feishu-user-plugin 1.3.16 → 1.3.17

package/src/test-pagination-cursor-chain.js

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+// Unit tests for the cursor-chain fixes (2026-06-07 systemic audit, follow-up
+// to PR #118): clients that return hasMore but drop the resume cursor, tool
+// schemas/handlers that never expose page_token, and partial-failure arrays
+// silently swallowed.
+//
+// Covers:
+//   1. read_messages / read_p2p_messages — page_token passthrough (client ready)
+//   2. list_wiki_nodes — client must return pageToken; handler must pass it
+//   3. manage_bitable_record(search) — same chain as 2
+//   4. listWikiSpaces — internal pagination to completion (was silent 50-cap)
+//   5. manage_members(add) — surface not_existed_id_list / pending_approval_id_list
+'use strict';
+
+const assert = require('assert');
+const wikiClient = require('./clients/official/wiki');
+const bitableClient = require('./clients/official/bitable');
+const groupsClient = require('./clients/official/groups');
+const imReadHandlers = require('./tools/im-read').handlers;
+const wikiHandlers = require('./tools/wiki').handlers;
+const bitableHandlers = require('./tools/bitable').handlers;
+const groupsHandlers = require('./tools/groups').handlers;
+
+let pass = 0, fail = 0;
+async function ok(name, fn) {
+  try { await fn(); console.log(`  OK  ${name}`); pass++; }
+  catch (e) { console.log(`  FAIL ${name}: ${e.message}`); fail++; }
+}
+
+async function run() {
+  console.log('=== test-pagination-cursor-chain ===');
+
+  // --- 1. read_messages / read_p2p_messages ---
+
+  await ok('read_messages handler passes page_token through to readMessagesWithFallback', async () => {
+    let got;
+    const official = {
+      hasUAT: true,
+      readMessagesWithFallback: async (chatId, opts) => { got = { chatId, opts }; return { items: [] }; },
+    };
+    const ctx = { getOfficialClient: () => official, getUserClient: async () => { throw new Error('no cookie'); } };
+    await imReadHandlers.read_messages({ chat_id: 'oc_test', page_token: 'PT1' }, ctx);
+    assert.strictEqual(got.chatId, 'oc_test');
+    assert.strictEqual(got.opts.pageToken, 'PT1', 'page_token must reach the client as pageToken');
+  });
+
+  await ok('read_p2p_messages handler passes page_token through to readMessagesAsUser', async () => {
+    let got;
+    const official = {
+      readMessagesAsUser: async (chatId, opts) => { got = { chatId, opts }; return { items: [] }; },
+    };
+    const ctx = { getOfficialClient: () => official, getUserClient: async () => { throw new Error('no cookie'); } };
+    await imReadHandlers.read_p2p_messages({ chat_id: '7123456', page_token: 'PT2' }, ctx);
+    assert.strictEqual(got.opts.pageToken, 'PT2');
+  });
+
+  // --- 2. list_wiki_nodes ---
+
+  await ok('listWikiNodes client returns the resume pageToken alongside hasMore', async () => {
+    const self = {
+      async _asUserOrApp() {
+        return { data: { items: [{ node_token: 'n1' }], has_more: true, page_token: 'WNEXT' }, _viaUser: true };
+      },
+    };
+    const r = await wikiClient.listWikiNodes.call(self, 'sp1', {});
+    assert.strictEqual(r.hasMore, true);
+    assert.strictEqual(r.pageToken, 'WNEXT', 'hasMore without a cursor is a dead end');
+  });
+
+  await ok('list_wiki_nodes handler passes page_token through', async () => {
+    let got;
+    const ctx = {
+      getOfficialClient: () => ({
+        listWikiNodes: async (spaceId, opts) => { got = { spaceId, opts }; return { items: [], hasMore: false }; },
+      }),
+    };
+    await wikiHandlers.list_wiki_nodes({ space_id: 'sp1', page_token: 'PT3' }, ctx);
+    assert.strictEqual(got.opts.pageToken, 'PT3');
+  });
+
+  // --- 3. manage_bitable_record(search) ---
+
+  await ok('searchBitableRecords client returns the resume pageToken alongside hasMore', async () => {
+    const self = {
+      async _asUserOrApp() {
+        return { data: { items: [{ record_id: 'r1' }], total: 2000, has_more: true, page_token: 'BNEXT' }, _viaUser: true };
+      },
+      // legacy path uses _safeSDKCall? keep both shims so the test follows the impl
+      async _safeSDKCall(fn) { return fn(); },
+    };
+    const r = await bitableClient.searchBitableRecords.call(self, 'app1', 'tbl1', {});
+    assert.strictEqual(r.hasMore, true);
+    assert.strictEqual(r.pageToken, 'BNEXT', 'hasMore + total without a cursor strands the caller at page 1');
+  });
+
+  await ok('manage_bitable_record(search) handler passes page_token through', async () => {
+    let got;
+    const ctx = {
+      resolveDocId: async (x) => x,
+      getOfficialClient: () => ({
