@openclaw/feishu 2026.7.2-beta.4 → 2026.7.2-beta.7

package/dist/monitor.startup-CqH2tiJq.js

@@ -0,0 +1,143 @@
+import { t as getFeishuRuntime } from "./runtime-C5JxBWZp.js";
+import { r as registerFeishuAiAgent, t as probeFeishu } from "./probe-p3POS2RN.js";
+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { normalizeAccountId } from "openclaw/plugin-sdk/account-resolution";
+//#region extensions/feishu/src/bot-identity-cache.ts
+const FEISHU_BOT_IDENTITY_CACHE_NAMESPACE = "feishu.bot-identity-cache";
+const FEISHU_BOT_IDENTITY_CACHE_MAX_ENTRIES = 128;
+function openFeishuBotIdentityCache() {
+	return getFeishuRuntime().state.openKeyedStore({
+		namespace: FEISHU_BOT_IDENTITY_CACHE_NAMESPACE,
+		maxEntries: FEISHU_BOT_IDENTITY_CACHE_MAX_ENTRIES
+	});
+}
+function parseCachedFeishuBotIdentity(value) {
+	if (!value || typeof value !== "object") return null;
+	const state = value;
+	const appId = normalizeOptionalString(state.appId);
+	const botOpenId = normalizeOptionalString(state.botOpenId);
+	const botName = normalizeOptionalString(state.botName);
+	const fetchedAt = normalizeOptionalString(state.fetchedAt);
+	if (!appId || !botOpenId || !fetchedAt || Number.isNaN(Date.parse(fetchedAt))) return null;
+	return {
+		appId,
+		botOpenId,
+		botName,
+		fetchedAt
+	};
+}
+async function readCachedFeishuBotIdentity(params) {
+	const appId = normalizeOptionalString(params.appId);
+	if (!appId) return null;
+	const cached = parseCachedFeishuBotIdentity(await openFeishuBotIdentityCache().lookup(normalizeAccountId(params.accountId)));
+	if (!cached || cached.appId !== appId) return null;
+	return {
+		botOpenId: cached.botOpenId,
+		botName: cached.botName,
+		fetchedAt: cached.fetchedAt
+	};
+}
+async function writeCachedFeishuBotIdentity(params) {
+	const appId = normalizeOptionalString(params.appId);
+	const botOpenId = normalizeOptionalString(params.botOpenId);
+	if (!appId || !botOpenId) return;
+	const botName = normalizeOptionalString(params.botName);
+	await openFeishuBotIdentityCache().register(normalizeAccountId(params.accountId), {
+		appId,
+		botOpenId,
+		botName,
+		fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+//#endregion
+//#region extensions/feishu/src/monitor-startup-timeout.ts
+const FEISHU_STARTUP_BOT_INFO_TIMEOUT_DEFAULT_MS = 3e4;
+const FEISHU_STARTUP_BOT_INFO_TIMEOUT_ENV = "OPENCLAW_FEISHU_STARTUP_PROBE_TIMEOUT_MS";
+function resolveStartupProbeTimeoutMs(env = process.env) {
+	const raw = env[FEISHU_STARTUP_BOT_INFO_TIMEOUT_ENV];
+	if (raw) {
+		const parsed = parseStrictPositiveInteger(raw);
+		if (parsed !== void 0) return parsed;
+		console.warn(`[feishu] ${FEISHU_STARTUP_BOT_INFO_TIMEOUT_ENV}="${raw}" is invalid; using default ${FEISHU_STARTUP_BOT_INFO_TIMEOUT_DEFAULT_MS}ms`);
+	}
+	return FEISHU_STARTUP_BOT_INFO_TIMEOUT_DEFAULT_MS;
+}
+//#endregion
+//#region extensions/feishu/src/monitor.startup.ts
+const FEISHU_STARTUP_BOT_INFO_TIMEOUT_MS = resolveStartupProbeTimeoutMs();
+function isTimeoutErrorMessage(message) {
+	const lower = normalizeLowercaseStringOrEmpty(message);
