@openclaw/feishu 2026.7.2-beta.7 → 2026.7.34

package/dist/.setup/probe-DbUBx0Px.mjs

@@ -0,0 +1,162 @@
+import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.mjs";
+import { r as createFeishuClient } from "./client-DLqNWY5r.mjs";
+import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+//#region extensions/feishu/src/async.ts
+const RACE_TIMEOUT = Symbol("race-timeout");
+const RACE_ABORT = Symbol("race-abort");
+async function raceWithTimeoutAndAbort(promise, options = {}) {
+	if (options.abortSignal?.aborted) return { status: "aborted" };
+	if (options.timeoutMs === void 0 && !options.abortSignal) return {
+		status: "resolved",
+		value: await promise
+	};
+	let timeoutHandle;
+	let abortHandler;
+	const contenders = [promise];
+	if (options.timeoutMs !== void 0) {
+		const timeoutMs = resolveTimerTimeoutMs(options.timeoutMs, 1);
+		contenders.push(new Promise((resolve) => {
+			timeoutHandle = setTimeout(() => resolve(RACE_TIMEOUT), timeoutMs);
+		}));
+	}
+	if (options.abortSignal) contenders.push(new Promise((resolve) => {
+		abortHandler = () => resolve(RACE_ABORT);
+		options.abortSignal?.addEventListener("abort", abortHandler, { once: true });
+	}));
+	try {
+		const result = await Promise.race(contenders);
+		if (result === RACE_TIMEOUT) return { status: "timeout" };
+		if (result === RACE_ABORT) return { status: "aborted" };
+		return {
+			status: "resolved",
+			value: result
+		};
+	} finally {
+		if (timeoutHandle) clearTimeout(timeoutHandle);
+		if (abortHandler) options.abortSignal?.removeEventListener("abort", abortHandler);
+	}
+}
+function waitForAbortableDelay(delayMs, abortSignal) {
+	if (abortSignal?.aborted) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		let settled = false;
+		let timer = void 0;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			if (timer) clearTimeout(timer);
+			if (handleAbort) abortSignal?.removeEventListener("abort", handleAbort);
+			resolve(value);
+		};
+		const handleAbort = () => {
+			finish(false);
+		};
+		abortSignal?.addEventListener("abort", handleAbort, { once: true });
+		if (abortSignal?.aborted) {
+			finish(false);
+			return;
+		}
+		timer = setTimeout(() => finish(true), resolveTimerTimeoutMs(delayMs, 1));
+		timer.unref?.();
+	});
+}
+//#endregion
+//#region extensions/feishu/src/probe.ts
+var probe_exports = /* @__PURE__ */ __exportAll({
+	FEISHU_PROBE_REQUEST_TIMEOUT_MS: () => FEISHU_PROBE_REQUEST_TIMEOUT_MS,
+	probeFeishu: () => probeFeishu
+});
+/** Cache probe results to reduce repeated health-check calls.
+* Gateway health checks call probeFeishu() every minute; without caching this
+* burns ~43,200 calls/month, easily exceeding Feishu's free-tier quota.
+* Successful bot info is effectively static, while failures are cached briefly
+* to avoid hammering the API during transient outages. */
+const probeCache = /* @__PURE__ */ new Map();
+const PROBE_SUCCESS_TTL_MS = 6e5;
+const PROBE_ERROR_TTL_MS = 6e4;
+const MAX_PROBE_CACHE_SIZE = 64;
+const FEISHU_PROBE_REQUEST_TIMEOUT_MS = 1e4;
+function setCachedProbeResult(cacheKey, result, ttlMs) {
+	const expiresAt = resolveExpiresAtMsFromDurationMs(ttlMs);
+	if (expiresAt === void 0) {
+		probeCache.delete(cacheKey);
+		return result;
+	}
+	probeCache.set(cacheKey, {
+		result,
+		expiresAt
+	});
+	if (probeCache.size > MAX_PROBE_CACHE_SIZE) {
+		const oldest = probeCache.keys().next().value;
+		if (oldest !== void 0) probeCache.delete(oldest);
+	}
+	return result;
+}
+async function probeFeishu(creds, options = {}) {
+	if (!creds?.appId || !creds?.appSecret) return {
+		ok: false,
+		error: "missing credentials (appId, appSecret)"
+	};
+	if (options.abortSignal?.aborted) return {
+		ok: false,
+		appId: creds.appId,
+		error: "probe aborted"
+	};
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	const cacheKey = creds.accountId ?? `${creds.appId}:${creds.appSecret.slice(0, 8)}`;
+	const cached = probeCache.get(cacheKey);
+	if (cached) {
+		const now = asDateTimestampMs(Date.now());
+		const expiresAt = asDateTimestampMs(cached.expiresAt);
+		if (now !== void 0 && expiresAt !== void 0 && expiresAt > now) return cached.result;
+		probeCache.delete(cacheKey);
+	}
+	try {
+		const responseResult = await raceWithTimeoutAndAbort(createFeishuClient(creds).request({
+			method: "POST",
+			url: "/open-apis/bot/v1/openclaw_bot/ping",
+			data: { needBotInfo: true },
+			timeout: timeoutMs
+		}), {
+			timeoutMs,
+			abortSignal: options.abortSignal
+		});
+		if (responseResult.status === "aborted") return {
+			ok: false,
+			appId: creds.appId,
+			error: "probe aborted"
+		};
+		if (responseResult.status === "timeout") return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: `probe timed out after ${timeoutMs}ms`
+		}, PROBE_ERROR_TTL_MS);
+		const response = responseResult.value;
+		if (options.abortSignal?.aborted) return {
+			ok: false,
+			appId: creds.appId,
+			error: "probe aborted"
+		};
+		if (response.code !== 0) return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: `API error: ${response.msg || `code ${response.code}`}`
+		}, PROBE_ERROR_TTL_MS);
+		const botInfo = response.data?.pingBotInfo;
+		return setCachedProbeResult(cacheKey, {
+			ok: true,
+			appId: creds.appId,
+			botName: botInfo?.botName,
+			botOpenId: botInfo?.botID
+		}, PROBE_SUCCESS_TTL_MS);
+	} catch (err) {
+		return setCachedProbeResult(cacheKey, {
+			ok: false,
+			appId: creds.appId,
+			error: formatErrorMessage(err)
+		}, PROBE_ERROR_TTL_MS);
+	}
+}
+//#endregion
+export { waitForAbortableDelay as i, probe_exports as n, raceWithTimeoutAndAbort as r, probeFeishu as t };

