@openclaw/feishu 2026.7.1 → 2026.7.2-beta.2

package/dist/{channel-DRQRQQQ3.js → channel-X30GQVwc.js}

@@ -1,74 +1,61 @@
-import { a as resolveDefaultFeishuAccountId, d as isRecord$1, i as listFeishuAccountIds, n as inspectFeishuCredentials, o as resolveFeishuAccount, r as listEnabledFeishuAccounts, s as resolveFeishuRuntimeAccount } from "./accounts-Bs5uJ4h0.js";
-import { i as resolveReceiveIdType, n as looksLikeFeishuId, r as normalizeFeishuTarget, t as detectIdType } from "./targets-BUjQ1TcA.js";
-import { a as readNativeFeishuCardJson, n as createFeishuSendReceipt, u as createFeishuCardInteractionEnvelope } from "./send-result-BMQw-YhV.js";
-import { a as parseFeishuTargetId, i as parseFeishuDirectConversationId, n as buildFeishuModelOverrideParentCandidates, o as resolveConfiguredFeishuGroupSessionScope, r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-CdLdoot3.js";
+import { a as resolveDefaultFeishuAccountId, d as isRecord$1, i as listFeishuAccountIds, n as inspectFeishuCredentials, o as resolveFeishuAccount, r as listEnabledFeishuAccounts, s as resolveFeishuRuntimeAccount } from "./accounts-BDoGHJDk.js";
+import { i as resolveReceiveIdType, n as looksLikeFeishuId, r as normalizeFeishuTarget } from "./targets-BUjQ1TcA.js";
+import { A as resolveFeishuChatType, D as resolveFeishuGroupToolPolicy, N as createFeishuCardInteractionEnvelope, _ as canEnumerateAllFeishuPeers, a as readNativeFeishuCardJson, b as resolveFeishuChatReadPreliminaryAuthorization, g as canEnumerateAllFeishuGroups, h as authorizeFeishuChatMemberRead, k as normalizeFeishuChatType, m as assertFeishuChatReadAllowed, n as createFeishuSendReceipt, u as chunkFeishuMarkdown, v as isFeishuGroupReadAllowed, w as resolveFeishuGroupConfig, y as isFeishuGroupReadEnabled } from "./send-result-DsqTk27v.js";
+import { a as parseFeishuTargetId, i as parseFeishuDirectConversationId, n as buildFeishuModelOverrideParentCandidates, o as resolveConfiguredFeishuGroupSessionScope, r as parseFeishuConversationId, t as buildFeishuConversationId } from "./conversation-id-BeJL-wq7.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DXH5hux1.js";
 import { t as messageActionTargetAliases } from "./security-audit-BIeA3W3Q.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DLaBl9m4.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DnlMcrn5.js";
 import { t as collectFeishuSecurityAuditFindings } from "./security-audit-shared-BIHeF-S_.js";
-import { t as resolveFeishuSessionConversation } from "./session-conversation-BYuoVJwl.js";
+import { t as resolveFeishuSessionConversation } from "./session-conversation-BksWrfzm.js";
 import { createLazyRuntimeModule, createLazyRuntimeNamedExport } from "openclaw/plugin-sdk/lazy-runtime";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
+import { ToolAuthorizationError, createActionGate } from "openclaw/plugin-sdk/channel-actions";
 import { adaptScopedAccountAccessor, createHybridChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildChannelOutboundSessionRoute, createChatChannelPlugin, stripChannelTargetPrefix } from "openclaw/plugin-sdk/channel-core";
 import { createAccountStatusSink, createRuntimeOutboundDelegates, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { createAllowlistProviderGroupPolicyWarningCollector, projectConfigAccountIdWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { getSessionBindingService } from "openclaw/plugin-sdk/conversation-runtime";
-import { createChannelDirectoryAdapter, createRuntimeDirectoryLiveAdapter, listDirectoryGroupEntriesFromMapKeysAndAllowFrom, listDirectoryUserEntriesFromAllowFromAndMapKeys } from "openclaw/plugin-sdk/directory-runtime";
-import { interactiveReplyToPresentation, normalizeInteractiveReply, normalizeMessagePresentation, renderMessagePresentationFallbackText, resolveInteractiveTextFallback } from "openclaw/plugin-sdk/interactive-runtime";
+import { applyDirectoryQueryAndLimit, createChannelDirectoryAdapter, createRuntimeDirectoryLiveAdapter, listDirectoryGroupEntriesFromMapKeysAndAllowFrom, listDirectoryUserEntriesFromAllowFrom, listDirectoryUserEntriesFromAllowFromAndMapKeys } from "openclaw/plugin-sdk/directory-runtime";
+import { interactiveReplyToPresentation, normalizeInteractiveReply, normalizeMessagePresentation, renderMessagePresentationChartFallbackText, renderMessagePresentationFallbackText, renderMessagePresentationTableFallbackText, resolveInteractiveTextFallback } from "openclaw/plugin-sdk/interactive-runtime";
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { buildProbeChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { chunkTextForOutbound, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, normalizeAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
-import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { createActionGate } from "openclaw/plugin-sdk/channel-actions";
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-primitives";
+import { sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-resolution";
+import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
 import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
 import { normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/account-id";
+import { DmPolicySchema, GroupPolicySchema, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
 import { buildSecretInputSchema, hasConfiguredSecretInput as hasConfiguredSecretInput$2 } from "openclaw/plugin-sdk/secret-input";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
-import { loadSessionStore, resolveSessionFilePath, resolveStorePath, updateSessionStore } from "openclaw/plugin-sdk/session-store-runtime";
+import { deleteSessionEntry, isValidAgentHarnessSessionStoreEntry, listSessionEntries, loadTranscriptEventsSync, parseSqliteSessionFileMarker, resolveSessionStoreBackupPaths, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
-import { createChannelIngressResolver, defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, createSetupTranslator, formatDocsLink, hasConfiguredSecretInput as hasConfiguredSecretInput$1, mergeAllowFromEntries, patchTopLevelChannelConfigSection, promptSingleChannelSecretInput, splitSetupEntries } from "openclaw/plugin-sdk/setup";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, createSetupTranslator, formatDocsLink, hasConfiguredSecretInput as hasConfiguredSecretInput$1, mergeAllowFromEntries, patchTopLevelChannelConfigSection, promptSingleChannelSecretInput, setSetupChannelEnabled, splitSetupEntries } from "openclaw/plugin-sdk/setup";
 //#region extensions/feishu/src/approval-auth.ts
 function normalizeFeishuApproverId(value) {
 	const trimmed = normalizeOptionalLowercaseString(normalizeFeishuTarget(String(value)));
 	return trimmed?.startsWith("ou_") ? trimmed : void 0;
 }
-const feishuApprovalAuth = createResolvedApproverActionAuthAdapter({
+const feishuApprovalAuth = createChannelApprovalAuth({
 	channelLabel: "Feishu",
-	resolveApprovers: ({ cfg, accountId }) => {
-		const account = resolveFeishuAccount({
+	resolveInputs: ({ cfg, accountId }) => {
+		return { allowFrom: resolveFeishuAccount({
 			cfg,
 			accountId
-		}).config;
-		return resolveApprovalApprovers({
-			allowFrom: account.allowFrom,
-			normalizeApprover: normalizeFeishuApproverId
-		});
+		}).config.allowFrom };
 	},
-	normalizeSenderId: (value) => normalizeFeishuApproverId(value)
-});
+	normalizeApprover: normalizeFeishuApproverId
+}).approvalAuth;
 //#endregion
 //#region extensions/feishu/src/config-schema.ts
 const ChannelActionsSchema = z.object({ reactions: z.boolean().optional() }).strict().optional();
-const DmPolicySchema = z.enum([
-	"open",
-	"pairing",
-	"allowlist"
-]);
-const GroupPolicySchema = z.union([z.enum([
-	"open",
-	"allowlist",
-	"disabled"
-]), z.literal("allowall").transform(() => "open")]);
+const FeishuGroupPolicySchema = z.union([GroupPolicySchema, z.literal("allowall").transform(() => "open")]);
 const FeishuDomainSchema = z.union([z.enum(["feishu", "lark"]), z.string().url().startsWith("https://")]);
 const FeishuConnectionModeSchema = z.enum(["websocket", "webhook"]);
 const TtsOverrideSchema = z.object({
@@ -115,12 +102,18 @@ const RenderModeSchema = z.enum([
 	"raw",
 	"card"
 ]).optional();
-const StreamingModeSchema = z.boolean().optional();
-const BlockStreamingSchema = z.boolean().optional();
 const BlockStreamingCoalesceSchema = z.object({
-	enabled: z.boolean().optional(),
-	minDelayMs: z.number().int().positive().optional(),
-	maxDelayMs: z.number().int().positive().optional()
+	minChars: z.number().int().positive().optional(),
+	maxChars: z.number().int().positive().optional(),
+	idleMs: z.number().int().nonnegative().optional()
+}).strict().optional();
+const FeishuStreamingSchema = z.object({
+	mode: z.enum(["off", "partial"]).optional(),
+	chunkMode: z.enum(["length", "newline"]).optional(),
+	block: z.object({
+		enabled: z.boolean().optional(),
+		coalesce: BlockStreamingCoalesceSchema
+	}).strict().optional()
 }).strict().optional();
 const ChannelHeartbeatVisibilitySchema = z.object({
 	visibility: z.enum(["visible", "hidden"]).optional(),
@@ -194,17 +187,12 @@ const ReactionNotificationModeSchema = z.enum([
 * causing the reply to appear as a topic (话题) under the original message.
