress.admission !== "dispatch") {
+		if (dmIngress.ingress.admission === "pairing-required") {
 			const client = createFeishuClient(account);
 			await pairing.issueChallenge({
 				senderId: turn.senderId,

package/dist/policy-DrLgxWF_.js

@@ -0,0 +1,181 @@
+import { t as detectIdType } from "./targets-JMFJRKSe.js";
+import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
+import { normalizeAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
+import { createChannelIngressResolver, defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
+//#region extensions/feishu/src/policy.ts
+const FEISHU_PROVIDER_PREFIX_RE = /^(feishu|lark):/i;
+const FEISHU_TYPED_PREFIX_RE = /^(chat|group|channel|user|dm|open_id):/i;
+const FEISHU_ID_KIND = "plugin:feishu-id";
+const feishuIngressIdentity = defineStableChannelIngressIdentity({
+	key: "feishu-id",
+	kind: FEISHU_ID_KIND,
+	normalize: normalizeFeishuAllowEntry,
+	sensitivity: "pii",
+	aliases: [{
+		key: "feishu-alt-id",
+		kind: FEISHU_ID_KIND,
+		normalizeEntry: () => null,
+		normalizeSubject: normalizeFeishuAllowEntry,
+		sensitivity: "pii"
+	}],
+	isWildcardEntry: (entry) => normalizeFeishuAllowEntry(entry) === "*",
+	resolveEntryId: ({ entryIndex }) => `feishu-entry-${entryIndex + 1}`
+});
+function normalizeFeishuAllowEntry(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return "";
+	if (trimmed === "*") return "*";
+	let withoutProviderPrefix = trimmed;
+	while (FEISHU_PROVIDER_PREFIX_RE.test(withoutProviderPrefix)) withoutProviderPrefix = withoutProviderPrefix.replace(FEISHU_PROVIDER_PREFIX_RE, "").trim();
+	if (withoutProviderPrefix === "*") return "*";
+	const lowered = normalizeOptionalLowercaseString(withoutProviderPrefix) ?? "";
+	if (!lowered) return "";
+	const prefixed = lowered.match(FEISHU_TYPED_PREFIX_RE);
+	if (prefixed?.[1]) {
+		const kind = [
+			"chat",
+			"group",
+			"channel"
+		].includes(prefixed[1]) ? "chat" : "user";
+		const value = withoutProviderPrefix.slice(prefixed[0].length).trim();
+		return value === "*" ? "*" : value ? `${kind}:${value}` : "";
+	}
+	const detectedType = detectIdType(withoutProviderPrefix);
+	if (detectedType === "chat_id") return `chat:${withoutProviderPrefix}`;
+	if (detectedType === "open_id" || detectedType === "user_id") return `user:${withoutProviderPrefix}`;
+	return "";
+}
+function normalizeFeishuDmPolicy(policy) {
+	return policy === "open" || policy === "pairing" || policy === "allowlist" || policy === "disabled" ? policy : "pairing";
+}
+function normalizeFeishuGroupPolicy(policy) {
+	return policy === "allowall" ? "open" : policy;
+}
+function createFeishuIngressSubject(params) {
+	const ids = [params.primaryId, ...params.alternateIds ?? []].map((value) => value?.trim()).filter((value) => Boolean(value));
+	return {
+		stableId: ids[0],
+		aliases: { "feishu-alt-id": ids[1] }
+	};
+}
+function createFeishuIngressResolver(params) {
+	return createChannelIngressResolver({
+		channelId: "feishu",
+		accountId: normalizeAccountId(params.accountId) ?? "default",
+		identity: feishuIngressIdentity,
+		cfg: params.cfg,
+		...params.readAllowFromStore ? { readStoreAllowFrom: params.readAllowFromStore } : {}
+	});
+}
+async function resolveFeishuDmIngressAccess(params) {
+	return await createFeishuIngressResolver({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		readAllowFromStore: params.readAllowFromStore
+	}).message({
+		subject: createFeishuIngressSubject({