+        searchBitableRecords: async (appToken, tableId, opts) => { got = { appToken, tableId, opts }; return { items: [], hasMore: false }; },
+      }),
+    };
+    await bitableHandlers.manage_bitable_record({ action: 'search', app_token: 'app1', table_id: 'tbl1', page_token: 'PT4' }, ctx);
+    assert.strictEqual(got.opts.pageToken, 'PT4');
+  });
+
+  // --- 4. listWikiSpaces full pagination ---
+
+  await ok('listWikiSpaces follows page_token to fetch ALL spaces past the 50/page cap', async () => {
+    const calls = [];
+    const self = {
+      async _asUserOrApp({ query }) {
+        const key = (query && query.page_token) || '';
+        calls.push(key);
+        if (key === '') return { data: { items: Array.from({ length: 50 }, (_, i) => ({ space_id: 's' + i })), has_more: true, page_token: 'SP2' }, _viaUser: true };
+        if (key === 'SP2') return { data: { items: [{ space_id: 's50' }], has_more: false }, _viaUser: true };
+        throw new Error('unexpected page_token: ' + key);
+      },
+    };
+    const r = await wikiClient.listWikiSpaces.call(self);
+    assert.strictEqual(r.items.length, 51, 'all pages concatenated');
+    assert.deepStrictEqual(calls, ['', 'SP2']);
+    assert.ok(!r.hasMore, 'complete fetch must not flag hasMore');
+  });
+
+  await ok('listWikiSpaces continues past a permission-filtered empty page (empty + advancing token)', async () => {
+    const calls = [];
+    const self = {
+      async _asUserOrApp({ query }) {
+        const key = (query && query.page_token) || '';
+        calls.push(key);
+        if (key === '') return { data: { items: [{ space_id: 's1' }], has_more: true, page_token: 'SP2' }, _viaUser: true };
+        if (key === 'SP2') return { data: { items: [], has_more: true, page_token: 'SP3' }, _viaUser: true }; // filtered-empty
+        if (key === 'SP3') return { data: { items: [{ space_id: 's2' }], has_more: false }, _viaUser: true };
+        throw new Error('unexpected page_token: ' + key);
+      },
+    };
+    const r = await wikiClient.listWikiSpaces.call(self);
+    assert.strictEqual(r.items.length, 2, 'must page through the filtered-empty page to reach s2');
+    assert.deepStrictEqual(calls, ['', 'SP2', 'SP3']);
+    assert.ok(!r.hasMore, 'complete fetch must not flag hasMore');
+  });
+
+  await ok('listWikiSpaces terminates on a stalled cursor and reports hasMore', async () => {
+    let n = 0;
+    const self = {
+      async _asUserOrApp() {
+        n++;
+        return { data: { items: n === 1 ? [{ space_id: 's1' }] : [], has_more: true, page_token: 'LOOP' }, _viaUser: true };
+      },
+    };
+    const r = await wikiClient.listWikiSpaces.call(self);
+    assert.ok(n <= 3, `must terminate, made ${n} calls`);
+    assert.strictEqual(r.items.length, 1);
+    assert.strictEqual(r.hasMore, true, 'incompleteness must be visible');
+  });
+
+  // --- 5. manage_members(add) partial-failure arrays ---
+
+  await ok('addChatMembers surfaces not_existed_id_list and pending_approval_id_list', async () => {
+    const self = {
+      async _safeSDKCall(fn) {
+        return { data: { invalid_id_list: ['bad1'], not_existed_id_list: ['ghost1'], pending_approval_id_list: ['wait1', 'wait2'] } };
+      },
+    };
+    const r = await groupsClient.addChatMembers.call(self, 'oc_g', ['bad1', 'ghost1', 'wait1', 'wait2', 'ok1']);
+    assert.deepStrictEqual(r.invalidIds, ['bad1']);
+    assert.deepStrictEqual(r.notExistedIds, ['ghost1'], 'not_existed ids must not be swallowed');
+    assert.deepStrictEqual(r.pendingApprovalIds, ['wait1', 'wait2'], 'pending-approval ids must not be swallowed');
+  });
+
+  await ok('manage_members(add) response names the partial failures, not a silent success', async () => {
+    const ctx = {
+      getOfficialClient: () => ({
+        addChatMembers: async () => ({ invalidIds: [], notExistedIds: ['ghost1'], pendingApprovalIds: ['wait1'] }),
+      }),
+    };
+    const res = await groupsHandlers.manage_members({ chat_id: 'oc_g', member_ids: ['ghost1', 'wait1', 'ok1'], action: 'add' }, ctx);
+    const txt = res.content[0].text;
+    assert.ok(/ghost1/.test(txt), 'not-existed id visible in response');
+    assert.ok(/wait1/.test(txt), 'pending id visible in response');
+    assert.ok(txt.startsWith('⚠'), `partial failure must be lifted as a top warning, not buried in JSON: ${txt.slice(0, 120)}`);
+  });
+
+  console.log(`\n=== test-pagination-cursor-chain: ${pass} passed, ${fail} failed ===`);
+  if (fail > 0) process.exit(1);
+}
+
+if (require.main === module) {
+  run().catch((e) => { console.error('test-pagination-cursor-chain harness error:', e); process.exit(1); });
+}
+
+module.exports = { run };