 */
 const ReplyInThreadSchema = z.enum(["disabled", "enabled"]).optional();
-const FeishuGroupSchema = z.object({
-	requireMention: z.boolean().optional(),
+const FeishuGroupSchema = buildGroupEntrySchema({
 	tools: ToolPolicySchema,
-	skills: z.array(z.string()).optional(),
-	enabled: z.boolean().optional(),
-	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
-	systemPrompt: z.string().optional(),
 	groupSessionScope: GroupSessionScopeSchema,
 	topicSessionMode: TopicSessionModeSchema,
 	replyInThread: ReplyInThreadSchema
-}).strict();
+}).omit({ toolsBySender: true });
 const FeishuSharedConfigShape = {
 	webhookHost: z.string().optional(),
 	webhookPort: z.number().int().positive().optional(),
@@ -213,7 +201,7 @@ const FeishuSharedConfigShape = {
 	configWrites: z.boolean().optional(),
 	dmPolicy: DmPolicySchema.optional(),
 	allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
-	groupPolicy: GroupPolicySchema.optional(),
+	groupPolicy: FeishuGroupPolicySchema.optional(),
 	groupAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
 	groupSenderAllowFrom: z.array(z.union([z.string(), z.number()])).optional(),
 	requireMention: z.boolean().optional(),
@@ -222,14 +210,11 @@ const FeishuSharedConfigShape = {
 	dmHistoryLimit: z.number().int().min(0).optional(),
 	dms: z.record(z.string(), DmConfigSchema).optional(),
 	textChunkLimit: z.number().int().positive().optional(),
-	chunkMode: z.enum(["length", "newline"]).optional(),
-	blockStreaming: BlockStreamingSchema,
-	blockStreamingCoalesce: BlockStreamingCoalesceSchema,
 	mediaMaxMb: z.number().positive().optional(),
 	httpTimeoutMs: z.number().int().positive().max(3e5).optional(),
 	heartbeat: ChannelHeartbeatVisibilitySchema,
 	renderMode: RenderModeSchema,
-	streaming: StreamingModeSchema,
+	streaming: FeishuStreamingSchema,
 	tools: FeishuToolsConfigSchema,
 	actions: ChannelActionsSchema,
 	replyInThread: ReplyInThreadSchema,
@@ -256,7 +241,7 @@ const FeishuAccountConfigSchema = z.object({
 	groupSessionScope: GroupSessionScopeSchema,
 	topicSessionMode: TopicSessionModeSchema
 }).strict();
-const FeishuConfigSchema = z.object({
+const FeishuChannelConfigSchema = buildChannelConfigSchema(buildMultiAccountChannelSchema(z.object({
 	enabled: z.boolean().optional(),
 	defaultAccount: z.string().optional(),
 	appId: z.string().optional(),
@@ -269,15 +254,17 @@ const FeishuConfigSchema = z.object({
 	...FeishuSharedConfigShape,
 	dmPolicy: DmPolicySchema.optional().default("pairing"),
 	reactionNotifications: ReactionNotificationModeSchema.optional().default("own"),
-	groupPolicy: GroupPolicySchema.optional().default("allowlist"),
+	groupPolicy: FeishuGroupPolicySchema.optional().default("allowlist"),
 	requireMention: z.boolean().optional(),
 	groupSessionScope: GroupSessionScopeSchema,
 	topicSessionMode: TopicSessionModeSchema,
 	dynamicAgentCreation: DynamicAgentCreationSchema,
 	typingIndicator: z.boolean().optional().default(true),
-	resolveSenderNames: z.boolean().optional().default(true),
-	accounts: z.record(z.string(), FeishuAccountConfigSchema.optional()).optional()
-}).strict().superRefine((value, ctx) => {
+	resolveSenderNames: z.boolean().optional().default(true)
+}).strict(), {
+	accountSchema: FeishuAccountConfigSchema,
+	optionalAccount: true
+}).superRefine((value, ctx) => {
 	const defaultAccount = value.defaultAccount?.trim();
 	if (defaultAccount && value.accounts && Object.keys(value.accounts).length > 0) {
 		const normalizedDefaultAccount = normalizeAccountId$1(defaultAccount);
@@ -333,7 +320,7 @@ const FeishuConfigSchema = z.object({
 			message: "channels.feishu.dmPolicy=\"open\" requires channels.feishu.allowFrom to include \"*\""
 		});
 	}
-});
+}), { jsonSchemaMode: "input" });
 //#endregion
 //#region extensions/feishu/src/directory.static.ts
 function toFeishuDirectoryPeers(ids) {
@@ -374,6 +361,27 @@ async function listFeishuDirectoryGroups(params) {
 		limit: params.limit
 	}).map((entry) => entry.id));
 }
+async function listAuthorizedFeishuDirectoryPeers(params) {
+	return toFeishuDirectoryPeers(listDirectoryUserEntriesFromAllowFrom({
+		allowFrom: resolveFeishuAccount({
+			cfg: params.cfg,
+			accountId: params.accountId
+		}).config.allowFrom,
+		query: params.query,
+		limit: params.limit,
+		normalizeId: (entry) => normalizeFeishuTarget(entry) ?? entry
+	}).map((entry) => entry.id));
+}
+async function listAuthorizedFeishuDirectoryGroups(params) {
+	const account = resolveFeishuAccount({
+		cfg: params.cfg,
+		accountId: params.accountId
+	});
+	return toFeishuDirectoryGroups(applyDirectoryQueryAndLimit(listDirectoryGroupEntriesFromMapKeysAndAllowFrom({
+		groups: Object.fromEntries(Object.entries(account.config.groups ?? {}).filter(([, group]) => group?.enabled !== false)),
+		allowFrom: account.config.groupAllowFrom
+	}).filter((entry) => isFeishuGroupReadAllowed(params.cfg, account, entry.id, false)).map((entry) => entry.id), params));
+}
 //#endregion
 //#region extensions/feishu/src/doctor.ts
 const FEISHU_STATE_DIR = "feishu";
@@ -407,6 +415,12 @@ function existsFile(filePath) {
 		return false;
 	}
 }
+function resolveFeishuAgentSessionsDir(agentId) {
+	return path.join(resolveStateDir(), "agents", normalizeAgentId(agentId), "sessions");
+}
+function isSqliteTranscriptMarker(value) {
+	return parseSqliteSessionFileMarker(value) !== void 0;
+}
 function safeReadDir(dir) {
 	try {
 		return fs.readdirSync(dir, { withFileTypes: true });
@@ -472,9 +486,11 @@ function resolveConfiguredDefaultAgentId(cfg) {
 function collectFeishuSessionTargets(params) {
 	const byStorePath = /* @__PURE__ */ new Map();
 	const addTarget = (target) => {
-		byStorePath.set(path.resolve(target.storePath), {
+		const resolvedStorePath = path.resolve(target.storePath);
+		byStorePath.set(`${normalizeAgentId(target.agentId)}\0${resolvedStorePath}`, {
 			...target,
-			storePath: path.resolve(target.storePath)
+			agentId: normalizeAgentId(target.agentId),
+			storePath: resolvedStorePath
 		});
 	};
 	for (const agentId of collectConfiguredAgentIds(params.cfg)) addTarget({
@@ -528,16 +544,23 @@ function collectCorruptFeishuStateJsonFindings(feishuStateDir) {
 function resolveSessionTranscriptCandidates(params) {
 	const candidates = /* @__PURE__ */ new Set();
 	const sessionsDir = path.dirname(params.storePath);
+	const agentSessionsDir = resolveFeishuAgentSessionsDir(params.agentId);
 	const addSafeCandidate = (candidate) => {
 		const resolved = path.isAbsolute(candidate) ? path.resolve(candidate) : path.resolve(sessionsDir, candidate);
-		if (resolved === sessionsDir || !isPathWithinRoot(resolved, sessionsDir)) return;
+		const isStoreCandidate = isPathWithinRoot(resolved, sessionsDir);
+		const isAgentSessionCandidate = isPathWithinRoot(resolved, agentSessionsDir);
+		if (resolved === sessionsDir || resolved === agentSessionsDir || !isStoreCandidate && !isAgentSessionCandidate) return false;
 		candidates.add(resolved);
+		return true;
 	};
 	if (typeof params.entry.sessionId === "string" && /^[a-z0-9][a-z0-9._-]{0,127}$/i.test(params.entry.sessionId)) {
-		candidates.add(resolveSessionFilePath(params.entry.sessionId, typeof params.entry.sessionFile === "string" ? { sessionFile: params.entry.sessionFile } : void 0, {
-			agentId: params.agentId,
-			sessionsDir
-		}));
+		let addedExplicitCandidate = false;
+		if (typeof params.entry.sessionFile === "string" && params.entry.sessionFile.trim()) {
+			const explicitSessionFile = params.entry.sessionFile.trim();
+			if (isSqliteTranscriptMarker(explicitSessionFile)) return [];
+			addedExplicitCandidate = addSafeCandidate(explicitSessionFile);
+		}
+		if (!addedExplicitCandidate) candidates.add(path.join(sessionsDir, `${params.entry.sessionId}.jsonl`));
 		return [...candidates].toSorted();
 	}
 	if (typeof params.entry.sessionFile === "string" && params.entry.sessionFile.trim()) addSafeCandidate(params.entry.sessionFile.trim());
