@openclaw/feishu 2026.9.3 → 2026.9.5

package/node_modules/@larksuiteoapi/node-sdk/lib/index.js

@@ -297,11 +297,17 @@ const formatDomain = (domain) => {
     }
 };
 
-const fillApiPath = (apiPath, pathSupplement = {}) => apiPath.replace(/:([^/]+)/g, (_, $1) => {
-    if (pathSupplement[$1] !== undefined) {
-        return pathSupplement[$1];
+const fillApiPath = (apiPath, pathSupplement = {}) => 
+// Only treat `:name` as a path parameter when it starts a path segment
+// (string start or right after `/`). Colons inside the URL authority,
+// e.g. `http://localhost:3000` or `user:pw@host`, must be left untouched.
+// The separator is captured and re-emitted instead of using a lookbehind
+// because the compile target (es6) has no lookbehind support.
+apiPath.replace(/(^|\/):([^/]+)/g, (_, pathPrefix, pathKey) => {
+    if (pathSupplement[pathKey] !== undefined) {
+        return `${pathPrefix}${pathSupplement[pathKey]}`;
     }
-    throw new Error(`request miss ${$1} path argument`);
+    throw new Error(`request miss ${pathKey} path argument`);
 });
 
 const assert = (predication, callback) => __awaiter(void 0, void 0, void 0, function* () {
@@ -101978,6 +101984,14 @@ class DataCache {
     }
     mergeData(params) {
         const { message_id, sum, seq, trace_id, data } = params;
+        // Guard against malformed fragment metadata: an invalid `sum` makes
+        // `new Array(sum)` throw (RangeError), and a `seq` outside [0, sum)
+        // would create sparse holes that silently corrupt the merged buffer
+        // (JSON.parse then fails and the event is lost).
+        // See https://github.com/larksuite/node-sdk/issues/201
+        if (!Number.isInteger(sum) || sum <= 0 || !Number.isInteger(seq) || seq < 0 || seq >= sum) {
+            throw new Error(`invalid event fragment metadata (sum: ${sum}, seq: ${seq})`);
+        }
         const cache = this.cache.get(message_id);
         if (!cache) {
             const buffer = new Array(sum).fill(undefined);
@@ -101990,6 +102004,12 @@ class DataCache {
             });
         }
         else {
+            // A later fragment that disagrees with the first one about `sum` cannot
+            // be placed reliably: its `seq` was only validated against its own sum,
+            // so it could still land outside the allocated buffer and leave a hole.
+            if (sum !== cache.buffer.length) {
+                throw new Error(`invalid event fragment metadata (sum: ${sum} differs from first fragment's ${cache.buffer.length}, seq: ${seq})`);
+            }
             cache.buffer[seq] = data;
         }
         const mergedCache = this.cache.get(message_id);
@@ -102087,12 +102107,26 @@ var HttpStatusCode;
     HttpStatusCode[HttpStatusCode["internal_server_error"] = 500] = "internal_server_error";
 })(HttpStatusCode || (HttpStatusCode = {}));
 
