oasis_test_v2 2.2.111 → 2.2.112

package/dist/feishu/wrapper.sh

@@ -10,6 +10,12 @@
 # 环境变量：
 #   LARK_BIN          — 真实 lark-cli 绝对路径（避免递归调用自身）
 #   FEISHU_CREDS_FILE — 凭据文件路径（内含 export LARKSUITE_CLI_* 行）
+#
+# 按 Agent 限制可用模块（产品反馈「飞书连接器·按 Agent 的权限模型」）：凭据文件里有
+# OASIS_FEISHU_ALLOW 时，只放行所选模块的 `lark-cli <domain>` 与 `lark-cli api <METHOD> /open-apis/<service>/…`，
+# 机器人与用户身份一样拦（bot 的企业 token 能调应用开通的全集，飞书侧分不开）。放行表由 inject() 按
+# FEISHU_AUTH_SELECTION 算好写入（feishuModulePolicyEnv），这里不认识任何模块，只查表。
+# 被拦时照 lark-cli 的错误形状往 stderr 打一段 JSON、退出码 3（与 lark-cli 自己的鉴权失败同码）。
 
 set -euo pipefail
 
@@ -21,10 +27,94 @@ source "$(dirname "$(realpath "$0")")/../_base/wrapper-base.sh"
 oasis_resolve_bin
 oasis_check_available
 
+# 放行表只认凭据文件里的：先清掉 agent 环境里可能带进来的同名变量。
+unset OASIS_FEISHU_ALLOW OASIS_FEISHU_NEED OASIS_FEISHU_MODULES
+
 # Load feishu credentials into THIS process only (not visible to the agent).
 if [ -n "${FEISHU_CREDS_FILE:-}" ] && [ -f "${FEISHU_CREDS_FILE}" ]; then
   # shellcheck disable=SC1090
   source "${FEISHU_CREDS_FILE}"
 fi
 
+# 任何模块都放行的命令（帮助、查参数、内置技能、自检）；与 scopes.ts FEISHU_NEUTRAL_COMMANDS 同一份。
+FEISHU_NEUTRAL_COMMANDS=" help schema skills whoami doctor completion auth config profile update "
+# 任何模块都放行的接口 service；与 scopes.ts FEISHU_NEUTRAL_API_SERVICES 同一份。
+FEISHU_NEUTRAL_API=" authen auth "
+
+feishu_blocked() {
+  # $1 = 放行表里的键（cmd:<domain> / api:<service>）；$2 = 给人看的命令写法（已过滤成安全字符）。
+  local key="$1" shown="$2" need="" message hint
+  local entry
+  for entry in ${OASIS_FEISHU_NEED:-}; do
+    if [ "${entry%%=*}" = "$key" ]; then need="${entry#*=}"; break; fi
+  done
+  if [ -n "$need" ]; then
+    message="本 agent 的飞书连接器没有开放「${need}」模块，${shown} 已被 Oasis 拦下（机器人与用户身份都不可用）。当前开放的模块：${OASIS_FEISHU_MODULES:-无}。"
+    hint="如需使用，请让配置人在 Oasis 里这个 agent 的飞书连接器详情点「重新连接」，勾选「${need}」后完成授权。"
+  else
+    message="${shown} 不属于任何可勾选的飞书功能模块；本 agent 的飞书调用已按模块限制，Oasis 不放行它。当前开放的模块：${OASIS_FEISHU_MODULES:-无}。"
+    hint="请改用已开放模块对应的 lark-cli 命令；确需此能力请联系 Oasis 管理员。"
+  fi
+  printf '{\n  "ok": false,\n  "error": {\n    "type": "oasis_module_blocked",\n    "message": "%s",\n    "hint": "%s"\n  }\n}\n' "$message" "$hint" >&2
+  exit 3
+}
+
+# 只把「看起来像命令名 / service 名」的字符串回显出来，其余一律写成占位——它要进 JSON。
+feishu_safe() {
+  case "$1" in
+    ''|*[!A-Za-z0-9_.-]*) printf '%s' "该命令" ;;
+    *) printf '%s' "$1" ;;
+  esac
+}
+
+feishu_enforce_modules() {
+  [ -n "${OASIS_FEISHU_ALLOW:-}" ] || return 0   # 没保存过模块选择：不限制
+  local args=("$@") i=0 n=$# cmd=""
+  # 跳过命令前的全局参数（--profile X、-h/--help、-v/--version）。
+  while [ "$i" -lt "$n" ]; do
+    case "${args[$i]}" in
+      --profile) i=$((i + 2)) ;;
+      -*) i=$((i + 1)) ;;
+      *) cmd="${args[$i]}"; break ;;
+    esac
+  done
+  [ -n "$cmd" ] || return 0                      # 只有 --help / --version 之类
+  case "$FEISHU_NEUTRAL_COMMANDS" in *" $cmd "*) return 0 ;; esac
+
+  if [ "$cmd" = "api" ]; then
+    # lark-cli api <METHOD> <path> [flags]：取 api 之后第二个位置参数为 path（跳过带值的参数）。
+    local pos=0 path="" a
+    i=$((i + 1))
+    while [ "$i" -lt "$n" ]; do
+      a="${args[$i]}"
+      case "$a" in
+        --as|--data|--file|--format|--jq|-q|--output|-o|--page-delay|--page-limit|--page-size|--params|--profile) i=$((i + 2)); continue ;;
+        -*) i=$((i + 1)); continue ;;
+      esac
+      pos=$((pos + 1))
+      if [ "$pos" -eq 2 ]; then path="$a"; break; fi
+      i=$((i + 1))
+    done
+    [ -n "$path" ] || return 0                   # 没给 path：lark-cli 自己报用法错，不会发请求
+    # 归一成 <service>/…：lark-cli 接受完整 URL、/open-apis/ 前缀可省、前导斜杠可省。
+    local p="$path"
+    p="${p#http://}"; p="${p#https://}"
+    case "$path" in http://*|https://*) p="${p#*/}" ;; esac
+    while [ "${p#/}" != "$p" ]; do p="${p#/}"; done
+    p="${p#open-apis/}"
+    while [ "${p#/}" != "$p" ]; do p="${p#/}"; done
+    # 路径里带 .. 或百分号编码的，不去猜它最后落到哪个 service——直接拒。
+    case "$p" in *..*|*%*|*\\*) feishu_blocked "api:?" "lark-cli api（路径含 .. 或编码字符）" ;; esac
+    local svc="${p%%[/?#]*}"
+    case "$FEISHU_NEUTRAL_API" in *" $svc "*) return 0 ;; esac
+    case "$OASIS_FEISHU_ALLOW" in *" api:$svc "*) return 0 ;; esac
+    feishu_blocked "api:$svc" "lark-cli api …/open-apis/$(feishu_safe "$svc")/…"
+  fi
+
+  case "$OASIS_FEISHU_ALLOW" in *" cmd:$cmd "*) return 0 ;; esac
+  feishu_blocked "cmd:$cmd" "lark-cli $(feishu_safe "$cmd")"
+}
+
+feishu_enforce_modules "$@"
+
 exec "$LARK_BIN" "$@"