@@ -556,6 +579,47 @@ function isBlankUserMessage(value) {
 function isUserMessage(value) {
 	return isRecord(value) && value.type === "message" && isRecord(value.message) && value.message.role === "user";
 }
+function inspectTranscriptEntries(params) {
+	let blankUserMessageRun = 0;
+	let maxBlankUserMessageRun = 0;
+	for (const entry of params.entries) if (isBlankUserMessage(entry)) {
+		blankUserMessageRun += 1;
+		maxBlankUserMessageRun = Math.max(maxBlankUserMessageRun, blankUserMessageRun);
+	} else if (isUserMessage(entry)) blankUserMessageRun = 0;
+	if (params.entries.length === 0) {
+		if (params.allowMissingSessionHeader) return null;
+		return {
+			kind: "invalid-session-transcript",
+			sessionKey: params.sessionKey,
+			storePath: params.storePath,
+			path: params.transcriptPath,
+			reason: "empty transcript"
+		};
+	}
+	const firstEntry = params.entries[0];
+	if (!isSessionHeader(firstEntry) && (!params.allowMissingSessionHeader || !isUserMessage(firstEntry) && !isBlankUserMessage(firstEntry))) return {
+		kind: "invalid-session-transcript",
+		sessionKey: params.sessionKey,
+		storePath: params.storePath,
+		path: params.transcriptPath,
+		reason: "invalid session header"
+	};
+	if ((params.malformedLines ?? 0) > 0) return {
+		kind: "invalid-session-transcript",
+		sessionKey: params.sessionKey,
+		storePath: params.storePath,
+		path: params.transcriptPath,
+		reason: `${params.malformedLines} malformed JSONL line(s)`
+	};
+	if (maxBlankUserMessageRun >= BLANK_USER_MESSAGE_REPAIR_THRESHOLD) return {
+		kind: "blank-user-message-run",
+		sessionKey: params.sessionKey,
+		storePath: params.storePath,
+		path: params.transcriptPath,
+		count: maxBlankUserMessageRun
+	};
+	return null;
+}
 function inspectSessionTranscript(params) {
 	let stat;
 	try {
@@ -585,52 +649,54 @@ function inspectSessionTranscript(params) {
 	}
 	const entries = [];
 	let malformedLines = 0;
-	let blankUserMessageRun = 0;
-	let maxBlankUserMessageRun = 0;
 	for (const line of raw.split(/\r?\n/)) {
 		if (!line.trim()) continue;
 		try {
 			const entry = JSON.parse(line);
 			entries.push(entry);
-			if (isBlankUserMessage(entry)) {
-				blankUserMessageRun += 1;
-				maxBlankUserMessageRun = Math.max(maxBlankUserMessageRun, blankUserMessageRun);
-			} else if (isUserMessage(entry)) blankUserMessageRun = 0;
 		} catch {
 			malformedLines += 1;
 		}
 	}
-	if (entries.length === 0) return {
-		kind: "invalid-session-transcript",
-		sessionKey: params.sessionKey,
-		storePath: params.storePath,
-		path: params.transcriptPath,
-		reason: "empty transcript"
-	};
-	if (!isSessionHeader(entries[0])) return {
-		kind: "invalid-session-transcript",
-		sessionKey: params.sessionKey,
-		storePath: params.storePath,
-		path: params.transcriptPath,
-		reason: "invalid session header"
-	};
-	if (malformedLines > 0) return {
-		kind: "invalid-session-transcript",
-		sessionKey: params.sessionKey,
-		storePath: params.storePath,
-		path: params.transcriptPath,
-		reason: `${malformedLines} malformed JSONL line(s)`
-	};
-	if (maxBlankUserMessageRun >= BLANK_USER_MESSAGE_REPAIR_THRESHOLD) return {
-		kind: "blank-user-message-run",
+	return inspectTranscriptEntries({
+		...params,
+		entries,
+		malformedLines
+	});
+}
+function inspectSqliteSessionTranscript(params) {
+	if (typeof params.entry.sessionFile !== "string") return null;
+	const marker = parseSqliteSessionFileMarker(params.entry.sessionFile);
+	if (!marker) return null;
+	const sessionId = typeof params.entry.sessionId === "string" && params.entry.sessionId.trim() ? params.entry.sessionId.trim() : marker.sessionId;
+	let entries;
+	try {
+		entries = loadTranscriptEventsSync({
+			agentId: marker.agentId,
+			sessionId,
+			sessionKey: params.sessionKey,
+			storePath: marker.storePath
+		});
+	} catch {
+		return {
+			kind: "invalid-session-transcript",
+			sessionKey: params.sessionKey,
+			storePath: params.storePath,
+			path: params.entry.sessionFile,
+			reason: "unreadable"
+		};
+	}
+	return inspectTranscriptEntries({
 		sessionKey: params.sessionKey,
 		storePath: params.storePath,
-		path: params.transcriptPath,
-		count: maxBlankUserMessageRun
-	};
-	return null;
+		transcriptPath: params.entry.sessionFile,
+		allowMissingSessionHeader: true,
+		entries
+	});
 }
 function collectFeishuSessionFindings(params) {
+	const sqliteFinding = inspectSqliteSessionTranscript(params);
+	if (sqliteFinding) return [sqliteFinding];
 	const transcriptCandidates = resolveSessionTranscriptCandidates(params);
 	const existing = transcriptCandidates.filter(existsFile);
 	if (transcriptCandidates.length > 0 && existing.length === 0) return [{
@@ -682,24 +748,23 @@ function inspectFeishuDoctorState(params) {
 		cfg: params.cfg,
 		env,
 		stateDir
-	})) {
-		const store = loadSessionStore(target.storePath, { skipCache: true });
-		for (const [key, entry] of Object.entries(store).toSorted(([left], [right]) => left.localeCompare(right))) {
-			if (!isFeishuSessionEntry(key, entry)) continue;
-			const sessionEntry = toFeishuSessionEntry(entry);
-			sessionEntries.push({
-				key,
-				storePath: target.storePath,
-				agentId: target.agentId,
-				entry: sessionEntry
-			});
-			findings.push(...collectFeishuSessionFindings({
-				sessionKey: key,
-				storePath: target.storePath,
-				agentId: target.agentId,
-				entry: sessionEntry
-			}));
-		}
+	})) for (const { sessionKey: key, entry } of listSessionEntries({
+		agentId: target.agentId,
+		storePath: target.storePath
+	}).filter(({ sessionKey, entry: sessionEntry }) => !isValidAgentHarnessSessionStoreEntry(sessionKey, sessionEntry) && isFeishuSessionEntry(sessionKey, sessionEntry)).toSorted((left, right) => left.sessionKey.localeCompare(right.sessionKey))) {
+		const sessionEntry = toFeishuSessionEntry(entry);
+		sessionEntries.push({
+			key,
+			storePath: target.storePath,
+			agentId: target.agentId,
+			entry: sessionEntry
+		});
+		findings.push(...collectFeishuSessionFindings({
+			sessionKey: key,
+			storePath: target.storePath,
+			agentId: target.agentId,
+			entry: sessionEntry
+		}));
 	}
 	return {
 		stateDir,
@@ -735,13 +800,19 @@ function movePathToBackup(params) {
 	return true;
 }
 function copyStoreBackup(params) {
-	if (!existsFile(params.storePath)) return;
-	const targetPath = path.join(params.backupDir, "session-stores", params.agentId, path.basename(params.storePath));
-	fs.mkdirSync(path.dirname(targetPath), {
-		recursive: true,
-		mode: 448
-	});
-	fs.copyFileSync(params.storePath, resolveUniquePath(targetPath));
+	const targetDir = path.join(params.backupDir, "session-stores", params.agentId);
+	for (const sourcePath of resolveSessionStoreBackupPaths({
+		agentId: params.agentId,
+		storePath: params.storePath
+	})) {
+		if (!existsFile(sourcePath)) continue;
+		const targetPath = path.join(targetDir, path.basename(sourcePath));
+		fs.mkdirSync(path.dirname(targetPath), {
+			recursive: true,
+			mode: 448
+		});
+		fs.copyFileSync(sourcePath, resolveUniquePath(targetPath));
+	}
 }
 function collectSessionArtifactPaths(params) {
 	const artifacts = /* @__PURE__ */ new Set();
@@ -821,15 +892,22 @@ async function repairFeishuDoctorState(params) {
 			agentId: group.agentId
 		});
 		const keys = new Set(group.entries.map((entry) => entry.key));
-		const removedEntries = await updateSessionStore(storePath, (store) => {
-			const removed = [];
-			for (const key of keys) if (Object.hasOwn(store, key)) {
-				delete store[key];
-				const entry = group.entries.find((candidate) => candidate.key === key);
-				if (entry) removed.push(entry);
-			}
-			return removed;
-		}, { skipMaintenance: true });
+		const removedEntries = [];
+		for (const key of keys) {
+			const currentEntry = listSessionEntries({
+				agentId: group.agentId,
+				storePath