+// Render a thrown value for an error log: prefer the Error message, fall back
+// to String(err) for non-Error throws and Errors with an empty message.
+const describeError = (err) => {
+    const message = err === null || err === void 0 ? void 0 : err.message;
+    return message ? message : String(err);
+};
 class WSClient {
     constructor(params) {
         var _a;
         this.wsConfig = new WSConfig();
         this.reconnectGeneration = 0;
         this.isConnecting = false;
+        /**
+         * Set by {@link close}, cleared by {@link start}. Distinct from
+         * `reconnectGeneration`, which only invalidates *older* loops: a fresh
+         * `reConnect()` bumps the generation itself, so a closed client could
+         * resurrect its own retry loop. This flag says "this client is done"
+         * until someone starts it again.
+         */
+        this.closed = false;
         this.reconnectInfo = {
             lastConnectTime: 0,
             nextConnectTime: 0,
@@ -102174,6 +102208,57 @@ class WSClient {
             this.livenessTimer = undefined;
         }
     }
+    /**
+     * Detach a socket we are about to throw away: drop every listener, but
+     * leave one 'error' sink behind.
+     *
+     * `ws` reports the abort of a non-OPEN socket asynchronously — both
+     * `terminate()` and `close()` route through `abortHandshake()`, which
+     * emits 'error' on a later tick — and a non-force `close()` on an OPEN
+     * socket keeps the connection alive until the peer answers (up to `ws`'s
+     * 30s closeTimeout), during which a TCP reset still surfaces as 'error'.
+     * An EventEmitter with no 'error' listener throws instead of emitting, and
+     * that throw lands outside every try/catch, killing the host process.
+     * See https://github.com/larksuite/node-sdk/issues/197
+     *
+     * NOTE: not for the liveness watchdog — that one terminates *on purpose*
+     * and needs its listeners intact so 'close' drives the reconnect.
+     */
+    detachSocket(socket) {
+        socket.removeAllListeners();
+        // `on`, not `once`: the sink must outlive however many errors `ws`
+        // decides to emit, without depending on its internal de-dup latch.
+        socket.on('error', (err) => {
+            // Message only — the error may carry request details, and connectUrl
+            // is issued by pullConnectConfig and can embed a short-lived ticket.
+            this.logger.debug('[ws]', 'ignored error from discarded socket', err === null || err === void 0 ? void 0 : err.message);
+        });
+    }
+    /**
+     * Throw away whatever the current attempt established — socket *and* the
+     * timers its 'open' handler armed. A handshake that completes after
+     * `close()` runs `pingLoop()`, and that timer is not unref'd: leaving it
+     * behind keeps the event loop alive forever on a client the caller closed.
+     *
+     * Only safe when {@link closed} is set: otherwise a newer session may
+     * already own `wsConfig`'s instance.
+     */
+    discardConnection() {
+        if (this.pingInterval) {
+            clearTimeout(this.pingInterval);
+            this.pingInterval = undefined;
+        }
+        this.clearLiveness();
+        const socket = this.wsConfig.getWSInstance();
+        if (!socket)
+            return;
+        this.detachSocket(socket);
+        try {
+            socket.terminate();
+        }
+        catch ( /* best effort */_a) { /* best effort */ }
+        this.wsConfig.setWSInstance(null);
+    }
     /**
      * Invoke a user-supplied callback safely: no-op if undefined, swallow any
      * exception to avoid breaking the WS state machine.
@@ -102291,7 +102376,7 @@ class WSClient {
             if (this.handshakeTimeoutMs && this.handshakeTimeoutMs > 0) {
                 timer = setTimeout(() => {
                     this.logger.error('[ws]', `handshake timeout after ${this.handshakeTimeoutMs}ms`);
-                    wsInstance.removeAllListeners();
+                    this.detachSocket(wsInstance);
                     try {
                         wsInstance.terminate();
                     }
@@ -102349,6 +102434,19 @@ class WSClient {
                 finally {
                     this.isConnecting = false;
                 }
+                if (this.closed) {
+                    // close() landed while the handshake was still in flight. Drop
+                    // whatever this attempt established — nobody holds a reference to it
+                    // any more — and bail out, so the reConnect() below cannot resurrect
+                    // a client the caller already closed.
+                    this.discardConnection();
+                    return;
+                }
+                if (currentGeneration !== this.reconnectGeneration) {
+                    // Superseded by a newer session, which now owns wsConfig's instance.
+                    // Leave the socket alone and just stop.
+                    return;
+                }
                 if (result.ok) {
                     this.hasEverConnected = true;
                     this.safeInvoke('onReady', this.onReady);
@@ -102396,6 +102494,10 @@ class WSClient {
                         count++;
                         this.currentReconnectAttempts = count;
                         const result = yield tryConnect();
+                        if (this.closed) {
+                            this.discardConnection();
+                            return;
+                        }
                         // Re-check after async operation in case a new session started
                         if (currentGeneration !== this.reconnectGeneration) {
                             return;
@@ -102467,13 +102569,21 @@ class WSClient {
             // Any inbound frame proves the connection is alive — cancel the pong
             // watchdog (but don't re-arm; it'll be armed again on the next ping).
             this.clearLiveness();
-            const data = decode(buffer);
-            const { method } = data;
-            if (method === FrameType.control) {
-                yield this.handleControlData(data);
+            try {
+                const data = decode(buffer);
+                const { method } = data;
+                if (method === FrameType.control) {
+                    yield this.handleControlData(data);
+                }
+                if (method === FrameType.data) {
+                    yield this.handleEventData(data);
+                }
             }
-            if (method === FrameType.data) {
-                yield this.handleEventData(data);
+            catch (err) {
+                // A frame that fails to decode/parse must never be dropped silently or
+                // become an unhandled rejection that can crash the process: log it so
+                // operators can reconcile the loss. See https://github.com/larksuite/node-sdk/issues/201
+                this.logger.error('[ws]', `failed to handle inbound frame: ${describeError(err)}`);
             }
         }));
         wsInstance === null || wsInstance === void 0 ? void 0 : wsInstance.on('error', (e) => {
@@ -102495,8 +102605,18 @@ class WSClient {
             }
             if (type === MessageType.pong && payload) {
                 this.logger.trace('[ws]', 'receive pong');
-                const dataString = new TextDecoder("utf-8").decode(payload);
-                const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = JSON.parse(dataString);
+                let pong;
+                try {
+                    const dataString = new TextDecoder("utf-8").decode(payload);