+	return lower.includes("timeout") || lower.includes("timed out");
+}
+function isAbortErrorMessage(message) {
+	return normalizeLowercaseStringOrEmpty(message).includes("aborted");
+}
+async function writeProviderBotIdentityCache(params) {
+	try {
+		await writeCachedFeishuBotIdentity({
+			accountId: params.account.accountId,
+			appId: params.account.appId,
+			botOpenId: params.botOpenId,
+			botName: params.botName
+		});
+	} catch {
+		params.runtime?.log?.(`feishu[${params.account.accountId}]: bot identity cache write failed; continuing startup`);
+	}
+}
+async function readProviderBotIdentityCache(params) {
+	try {
+		const cached = await readCachedFeishuBotIdentity({
+			accountId: params.account.accountId,
+			appId: params.account.appId
+		});
+		if (!cached) return {};
+		params.runtime?.log?.(`feishu[${params.account.accountId}]: using cached provider-verified bot identity while the fresh probe is unavailable`);
+		return {
+			botOpenId: cached.botOpenId,
+			botName: cached.botName,
+			source: "cache"
+		};
+	} catch {
+		params.runtime?.log?.(`feishu[${params.account.accountId}]: bot identity cache read failed; continuing without cached identity`);
+		return {};
+	}
+}
+async function fetchBotIdentityForMonitor(account, options = {}) {
+	if (options.abortSignal?.aborted) return {};
+	const timeoutMs = options.timeoutMs ?? FEISHU_STARTUP_BOT_INFO_TIMEOUT_MS;
+	const result = await probeFeishu(account, {
+		timeoutMs,
+		abortSignal: options.abortSignal
+	});
+	const resultAppId = normalizeOptionalString(result.appId);
+	if (result.ok && resultAppId === account.appId) {
+		registerFeishuAiAgent(account, { abortSignal: options.abortSignal }).then((registration) => {
+			if (!registration.ok && registration.reason !== "aborted") (options.runtime?.log ?? console.log)(`feishu[${account.accountId}]: AI-agent registration unavailable (${registration.reason}); continuing with standard bot identity`);
+		}).catch(() => {
+			(options.runtime?.log ?? console.log)(`feishu[${account.accountId}]: AI-agent registration failed unexpectedly; continuing with standard bot identity`);
+		});
+		await writeProviderBotIdentityCache({
+			account,
+			botOpenId: result.botOpenId,
+			botName: result.botName,
+			runtime: options.runtime
+		});
+		return {
+			botOpenId: normalizeOptionalString(result.botOpenId),
+			botName: normalizeOptionalString(result.botName),
+			source: "provider"
+		};
+	}
+	if (result.ok) (options.runtime?.log ?? console.log)(`feishu[${account.accountId}]: bot info probe returned identity for a different app; ignoring stale result`);
+	const probeError = result.error ?? void 0;
+	if (options.abortSignal?.aborted || isAbortErrorMessage(probeError)) return {};
+	if (isTimeoutErrorMessage(probeError)) (options.runtime?.error ?? console.error)(`feishu[${account.accountId}]: bot info probe timed out after ${timeoutMs}ms; continuing startup`);
+	if (options.allowCachedFallback === false) return {};
+	return readProviderBotIdentityCache({
+		account,
+		runtime: options.runtime
+	});
+}
+//#endregion
+export { fetchBotIdentityForMonitor as t };