package/dist/index.js

@@ -19611,405 +19611,6 @@ var init_host_isolation = __esm({
   }
 });
 
-// ../connectors/src/feishu/index.ts
-async function fetchFeishuTenantAccessToken(appId, appSecret) {
-  try {
-    const resp = await fetch(FEISHU_TENANT_TOKEN_URL, {
-      method: "POST",
-      headers: { "Content-Type": "application/json; charset=utf-8" },
-      body: JSON.stringify({ app_id: appId, app_secret: appSecret }),
-      signal: AbortSignal.timeout(TENANT_TOKEN_TIMEOUT_MS)
-    });
-    const data = await resp.json();
-    if (!resp.ok || data.code !== 0 || typeof data.tenant_access_token !== "string" || !data.tenant_access_token) {
-      log("[feishu]", `\u6362\u4F01\u4E1A token \u5931\u8D25\uFF08\u672C\u8F6E bot \u8EAB\u4EFD\u4E0D\u53EF\u7528\uFF09: HTTP ${resp.status} code=${String(data.code)} ${String(data.msg ?? "")}`.trim());
-      return null;
-    }
-    return data.tenant_access_token;
-  } catch (err) {
-    log("[feishu]", `\u6362\u4F01\u4E1A token \u5931\u8D25\uFF08\u672C\u8F6E bot \u8EAB\u4EFD\u4E0D\u53EF\u7528\uFF09: ${String(err?.message ?? err).slice(0, 200)}`);
-    return null;
-  }
-}
-function previousTenantToken(credsFile, appId) {
-  if (!credsFile) return null;
-  try {
-    const prev = readSessionCredsFile(credsFile);
-    if (prev["LARKSUITE_CLI_APP_ID"] !== appId) return null;
-    return prev["LARKSUITE_CLI_TENANT_ACCESS_TOKEN"] || null;
-  } catch {
-    return null;
-  }
-}
-function parseFeishuTokenResponse(data, nowMs) {
-  const accessToken = String(data["access_token"] ?? "");
-  const refreshToken = String(data["refresh_token"] ?? "");
-  const expiresInSec = Number(data["expires_in"] ?? 7200);
-  const refreshExpiresInSec = Number(
-    data["refresh_token_expires_in"] ?? data["refresh_expires_in"] ?? 30 * 24 * 3600
-  );
-  const expiresAtMs = nowMs + expiresInSec * 1e3;
-  return {
-    credentials: {
-      ...accessToken ? { user_access_token: accessToken } : {},
-      ...refreshToken ? { refresh_token: refreshToken } : {},
-      user_token_expires_at: String(expiresAtMs),
-      refresh_token_expires_at: String(nowMs + refreshExpiresInSec * 1e3)
-    },
-    expiresAt: new Date(expiresAtMs)
-  };
-}
-var import_node_child_process13, import_node_util4, import_node_path12, import_node_url, import_promises5, execFileAsync2, __dirname2, FEISHU_WELL_KNOWN_SKILLS_BASE, FEISHU_TOKEN_URL, FEISHU_TENANT_TOKEN_URL, FEISHU_USER_OPEN_ID_VAR, FEISHU_AUTHORIZED_BY_VAR, FEISHU_USER_AUTH_INVALID_VAR, FEISHU_REFRESH_REVOKED_CODES, TENANT_TOKEN_TIMEOUT_MS, FeishuConnector;
-var init_feishu = __esm({
-  "../connectors/src/feishu/index.ts"() {
-    "use strict";
-    import_node_child_process13 = require("node:child_process");
-    import_node_util4 = require("node:util");
-    import_node_path12 = require("node:path");
-    import_node_url = require("node:url");
-    import_promises5 = require("node:fs/promises");
-    init_base();
-    init_logger();
-    execFileAsync2 = (0, import_node_util4.promisify)(import_node_child_process13.execFile);
-    __dirname2 = (0, import_node_path12.dirname)((0, import_node_url.fileURLToPath)(__esm_import_meta_url));
-    FEISHU_WELL_KNOWN_SKILLS_BASE = "https://open.feishu.cn/.well-known/skills";
-    FEISHU_TOKEN_URL = "https://open.feishu.cn/open-apis/authen/v2/oauth/token";
-    FEISHU_TENANT_TOKEN_URL = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal";
-    FEISHU_USER_OPEN_ID_VAR = "FEISHU_USER_OPEN_ID";
-    FEISHU_AUTHORIZED_BY_VAR = "FEISHU_AUTHORIZED_BY";
-    FEISHU_USER_AUTH_INVALID_VAR = "FEISHU_USER_AUTH_INVALID";
-    FEISHU_REFRESH_REVOKED_CODES = /* @__PURE__ */ new Set([20024, 20026, 20037, 20064, 20073, 20074]);
-    TENANT_TOKEN_TIMEOUT_MS = 5e3;
-    FeishuConnector = class extends CliConnector {
-      config = {
-        slug: "feishu",
-        type: "cli",
-        // schema 要**声明本连接器实际消费的全部凭据**，不只是「让用户手填的那几个」。
-        // 历史上这里只写了 app_id，而 inject() 其实还要 app_secret / user_access_token
-        // （后两者由控制台 OAuth 流写进变量表，用户不手填）——于是 secret 标记缺失，
-        // 密钥黑名单只能在 serve.ts 另手写一份。现在黑名单从 sensitiveVars 推导，schema 必须诚实。
-        schema: [
-          { key: "app_id", description: "\u98DE\u4E66 App ID\uFF08\u7559\u7A7A\u5219\u81EA\u52A8\u521B\u5EFA\u65B0\u5E94\u7528\uFF09", secret: false, required: false },