+                    pong = JSON.parse(dataString);
+                }
+                catch (err) {
+                    // A malformed pong must not drop the frame silently or crash the
+                    // process. See https://github.com/larksuite/node-sdk/issues/201
+                    this.logger.error('[ws]', `invalid pong payload: ${describeError(err)}`);
+                    return;
+                }
+                const { PingInterval, ReconnectCount, ReconnectInterval, ReconnectNonce } = pong;
                 this.wsConfig.updateWs({
                     pingInterval: PingInterval * 1000,
                     reconnectCount: ReconnectCount,
@@ -102519,13 +102639,23 @@ class WSClient {
             if (type !== MessageType.event) {
                 return;
             }
-            const mergedData = this.dataCache.mergeData({
-                message_id,
-                sum: Number(sum),
-                seq: Number(seq),
-                trace_id,
-                data: payload
-            });
+            let mergedData;
+            try {
+                mergedData = this.dataCache.mergeData({
+                    message_id,
+                    sum: Number(sum),
+                    seq: Number(seq),
+                    trace_id,
+                    data: payload
+                });
+            }
+            catch (err) {
+                // Malformed fragment metadata must not be dropped silently: log the
+                // metadata so operators can reconcile.
+                // See https://github.com/larksuite/node-sdk/issues/201
+                this.logger.error('[ws]', `failed to merge event fragments, message_id: ${message_id}; trace_id: ${trace_id}; error: ${describeError(err)}`);
+                return;
+            }
             if (!mergedData) {
                 return;
             }
@@ -102595,6 +102725,7 @@ class WSClient {
      */
     close(params = {}) {
         const { force = false } = params;
+        this.closed = true;
         // Invalidate any in-flight reconnect loops
         this.reconnectGeneration++;
         if (this.pingInterval) {
@@ -102611,7 +102742,7 @@ class WSClient {
         this.currentReconnectAttempts = 0;
         const wsInstance = this.wsConfig.getWSInstance();
         if (wsInstance) {
-            wsInstance.removeAllListeners();
+            this.detachSocket(wsInstance);
             if (force) {
                 wsInstance.terminate();
             }
@@ -102637,6 +102768,7 @@ class WSClient {
             // Clear any terminal-error state left over from a previous session so
             // getConnectionStatus() reflects the fresh start.
             this.terminalError = false;
+            this.closed = false;
             this.currentReconnectAttempts = 0;
             // Re-arm the cache sweep in case the client was previously close()d
             // (which destroys the timer); idempotent when already running.
@@ -103097,6 +103229,7 @@ function startPolling(ctx) {
         let domainSwitched = false;
         let pollTimer = null;
         let expireTimer = null;
+        let settled = false;
         const cleanup = () => {
             var _a;
             if (pollTimer !== null) {
@@ -103109,25 +103242,60 @@ function startPolling(ctx) {
             }
             (_a = ctx.signal) === null || _a === void 0 ? void 0 : _a.removeEventListener('abort', onAbort);
         };
-        const onAbort = () => {
+        // Every terminal transition goes through succeed() / fail(): they flip
+        // `settled`, drop the timers and the abort listener, and ignore any later
+        // call. Keeping that bookkeeping in one place is what stops a cancelled
+        // run from resuming — see issue #211.
+        const succeed = (result) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            resolve(result);
+        };
+        const fail = (err) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
             cleanup();
-            reject(createError('abort', 'Registration was aborted'));
+            reject(err);
+        };
+        // Scheduling is guarded too: a status callback may abort the run
+        // synchronously, and a timer armed after cleanup() would never be cleared.
+        const scheduleNextPoll = () => {
+            if (settled) {
+                return;
+            }
+            pollTimer = setTimeout(poll, interval);
+        };
+        const onAbort = () => {
+            fail(createError('abort', 'Registration was aborted'));
         };
         if ((_a = ctx.signal) === null || _a === void 0 ? void 0 : _a.aborted) {
-            return reject(createError('abort', 'Registration was aborted'));
+            return fail(createError('abort', 'Registration was aborted'));
         }
         (_b = ctx.signal) === null || _b === void 0 ? void 0 : _b.addEventListener('abort', onAbort, { once: true });
         expireTimer = setTimeout(() => {
-            cleanup();
-            reject(createError('expired_token', 'Polling timed out'));
+            fail(createError('expired_token', 'Polling timed out'));
         }, ctx.expireIn);
         const poll = () => __awaiter(this, void 0, void 0, function* () {
             var _c, _d, _e, _f, _g, _h;
+            if (settled) {
+                return;
+            }
             try {
                 const pollRes = yield requestRegistration(baseUrl, {
                     action: 'poll',
                     device_code: ctx.deviceCode,
                 });
+                // The run may have been aborted or have expired while this request
+                // was in flight. Drop the response: no status callback, no next
+                // poll (issue #211).
+                if (settled) {
+                    return;
+                }
                 // Lark domain switch (once only)
                 if (((_c = pollRes.user_info) === null || _c === void 0 ? void 0 : _c.tenant_brand) === 'lark' && !domainSwitched) {
                     baseUrl = ctx.larkBaseUrl;
@@ -103138,8 +103306,7 @@ function startPolling(ctx) {
                 }
                 // Success
                 if (pollRes.client_id && pollRes.client_secret) {
-                    cleanup();
-                    resolve({
+                    succeed({
                         client_id: pollRes.client_id,
                         client_secret: pollRes.client_secret,
                         user_info: pollRes.user_info,
@@ -103157,22 +103324,19 @@ function startPolling(ctx) {
                         break;
                     case 'access_denied':
                     case 'expired_token':
-                        cleanup();
-                        reject(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : 'Unknown error'));
+                        fail(createError(pollRes.error, (_g = pollRes.error_description) !== null && _g !== void 0 ? _g : 'Unknown error'));
                         return;
                     default:
                         if (pollRes.error) {
-                            cleanup();
-                            reject(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : 'Unknown error'));
+                            fail(createError(pollRes.error, (_h = pollRes.error_description) !== null && _h !== void 0 ? _h : 'Unknown error'));
                             return;
                         }
                         break;
                 }
-                pollTimer = setTimeout(poll, interval);
+                scheduleNextPoll();
             }
             catch (e) {
-                cleanup();
-                reject(e);
+                fail(e);
             }
         });
         poll();