+			}).find((candidate) => candidate.sessionKey === key)?.entry;
+			if (!currentEntry || isValidAgentHarnessSessionStoreEntry(key, currentEntry)) continue;
+			if (!await deleteSessionEntry({
+				agentId: group.agentId,
+				archiveTranscript: true,
+				sessionKey: key,
+				storePath
+			})) continue;
+			const entry = group.entries.find((candidate) => candidate.key === key);
+			if (entry) removedEntries.push(entry);
+		}
 		const removed = removedEntries.length;
 		removedSessionEntries += removed;
 		if (removed > 0) {
@@ -913,189 +991,43 @@ async function runFeishuDoctorSequence(params) {
 		warningNotes: report.warnings
 	};
 }
-const feishuDoctor = { runConfigSequence: async ({ cfg, env, shouldRepair }) => await runFeishuDoctorSequence({
-	cfg,
-	env,
-	shouldRepair
-}) };
+const feishuDoctor = {
+	legacyConfigRules,
+	normalizeCompatibilityConfig,
+	runConfigSequence: async ({ cfg, env, shouldRepair }) => await runFeishuDoctorSequence({
+		cfg,
+		env,
+		shouldRepair
+	})
+};
 //#endregion
-//#region extensions/feishu/src/policy.ts
-const FEISHU_PROVIDER_PREFIX_RE = /^(feishu|lark):/i;
-const FEISHU_TYPED_PREFIX_RE = /^(chat|group|channel|user|dm|open_id):/i;
-const FEISHU_ID_KIND = "plugin:feishu-id";
-const feishuIngressIdentity = defineStableChannelIngressIdentity({
-	key: "feishu-id",
-	kind: FEISHU_ID_KIND,
-	normalize: normalizeFeishuAllowEntry,
-	sensitivity: "pii",
-	aliases: [{
-		key: "feishu-alt-id",
-		kind: FEISHU_ID_KIND,
-		normalizeEntry: () => null,
-		normalizeSubject: normalizeFeishuAllowEntry,
-		sensitivity: "pii"
-	}],
-	isWildcardEntry: (entry) => normalizeFeishuAllowEntry(entry) === "*",
-	resolveEntryId: ({ entryIndex }) => `feishu-entry-${entryIndex + 1}`
-});
-function normalizeFeishuAllowEntry(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return "";
-	if (trimmed === "*") return "*";
-	let withoutProviderPrefix = trimmed;
-	while (FEISHU_PROVIDER_PREFIX_RE.test(withoutProviderPrefix)) withoutProviderPrefix = withoutProviderPrefix.replace(FEISHU_PROVIDER_PREFIX_RE, "").trim();
-	if (withoutProviderPrefix === "*") return "*";
-	const lowered = normalizeOptionalLowercaseString(withoutProviderPrefix) ?? "";
-	if (!lowered) return "";
-	const prefixed = lowered.match(FEISHU_TYPED_PREFIX_RE);
-	if (prefixed?.[1]) {
-		const kind = [
-			"chat",
-			"group",
-			"channel"
-		].includes(prefixed[1]) ? "chat" : "user";
-		const value = withoutProviderPrefix.slice(prefixed[0].length).trim();
-		return value === "*" ? "*" : value ? `${kind}:${value}` : "";
+//#region extensions/feishu/src/presentation-card.ts
+const FEISHU_CARD_MAX_BYTES = 30 * 1024;
+const FEISHU_CARD_MAX_ELEMENTS = 200;
+function countFeishuCardElements(value, ancestors = /* @__PURE__ */ new Set()) {
+	if (Array.isArray(value)) return value.reduce((count, entry) => count + countFeishuCardElements(entry, ancestors), 0);
+	if (!value || typeof value !== "object") return 0;
+	if (ancestors.has(value)) return 201;
+	ancestors.add(value);
+	const record = value;
+	let count = typeof record.tag === "string" ? 1 : 0;
+	for (const entry of Object.values(record)) {
+		count += countFeishuCardElements(entry, ancestors);
+		if (count > FEISHU_CARD_MAX_ELEMENTS) break;
 	}
-	const detectedType = detectIdType(withoutProviderPrefix);
-	if (detectedType === "chat_id") return `chat:${withoutProviderPrefix}`;
-	if (detectedType === "open_id" || detectedType === "user_id") return `user:${withoutProviderPrefix}`;
-	return "";
-}
-function normalizeFeishuDmPolicy(policy) {
-	return policy === "open" || policy === "pairing" || policy === "allowlist" || policy === "disabled" ? policy : "pairing";
-}
-function normalizeFeishuGroupPolicy(policy) {
-	return policy === "allowall" ? "open" : policy;
-}
-function createFeishuIngressSubject(params) {
-	const ids = [params.primaryId, ...params.alternateIds ?? []].map((value) => value?.trim()).filter((value) => Boolean(value));
-	return {
-		stableId: ids[0],
-		aliases: { "feishu-alt-id": ids[1] }
-	};
-}
-function createFeishuIngressResolver(params) {
-	return createChannelIngressResolver({
-		channelId: "feishu",
-		accountId: normalizeAccountId(params.accountId) ?? "default",
-		identity: feishuIngressIdentity,
-		cfg: params.cfg,
-		...params.readAllowFromStore ? { readStoreAllowFrom: params.readAllowFromStore } : {}
-	});
+	ancestors.delete(value);
+	return count;
 }
-async function resolveFeishuDmIngressAccess(params) {
-	return await createFeishuIngressResolver({
-		cfg: params.cfg,
-		accountId: params.accountId,
-		readAllowFromStore: params.readAllowFromStore
-	}).message({
-		subject: createFeishuIngressSubject({
-			primaryId: params.senderOpenId,
-			alternateIds: [params.senderUserId]
-		}),
-		conversation: {
-			kind: "direct",
-			id: params.conversationId
-		},
-		event: { mayPair: params.mayPair },
-		dmPolicy: normalizeFeishuDmPolicy(params.dmPolicy),
-		groupPolicy: "disabled",
-		allowFrom: params.allowFrom ?? [],
-		...params.command ? { command: params.command } : {}
-	});
-}
-async function resolveFeishuGroupConversationIngressAccess(params) {
-	const groupPolicy = normalizeFeishuGroupPolicy(params.groupPolicy);
-	const groupAllowFrom = groupPolicy === "allowlist" && params.groupExplicitlyConfigured ? [...params.groupAllowFrom ?? [], params.chatId] : params.groupAllowFrom ?? [];
-	return await createFeishuIngressResolver({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).message({
-		subject: createFeishuIngressSubject({ primaryId: params.chatId }),
-		conversation: {
-			kind: "group",
-			id: params.chatId
-		},
-		dmPolicy: "disabled",
-		groupPolicy,
-		groupAllowFrom
-	});
-}
-async function resolveFeishuGroupSenderActivationIngressAccess(params) {
-	const groupAllowFrom = params.allowFrom ?? [];
-	return await createFeishuIngressResolver({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).message({
-		subject: createFeishuIngressSubject({
-			primaryId: params.senderOpenId,
-			alternateIds: [params.senderUserId]
-		}),
-		conversation: {
-			kind: "group",
-			id: params.chatId
-		},
-		dmPolicy: "disabled",
-		groupPolicy: groupAllowFrom.length > 0 ? "allowlist" : "open",
-		groupAllowFrom,
-		mentionFacts: {
-			canDetectMention: true,
-			wasMentioned: params.mentionedBot
-		},
-		policy: { activation: {
-			requireMention: params.requireMention,
-			allowTextCommands: false
-		} },
-		...params.command ? { command: params.command } : {}
-	});
-}
-function resolveFeishuGroupConfig(params) {
-	const groups = params.cfg?.groups ?? {};
-	const wildcard = groups["*"];
-	const groupId = params.groupId?.trim();
-	if (!groupId) return;
-	const direct = groups[groupId];
-	if (direct) return direct;
-	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
-	const matchKey = Object.keys(groups).find((key) => normalizeOptionalLowercaseString(key) === lowered);
-	if (matchKey) return groups[matchKey];
-	return wildcard;
-}
-function hasExplicitFeishuGroupConfig(params) {
-	const groups = params.cfg?.groups ?? {};
-	const groupId = params.groupId?.trim();
-	if (!groupId) return false;
-	if (Object.hasOwn(groups, groupId) && groupId !== "*") return true;
-	const lowered = normalizeOptionalLowercaseString(groupId) ?? "";
-	return Object.keys(groups).some((key) => key !== "*" && normalizeOptionalLowercaseString(key) === lowered);
-}
-function resolveFeishuGroupToolPolicy(params) {
-	const cfg = params.cfg.channels?.feishu;
-	if (!cfg) return;
-	return resolveFeishuGroupConfig({
-		cfg,
-		groupId: params.groupId
-	})?.tools;
+function isFeishuCardWithinEnvelope(card) {
+	try {
+		return Buffer.byteLength(JSON.stringify(card), "utf8") <= FEISHU_CARD_MAX_BYTES && countFeishuCardElements(card) <= FEISHU_CARD_MAX_ELEMENTS;
+	} catch {
+		return false;
+	}
 }
-function resolveFeishuReplyPolicy(params) {
-	if (params.isDirectMessage) return { requireMention: false };