package/dist/.setup/runtime-setter-api-CG-RC4_r.mjs

@@ -0,0 +1,3 @@
+import { n as setFeishuRuntime } from "./runtime-C5JxBWZp.mjs";
+import "../runtime-setter-api.js";
+export { setFeishuRuntime };

package/dist/.setup/secret-contract-DLaBl9m4.mjs

@@ -0,0 +1,137 @@
+import { collectConditionalChannelFieldAssignments, collectSecretInputAssignment, getChannelSurface, hasConfiguredSecretInputValue, hasOwnProperty, isBaseFieldActiveForChannelSurface, normalizeSecretStringValue } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/feishu/src/secret-contract.ts
+const secretTargetRegistryEntries = [
+	{
+		id: "channels.feishu.accounts.*.appSecret",
+		targetType: "channels.feishu.accounts.*.appSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.accounts.*.appSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.feishu.accounts.*.encryptKey",
+		targetType: "channels.feishu.accounts.*.encryptKey",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.accounts.*.encryptKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.feishu.accounts.*.verificationToken",
+		targetType: "channels.feishu.accounts.*.verificationToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.accounts.*.verificationToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.feishu.appSecret",
+		targetType: "channels.feishu.appSecret",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.appSecret",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.feishu.encryptKey",
+		targetType: "channels.feishu.encryptKey",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.encryptKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.feishu.verificationToken",
+		targetType: "channels.feishu.verificationToken",
+		configFile: "openclaw.json",
+		pathPattern: "channels.feishu.verificationToken",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	}
+];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "feishu");
+	if (!resolved) return;
+	const { channel: feishu, surface } = resolved;
+	const topLevelAppSecretActive = surface.channelEnabled && hasConfiguredSecretInputValue(feishu.appId, params.defaults) && hasConfiguredSecretInputValue(feishu.appSecret, params.defaults) || isBaseFieldActiveForChannelSurface(surface, "appSecret");
+	collectSecretInputAssignment({
+		value: feishu.appSecret,
+		path: "channels.feishu.appSecret",
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: topLevelAppSecretActive,
+		inactiveReason: "no enabled account inherits this top-level Feishu appSecret.",
+		apply: (value) => {
+			feishu.appSecret = value;
+		}
+	});
+	if (surface.hasExplicitAccounts) for (const { accountId, account, enabled } of surface.accounts) {
+		if (!hasOwnProperty(account, "appSecret")) continue;
+		collectSecretInputAssignment({
+			value: account.appSecret,
+			path: `channels.feishu.accounts.${accountId}.appSecret`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: enabled,
+			inactiveReason: "Feishu account is disabled.",
+			apply: (value) => {
+				account.appSecret = value;
+			}
+		});
+	}
+	const baseConnectionMode = normalizeSecretStringValue(feishu.connectionMode) === "webhook" ? "webhook" : "websocket";
+	const resolveAccountMode = (account) => hasOwnProperty(account, "connectionMode") ? normalizeSecretStringValue(account.connectionMode) : baseConnectionMode;
+	collectConditionalChannelFieldAssignments({
+		channelKey: "feishu",
+		field: "encryptKey",
+		channel: feishu,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: baseConnectionMode === "webhook",
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "encryptKey") && resolveAccountMode(account) === "webhook",
+		accountActive: ({ account, enabled }) => enabled && resolveAccountMode(account) === "webhook",
+		topInactiveReason: "no enabled Feishu webhook-mode surface inherits this top-level encryptKey.",
+		accountInactiveReason: "Feishu account is disabled or not running in webhook mode."
+	});
+	collectConditionalChannelFieldAssignments({
+		channelKey: "feishu",
+		field: "verificationToken",
+		channel: feishu,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActiveWithoutAccounts: baseConnectionMode === "webhook",
+		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !hasOwnProperty(account, "verificationToken") && resolveAccountMode(account) === "webhook",
+		accountActive: ({ account, enabled }) => enabled && resolveAccountMode(account) === "webhook",
+		topInactiveReason: "no enabled Feishu webhook-mode surface inherits this top-level verificationToken.",
+		accountInactiveReason: "Feishu account is disabled or not running in webhook mode."
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/.setup/secret-contract-api-ZtO0BWHd.mjs