package/dist/probe-p3POS2RN.js

@@ -0,0 +1,219 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
+import { r as createFeishuClient } from "./client-Dcbs6vml.js";
+import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { createHash } from "node:crypto";
+//#region extensions/feishu/src/async.ts
+const RACE_TIMEOUT = Symbol("race-timeout");
+const RACE_ABORT = Symbol("race-abort");
+async function raceWithTimeoutAndAbort(promise, options = {}) {
+	if (options.abortSignal?.aborted) return { status: "aborted" };
+	if (options.timeoutMs === void 0 && !options.abortSignal) return {
+		status: "resolved",
+		value: await promise
+	};
+	let timeoutHandle;
+	let abortHandler;
+	const contenders = [promise];
+	if (options.timeoutMs !== void 0) {
+		const timeoutMs = resolveTimerTimeoutMs(options.timeoutMs, 1);
+		contenders.push(new Promise((resolve) => {
+			timeoutHandle = setTimeout(() => resolve(RACE_TIMEOUT), timeoutMs);
+		}));
+	}
+	if (options.abortSignal) contenders.push(new Promise((resolve) => {
+		abortHandler = () => resolve(RACE_ABORT);
+		options.abortSignal?.addEventListener("abort", abortHandler, { once: true });
+	}));
+	try {
+		const result = await Promise.race(contenders);
+		if (result === RACE_TIMEOUT) return { status: "timeout" };
+		if (result === RACE_ABORT) return { status: "aborted" };
+		return {
+			status: "resolved",
+			value: result
+		};
+	} finally {
+		if (timeoutHandle) clearTimeout(timeoutHandle);
+		if (abortHandler) options.abortSignal?.removeEventListener("abort", abortHandler);
+	}
+}
+function waitForAbortableDelay(delayMs, abortSignal) {
+	if (abortSignal?.aborted) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		let settled = false;
+		let timer = void 0;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			if (handleAbort) abortSignal?.removeEventListener("abort", handleAbort);
+			resolve(value);
+		};
+		const handleAbort = () => {
+			finish(false);
+		};
+		abortSignal?.addEventListener("abort", handleAbort, { once: true });
+		if (abortSignal?.aborted) {
+			finish(false);
+			return;
+		}
+		timer = setTimeout(() => finish(true), resolveTimerTimeoutMs(delayMs, 1));
+		timer.unref?.();
+	});
+}
+//#endregion
+//#region extensions/feishu/src/probe.ts
+var probe_exports = /* @__PURE__ */ __exportAll({
+	probeFeishu: () => probeFeishu,
+	registerFeishuAiAgent: () => registerFeishuAiAgent
+});
+/** Cache probe results to reduce repeated health-check calls.
+* Gateway health checks call probeFeishu() every minute; without caching this
+* burns ~43,200 calls/month, easily exceeding Feishu's free-tier quota.
+* Successful bot info is effectively static, while failures are cached briefly
+* to avoid hammering the API during transient outages. */
+const probeCache = /* @__PURE__ */ new Map();
+const PROBE_SUCCESS_TTL_MS = 600 * 1e3;
+const PROBE_ERROR_TTL_MS = 60 * 1e3;
+const MAX_PROBE_CACHE_SIZE = 64;
+const FEISHU_PROBE_REQUEST_TIMEOUT_MS = 1e4;
+function buildProbeCacheKey(creds) {
+	const identity = [
+		creds.accountId ?? null,
+		creds.appId,
+		creds.appSecret,
+		creds.domain ?? null
+	];
+	return createHash("sha256").update(JSON.stringify(identity)).digest("hex");
+}
+function setCachedProbeResult(cacheKey, result, ttlMs) {
+	const expiresAt = resolveExpiresAtMsFromDurationMs(ttlMs);
+	if (expiresAt === void 0) {
+		probeCache.delete(cacheKey);
+		return result;
+	}
+	probeCache.set(cacheKey, {
+		result,
+		expiresAt
+	});
+	if (probeCache.size > MAX_PROBE_CACHE_SIZE) {
+		const oldest = probeCache.keys().next().value;