-	const feishuCfg = params.cfg.channels?.feishu;
-	const resolvedCfg = resolveMergedAccountConfig({
-		channelConfig: feishuCfg,
-		accounts: feishuCfg?.accounts,
-		accountId: normalizeAccountId(params.accountId),
-		normalizeAccountId,
-		omitKeys: ["defaultAccount"]
-	});
-	const groupRequireMention = resolveFeishuGroupConfig({
-		cfg: resolvedCfg,
-		groupId: params.groupId
-	})?.requireMention;
-	return { requireMention: typeof groupRequireMention === "boolean" ? groupRequireMention : typeof resolvedCfg.requireMention === "boolean" ? resolvedCfg.requireMention : params.groupPolicy !== "open" };
+function assertFeishuCardWithinEnvelope(card, label = "Feishu card") {
+	if (!isFeishuCardWithinEnvelope(card)) throw new Error(`${label} exceeds the 30 KB or 200-element API limit.`);
 }
-//#endregion
-//#region extensions/feishu/src/presentation-card.ts
 function escapeFeishuCardMarkdownText(text) {
 	return text.replace(/[&<>]/g, (char) => {
 		switch (char) {
@@ -1117,11 +1049,13 @@ function resolveSafeFeishuButtonUrl(url) {
 	}
 }
 function resolveFeishuButtonUrl(button) {
+	if (button.action?.type === "url" || button.action?.type === "web-app") return button.action.url;
+	if (button.action) return;
 	return button.url ?? button.webApp?.url ?? button.web_app?.url;
 }
 function resolveFeishuCommandButtonValue(button) {
-	if (button.action?.type === "callback") return;
 	if (button.action?.type === "command") return button.action.command;
+	if (button.action) return;
 	return button.value;
 }
 function mapFeishuButtonType(style) {
@@ -1171,6 +1105,14 @@ function buildFeishuCardElementsForBlock(block) {
 	}];
 	if (block.type === "divider") return [{ tag: "hr" }];
 	if (block.type === "buttons") return block.buttons.map((button) => buildFeishuPayloadButton(button)).filter((button) => Boolean(button));
+	if (block.type === "chart") return [{
+		tag: "markdown",
+		content: escapeFeishuCardMarkdownText(renderMessagePresentationChartFallbackText(block))
+	}];
+	if (block.type === "table") return [{
+		tag: "markdown",
+		content: escapeFeishuCardMarkdownText(renderMessagePresentationTableFallbackText(block))
+	}];
 	const labels = block.options.map((option) => `- ${option.label}`).join("\n");
 	return [{
 		tag: "markdown",
@@ -1427,7 +1369,7 @@ function applyNewAppSecurityPolicy(cfg, accountId, openId, groupPolicy) {
 	next = patchFeishuConfig(next, accountId, groupPatch);
 	return next;
 }
-const loadAppRegistrationModule = createLazyRuntimeModule(() => import("./app-registration-BwQ-aGTe.js"));
+const loadAppRegistrationModule = createLazyRuntimeModule(() => import("./app-registration-BzkyrVZu.js"));
 async function promptFeishuDomain(params) {
 	return await params.prompter.select({
 		message: t("wizard.feishu.domainPrompt"),
@@ -1454,7 +1396,7 @@ async function promptFeishuSetupMethod(prompter) {
 		initialValue: "manual"
 	});
 }
-async function runScanToCreate(prompter, domain) {
+async function runScanToCreate(prompter, domain, beforePersistentEffect) {
 	const { beginAppRegistration, initAppRegistration, pollAppRegistration, printQrCode } = await loadAppRegistrationModule();
 	try {
 		await initAppRegistration(domain);
@@ -1462,6 +1404,7 @@ async function runScanToCreate(prompter, domain) {
 		await prompter.note(t("wizard.feishu.scanUnavailable"), t("wizard.feishu.setupTitle"));
 		return null;
 	}
+	await beforePersistentEffect?.();
 	const begin = await beginAppRegistration(domain);
 	await prompter.note(t("wizard.feishu.scanQr"), t("wizard.feishu.scanTitle"));
 	await printQrCode(begin.qrUrl);
@@ -1508,7 +1451,7 @@ async function runNewAppFlow(params) {
 		initialValue: currentDomain
 	});
 	scanDomain = selectedDomain;
-	const scanResult = setupMethod === "scan" ? await runScanToCreate(prompter, selectedDomain) : null;
+	const scanResult = setupMethod === "scan" ? await runScanToCreate(prompter, selectedDomain, options?.beforePersistentEffect) : null;
 	if (scanResult) {
 		appId = scanResult.appId;
 		appSecret = scanResult.appSecret;
@@ -1651,7 +1594,7 @@ const feishuSetupWizard = {
 			});
 			let probeResult = null;
 			if (configured && account.configured) try {
-				const { probeFeishu } = await import("./probe-Dxyo9zlw.js").then((n) => n.n);
+				const { probeFeishu } = await import("./probe-BgboTHIn.js").then((n) => n.n);
 				probeResult = await probeFeishu(account);
 			} catch {}
 			if (!configured) return [formatFeishuStatusLine("needs-credentials")];
@@ -1687,11 +1630,7 @@ const feishuSetupWizard = {
 		});
 	},
 	dmPolicy: feishuDmPolicy,
-	disable: (cfg) => patchTopLevelChannelConfigSection({
-		cfg,
-		channel,
-		patch: { enabled: false }
-	})
+	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
 };
 //#endregion
 //#region extensions/feishu/src/channel.ts
@@ -1727,7 +1666,7 @@ const meta = {
 	order: 70,
 	preferSessionLookupForAnnounceTarget: true
 };
-const loadFeishuChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-pvr-Y5ji.js"), "feishuChannelRuntime");
+const loadFeishuChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-By2uqa3Q.js"), "feishuChannelRuntime");
 function toFeishuMessageSendResult(result, kind) {
 	const receipt = result.receipt ?? createFeishuSendReceipt({
 		messageId: result.messageId,
@@ -1771,9 +1710,22 @@ const feishuMessageAdapter = defineChannelMessageAdapter({
 	}
 });
 async function createFeishuActionClient(account) {
-	const { createFeishuClient } = await import("./client-B7EAV_Ss.js").then((n) => n.t);
+	const { createFeishuClient } = await import("./client-87BmeMpj.js").then((n) => n.t);
 	return createFeishuClient(account);
 }
+async function resolveFeishuChatTypeById(params) {
+	const client = await createFeishuActionClient(params.account);
+	return resolveFeishuChatType(await params.runtime.getChatInfo(client, params.chatId));
+}
+async function resolveFeishuMessageChatType(params) {
+	const knownChatType = normalizeFeishuChatType(params.message.chatType);
+	if (knownChatType) return knownChatType;
+	return resolveFeishuChatTypeById({
+		account: params.account,
+		chatId: params.message.chatId,
+		runtime: params.runtime
+	});
+}
 const collectFeishuSecurityWarnings = createAllowlistProviderGroupPolicyWarningCollector({
 	providerConfigPresent: (cfg) => cfg.channels?.feishu !== void 0,
 	resolveGroupPolicy: ({ cfg, accountId }) => resolveFeishuAccount({
@@ -2017,6 +1969,119 @@ function resolveFeishuMessageId(params) {
 		"reply_to"
 	]);
 }
+function resolveFeishuMessageReadTarget(ctx) {
+	const explicitChatId = resolveFeishuChatId({ params: ctx.params });
+	const currentChatId = resolveFeishuChatId({
+		params: {},
+		toolContext: ctx.toolContext
+	});
+	const chatId = explicitChatId ?? currentChatId;
+	if (!chatId) return;
+	const normalizedChatId = normalizeFeishuTarget(chatId) ?? chatId.trim();
+	if (normalizedChatId !== (currentChatId ? normalizeFeishuTarget(currentChatId) ?? currentChatId.trim() : void 0)) return { chatId: normalizedChatId };
+	return {
+		chatId: normalizedChatId,
+		chatType: ctx.toolContext?.currentChatType === "direct" ? "p2p" : ctx.toolContext?.currentChatType === "group" || ctx.toolContext?.currentChatType === "channel" ? "group" : void 0
+	};
+}
+function assertFeishuMessageMatchesReadTarget(params) {
+	if ((normalizeFeishuTarget(params.messageChatId) ?? params.messageChatId.trim()) !== params.authorizedChatId) throw new ToolAuthorizationError("Feishu message target is not allowed.");
+}
+async function authorizeFeishuMessageReadTarget(params) {
+	const authorize = (chatType) => assertFeishuChatReadAllowed({
+		cfg: params.ctx.cfg,
+		account: params.account,
+		chatId: params.target.chatId,
+		chatType,
+		ctx: params.ctx
+	});
+	if (params.target.chatType) return authorize(params.target.chatType);
+	const preliminary = resolveFeishuChatReadPreliminaryAuthorization({
+		cfg: params.ctx.cfg,
+		account: params.account,
