larkway 0.3.54 → 0.3.55

package/README.md

@@ -8,7 +8,7 @@
 
 You @ the bot in a Feishu thread. It runs on your machine — reading your real codebase, executing commands, opening MRs — and posts the result back. You define what the agent knows and what it can do. Larkway just carries the messages.
 
-**Current release: v0.3.54**
+**Current release: v0.3.55**
 
 ---
 

package/README.zh.md

@@ -8,7 +8,7 @@
 
 你在飞书话题里 @ bot，它在你的机器上运行——读真实代码库、执行命令、开 MR——把结果贴回飞书。你定义 agent 知道什么、能做什么。Larkway 只负责传递消息。
 
-**当前版本：v0.3.54**
+**当前版本：v0.3.55**
 
 ---
 

package/dist/cli/index.js

@@ -20593,7 +20593,7 @@ var require_websocket = __commonJS({
     var http2 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash2 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -21261,7 +21261,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -21630,7 +21630,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http2 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash2 } = __require("crypto");
+    var { createHash: createHash3 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -21937,7 +21937,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash2("sha1").update(key + GUID).digest("base64");
+        const digest = createHash3("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -107881,6 +107881,7 @@ var init_channelCardKitClient = __esm({
 });
 
 // src/lark/outboundPostClient.ts
+import { createHash as createHash2 } from "node:crypto";
 function numericStatus(err2) {
   if (!err2 || typeof err2 !== "object") return void 0;
   const rec = err2;

package/dist/main.js

@@ -20145,7 +20145,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash3 } = __require("crypto");
+    var { randomBytes, createHash: createHash4 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -20813,7 +20813,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -21182,7 +21182,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash3 } = __require("crypto");
+    var { createHash: createHash4 } = __require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -21489,7 +21489,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash3("sha1").update(key + GUID).digest("base64");
+        const digest = createHash4("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -112048,6 +112048,10 @@ var ChannelCardKitClient = class {
 };
 
 // src/lark/outboundPostClient.ts
+import { createHash as createHash2 } from "node:crypto";
+function safeIdempotencyKey(raw) {
+  return "lw-" + createHash2("sha256").update(raw).digest("hex").slice(0, 40);
+}
 function numericStatus(err) {
   if (!err || typeof err !== "object") return void 0;
   const rec = err;
@@ -117052,7 +117056,12 @@ async function processHandoffs(ctx) {
       });
       const sent = await ctx.postClient.createPostReply(ctx.replyAnchorId, content, {
         replyInThread: true,
-        idempotencyKey: `handoff:${ctx.triggerMessageId}:${i}:${rosterEntry?.botId ?? wanted}`
+        // Hashed: raw `handoff:<om_ id>:<i>:<botId>` sits at ~50 chars — right
+        // on Feishu's uuid validation cap (99992402). Same-input stability
+        // keeps retry dedup working.
+        idempotencyKey: safeIdempotencyKey(
+          `handoff:${ctx.triggerMessageId}:${i}:${rosterEntry?.botId ?? wanted}`
+        )
       });
       mirrorMessageId = sent.messageId;
     } catch (err) {
@@ -118415,12 +118424,12 @@ async function createCotProgressHandle(opts) {
 }
 
 // src/lark/idempotency.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 var KEY_PREFIX = "lw-p-";
 var KEY_HASH_CHARS = 43;
 var MAX_POST_IDEMPOTENCY_KEY_LENGTH = 64;
 function sha256Base64Url(input) {
-  return createHash2("sha256").update(input).digest("base64url");
+  return createHash3("sha256").update(input).digest("base64url");
 }
 function digestPostContent(content) {
   return sha256Base64Url(content).slice(0, 22);
@@ -130255,7 +130264,10 @@ async function runV2Mode({
             chatId,
             buildPostContent({ text: `${header}
 ${prompt}` }),
-            { idempotencyKey: `schedule:${bot.id}:${id}:${occurrence}` }
+            // Hashed: Feishu's uuid field rejects long/odd-charset keys with
+            // 99992402 (see safeIdempotencyKey) — raw cron keys contain
+            // spaces/asterisks and overflow the cap.
+            { idempotencyKey: safeIdempotencyKey(`schedule:${bot.id}:${id}:${occurrence}`) }
           );
           mirrorId = sent.messageId;
         } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "larkway",
-  "version": "0.3.54",
+  "version": "0.3.55",
   "description": "Thin bridge: Feishu thread to local Claude Code CLI",
   "license": "MIT",
   "author": "Chuck Wu (chuckwu0)",