-          { key: "app_secret", description: "\u98DE\u4E66 App Secret\uFF08\u63A7\u5236\u53F0\u6388\u6743\u6D41\u5199\u5165\uFF0C\u975E\u624B\u586B\uFF09", secret: true, required: true },
-          { key: "user_access_token", description: "\u98DE\u4E66\u7528\u6237 token\uFF08OAuth \u6388\u6743\u540E\u5199\u5165\uFF0C~2h \u8F6E\u6362\uFF09", secret: true, required: false }
-        ]
-      };
-      commandName = "lark-cli";
-      requiredCommands = ["lark-cli"];
-      envPrefix = "FEISHU_";
-      /** server 侧从 actor 变量表组装凭据的声明（见 provision.ts）。这些会随 job 下发到节点。 */
-      credentialSources = [
-        { key: "app_id", from: "FEISHU_APP_ID", required: true },
-        { key: "app_secret", from: "FEISHU_APP_SECRET", required: true },
-        { key: "user_access_token", from: "FEISHU_USER_ACCESS_TOKEN", required: false }
-      ];
-      /**
-       * 续期材料——**只在 server 侧读，不下发节点**。refresh_token 能换出新的 user token，
-       * 属于"长期材料"，没有任何理由让它出现在 agent 所在的机器上。
-       */
-      refreshCredentialSources = [
-        // App 凭据是**组织级**共享的（个人变量优先，缺失回落全局默认）；用户 token 类只认个人变量。
-        { key: "app_id", from: "FEISHU_APP_ID", orgDefault: true, required: true },
-        { key: "app_secret", from: "FEISHU_APP_SECRET", orgDefault: true, required: true },
-        { key: "refresh_token", from: "FEISHU_REFRESH_TOKEN", required: true },
-        { key: "user_token_expires_at", from: "FEISHU_USER_TOKEN_EXPIRES_AT", required: false },
-        { key: "refresh_token_expires_at", from: "FEISHU_REFRESH_TOKEN_EXPIRES_AT", required: false },
-        { key: "user_access_token", from: "FEISHU_USER_ACCESS_TOKEN", required: false }
-      ];
-      /** 过期判定只认这个键——必须与注入时消费的 token 同源（见接口注释里的历史坑）。 */
-      expiresAtCredentialKey = "user_token_expires_at";
-      /**
-       * 下发前 user token 至少还要剩 40 分钟，不够就换新（Bug 0201）。
-       *
-       * 必须 > `SESSION_CREDENTIAL_RENEW_INTERVAL_MS`（30 分钟）：会话中途续期每 30 分钟问一次 server，
-       * 问的就是这条门槛。门槛若只有通用的 5 分钟，一张还剩 20 分钟的 token 会被原样发回，
-       * 20 分钟后失效、要再等 10 分钟才到下一拍——最坏断档近 25 分钟（`99991677 token expire`）。
-       * 取 40 = 30 分钟间隔 + 10 分钟调度余量：任一拍之后剩余 > 40，到下一拍仍 > 10。
-       *
-       * 不像 GitHub 那样取全寿命（每次都换）：飞书每次刷新都会轮换 refresh_token，
-       * 换得越勤，「飞书已轮换、我们还没落库」的窗口就越常被碰上，所以只取刚好够用的值。
-       */
-      minRemainingLifetimeMs = 40 * 6e4;
-      /**
-       * 只由服务端定时任务续期（Bug 0318）：refresh_token 一次性、每刷必轮换，派单与会话中途再各刷一次就是
-       * 多个写者并发打断续期链；懒续期又让闲置超过 refresh_token 寿命的员工悄悄失效。派单只读库里最新的 token。
-       */
-      scheduledRefreshOnly = true;
-      /** refresh_token 自身 ~30d 过期，过了只能重新授权。 */
-      refreshMaterialExpiresAtCredentialKey = "refresh_token_expires_at";
-      /**
-       * refresh_token 过期后该清掉的键——**只清这个员工的授权产物**。
-       * app_id / app_secret 刻意不在其中：它们代表组织级 App 凭据，与其他员工的连接无关。
-       */
-      clearOnExpiredCredentialKeys = [
-        "user_access_token",
-        "refresh_token",
-        "user_token_expires_at",
-        "refresh_token_expires_at"
-      ];
-      /**
-       * 绝不允许进入 agent 进程环境的原始变量。
-       * 含 APP_ID 与几个过期时间戳：它们本身不算密钥，但同属飞书凭据材料，一并挡在 agent 之外，
-       * 避免 agent 绕开 wrapper 自行拼凭据（沿用既有行为）。
-       */
-      sensitiveVars = [
-        "FEISHU_APP_ID",
-        "FEISHU_APP_SECRET",
-        "FEISHU_USER_ACCESS_TOKEN",
-        "FEISHU_REFRESH_TOKEN",
-        "FEISHU_USER_TOKEN_EXPIRES_AT",
-        "FEISHU_REFRESH_TOKEN_EXPIRES_AT",
-        FEISHU_USER_OPEN_ID_VAR,
-        FEISHU_AUTHORIZED_BY_VAR,
-        FEISHU_USER_AUTH_INVALID_VAR
-      ];
-      /** 宿主机登录态隔离，理由同 github（见接口注释）：由通用装配层无条件设。 */
-      hostCredentialIsolationEnvKeys = ["LARKSUITE_CLI_CONFIG_DIR"];
-      /** inject() 写进 sessionEnv 的全部键——通用 cleanup() 按它逐个删。 */
-      injectedEnvKeys = [
-        "LARK_BIN",
-        "FEISHU_CREDS_FILE",
-        "FEISHU_RUN_TMPDIR",
-        "LARKSUITE_CLI_CONFIG_DIR"
-      ];
-      /**
-       * 自检：拿 user_access_token 问飞书「我是谁」，回 `{ok, identity, data:{name, open_id}}`。
-       *
-       * **不能用 `lark-cli auth status`**：注入外部凭据后整个 auth 命名空间会被拒
-       * （"credentials are provided externally and do not support interactive management"），
-       * 自检会恒为失败。实测 2026-08-03 踩到——`auth status` 只在**读宿主机 profile** 时才有输出，
-       * 恰恰是我们要隔离掉的那条路径。
-       */
-      verifyArgs = ["api", "GET", "/open-apis/authen/v1/user_info"];
-      /** 厂商技能包源——平台自动拉取飞书官方技能包时用。 */
-      wellKnownSkillsBase = FEISHU_WELL_KNOWN_SKILLS_BASE;
-      larkBin;
-      fetchTenantToken;
-      /** `fetchTenantToken` 只给测试替换（不打真飞书）；生产一律用 {@link fetchFeishuTenantAccessToken}。 */