+		chatId: params.target.chatId,
+		ctx: params.ctx
+	});
+	if (preliminary.decision === "allow") return preliminary.chatId;
+	if (preliminary.decision === "deny") throw new ToolAuthorizationError("Feishu read target is not allowed.");
+	await getAuthorizedFeishuChatInfo({
+		ctx: params.ctx,
+		account: params.account,
+		runtime: params.runtime,
+		chatId: params.target.chatId
+	});
+	return preliminary.chatId;
+}
+async function getAuthorizedFeishuChatInfo(params) {
+	const preliminary = resolveFeishuChatReadPreliminaryAuthorization({
+		cfg: params.ctx.cfg,
+		account: params.account,
+		chatId: params.chatId,
+		ctx: params.ctx
+	});
+	if (preliminary.decision === "deny") throw new ToolAuthorizationError("Feishu read target is not allowed.");
+	const client = await createFeishuActionClient(params.account);
+	let chat;
+	try {
+		chat = await params.runtime.getChatInfo(client, preliminary.chatId);
+	} catch (error) {
+		if (preliminary.decision === "needs-metadata") assertFeishuChatReadAllowed({
+			cfg: params.ctx.cfg,
+			account: params.account,
+			chatId: preliminary.chatId,
+			ctx: params.ctx
+		});
+		throw error;
+	}
+	assertFeishuChatReadAllowed({
+		cfg: params.ctx.cfg,
+		account: params.account,
+		chatId: preliminary.chatId,
+		chatType: resolveFeishuChatType(chat),
+		ctx: params.ctx
+	});
+	return {
+		chat,
+		client
+	};
+}
+async function getAuthorizedFeishuMessage(params) {
+	const target = resolveFeishuMessageReadTarget(params.ctx);
+	if (!target && params.ctx.conversationReadOrigin !== "direct-operator") throw new ToolAuthorizationError("Feishu message reads require a chat target or current conversation.");
+	const authorizedChatId = target ? await authorizeFeishuMessageReadTarget({
+		ctx: params.ctx,
+		account: params.account,
+		runtime: params.runtime,
+		target
+	}) : void 0;
+	const message = await params.runtime.getMessageFeishu({
+		cfg: params.ctx.cfg,
+		messageId: params.messageId,
+		accountId: params.ctx.accountId ?? void 0
+	});
+	if (!message) return null;
+	if (authorizedChatId) assertFeishuMessageMatchesReadTarget({
+		authorizedChatId,
+		messageChatId: message.chatId
+	});
+	assertFeishuChatReadAllowed({
+		cfg: params.ctx.cfg,
+		account: params.account,
+		chatId: message.chatId,
+		chatType: await resolveFeishuMessageChatType({
+			account: params.account,
+			message,
+			runtime: params.runtime
+		}),
+		ctx: params.ctx
+	});
+	return message;
+}
+async function requireAuthorizedFeishuMessage(params) {
+	const message = await getAuthorizedFeishuMessage(params);
+	if (!message) throw new Error(`Feishu message not found: ${params.messageId}`);
+	return message;
+}
 function resolveFeishuMemberId(params) {
 	return readFirstString(params, [
 		"memberId",
@@ -2030,6 +2095,9 @@ function resolveFeishuMemberId(params) {
 	]);
 }
 function resolveFeishuMemberIdType(params) {
+	return resolveRequestedFeishuMemberIdType(params) ?? "open_id";
+}
+function resolveRequestedFeishuMemberIdType(params) {
 	const raw = readFirstString(params, [
 		"memberIdType",
 		"member_id_type",
@@ -2044,7 +2112,7 @@ function resolveFeishuMemberIdType(params) {
 		"union_id"
 	])) return "user_id";
 	if (readFirstString(params, ["unionId", "union_id"]) && !readFirstString(params, ["openId", "open_id"])) return "union_id";
-	return "open_id";
+	if (readFirstString(params, ["openId", "open_id"])) return "open_id";
 }
 const feishuPlugin = createChatChannelPlugin({
 	base: {
@@ -2076,7 +2144,7 @@ const feishuPlugin = createChatChannelPlugin({
 		mentions: { stripPatterns: () => ["<at user_id=\"[^\"]*\">[^<]*</at>"] },
 		reload: { configPrefixes: ["channels.feishu"] },
 		doctor: feishuDoctor,
-		configSchema: buildChannelConfigSchema(FeishuConfigSchema),
+		configSchema: FeishuChannelConfigSchema,
 		config: {
 			...feishuConfigAdapter,
 			setAccountEnabled: ({ cfg, accountId, enabled }) => {
@@ -2153,21 +2221,44 @@ const feishuPlugin = createChatChannelPlugin({
 					const presentation = normalizeMessagePresentation(ctx.params.presentation) ?? (interactive ? interactiveReplyToPresentation(interactive) : void 0);
 					const mediaUrl = readFeishuMediaParam(ctx.params);
 					const audioAsVoice = readBooleanParam(ctx.params, ["asVoice", "audioAsVoice"]);
-					const card = presentation ? buildFeishuPresentationCard({
+					if (textCard && !presentation) assertFeishuCardWithinEnvelope(textCard, "Feishu native card");
+					const generatedCard = presentation ? buildFeishuPresentationCard({
 						presentation,
 						fallbackText: textCard ? void 0 : resolveInteractiveTextFallback({
 							text,
 							interactive
 						})
-					}) : textCard;
+					}) : void 0;
+					const presentationCard = generatedCard && isFeishuCardWithinEnvelope(generatedCard) ? generatedCard : void 0;
+					const presentationFellBack = Boolean(generatedCard && !presentationCard);
+					const card = presentation ? presentationCard : textCard;
 					if (card && mediaUrl) throw new Error(`Feishu ${ctx.action} does not support card with media.`);
-					if (!card && !text && !mediaUrl) throw new Error(`Feishu ${ctx.action} requires text/message, media, or card.`);
+					if (!card && !text && !mediaUrl && !presentationFellBack) throw new Error(`Feishu ${ctx.action} requires text/message, media, or card.`);
 					const runtime = await loadFeishuChannelRuntime();
 					const maybeSendMedia = runtime.feishuOutbound.sendMedia;
 					if (mediaUrl && !maybeSendMedia) throw new Error("Feishu media sending is not available.");
 					const sendMedia = maybeSendMedia;
 					let result;
-					if (card) {
+					if (presentationFellBack && presentation) {
+						const sendPayload = runtime.feishuOutbound.sendPayload;
+						if (!sendPayload) throw new Error("Feishu presentation fallback delivery is not available.");
+						const fallbackText = textCard ? void 0 : text;
+						result = await sendPayload({
+							cfg: ctx.cfg,
+							to,
+							text: fallbackText ?? "",
+							payload: {
+								text: fallbackText,
+								presentation,
+								...mediaUrl ? { mediaUrl } : {},
+								...audioAsVoice === void 0 ? {} : { audioAsVoice }
+							},
+							accountId: ctx.accountId ?? void 0,
+							mediaLocalRoots: ctx.mediaLocalRoots,
+							...replyInThread ? { threadId: replyToMessageId } : { replyToId: replyToMessageId },
+							...audioAsVoice === void 0 ? {} : { audioAsVoice }
+						});
+					} else if (card) {
 						if (containsLegacyFeishuCardCommandValue(card)) throw new Error("Feishu card buttons that trigger text or commands must use structured interaction envelopes.");
 						result = await runtime.sendCardFeishu({
 							cfg: ctx.cfg,
@@ -2205,11 +2296,11 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "read") {
 					const messageId = resolveFeishuMessageId(ctx.params);
 					if (!messageId) throw new Error("Feishu read requires messageId.");
-					const { getMessageFeishu } = await loadFeishuChannelRuntime();
-					const message = await getMessageFeishu({
-						cfg: ctx.cfg,
-						messageId,
-						accountId: ctx.accountId ?? void 0
+					const message = await getAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime: await loadFeishuChannelRuntime(),
+						messageId
 					});
 					if (!message) return {
 						isError: true,
@@ -2231,12 +2322,18 @@ const feishuPlugin = createChatChannelPlugin({
 					if (!messageId) throw new Error("Feishu edit requires messageId.");
 					const text = readFirstString(ctx.params, ["text", "message"]);
 					const card = ctx.params.card && typeof ctx.params.card === "object" ? ctx.params.card : void 0;
-					const { editMessageFeishu } = await loadFeishuChannelRuntime();
+					const runtime = await loadFeishuChannelRuntime();
+					await requireAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime,
+						messageId
+					});
 					return jsonActionResult({
 						ok: true,