+		if (oldest !== void 0) probeCache.delete(oldest);
+	}
+	return result;
+}
+async function probeFeishu(creds, options = {}) {
+	if (!creds?.appId || !creds?.appSecret) return {
+		ok: false,
+		error: "missing credentials (appId, appSecret)"
+	};
+	if (options.abortSignal?.aborted) return {
+		ok: false,
+		appId: creds.appId,
+		error: "probe aborted"
+	};
+	const timeoutMs = options.timeoutMs ?? FEISHU_PROBE_REQUEST_TIMEOUT_MS;
+	const cacheKey = buildProbeCacheKey(creds);
+	const cached = probeCache.get(cacheKey);
+	if (cached) {
+		const now = asDateTimestampMs(Date.now());
+		const expiresAt = asDateTimestampMs(cached.expiresAt);
+		if (now !== void 0 && expiresAt !== void 0 && expiresAt > now) return cached.result;
+		probeCache.delete(cacheKey);
+	}
+	try {
+		const responseResult = await raceWithTimeoutAndAbort(createFeishuClient(creds).request({
+			method: "GET",
+			url: "/open-apis/bot/v3/info",
+			timeout: timeoutMs
+		}), {
+			timeoutMs,
+			abortSignal: options.abortSignal
+		});
+		if (responseResult.status === "aborted") return {
+			ok: false,
+			appId: creds.appId,
+			error: "probe aborted"
+		};
+		if (responseResult.status === "timeout") return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: `probe timed out after ${timeoutMs}ms`
+		}, PROBE_ERROR_TTL_MS);
+		const response = responseResult.value;
+		if (options.abortSignal?.aborted) return {
+			ok: false,
+			appId: creds.appId,
+			error: "probe aborted"
+		};
+		if (response.code !== 0) return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: `API error: ${response.msg || `code ${response.code}`}`
+		}, PROBE_ERROR_TTL_MS);
+		const botInfo = response.bot ?? response.data?.bot;
+		if (!botInfo?.open_id) return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: "API response missing bot open_id"
+		}, PROBE_ERROR_TTL_MS);
+		return setCachedProbeResult(cacheKey, {
+			ok: true,
+			appId: creds.appId,
+			botName: botInfo.app_name,
+			botOpenId: botInfo.open_id
+		}, PROBE_SUCCESS_TTL_MS);
+	} catch (err) {
+		return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: formatErrorMessage(err)
+		}, PROBE_ERROR_TTL_MS);
+	}
+}
+/**
+* Preserve Feishu's optional AI-agent registration without coupling it to health or
+* identity. Monitor startup calls this once per account and never awaits it.
+*/
+async function registerFeishuAiAgent(creds, options = {}) {
+	if (!creds?.appId || !creds?.appSecret) return {
+		ok: false,
+		reason: "missing-credentials"
+	};
+	if (options.abortSignal?.aborted) return {
+		ok: false,
+		reason: "aborted"
+	};
+	const timeoutMs = options.timeoutMs ?? FEISHU_PROBE_REQUEST_TIMEOUT_MS;
+	try {
+		const responseResult = await raceWithTimeoutAndAbort(createFeishuClient(creds).request({
+			method: "POST",
+			url: "/open-apis/bot/v1/openclaw_bot/ping",
+			data: { needBotInfo: true },
+			timeout: timeoutMs
+		}), {
+			timeoutMs,
+			abortSignal: options.abortSignal
+		});
+		if (responseResult.status === "aborted" || options.abortSignal?.aborted) return {
+			ok: false,
+			reason: "aborted"
+		};
+		if (responseResult.status === "timeout") return {
+			ok: false,
+			reason: "timeout"
+		};
+		return responseResult.value.code === 0 ? { ok: true } : {
+			ok: false,
+			reason: "api-error"
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "request-error"
+		};
+	}
+}
+//#endregion
+export { waitForAbortableDelay as a, raceWithTimeoutAndAbort as i, probe_exports as n, registerFeishuAiAgent as r, probeFeishu as t };