package/src/tools/bitable.js

@@ -106,6 +106,7 @@ const schemas = [
         filter: { type: 'object', description: 'Filter conditions (search only, optional)' },
         sort: { type: 'array', description: 'Sort conditions (search only, optional)' },
         page_size: { type: 'number', description: 'Results per page (search only, default 20)' },
+        page_token: { type: 'string', description: 'Pagination cursor (search only) — pass the pageToken from a previous response to fetch the next page when hasMore is true.' },
       },
       required: ['action', 'app_token', 'table_id'],
     },
@@ -221,7 +222,7 @@ const handlers = {
     switch (args.action) {
       case 'search':
         return json(await c.searchBitableRecords(appToken, args.table_id, {
-          filter: args.filter, sort: args.sort, pageSize: args.page_size,
+          filter: args.filter, sort: args.sort, pageSize: args.page_size, pageToken: args.page_token,
         }));
       case 'get': {
         need(args.record_id, 'record_id', 'get');

package/src/tools/docs.js

@@ -31,11 +31,13 @@ const schemas = [
   },
   {
     name: 'get_doc_blocks',
-    description: '[Official API] Get structured block tree of a document. Returns block types, content, and hierarchy for precise document analysis.',
+    description: '[Official API] Get structured block tree of a document. Returns block types, content, and hierarchy for precise document analysis. Follows pagination internally and returns ALL blocks by default — hasMore:false in the response guarantees the complete tree (pre-v1.3.17 silently capped at 500 blocks). For very large docs, pass max_blocks to bound one call (rounded up to 500/page granularity) and page forward by passing the returned nextPageToken back as page_token; a bounded response carries truncated:true + hasMore:true so partial output is never silent.',
     inputSchema: {
       type: 'object',
       properties: {
         document_id: { type: 'string', description: 'Document ID (from search_docs or create_doc)' },
+        page_token: { type: 'string', description: 'Resume cursor — pass the nextPageToken from a previous truncated response to fetch the next slice.' },
+        max_blocks: { type: 'number', description: 'Soft cap on blocks returned in this call (rounded up to page granularity of 500). Omit to fetch the entire document.' },
       },
       required: ['document_id'],
     },
@@ -56,7 +58,7 @@ const schemas = [
   },
   {
     name: 'manage_doc_block',
-    description: '[Official API] Manage content blocks in a document. Single tool replaces v1.3.6 create_doc_block / update_doc_block / delete_doc_blocks.\n  action=create — six modes (pass exactly ONE):\n    (A) Generic — pass `children` array (e.g. [{block_type:2, text:{...}}]).\n    (B) Image from local file — pass `image_path`; plugin uploads and patches.\n    (C) Image from token — pass `image_token` (already uploaded).\n    (D) File attachment from local file — pass `file_path`; plugin handles VIEW-wrap + replace_file.\n    (E) File from token — pass `file_token`.\n    (F) Table — pass `table={rows,columns,cells?}`; plugin creates a block_type=31 table (Feishu auto-makes the block_type=32 cells) and fills each provided cell. USE THIS for tables — do NOT hand-build table blocks via `children` (the table block_type is 31, NOT 40; getting it wrong returns invalid_param).\n  action=update — generic (pass `update_body`), image-replace (pass `image_token`), or file-replace (pass `file_token`).\n  action=delete — pass `parent_block_id` + `start_index` + `end_index` (range delete).\n`document_id` accepts native ID, wiki node token, or Feishu URL.',
+    description: '[Official API] Manage content blocks in a document. Single tool replaces v1.3.6 create_doc_block / update_doc_block / delete_doc_blocks.\n  action=create — six modes (pass exactly ONE):\n    (A) Generic — pass `children` array (e.g. [{block_type:2, text:{...}}]).\n    (B) Image from local file — pass `image_path`; plugin uploads and patches.\n    (C) Image from token — pass `image_token` (already uploaded).\n    (D) File attachment from local file — pass `file_path`; plugin handles VIEW-wrap + replace_file.\n    (E) File from token — pass `file_token`.\n    (F) Table — pass `table={rows,columns,cells?}`; plugin creates a block_type=31 table (Feishu auto-makes the block_type=32 cells) and fills each provided cell. USE THIS for tables — do NOT hand-build table blocks via `children` (the table block_type is 31, NOT 40; getting it wrong returns invalid_param).\n  action=update — generic (pass `update_body`), image-replace (pass `image_token`), or file-replace (pass `file_token`). ⚠ `update_text_elements` REPLACES the block\'s ENTIRE elements array — it is a full overwrite, NOT a patch/append. Any element you omit (bold runs, links, prefixes) is permanently lost; to change part of a block, read it first (get_doc_blocks) and resend ALL elements.\n  action=delete — pass `parent_block_id` + `start_index` + `end_index` (range delete).\n`document_id` accepts native ID, wiki node token, or Feishu URL.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -72,8 +74,8 @@ const schemas = [