 						channel: "feishu",
 						action: "edit",
-						...await editMessageFeishu({
+						...await runtime.editMessageFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							text,
@@ -2248,12 +2345,18 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "pin") {
 					const messageId = resolveFeishuMessageId(ctx.params);
 					if (!messageId) throw new Error("Feishu pin requires messageId.");
-					const { createPinFeishu } = await loadFeishuChannelRuntime();
+					const runtime = await loadFeishuChannelRuntime();
+					await requireAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime,
+						messageId
+					});
 					return jsonActionResult({
 						ok: true,
 						channel: "feishu",
 						action: "pin",
-						pin: await createPinFeishu({
+						pin: await runtime.createPinFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							accountId: ctx.accountId ?? void 0
@@ -2263,8 +2366,14 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "unpin") {
 					const messageId = resolveFeishuMessageId(ctx.params);
 					if (!messageId) throw new Error("Feishu unpin requires messageId.");
-					const { removePinFeishu } = await loadFeishuChannelRuntime();
-					await removePinFeishu({
+					const runtime = await loadFeishuChannelRuntime();
+					await requireAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime,
+						messageId
+					});
+					await runtime.removePinFeishu({
 						cfg: ctx.cfg,
 						messageId,
 						accountId: ctx.accountId ?? void 0
@@ -2279,7 +2388,14 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "list-pins") {
 					const chatId = resolveFeishuChatId(ctx);
 					if (!chatId) throw new Error("Feishu list-pins requires chatId or channelId.");
-					const { listPinsFeishu } = await loadFeishuChannelRuntime();
+					const runtime = await loadFeishuChannelRuntime();
+					await getAuthorizedFeishuChatInfo({
+						ctx,
+						account,
+						runtime,
+						chatId
+					});
+					const { listPinsFeishu } = runtime;
 					return jsonActionResult({
 						ok: true,
 						channel: "feishu",
@@ -2299,39 +2415,97 @@ const feishuPlugin = createChatChannelPlugin({
 					const chatId = resolveFeishuChatId(ctx);
 					if (!chatId) throw new Error("Feishu channel-info requires chatId or channelId.");
 					const runtime = await loadFeishuChannelRuntime();
-					const client = await createFeishuActionClient(account);
-					const channel = await runtime.getChatInfo(client, chatId);
+					const { chat: channel, client } = await getAuthorizedFeishuChatInfo({
+						ctx,
+						account,
+						runtime,
+						chatId
+					});
+					const chatType = resolveFeishuChatType(channel);
 					if (!(ctx.params.includeMembers === true || ctx.params.members === true)) return jsonActionResult({
 						ok: true,
 						provider: "feishu",
 						action: "channel-info",
 						channel
 					});
+					const requestedMemberIdType = resolveRequestedFeishuMemberIdType(ctx.params);
+					const authorization = authorizeFeishuChatMemberRead({
+						cfg: ctx.cfg,
+						account,
+						chatId,
+						chatType,
+						ctx,
+						memberIdType: requestedMemberIdType
+					});
 					return jsonActionResult({
 						ok: true,
 						provider: "feishu",
 						action: "channel-info",
 						channel,
-						members: await runtime.getChatMembers(client, chatId, readOptionalPositiveInteger(ctx.params, ["pageSize", "page_size"]), readFirstString(ctx.params, ["pageToken", "page_token"]), resolveFeishuMemberIdType(ctx.params))
+						members: authorization.kind === "direct" ? runtime.buildFeishuDirectChatMembers(authorization) : await runtime.getChatMembers(client, chatId, readOptionalPositiveInteger(ctx.params, ["pageSize", "page_size"]), readFirstString(ctx.params, ["pageToken", "page_token"]), resolveFeishuMemberIdType(ctx.params))
 					});
 				}
 				if (ctx.action === "member-info") {
 					const runtime = await loadFeishuChannelRuntime();
-					const client = await createFeishuActionClient(account);
 					const memberId = resolveFeishuMemberId(ctx.params);
-					if (memberId) return jsonActionResult({
-						ok: true,
-						channel: "feishu",
-						action: "member-info",
-						member: await runtime.getFeishuMemberInfo(client, memberId, resolveFeishuMemberIdType(ctx.params))
-					});
+					if (memberId) {
+						const chatId = resolveFeishuChatId(ctx);
+						if (!chatId) throw new Error("Feishu member-info requires chatId or channelId when memberId is provided.");
+						const { chat, client } = await getAuthorizedFeishuChatInfo({
+							ctx,
+							account,
+							runtime,
+							chatId
+						});
+						const requestedMemberIdType = resolveRequestedFeishuMemberIdType(ctx.params);
+						const memberIdType = resolveFeishuMemberIdType(ctx.params);
+						const authorization = authorizeFeishuChatMemberRead({
+							cfg: ctx.cfg,
+							account,
+							chatId,
+							chatType: resolveFeishuChatType(chat),
+							ctx,
+							memberId,
+							memberIdType: requestedMemberIdType
+						});
+						if (authorization.kind === "group") {
+							await runtime.assertFeishuChatMember(client, chatId, memberId, memberIdType);
+							return jsonActionResult({
+								ok: true,
+								channel: "feishu",
+								action: "member-info",
+								member: await runtime.getFeishuMemberInfo(client, memberId, memberIdType)
+							});
+						}
+						return jsonActionResult({
+							ok: true,
+							channel: "feishu",
+							action: "member-info",
+							member: await runtime.getFeishuMemberInfo(client, authorization.memberId, authorization.memberIdType)
+						});
+					}
 					const chatId = resolveFeishuChatId(ctx);
 					if (!chatId) throw new Error("Feishu member-info requires memberId or chatId/channelId.");
+					const { chat, client } = await getAuthorizedFeishuChatInfo({
+						ctx,
+						account,
+						runtime,
+						chatId
+					});
+					const requestedMemberIdType = resolveRequestedFeishuMemberIdType(ctx.params);
+					const authorization = authorizeFeishuChatMemberRead({
+						cfg: ctx.cfg,
+						account,
+						chatId,
+						chatType: resolveFeishuChatType(chat),
+						ctx,
+						memberIdType: requestedMemberIdType
+					});
 					return jsonActionResult({
 						ok: true,
 						channel: "feishu",
 						action: "member-info",
-						...await runtime.getChatMembers(client, chatId, readOptionalPositiveInteger(ctx.params, ["pageSize", "page_size"]), readFirstString(ctx.params, ["pageToken", "page_token"]), resolveFeishuMemberIdType(ctx.params))
+						...authorization.kind === "direct" ? runtime.buildFeishuDirectChatMembers(authorization) : await runtime.getChatMembers(client, chatId, readOptionalPositiveInteger(ctx.params, ["pageSize", "page_size"]), readFirstString(ctx.params, ["pageToken", "page_token"]), resolveFeishuMemberIdType(ctx.params))
 					});
 				}
 				if (ctx.action === "channel-list") {
@@ -2339,43 +2513,33 @@ const feishuPlugin = createChatChannelPlugin({
 					const query = readFirstString(ctx.params, ["query"]);
 					const limit = readOptionalPositiveInteger(ctx.params, ["limit"]);
 					const scope = readFirstString(ctx.params, ["scope", "kind"]) ?? "all";
+					const directOperator = ctx.conversationReadOrigin === "direct-operator";
+					const listGroups = directOperator || canEnumerateAllFeishuGroups(ctx.cfg, account) ? runtime.listFeishuDirectoryGroupsLive : listAuthorizedFeishuDirectoryGroups;
+					const listPeers = directOperator || canEnumerateAllFeishuPeers(account) ? runtime.listFeishuDirectoryPeersLive : listAuthorizedFeishuDirectoryPeers;
+					const directoryParams = {
+						cfg: ctx.cfg,
+						query,
+						limit,
+						accountId: ctx.accountId ?? void 0,
+						fallbackToStatic: false
+					};
+					const groupDirectoryParams = {
+						...directoryParams,