-      constructor(larkBin, opts = {}) {
-        super(__dirname2);
-        this.larkBin = larkBin ?? this.resolveLarkBin();
-        this.fetchTenantToken = opts.fetchTenantToken ?? fetchFeishuTenantAccessToken;
-      }
-      /**
-       * 解析 user_info 的 JSON。lark-cli 的 `ok:false` 也是**退出码 0** 的正常输出，
-       * 所以必须在这里判 ok——只看子进程退出码会把「凭据失效」当成自检通过。
-       */
-      parseIdentity(stdout) {
-        let parsed;
-        try {
-          parsed = JSON.parse(stdout);
-        } catch {
-          return null;
-        }
-        const obj2 = parsed;
-        if (obj2.ok !== true) return null;
-        const openId = typeof obj2.data?.open_id === "string" ? obj2.data.open_id : "";
-        if (!openId) return null;
-        const name = typeof obj2.data?.name === "string" ? obj2.data.name : "";
-        return name ? `${name} (${openId})` : openId;
-      }
-      async connect(options = {}) {
-        if (this.isSimulated()) {
-          return { credentials: { app_id: options["app_id"] ?? "cli_simulated" } };
-        }
-        const app_id = options["app_id"] ?? await this.initNewApp();
-        await this.runAuthLogin(app_id);
-        return { credentials: { app_id } };
-      }
-      /**
-       * Agent run 开始：把凭据作为 lark-cli「外部凭据」写进凭据文件（不进 agent env）。
-       * credentials 接受：app_id, app_secret, user_access_token?（及其 FEISHU_* 别名）。
-       * 企业 token 不随 job 下发，由这里用 app_id/app_secret 现换（换不到只是本轮没有 bot 身份，不抛）。
-       *
-       * 注入的 sessionEnv 键（全部非敏感）：
-       *   FEISHU_CREDS_FILE — 凭据文件路径，wrapper source 它
-       *   FEISHU_RUN_TMPDIR — 本轮临时目录，cleanup 整个删掉
-       *   LARK_BIN          — 真实 lark-cli 绝对路径（防 wrapper 递归调用自身）
-       */
-      async inject(credentials2, sessionEnv) {
-        const appId = credentials2["app_id"] ?? credentials2["FEISHU_APP_ID"];
-        const appSecret = credentials2["app_secret"] ?? credentials2["FEISHU_APP_SECRET"];
-        if (!appId) throw new Error("feishu inject: missing app_id");
-        if (!appSecret) throw new Error("feishu inject: missing app_secret");
-        const userAccessToken = credentials2["user_access_token"] ?? credentials2["FEISHU_USER_ACCESS_TOKEN"];
-        const tenantAccessToken = this.isSimulated() ? null : await this.fetchTenantToken(appId, appSecret) ?? previousTenantToken(sessionEnv.get("FEISHU_CREDS_FILE"), appId);
-        const creds = await writeSessionCredsFile(this.config.slug, {
-          LARKSUITE_CLI_APP_ID: appId,
-          LARKSUITE_CLI_APP_SECRET: appSecret,
-          ...tenantAccessToken ? { LARKSUITE_CLI_TENANT_ACCESS_TOKEN: tenantAccessToken } : {},
-          ...userAccessToken ? { LARKSUITE_CLI_USER_ACCESS_TOKEN: userAccessToken } : {}
-        }, sessionEnv.get("FEISHU_RUN_TMPDIR"));
-        const configDir = (0, import_node_path12.join)(creds.dir, "lark-config");
-        await (0, import_promises5.mkdir)(configDir, { recursive: true, mode: 448 });
-        sessionEnv.set("LARK_BIN", await this.resolveAbsoluteLarkBin());
-        sessionEnv.set("FEISHU_CREDS_FILE", creds.file);
-        sessionEnv.set("FEISHU_RUN_TMPDIR", creds.dir);
-        sessionEnv.set("LARKSUITE_CLI_CONFIG_DIR", configDir);
-      }
-      /**
-       * 用 refresh_token 换一对新的 user token（飞书 v2 OAuth）。
-       *
-       * **纯换取，不落库**——持久化由调用方做（server 侧 `oauth.ts`）。这样平台知识
-       * （端点、字段名、~2h/~30d 的寿命）全部收在连接器里，与 GitHub App 的续期共用
-       * `_base/refresh.ts` 那套判定。
-       *
-       * 返回 null＝没有可用的续期材料（未完成授权）。平台报错则抛，由上层收敛成 failed。
-       */
-      async refreshCredentials(credentials2) {
-        const appId = credentials2["app_id"];
-        const appSecret = credentials2["app_secret"];
-        const refreshToken = credentials2["refresh_token"];
-        if (!appId || !appSecret || !refreshToken) return null;
-        const resp = await fetch(FEISHU_TOKEN_URL, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-            client_id: appId,
-            client_secret: appSecret
-          }).toString()
-        });
-        const data = await resp.json();
-        if (!resp.ok || data["error"]) {
-          const code2 = Number(data["code"]);
-          const msg = `feishu refresh failed: HTTP ${resp.status} code=${String(data["code"] ?? "")} ${String(data["error"] ?? "")}`.trim();
-          if (data["error"] === "invalid_grant" || FEISHU_REFRESH_REVOKED_CODES.has(code2)) throw new CredentialRevokedError(msg);