         image_token: { type: 'string', description: 'Pre-uploaded docx image token — create mode C, or update image-replace.' },
         file_path: { type: 'string', description: 'Local file path — create mode D (mutually exclusive with other create modes).' },
         file_token: { type: 'string', description: 'Pre-uploaded docx file token — create mode E, or update file-replace.' },
-        update_body: { type: 'object', description: 'Generic update payload for action=update. E.g. {update_text_elements:{elements:[{text_run:{content:"new text"}}]}}.' },
-        table: { type: 'object', description: 'Create a table — create mode F (mutually exclusive with other create modes). Shape: {rows:int>=1, columns:int>=1, cells?:string[][] (row-major plain text; omit/empty-string to leave a cell blank), column_width?:int[] (px, length=columns), header_row?:bool, header_column?:bool}. The plugin creates a block_type=31 table, lets Feishu auto-create the cells, and fills each provided cell by updating its text — you never specify block types. Returns {tableBlockId, cells:[[cellId,...]] (row-major grid), filled}. Example: {"rows":2,"columns":2,"cells":[["Name","Role"],["Ann","PM"]]}.' },
+        update_body: { type: 'object', description: 'Generic update payload for action=update. E.g. {update_text_elements:{elements:[{text_run:{content:"new text"}}]}}. ⚠ update_text_elements is a FULL REPLACEMENT of the block\'s elements array (not patch/append) — include every element you want to keep, or the omitted ones are permanently lost.' },
+        table: { type: 'object', description: 'Create a table — create mode F (mutually exclusive with other create modes). Shape: {rows:int>=1, columns:int>=1, cells?:string[][] (row-major plain text; omit/empty-string to leave a cell blank), column_width?:int[] (px, length=columns), header_row?:bool, header_column?:bool}. The plugin creates a block_type=31 table, lets Feishu auto-create the cells, and fills each provided cell by updating its text — you never specify block types. Returns {tableBlockId, cells:[[cellId,...]] (row-major grid), filled, failedCells?}. Cell fills auto-retry transient Feishu errors with backoff; cells that still fail do NOT abort the call — they are listed in failedCells:[{row,col,cellId,textBlockId?,reason,skipped?}] (0-based row/col) so you can repair each via action=update on its textBlockId (or action=create into its cellId). Example: {"rows":2,"columns":2,"cells":[["Name","Role"],["Ann","PM"]]}.' },
       },
       required: ['action', 'document_id'],
     },
@@ -108,7 +110,12 @@ const handlers = {
     return json(await ctx.getOfficialClient().readDoc(await ctx.resolveDocId(args.document_id)));
   },
   async get_doc_blocks(args, ctx) {
-    return json(await ctx.getOfficialClient().getDocBlocks(await ctx.resolveDocId(args.document_id)));
+    const opts = {};
+    if (args.page_token) opts.pageToken = args.page_token;
+    // Pass through verbatim — the client clamps to a finite integer >= 1 and
+    // treats anything else as "no cap" (PR #118 review).
+    if (args.max_blocks !== undefined) opts.maxBlocks = args.max_blocks;
+    return json(await ctx.getOfficialClient().getDocBlocks(await ctx.resolveDocId(args.document_id), opts));
   },
   async create_doc(args, ctx) {
     const r = await ctx.getOfficialClient().createDoc(args.title, args.folder_id, {
@@ -133,11 +140,20 @@ const handlers = {
         if (modes.length > 1) return text('manage_doc_block(create): pass exactly ONE of children / image_path / image_token / file_path / file_token / table.');
         if (args.table) {
           const t = args.table;
-          return json(await official.createDocTable(docId, args.parent_block_id, {
+          const r = await official.createDocTable(docId, args.parent_block_id, {
             rows: t.rows, columns: t.columns, cells: t.cells,
             columnWidth: t.column_width, headerRow: t.header_row, headerColumn: t.header_column,
             index: args.index,
-          }));
+          });
+          // Partial fill — lift a repair-oriented warning above the JSON so the
+          // caller cannot mistake a half-filled table for success (json() hoists
+          // fallbackWarning to the top of the rendered response).
+          if (r.failedCells && r.failedCells.length) {
+            const attempted = r.filled + r.failedCells.length;
+            const fillWarn = `⚠ Table ${r.tableBlockId} created, but ${r.failedCells.length}/${attempted} cell(s) could not be filled (transient errors were already retried). See failedCells[] below — repair each with manage_doc_block(action=update, block_id=<textBlockId>, update_body={update_text_elements:...}), or action=create into its cellId when no textBlockId is given.`;
+            r.fallbackWarning = r.fallbackWarning ? `${fillWarn}\n\n${r.fallbackWarning}` : fillWarn;
+          }
+          return json(r);
         }
         if (args.image_path || args.image_token) {
           const r = await official.createDocBlockWithImage(docId, args.parent_block_id, {
@@ -207,7 +223,13 @@ const handlers = {
       return text(`read_doc_markdown: feishu-docx render failed — ${e.message}. Try get_doc_blocks for raw JSON fallback. (feishu-docx version may need upgrading)`);
     }
 