+						filter: directOperator ? (group) => isFeishuGroupReadEnabled(ctx.cfg, account, group.id) : canEnumerateAllFeishuGroups(ctx.cfg, account) ? (group) => isFeishuGroupReadAllowed(ctx.cfg, account, group.id, false) : void 0
+					};
 					if (scope === "groups" || scope === "group" || scope === "channels" || scope === "channel") return jsonActionResult({
 						ok: true,
 						channel: "feishu",
 						action: "channel-list",
-						groups: await runtime.listFeishuDirectoryGroupsLive({
-							cfg: ctx.cfg,
-							query,
-							limit,
-							fallbackToStatic: false,
-							accountId: ctx.accountId ?? void 0
-						})
+						groups: await listGroups(groupDirectoryParams)
 					});
 					if (scope === "peers" || scope === "peer" || scope === "members" || scope === "member" || scope === "users" || scope === "user") return jsonActionResult({
 						ok: true,
 						channel: "feishu",
 						action: "channel-list",
-						peers: await runtime.listFeishuDirectoryPeersLive({
-							cfg: ctx.cfg,
-							query,
-							limit,
-							fallbackToStatic: false,
-							accountId: ctx.accountId ?? void 0
-						})
+						peers: await listPeers(directoryParams)
 					});
-					const [groups, peers] = await Promise.all([runtime.listFeishuDirectoryGroupsLive({
-						cfg: ctx.cfg,
-						query,
-						limit,
-						fallbackToStatic: false,
-						accountId: ctx.accountId ?? void 0
-					}), runtime.listFeishuDirectoryPeersLive({
-						cfg: ctx.cfg,
-						query,
-						limit,
-						fallbackToStatic: false,
-						accountId: ctx.accountId ?? void 0
-					})]);
+					const [groups, peers] = await Promise.all([listGroups(groupDirectoryParams), listPeers(directoryParams)]);
 					return jsonActionResult({
 						ok: true,
 						channel: "feishu",
@@ -2392,18 +2556,24 @@ const feishuPlugin = createChatChannelPlugin({
 					const clearAll = ctx.params.clearAll === true;
 					if (remove) {
 						if (!emoji) throw new Error("Emoji is required to remove a Feishu reaction.");
-						const { listReactionsFeishu, removeReactionFeishu } = await loadFeishuChannelRuntime();
-						const ownReaction = (await listReactionsFeishu({
+						const runtime = await loadFeishuChannelRuntime();
+						await requireAuthorizedFeishuMessage({
+							ctx,
+							account,
+							runtime,
+							messageId
+						});
+						const ownReaction = (await runtime.listReactionsFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							emojiType: emoji,
 							accountId: ctx.accountId ?? void 0
-						})).find((entry) => entry.operatorType === "app");
+						})).find((entry) => entry.operatorType === "app" && Boolean(account.appId) && entry.operatorId === account.appId);
 						if (!ownReaction) return jsonActionResult({
 							ok: true,
 							removed: null
 						});
-						await removeReactionFeishu({
+						await runtime.removeReactionFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							reactionId: ownReaction.reactionId,
@@ -2416,15 +2586,22 @@ const feishuPlugin = createChatChannelPlugin({
 					}
 					if (!emoji) {
 						if (!clearAll) throw new Error("Emoji is required to add a Feishu reaction. Set clearAll=true to remove all bot reactions.");
-						const { listReactionsFeishu, removeReactionFeishu } = await loadFeishuChannelRuntime();
-						const reactions = await listReactionsFeishu({
+						const runtime = await loadFeishuChannelRuntime();
+						await requireAuthorizedFeishuMessage({
+							ctx,
+							account,
+							runtime,
+							messageId
+						});
+						const reactions = await runtime.listReactionsFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							accountId: ctx.accountId ?? void 0
 						});
 						let removed = 0;
-						for (const reaction of reactions.filter((entry) => entry.operatorType === "app")) {
-							await removeReactionFeishu({
+						const ownReactions = reactions.filter((entry) => entry.operatorType === "app" && Boolean(account.appId) && entry.operatorId === account.appId);
+						for (const reaction of ownReactions) {
+							await runtime.removeReactionFeishu({
 								cfg: ctx.cfg,
 								messageId,
 								reactionId: reaction.reactionId,
@@ -2437,8 +2614,14 @@ const feishuPlugin = createChatChannelPlugin({
 							removed
 						});
 					}
-					const { addReactionFeishu } = await loadFeishuChannelRuntime();
-					await addReactionFeishu({
+					const runtime = await loadFeishuChannelRuntime();
+					await requireAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime,
+						messageId
+					});
+					await runtime.addReactionFeishu({
 						cfg: ctx.cfg,
 						messageId,
 						emojiType: emoji,
@@ -2452,10 +2635,16 @@ const feishuPlugin = createChatChannelPlugin({
 				if (ctx.action === "reactions") {
 					const messageId = resolveFeishuMessageId(ctx.params);
 					if (!messageId) throw new Error("Feishu reactions lookup requires messageId.");
-					const { listReactionsFeishu } = await loadFeishuChannelRuntime();
+					const runtime = await loadFeishuChannelRuntime();
+					await requireAuthorizedFeishuMessage({
+						ctx,
+						account,
+						runtime,
+						messageId
+					});
 					return jsonActionResult({
 						ok: true,
-						reactions: await listReactionsFeishu({
+						reactions: await runtime.listReactionsFeishu({
 							cfg: ctx.cfg,
 							messageId,
 							accountId: ctx.accountId ?? void 0
@@ -2513,10 +2702,7 @@ const feishuPlugin = createChatChannelPlugin({
 				};
 				return { to: `chat:${parsed?.chatId ?? conversationId.trim()}` };
 			},
-			resolveSessionConversation: ({ kind, rawId }) => resolveFeishuSessionConversation({
-				kind,
-				rawId
-			}),
+			resolveSessionConversation: resolveFeishuSessionConversation,
 			resolveOutboundSessionRoute: (params) => resolveFeishuOutboundSessionRoute(params),
 			targetResolver: {
 				looksLikeId: looksLikeFeishuId,
@@ -2569,7 +2755,7 @@ const feishuPlugin = createChatChannelPlugin({
 			})
 		}),
 		gateway: { startAccount: async (ctx) => {
-			const { monitorFeishuProvider } = await import("./monitor-CsbheK9J.js");
+			const { monitorFeishuProvider } = await import("./monitor-CHl0bWzb.js");
 			const account = resolveFeishuRuntimeAccount({
 				cfg: ctx.cfg,
 				accountId: ctx.accountId
@@ -2613,9 +2799,16 @@ const feishuPlugin = createChatChannelPlugin({
 			});
 		}
 	} },
+	threading: { buildToolContext: ({ context, hasRepliedRef }) => ({
+		currentChannelId: normalizeOptionalString(context.NativeChannelId) ?? normalizeOptionalString(context.To),
+		currentChatType: context.ChatType === "direct" || context.ChatType === "group" || context.ChatType === "channel" ? context.ChatType : void 0,
+		currentMessagingTarget: normalizeOptionalString(context.To),
+		currentThreadTs: context.MessageThreadId != null ? String(context.MessageThreadId) : void 0,
+		hasRepliedRef
+	}) },
 	outbound: {
 		deliveryMode: "direct",
-		chunker: chunkTextForOutbound,
+		chunker: chunkFeishuMarkdown,
 		chunkerMode: "markdown",
 		textChunkLimit: 4e3,
 		sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text),
@@ -2656,4 +2849,4 @@ const feishuPlugin = createChatChannelPlugin({
 	}
 });
 //#endregion
-export { setFeishuNamedAccountEnabled$1 as a, normalizeFeishuAllowEntry as c, resolveFeishuGroupConversationIngressAccess as d, resolveFeishuGroupSenderActivationIngressAccess as f, listFeishuDirectoryPeers as h, feishuSetupAdapter as i, resolveFeishuDmIngressAccess as l, listFeishuDirectoryGroups as m, feishuSetupWizard as n, buildFeishuPresentationCardElements as o, resolveFeishuReplyPolicy as p, runFeishuLogin as r, hasExplicitFeishuGroupConfig as s, feishuPlugin as t, resolveFeishuGroupConfig as u };
+export { setFeishuNamedAccountEnabled$1 as a, isFeishuCardWithinEnvelope as c, feishuSetupAdapter as i, listFeishuDirectoryGroups as l, feishuSetupWizard as n, assertFeishuCardWithinEnvelope as o, runFeishuLogin as r, buildFeishuPresentationCardElements as s, feishuPlugin as t, listFeishuDirectoryPeers as u };