-          throw new Error(msg);
-        }
-        return parseFeishuTokenResponse(data, Date.now());
-      }
-      async initNewApp() {
-        await new Promise((resolve11, reject) => {
-          const proc = (0, import_node_child_process13.spawn)(this.larkBin, ["config", "init", "--new"], { stdio: "inherit" });
-          proc.on("close", (code2) => code2 === 0 ? resolve11() : reject(new Error(`lark-cli config init exited ${code2}`)));
-          proc.on("error", reject);
-        });
-        const { stdout } = await execFileAsync2(this.larkBin, ["config", "show", "--json"]);
-        const cfg = JSON.parse(stdout);
-        if (!cfg.appId) throw new Error("feishu connector: could not determine app_id after config init");
-        return cfg.appId;
-      }
-      async runAuthLogin(app_id) {
-        await new Promise((resolve11, reject) => {
-          const proc = (0, import_node_child_process13.spawn)(this.larkBin, ["--profile", app_id, "auth", "login"], { stdio: "inherit" });
-          proc.on("close", (code2) => code2 === 0 ? resolve11() : reject(new Error(`lark-cli auth login exited ${code2}`)));
-          proc.on("error", reject);
-        });
-      }
-      resolveLarkBin() {
-        return process.env["LARK_CLI_BIN"] ?? "lark-cli";
-      }
-      async resolveAbsoluteLarkBin() {
-        if (this.larkBin.includes("/")) return this.larkBin;
-        return this.resolveRealBin(this.larkBin);
-      }
-    };
-  }
-});
-
-// ../connectors/src/feishu/user-auth.ts
-async function startFeishuDeviceAuthorization(input) {
-  const basicAuth = Buffer.from(`${input.appId}:${input.appSecret}`).toString("base64");
-  const resp = await (input.fetchImpl ?? fetch)(FEISHU_DEVICE_AUTHORIZATION_URL, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      "Authorization": `Basic ${basicAuth}`
-    },
-    body: new URLSearchParams({ client_id: input.appId, scope: input.scopes.join(" ") }).toString()
-  });
-  const data = await resp.json();
-  if (!resp.ok || data["error"]) {
-    throw new Error(String(data["error_description"] ?? data["error"] ?? "device authorization failed"));
-  }
-  const verificationUrl = String(data["verification_uri_complete"] ?? data["verification_uri"] ?? "");
-  if (!verificationUrl) throw new Error("no verification_uri in response");
-  const expiresIn = Number(data["expires_in"]);
-  const interval = Number(data["interval"]);
-  return {
-    verificationUrl,
-    deviceCode: String(data["device_code"] ?? ""),
-    ...Number.isFinite(expiresIn) && expiresIn > 0 ? { expiresIn } : {},
-    ...Number.isFinite(interval) && interval > 0 ? { interval } : {}
-  };
-}
-async function pollFeishuDeviceToken(input) {
-  const resp = await (input.fetchImpl ?? fetch)(FEISHU_TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-      device_code: input.deviceCode,
-      client_id: input.appId,
-      client_secret: input.appSecret
-    }).toString()
-  });
-  const data = await resp.json();
-  const errStr = data["error"];
-  if (errStr === "authorization_pending" || errStr === "slow_down") return { status: "pending" };
-  if (!resp.ok || errStr) throw new Error(String(data["error_description"] ?? errStr ?? "login failed"));
-  if (!data["access_token"]) throw new Error("no access_token in response");
-  return { status: "ok", data };
-}
-async function fetchFeishuUserIdentity(accessToken, fetchImpl = fetch) {
-  try {
-    const resp = await fetchImpl(FEISHU_USER_INFO_URL, { headers: { authorization: `Bearer ${accessToken}` } });
-    const ui = await resp.json();
-    if (!resp.ok || ui.code !== 0) return {};
-    const name = ui.data?.name || ui.data?.en_name;
-    return {
-      ...ui.data?.open_id ? { openId: ui.data.open_id } : {},
-      ...name ? { name } : {}
-    };
-  } catch {
-    return {};
-  }
-}
-async function sendFeishuBotTextToUser(input) {
-  const token2 = await (input.fetchTenantToken ?? fetchFeishuTenantAccessToken)(input.appId, input.appSecret);
-  if (!token2) throw new Error("\u6362\u4F01\u4E1A token \u5931\u8D25\uFF0Cbot \u79C1\u4FE1\u672A\u53D1\u51FA");
-  const resp = await (input.fetchImpl ?? fetch)(`${FEISHU_SEND_MESSAGE_URL}?receive_id_type=open_id`, {
-    method: "POST",
-    headers: { "content-type": "application/json; charset=utf-8", authorization: `Bearer ${token2}` },