package/dist/runtime-api.js

@@ -6,8 +6,7 @@ import { PAIRING_APPROVED_MESSAGE, buildProbeChannelStatusSummary, createDefault
 import { normalizeAgentId } from "openclaw/plugin-sdk/routing";
 import { getSessionEntry } from "openclaw/plugin-sdk/session-store-runtime";
 import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, createActionGate, createDedupeCache } from "openclaw/plugin-sdk/core";
-import { buildAgentMediaPayload } from "openclaw/plugin-sdk/agent-media-payload";
 import { evaluateSupplementalContextVisibility, filterSupplementalContextItems, resolveChannelContextVisibilityMode } from "openclaw/plugin-sdk/context-visibility-runtime";
 import { readJsonFileWithFallback } from "openclaw/plugin-sdk/json-store";
 import { isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
-export { DEFAULT_ACCOUNT_ID, PAIRING_APPROVED_MESSAGE, buildAgentMediaPayload, buildChannelConfigSchema, buildProbeChannelStatusSummary, chunkTextForOutbound, createActionGate, createChannelPairingController, createDedupeCache, createDefaultChannelRuntimeState, createReplyPrefixContext, evaluateSupplementalContextVisibility, filterSupplementalContextItems, getSessionEntry, isRequestBodyLimitError, normalizeAgentId, readJsonFileWithFallback, readRequestBodyWithLimit, requestBodyErrorToText, resolveChannelContextVisibilityMode, setFeishuRuntime };
+export { DEFAULT_ACCOUNT_ID, PAIRING_APPROVED_MESSAGE, buildChannelConfigSchema, buildProbeChannelStatusSummary, chunkTextForOutbound, createActionGate, createChannelPairingController, createDedupeCache, createDefaultChannelRuntimeState, createReplyPrefixContext, evaluateSupplementalContextVisibility, filterSupplementalContextItems, getSessionEntry, isRequestBodyLimitError, normalizeAgentId, readJsonFileWithFallback, readRequestBodyWithLimit, requestBodyErrorToText, resolveChannelContextVisibilityMode, setFeishuRuntime };

package/dist/security-audit-D7WK_BHh.js

@@ -0,0 +1,11 @@
+import "./security-audit-shared-BgpY7AiJ.js";
+//#region extensions/feishu/src/message-action-contract.ts
+const messageActionTargetAliases = {
+	read: { aliases: ["messageId"] },
+	pin: { aliases: ["messageId"] },
+	unpin: { aliases: ["messageId"] },
+	"list-pins": { aliases: ["chatId"] },
+	"channel-info": { aliases: ["chatId"] }
+};
+//#endregion
+export { messageActionTargetAliases as t };

package/dist/security-audit-shared-BgpY7AiJ.js

@@ -0,0 +1,33 @@
+import { asOptionalRecord, hasNonEmptyString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
+//#region extensions/feishu/src/security-audit-shared.ts
+function isFeishuDocToolEnabled(cfg) {
+	const feishu = asOptionalRecord(asOptionalRecord(cfg.channels)?.feishu);
+	if (!feishu || feishu.enabled === false) return false;
+	const baseTools = asOptionalRecord(feishu.tools);
+	const baseDocEnabled = baseTools?.doc !== false;
+	const baseAppId = hasNonEmptyString(feishu.appId);
+	const baseAppSecret = hasConfiguredSecretInput(feishu.appSecret, cfg.secrets?.defaults);
+	const baseConfigured = baseAppId && baseAppSecret;
+	const accounts = asOptionalRecord(feishu.accounts);
+	if (!accounts || Object.keys(accounts).length === 0) return baseDocEnabled && baseConfigured;
+	for (const accountValue of Object.values(accounts)) {
+		const account = asOptionalRecord(accountValue) ?? {};
+		if (account.enabled === false) continue;
+		if (!((asOptionalRecord(account.tools) ?? baseTools)?.doc !== false)) continue;
+		if ((hasNonEmptyString(account.appId) || baseAppId) && (hasConfiguredSecretInput(account.appSecret, cfg.secrets?.defaults) || baseAppSecret)) return true;
+	}
+	return false;
+}
+function collectFeishuSecurityAuditFindings(params) {
+	if (!isFeishuDocToolEnabled(params.cfg)) return [];
+	return [{
+		checkId: "channels.feishu.doc_owner_open_id",
+		severity: "warn",
+		title: "Feishu doc create can grant requester permissions",
+		detail: "channels.feishu tools include \"doc\"; feishu_doc action \"create\" can grant document access to the trusted requesting Feishu user.",
+		remediation: "Disable channels.feishu.tools.doc when not needed, and restrict tool access for untrusted prompts."
+	}];
+}
+//#endregion
+export { collectFeishuSecurityAuditFindings as t };

package/dist/security-contract-api.js

@@ -1,2 +1,2 @@
-import { t as collectFeishuSecurityAuditFindings } from "./security-audit-shared-BIHeF-S_.js";
+import { t as collectFeishuSecurityAuditFindings } from "./security-audit-shared-BgpY7AiJ.js";
 export { collectFeishuSecurityAuditFindings };