package/node_modules/@larksuiteoapi/node-sdk/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## v1.19.0 — July 22, 2026
+
+This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
+
+## 🔒 Security Fixes
+
+- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)
+
+## 🚀 New Features
+
+- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
+  adapters, and serializers. (#11043, #11081)
+- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
+- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)
+
+## 🐛 Bug Fixes
+
+- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
+- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
+- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
+- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
+- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)
+
+- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
+- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
+- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
+- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)
+
+## 🔧 Maintenance & Chores
+
+- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
+- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
+- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
+- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
+- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
+- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
+
+- @afonsojramos (#11028)
+- @MahinAnowar (#11006)
+- @yassertawfik4 (#11024)
+- @AnandSundar (#11029)
+- @lin-hongkuan (#11035)
+- @Wali007-lab (#11054)
+- @magicdawn (#11043)
+- @andrewkernel (#11053)
+- @Sagargupta16 (#11059)
+- @Rpaudel379 (#11078)
+- @kobihikri (#11076)
+- @spokodev (#11061)
+- @shaedrich (#11081)
+- @QodeXcli (#11062)
+- @akahoshi1421 (#11067)
+- @TheHonoredOne914 (#11071)
+- @Ahsan1Murtaza (#11073)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.18.1...v1.19.0)
+
+
 ## v1.18.0 — June 13, 2026
 
 This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.