@@ -0,0 +1,3 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-DLaBl9m4.mjs";
+import "../secret-contract-api.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/.setup/security-audit-Duuj2PkP.mjs

@@ -0,0 +1,11 @@
+import "./security-audit-shared-BIHeF-S_.mjs";
+//#region extensions/feishu/src/message-action-contract.ts
+const messageActionTargetAliases = {
+	read: { aliases: ["messageId"] },
+	pin: { aliases: ["messageId"] },
+	unpin: { aliases: ["messageId"] },
+	"list-pins": { aliases: ["chatId"] },
+	"channel-info": { aliases: ["chatId"] }
+};
+//#endregion
+export { messageActionTargetAliases as t };

package/dist/.setup/security-audit-shared-BIHeF-S_.mjs

@@ -0,0 +1,38 @@
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
+//#region extensions/feishu/src/security-audit-shared.ts
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function hasNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isFeishuDocToolEnabled(cfg) {
+	const feishu = asRecord(asRecord(cfg.channels)?.feishu);
+	if (!feishu || feishu.enabled === false) return false;
+	const baseTools = asRecord(feishu.tools);
+	const baseDocEnabled = baseTools?.doc !== false;
+	const baseAppId = hasNonEmptyString(feishu.appId);
+	const baseAppSecret = hasConfiguredSecretInput(feishu.appSecret, cfg.secrets?.defaults);
+	const baseConfigured = baseAppId && baseAppSecret;
+	const accounts = asRecord(feishu.accounts);
+	if (!accounts || Object.keys(accounts).length === 0) return baseDocEnabled && baseConfigured;
+	for (const accountValue of Object.values(accounts)) {
+		const account = asRecord(accountValue) ?? {};
+		if (account.enabled === false) continue;
+		if (!((asRecord(account.tools) ?? baseTools)?.doc !== false)) continue;
+		if ((hasNonEmptyString(account.appId) || baseAppId) && (hasConfiguredSecretInput(account.appSecret, cfg.secrets?.defaults) || baseAppSecret)) return true;
+	}
+	return false;
+}
+function collectFeishuSecurityAuditFindings(params) {
+	if (!isFeishuDocToolEnabled(params.cfg)) return [];
+	return [{
+		checkId: "channels.feishu.doc_owner_open_id",
+		severity: "warn",
+		title: "Feishu doc create can grant requester permissions",
+		detail: "channels.feishu tools include \"doc\"; feishu_doc action \"create\" can grant document access to the trusted requesting Feishu user.",
+		remediation: "Disable channels.feishu.tools.doc when not needed, and restrict tool access for untrusted prompts."
+	}];
+}
+//#endregion
+export { collectFeishuSecurityAuditFindings as t };