-    body: JSON.stringify({ receive_id: input.openId, msg_type: "text", content: JSON.stringify({ text: input.text }) })
-  });
-  const body2 = await resp.json();
-  if (body2.code !== 0) throw new Error(`feishu bot \u79C1\u4FE1\u5931\u8D25: code=${String(body2.code)} ${body2.msg ?? ""}`.trim());
-}
-async function lookupFeishuOpenIdByEmail(input) {
-  const token2 = await (input.fetchTenantToken ?? fetchFeishuTenantAccessToken)(input.appId, input.appSecret);
-  if (!token2) throw new Error("\u6362\u4F01\u4E1A token \u5931\u8D25\uFF0C\u672A\u80FD\u6309\u90AE\u7BB1\u67E5\u98DE\u4E66\u7528\u6237");
-  const resp = await (input.fetchImpl ?? fetch)(`${FEISHU_BATCH_GET_ID_URL}?user_id_type=open_id`, {
-    method: "POST",
-    headers: { "content-type": "application/json; charset=utf-8", authorization: `Bearer ${token2}` },
-    body: JSON.stringify({ emails: [input.email], include_resigned: false })
-  });
-  const body2 = await resp.json();
-  if (body2.code !== 0) throw new Error(`feishu \u6309\u90AE\u7BB1\u67E5\u7528\u6237\u5931\u8D25: code=${String(body2.code)} ${body2.msg ?? ""}`.trim());
-  const hit = body2.data?.user_list?.find((u) => u.email?.toLowerCase() === input.email.toLowerCase() && u.user_id);
-  return hit?.user_id ?? null;
-}
-function feishuUserAuthInvalidText(input) {
-  const head = `\u300C${input.agentName}\u300D\u7684\u98DE\u4E66\u7528\u6237\u6388\u6743\u5DF2\u5931\u6548\uFF08\u6388\u6743\u88AB\u64A4\u9500\u6216\u957F\u65F6\u95F4\u65E0\u6CD5\u7EED\u671F\uFF09\uFF0C\u4EE5\u4F60\u8EAB\u4EFD\u8C03\u7528\u98DE\u4E66\u7684\u529F\u80FD\u6682\u65F6\u7528\u4E0D\u4E86\uFF0Cbot \u8EAB\u4EFD\u4E0D\u53D7\u5F71\u54CD\u3002`;
-  return input.link ? `${head}
-\u70B9\u8FD9\u4E2A\u94FE\u63A5\u91CD\u65B0\u6388\u6743\uFF08\u9700\u7528\u6536\u5230\u8FD9\u6761\u79C1\u4FE1\u7684\u98DE\u4E66\u8D26\u53F7\u767B\u5F55\uFF0C7 \u5929\u5185\u6709\u6548\uFF09\uFF1A
-${input.link}` : `${head}
-\u8BF7\u5230 Oasis \u8BE5 Agent \u7684\u300C\u8FDE\u63A5\u5668\u300D\u9875\u91CD\u65B0\u6388\u6743\u98DE\u4E66\u3002`;
-}
-var FEISHU_DEVICE_AUTHORIZATION_URL, FEISHU_USER_INFO_URL, FEISHU_SEND_MESSAGE_URL, FEISHU_BATCH_GET_ID_URL;
-var init_user_auth = __esm({
-  "../connectors/src/feishu/user-auth.ts"() {
-    "use strict";
-    init_feishu();
-    FEISHU_DEVICE_AUTHORIZATION_URL = "https://accounts.feishu.cn/oauth/v1/device_authorization";
-    FEISHU_USER_INFO_URL = "https://open.feishu.cn/open-apis/authen/v1/user_info";
-    FEISHU_SEND_MESSAGE_URL = "https://open.feishu.cn/open-apis/im/v1/messages";
-    FEISHU_BATCH_GET_ID_URL = "https://open.feishu.cn/open-apis/contact/v3/users/batch_get_id";
-  }
-});
-
 // ../connectors/src/feishu/scopes.ts
 function scopesForDomains(domains) {
   const set = /* @__PURE__ */ new Set(["offline_access"]);
@@ -20042,6 +19643,11 @@ function scopesForSelection(sel, includeSendAsUser) {
   return scopes;
 }
 async function appHasScope(appId, appSecret, scope2, fetchImpl = fetch) {
+  return (await fetchFeishuAppScopes(appId, appSecret, fetchImpl)).some(
+    (s2) => s2.scope_name === scope2 && (!s2.scope_type || s2.scope_type === "user")
+  );
+}
+async function fetchFeishuAppScopes(appId, appSecret, fetchImpl = fetch) {
   const tokenResp = await fetchImpl("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", {
     method: "POST",
     headers: { "Content-Type": "application/json; charset=utf-8" },
@@ -20056,9 +19662,7 @@ async function appHasScope(appId, appSecret, scope2, fetchImpl = fetch) {
   });
   const body2 = await resp.json();
   if (body2.code !== 0) throw new Error(`application/v6/scopes failed: code=${body2.code} msg=${body2.msg ?? ""}`);
-  return (body2.data?.scopes ?? []).some(
-    (s2) => s2.scope_name === scope2 && (!s2.scope_type || s2.scope_type === "user")
-  );
+  return body2.data?.scopes ?? [];
 }
 function feishuAuthSelectionRecord(sel, sendAsUserRequested, tokenResponse) {
   const granted = typeof tokenResponse["scope"] === "string" ? tokenResponse["scope"].split(/\s+/).filter(Boolean) : void 0;
@@ -20069,7 +19673,64 @@ function feishuAuthSelectionRecord(sel, sendAsUserRequested, tokenResponse) {
     ...granted ? { grantedScopes: granted } : {}
   };
 }
-var FEISHU_BASIC_SCOPES, FEISHU_DOMAIN_SCOPES, FEISHU_USER_SCOPES, FEISHU_USER_SCOPE_STRING, FEISHU_SEND_AS_USER_SCOPE, FEISHU_AUTH_SELECTION_VAR, AUTO_APPROVED;