-    return text(_normaliseEmbeds(md));
+    md = _normaliseEmbeds(md);
+    // getDocBlocks paginates to completion, so hasMore only survives a stalled
+    // upstream cursor — still, never let partial output pass as the whole doc.
+    if (result.hasMore) {
+      md += `\n\n[output truncated: rendered ${blocks.length} blocks but the document has more — the block list could not be fetched to completion. Retry, or use get_doc_blocks with page_token to inspect the tail.]`;
+    }
+    return text(md);
   },
 };
 

package/src/tools/groups.js

@@ -74,7 +74,18 @@ const handlers = {
     if (args.action === 'remove') {
       return json(await official.removeChatMembers(args.chat_id, args.member_ids, memberIdType));
     }
-    return json(await official.addChatMembers(args.chat_id, args.member_ids, memberIdType));
+    const r = await official.addChatMembers(args.chat_id, args.member_ids, memberIdType);
+    // Lift a top warning when any id did NOT actually join — invalid format,
+    // nonexistent user, or stuck behind join-approval. Without it an empty
+    // invalidIds read as "everyone is in" while some never joined.
+    const problems = [];
+    if (r.invalidIds?.length) problems.push(`${r.invalidIds.length} invalid id(s): ${r.invalidIds.join(', ')}`);
+    if (r.notExistedIds?.length) problems.push(`${r.notExistedIds.length} nonexistent user(s): ${r.notExistedIds.join(', ')}`);
+    if (r.pendingApprovalIds?.length) problems.push(`${r.pendingApprovalIds.length} pending group-owner approval (NOT yet in the group): ${r.pendingApprovalIds.join(', ')}`);
+    if (problems.length) {
+      r.fallbackWarning = `⚠ Partial add — ${problems.join('; ')}. The rest joined successfully.`;
+    }
+    return json(r);
   },
 };
 