+			primaryId: params.senderOpenId,
+			alternateIds: [params.senderUserId]
+		}),
+		conversation: {
+			kind: "direct",
+			id: params.conversationId
+		},
+		event: { mayPair: params.mayPair },
+		dmPolicy: normalizeFeishuDmPolicy(params.dmPolicy),
+		groupPolicy: "disabled",
+		allowFrom: params.allowFrom ?? [],
+		...params.command ? { command: params.command } : {}
+	});
+}
+async function resolveFeishuGroupConversationIngressAccess(params) {
+	const groupPolicy = normalizeFeishuGroupPolicy(params.groupPolicy);
+	const groupAllowFrom = groupPolicy === "allowlist" && params.groupExplicitlyConfigured ? [...params.groupAllowFrom ?? [], params.chatId] : params.groupAllowFrom ?? [];
+	return await createFeishuIngressResolver({
+		cfg: params.cfg,
+		accountId: params.accountId
+	}).message({
+		subject: createFeishuIngressSubject({ primaryId: params.chatId }),
+		conversation: {
+			kind: "group",
+			id: params.chatId
+		},
+		dmPolicy: "disabled",
+		groupPolicy,
+		groupAllowFrom
+	});
+}
+async function resolveFeishuGroupSenderActivationIngressAccess(params) {
+	const groupAllowFrom = params.allowFrom ?? [];
+	return await createFeishuIngressResolver({
+		cfg: params.cfg,
+		accountId: params.accountId
+	}).message({
+		subject: createFeishuIngressSubject({
+			primaryId: params.senderOpenId,
+			alternateIds: [params.senderUserId]
+		}),
+		conversation: {
+			kind: "group",
+			id: params.chatId
+		},
+		dmPolicy: "disabled",
+		groupPolicy: groupAllowFrom.length > 0 ? "allowlist" : "open",
+		groupAllowFrom,
+		mentionFacts: {
+			canDetectMention: true,
+			wasMentioned: params.mentionedBot
+		},
+		policy: { activation: {
+			requireMention: params.requireMention,
+			allowTextCommands: false
+		} },
+		...params.command ? { command: params.command } : {}
+	});
+}
+function resolveFeishuGroupConfig(params) {
+	const groups = params.cfg?.groups ?? {};
+	const wildcard = groups["*"];
+	const groupId = params.groupId?.trim();
+	if (!groupId) return;
+	const direct = groups[groupId];
+	if (direct) return direct;
+	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
+	const matchKey = Object.keys(groups).find((key) => normalizeOptionalLowercaseString(key) === lowered);
+	if (matchKey) return groups[matchKey];
+	return wildcard;
+}
+function hasExplicitFeishuGroupConfig(params) {
+	const groups = params.cfg?.groups ?? {};
+	const groupId = params.groupId?.trim();
+	if (!groupId) return false;
+	if (Object.prototype.hasOwnProperty.call(groups, groupId) && groupId !== "*") return true;
+	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
+	return Object.keys(groups).some((key) => key !== "*" && normalizeOptionalLowercaseString(key) === lowered);
+}
+function resolveFeishuGroupToolPolicy(params) {
+	const cfg = params.cfg.channels?.feishu;
+	if (!cfg) return;
+	return resolveFeishuGroupConfig({
+		cfg,
+		groupId: params.groupId
+	})?.tools;
+}
+function resolveFeishuReplyPolicy(params) {
+	if (params.isDirectMessage) return { requireMention: false };
+	const feishuCfg = params.cfg.channels?.feishu;
+	const resolvedCfg = resolveMergedAccountConfig({
+		channelConfig: feishuCfg,
+		accounts: feishuCfg?.accounts,
+		accountId: normalizeAccountId(params.accountId),
+		normalizeAccountId,
+		omitKeys: ["defaultAccount"]
+	});
+	const groupRequireMention = resolveFeishuGroupConfig({
+		cfg: resolvedCfg,
+		groupId: params.groupId
+	})?.requireMention;