+function feishuModulePolicyEnv(modules) {
+  const picked = modules.filter((m2) => FEISHU_MODULE_ACCESS[m2]);
+  if (picked.length === 0) return null;
+  const allow = /* @__PURE__ */ new Set();
+  for (const m2 of picked) {
+    for (const c of FEISHU_MODULE_ACCESS[m2].commands) allow.add(`cmd:${c}`);
+    for (const s2 of FEISHU_MODULE_ACCESS[m2].apiServices) allow.add(`api:${s2}`);
+  }
+  const need2 = /* @__PURE__ */ new Map();
+  for (const [m2, a] of Object.entries(FEISHU_MODULE_ACCESS)) {
+    for (const k2 of [...a.commands.map((c) => `cmd:${c}`), ...a.apiServices.map((s2) => `api:${s2}`)]) {
+      if (allow.has(k2)) continue;
+      need2.set(k2, [...need2.get(k2) ?? [], (FEISHU_MODULE_LABELS[m2] ?? m2).replace(/\s+/g, "")]);
+    }
+  }
+  return {
+    OASIS_FEISHU_ALLOW: ` ${[...allow].sort().join(" ")} `,
+    OASIS_FEISHU_NEED: ` ${[...need2].sort(([a], [b2]) => a.localeCompare(b2)).map(([k2, v2]) => `${k2}=${v2.join("/")}`).join(" ")} `,
+    OASIS_FEISHU_MODULES: picked.map((m2) => FEISHU_MODULE_LABELS[m2] ?? m2).join("\u3001")
+  };
+}
+function feishuSelectedModules(raw) {
+  if (!raw) return [];
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed.modules) ? parsed.modules.filter((m2) => typeof m2 === "string" && !!FEISHU_MODULE_ACCESS[m2]) : [];
+  } catch {
+    return [];
+  }
+}
+function feishuModuleAccessReport(input) {
+  const granted = input.grantedScopes ? new Set(input.grantedScopes) : null;
+  const tenant = (input.appScopes ?? []).filter((s2) => s2.scope_type === "tenant" && s2.scope_name);
+  return input.modules.filter((m2) => FEISHU_MODULE_ACCESS[m2]).map((m2) => {
+    const prefixes = FEISHU_MODULE_ACCESS[m2].botScopePrefixes;
+    const mine = tenant.filter((s2) => prefixes.some((p2) => s2.scope_name.startsWith(p2)));
+    const bot = input.appScopes === null ? "unknown" : mine.some((s2) => s2.grant_status === void 0 || s2.grant_status === 1) ? "granted" : mine.length > 0 ? "pending" : "missing";
+    const missingUserScopes = granted ? (FEISHU_DOMAIN_SCOPES[m2]?.scopes ?? []).filter((s2) => !granted.has(s2)) : [];
+    const user = input.userAuthInvalid ? "invalid" : !input.hasUserAuth ? "none" : missingUserScopes.length > 0 ? "partial" : "granted";
+    return {
+      id: m2,
+      label: FEISHU_MODULE_LABELS[m2] ?? m2,
+      bot,
+      user,
+      missingUserScopes: user === "partial" ? missingUserScopes : []
+    };
+  });
+}
+function feishuSendAsUserState(sel) {
+  if (!sel.sendAsUser) return "off";
+  if (!sel.sendAsUserRequested) return "app_not_enabled";
+  if (sel.grantedScopes && !sel.grantedScopes.includes(FEISHU_SEND_AS_USER_SCOPE)) return "not_granted";
+  return "on";
+}
+function feishuAppPermissionConsoleUrl(appId) {
+  return `https://open.feishu.cn/app/${encodeURIComponent(appId)}/auth`;
+}
+var FEISHU_BASIC_SCOPES, FEISHU_DOMAIN_SCOPES, FEISHU_USER_SCOPES, FEISHU_USER_SCOPE_STRING, FEISHU_SEND_AS_USER_SCOPE, FEISHU_AUTH_SELECTION_VAR, AUTO_APPROVED, FEISHU_MODULE_ACCESS, FEISHU_MODULE_LABELS;
 var init_scopes = __esm({
   "../connectors/src/feishu/scopes.ts"() {
     "use strict";
@@ -20472,6 +20133,453 @@ var init_scopes = __esm({
     FEISHU_SEND_AS_USER_SCOPE = "im:message.send_as_user";
     FEISHU_AUTH_SELECTION_VAR = "FEISHU_AUTH_SELECTION";
     AUTO_APPROVED = new Set(FEISHU_BASIC_SCOPES);
+    FEISHU_MODULE_ACCESS = {
+      im: { commands: ["im"], apiServices: ["im"], botScopePrefixes: ["im:"] },
+      calendar: { commands: ["calendar"], apiServices: ["calendar"], botScopePrefixes: ["calendar:"] },
+      docs: { commands: ["docs", "drive", "markdown", "mindnotes"], apiServices: ["docx", "doc", "docs", "drive", "mindnote", "mindnotes", "suite"], botScopePrefixes: ["docs:", "docx:", "space:"] },
+      drive: { commands: ["drive", "markdown"], apiServices: ["drive"], botScopePrefixes: ["drive:"] },
+      sheets: { commands: ["sheets"], apiServices: ["sheets"], botScopePrefixes: ["sheets:"] },
+      base: { commands: ["base"], apiServices: ["bitable", "base"], botScopePrefixes: ["base:", "bitable:"] },
+      wiki: { commands: ["wiki"], apiServices: ["wiki"], botScopePrefixes: ["wiki:"] },
+      slides: { commands: ["slides"], apiServices: ["slides", "slides_ai"], botScopePrefixes: ["slides:"] },
+      task: { commands: ["task"], apiServices: ["task"], botScopePrefixes: ["task:"] },