package/src/tools/im-read.js

@@ -117,6 +117,7 @@ const schemas = [
         end_time: { type: 'string', description: 'End timestamp in seconds (optional)' },
         sort_type: { type: 'string', enum: ['ByCreateTimeDesc', 'ByCreateTimeAsc'], description: 'Sort order (default: ByCreateTimeDesc = newest first)' },
         expand_merge_forward: { type: 'boolean', description: 'Auto-expand merge_forward placeholders into their child messages (default true). Children carry parentMessageId; use that id (not the child id) with download_message_resource (kind=image or file).' },
+        page_token: { type: 'string', description: 'Pagination cursor — pass the pageToken from a previous response to fetch the next (older) page when hasMore is true.' },
       },
       required: ['chat_id'],
     },
@@ -155,6 +156,7 @@ const schemas = [
         end_time: { type: 'string', description: 'End timestamp in seconds (optional)' },
         sort_type: { type: 'string', enum: ['ByCreateTimeDesc', 'ByCreateTimeAsc'], description: 'Sort order (default: ByCreateTimeDesc = newest first)' },
         expand_merge_forward: { type: 'boolean', description: 'Auto-expand merge_forward placeholders into their child messages (default true). Children carry parentMessageId; use that id (not the child id) with download_message_resource (kind=image or file).' },
+        page_token: { type: 'string', description: 'Pagination cursor — pass the pageToken from a previous response to fetch the next (older) page when hasMore is true.' },
         via_user: { type: 'boolean', description: 'v1.3.12 — explicit identity override. `true` skips the bot path and reads directly via UAT (use when the chat is yours / external and you know bot has no access). `false` skips UAT fallback and surfaces the bot error instead of cross-identity hop (use when you specifically want the bot view). Omit for default auto-fallback (bot first, UAT on failure).' },
       },
       required: ['chat_id'],
@@ -230,7 +232,7 @@ const handlers = {
     }
     return json(await official.readMessagesAsUser(chatId, {
       pageSize: args.page_size, startTime: args.start_time, endTime: args.end_time,
-      sortType: args.sort_type,
+      sortType: args.sort_type, pageToken: args.page_token,
       expandMergeForward: args.expand_merge_forward !== false,
     }, uc));
   },
@@ -247,7 +249,7 @@ const handlers = {
     const official = ctx.getOfficialClient();
     const msgOpts = {
       pageSize: args.page_size, startTime: args.start_time, endTime: args.end_time,
-      sortType: args.sort_type,
+      sortType: args.sort_type, pageToken: args.page_token,
       expandMergeForward: args.expand_merge_forward !== false,
     };
     // v1.3.12: via_user opt-in routing override. true=skip bot (UAT only),

package/src/tools/wiki.js

@@ -5,7 +5,7 @@ const { json } = require('./_registry');
 const schemas = [
   {
     name: 'list_wiki_spaces',
-    description: '[Official API] List all accessible Wiki spaces.',
+    description: '[Official API] List all accessible Wiki spaces. Follows pagination internally and returns ALL spaces (pre-v1.3.17 silently capped at 50). If the upstream cursor stalls, the response carries hasMore:true — treat that as a partial list.',
     inputSchema: { type: 'object', properties: {} },
   },
   {
@@ -23,12 +23,13 @@ const schemas = [
   },
   {
     name: 'list_wiki_nodes',
-    description: '[Official API] List nodes in a Wiki space.',
+    description: '[Official API] List nodes in a Wiki space (50 per page). When hasMore is true, pass the returned pageToken back as page_token to fetch the next page. A page may be EMPTY while hasMore is still true (Feishu permission-filters per page) — do not stop at an empty page; keep paging until hasMore is false.',
     inputSchema: {
       type: 'object',
       properties: {
         space_id: { type: 'string', description: 'Wiki space ID' },
         parent_node_token: { type: 'string', description: 'Parent node token (optional)' },
+        page_token: { type: 'string', description: 'Pagination cursor — pass the pageToken from a previous response to fetch the next page.' },
       },
       required: ['space_id'],
     },
@@ -129,7 +130,7 @@ const handlers = {
     return json(await ctx.getOfficialClient().searchWiki(args.query, opts));
   },
   async list_wiki_nodes(args, ctx) {
-    return json(await ctx.getOfficialClient().listWikiNodes(args.space_id, { parentNodeToken: args.parent_node_token }));
+    return json(await ctx.getOfficialClient().listWikiNodes(args.space_id, { parentNodeToken: args.parent_node_token, pageToken: args.page_token }));
   },
   async create_wiki_node(args, ctx) {
     return json(await ctx.getOfficialClient().createWikiNode(args.space_id, {