+	return { requireMention: typeof groupRequireMention === "boolean" ? groupRequireMention : typeof resolvedCfg.requireMention === "boolean" ? resolvedCfg.requireMention : params.groupPolicy !== "open" };
+}
+//#endregion
+export { resolveFeishuGroupSenderActivationIngressAccess as a, resolveFeishuGroupConversationIngressAccess as i, resolveFeishuDmIngressAccess as n, resolveFeishuGroupToolPolicy as o, resolveFeishuGroupConfig as r, resolveFeishuReplyPolicy as s, hasExplicitFeishuGroupConfig as t };

package/dist/setup-api.js

@@ -1,2 +1,2 @@
-import { i as feishuSetupAdapter, n as feishuSetupWizard, t as feishuPlugin } from "./channel-C5kY2KFE.js";
+import { i as feishuSetupAdapter, n as feishuSetupWizard, t as feishuPlugin } from "./channel-DCSECj4a.js";
 export { feishuPlugin, feishuSetupAdapter, feishuSetupWizard };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/feishu",
-  "version": "2026.5.9-beta.1",
+  "version": "2026.5.10-beta.2",
   "description": "OpenClaw Feishu/Lark channel plugin (community maintained by @m1heng)",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@larksuiteoapi/node-sdk": "^1.62.1",
+    "@larksuiteoapi/node-sdk": "^1.63.1",
     "typebox": "1.1.38"
   },
   "devDependencies": {
@@ -16,7 +16,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.9-beta.1"
+    "openclaw": ">=2026.5.10-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -47,10 +47,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.5.9-beta.1"
+      "pluginApi": ">=2026.5.10-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.9-beta.1"
+      "openclawVersion": "2026.5.10-beta.2"
     },
     "release": {
       "publishToClawHub": true,

package/dist/policy-D6c-wMPl.js

@@ -1,118 +0,0 @@
-import { t as detectIdType } from "./targets-JMFJRKSe.js";
-import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
-import { normalizeAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
-import { evaluateSenderGroupAccessForPolicy } from "openclaw/plugin-sdk/group-access";
-//#region extensions/feishu/src/policy.ts
-const FEISHU_PROVIDER_PREFIX_RE = /^(feishu|lark):/i;
-function stripRepeatedFeishuProviderPrefixes(raw) {
-	let normalized = raw.trim();
-	while (FEISHU_PROVIDER_PREFIX_RE.test(normalized)) normalized = normalized.replace(FEISHU_PROVIDER_PREFIX_RE, "").trim();
-	return normalized;
-}
-function canonicalizeFeishuAllowlistKey(params) {
-	const value = params.value.trim();
-	if (!value) return "";
-	if (value === "*") return "*";
-	return `${params.kind}:${value}`;
-}
-function normalizeFeishuAllowEntry(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return "";
-	if (trimmed === "*") return "*";
-	const withoutProviderPrefix = stripRepeatedFeishuProviderPrefixes(trimmed);
-	if (withoutProviderPrefix === "*") return "*";
-	const lowered = normalizeOptionalLowercaseString(withoutProviderPrefix) ?? "";
-	if (!lowered) return "";
-	if (lowered.startsWith("chat:") || lowered.startsWith("group:") || lowered.startsWith("channel:")) return canonicalizeFeishuAllowlistKey({
-		kind: "chat",
-		value: withoutProviderPrefix.slice(withoutProviderPrefix.indexOf(":") + 1)
-	});
-	if (lowered.startsWith("user:") || lowered.startsWith("dm:")) return canonicalizeFeishuAllowlistKey({
-		kind: "user",
-		value: withoutProviderPrefix.slice(withoutProviderPrefix.indexOf(":") + 1)
-	});
-	if (lowered.startsWith("open_id:")) return canonicalizeFeishuAllowlistKey({
-		kind: "user",
-		value: withoutProviderPrefix.slice(withoutProviderPrefix.indexOf(":") + 1)
-	});
-	const detectedType = detectIdType(withoutProviderPrefix);
-	if (detectedType === "chat_id") return canonicalizeFeishuAllowlistKey({
-		kind: "chat",
-		value: withoutProviderPrefix
-	});
-	if (detectedType === "open_id" || detectedType === "user_id") return canonicalizeFeishuAllowlistKey({
-		kind: "user",
-		value: withoutProviderPrefix
-	});
-	return "";
-}
-function resolveFeishuAllowlistMatch(params) {
-	const allowFrom = params.allowFrom.map((entry) => normalizeFeishuAllowEntry(String(entry))).filter(Boolean);
-	if (allowFrom.length === 0) return { allowed: false };
-	if (allowFrom.includes("*")) return {
-		allowed: true,
-		matchKey: "*",
-		matchSource: "wildcard"
-	};
-	const senderCandidates = [params.senderId, ...params.senderIds ?? []].map((entry) => normalizeFeishuAllowEntry(entry ?? "")).filter(Boolean);
-	for (const senderId of senderCandidates) if (allowFrom.includes(senderId)) return {
-		allowed: true,
-		matchKey: senderId,
-		matchSource: "id"
-	};
-	return { allowed: false };
-}
-function resolveFeishuGroupConfig(params) {
-	const groups = params.cfg?.groups ?? {};
-	const wildcard = groups["*"];
-	const groupId = params.groupId?.trim();
-	if (!groupId) return;
-	const direct = groups[groupId];
-	if (direct) return direct;
-	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
-	const matchKey = Object.keys(groups).find((key) => normalizeOptionalLowercaseString(key) === lowered);
-	if (matchKey) return groups[matchKey];
-	return wildcard;
-}
-function hasExplicitFeishuGroupConfig(params) {
-	const groups = params.cfg?.groups ?? {};
-	const groupId = params.groupId?.trim();
-	if (!groupId) return false;
-	if (Object.prototype.hasOwnProperty.call(groups, groupId) && groupId !== "*") return true;
-	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
-	return Object.keys(groups).some((key) => key !== "*" && normalizeOptionalLowercaseString(key) === lowered);
-}
-function resolveFeishuGroupToolPolicy(params) {
-	const cfg = params.cfg.channels?.feishu;
-	if (!cfg) return;
-	return resolveFeishuGroupConfig({
-		cfg,
-		groupId: params.groupId
-	})?.tools;
-}
-function isFeishuGroupAllowed(params) {
-	return evaluateSenderGroupAccessForPolicy({
-		groupPolicy: params.groupPolicy === "allowall" ? "open" : params.groupPolicy,
-		groupAllowFrom: params.allowFrom.map((entry) => String(entry)),
-		senderId: params.senderId,
-		isSenderAllowed: () => resolveFeishuAllowlistMatch(params).allowed
-	}).allowed;
-}
-function resolveFeishuReplyPolicy(params) {
-	if (params.isDirectMessage) return { requireMention: false };
-	const feishuCfg = params.cfg.channels?.feishu;
-	const resolvedCfg = resolveMergedAccountConfig({
-		channelConfig: feishuCfg,
-		accounts: feishuCfg?.accounts,
-		accountId: normalizeAccountId(params.accountId),
-		normalizeAccountId,
-		omitKeys: ["defaultAccount"]
-	});
-	const groupRequireMention = resolveFeishuGroupConfig({
-		cfg: resolvedCfg,
-		groupId: params.groupId
-	})?.requireMention;
-	return { requireMention: typeof groupRequireMention === "boolean" ? groupRequireMention : typeof resolvedCfg.requireMention === "boolean" ? resolvedCfg.requireMention : params.groupPolicy !== "open" };
-}
-//#endregion
-export { resolveFeishuGroupToolPolicy as a, resolveFeishuGroupConfig as i, isFeishuGroupAllowed as n, resolveFeishuReplyPolicy as o, resolveFeishuAllowlistMatch as r, hasExplicitFeishuGroupConfig as t };