+      approval: { commands: ["approval"], apiServices: ["approval"], botScopePrefixes: ["approval:"] },
+      mail: { commands: ["mail"], apiServices: ["mail"], botScopePrefixes: ["mail:"] },
+      minutes: { commands: ["minutes"], apiServices: ["minutes"], botScopePrefixes: ["minutes:"] },
+      vc: { commands: ["vc", "note"], apiServices: ["vc"], botScopePrefixes: ["vc:"] },
+      contact: { commands: ["contact"], apiServices: ["contact", "search"], botScopePrefixes: ["contact:"] },
+      okr: { commands: ["okr"], apiServices: ["okr"], botScopePrefixes: ["okr:"] },
+      attendance: { commands: ["attendance"], apiServices: ["attendance"], botScopePrefixes: ["attendance:"] },
+      board: { commands: ["whiteboard"], apiServices: ["board"], botScopePrefixes: ["board:"] },
+      spark: { commands: ["apps"], apiServices: ["spark"], botScopePrefixes: ["spark:"] }
+    };
+    FEISHU_MODULE_LABELS = {
+      im: "\u5373\u65F6\u6D88\u606F",
+      calendar: "\u65E5\u5386",
+      docs: "\u4E91\u6587\u6863",
+      drive: "\u4E91\u76D8",
+      sheets: "\u7535\u5B50\u8868\u683C",
+      base: "\u591A\u7EF4\u8868\u683C",
+      wiki: "\u77E5\u8BC6\u5E93",
+      slides: "\u5E7B\u706F\u7247",
+      task: "\u4EFB\u52A1",
+      approval: "\u5BA1\u6279",
+      mail: "\u90AE\u4EF6",
+      minutes: "\u5999\u8BB0",
+      vc: "\u89C6\u9891\u4F1A\u8BAE",
+      contact: "\u901A\u8BAF\u5F55",
+      okr: "OKR",
+      attendance: "\u8003\u52E4",
+      board: "\u767D\u677F",
+      spark: "Spark \u5E94\u7528"
+    };
+  }
+});
+
+// ../connectors/src/feishu/index.ts
+async function fetchFeishuTenantAccessToken(appId, appSecret) {
+  try {
+    const resp = await fetch(FEISHU_TENANT_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json; charset=utf-8" },
+      body: JSON.stringify({ app_id: appId, app_secret: appSecret }),
+      signal: AbortSignal.timeout(TENANT_TOKEN_TIMEOUT_MS)
+    });
+    const data = await resp.json();
+    if (!resp.ok || data.code !== 0 || typeof data.tenant_access_token !== "string" || !data.tenant_access_token) {
+      log("[feishu]", `\u6362\u4F01\u4E1A token \u5931\u8D25\uFF08\u672C\u8F6E bot \u8EAB\u4EFD\u4E0D\u53EF\u7528\uFF09: HTTP ${resp.status} code=${String(data.code)} ${String(data.msg ?? "")}`.trim());
+      return null;
+    }
+    return data.tenant_access_token;
+  } catch (err) {
+    log("[feishu]", `\u6362\u4F01\u4E1A token \u5931\u8D25\uFF08\u672C\u8F6E bot \u8EAB\u4EFD\u4E0D\u53EF\u7528\uFF09: ${String(err?.message ?? err).slice(0, 200)}`);
+    return null;
+  }
+}
+function previousTenantToken(credsFile, appId) {
+  if (!credsFile) return null;
+  try {
+    const prev = readSessionCredsFile(credsFile);
+    if (prev["LARKSUITE_CLI_APP_ID"] !== appId) return null;
+    return prev["LARKSUITE_CLI_TENANT_ACCESS_TOKEN"] || null;
+  } catch {
+    return null;
+  }
+}
+function parseFeishuTokenResponse(data, nowMs) {
+  const accessToken = String(data["access_token"] ?? "");
+  const refreshToken = String(data["refresh_token"] ?? "");
+  const expiresInSec = Number(data["expires_in"] ?? 7200);
+  const refreshExpiresInSec = Number(
+    data["refresh_token_expires_in"] ?? data["refresh_expires_in"] ?? 30 * 24 * 3600
+  );
+  const expiresAtMs = nowMs + expiresInSec * 1e3;
+  return {
+    credentials: {
+      ...accessToken ? { user_access_token: accessToken } : {},
+      ...refreshToken ? { refresh_token: refreshToken } : {},
+      user_token_expires_at: String(expiresAtMs),
+      refresh_token_expires_at: String(nowMs + refreshExpiresInSec * 1e3)
+    },
+    expiresAt: new Date(expiresAtMs)
+  };
+}
+var import_node_child_process13, import_node_util4, import_node_path12, import_node_url, import_promises5, execFileAsync2, __dirname2, FEISHU_WELL_KNOWN_SKILLS_BASE, FEISHU_TOKEN_URL, FEISHU_TENANT_TOKEN_URL, FEISHU_USER_OPEN_ID_VAR, FEISHU_AUTHORIZED_BY_VAR, FEISHU_USER_AUTH_INVALID_VAR, FEISHU_REFRESH_REVOKED_CODES, TENANT_TOKEN_TIMEOUT_MS, FeishuConnector;
+var init_feishu = __esm({
+  "../connectors/src/feishu/index.ts"() {
+    "use strict";
+    import_node_child_process13 = require("node:child_process");
+    import_node_util4 = require("node:util");
+    import_node_path12 = require("node:path");
+    import_node_url = require("node:url");
+    import_promises5 = require("node:fs/promises");
+    init_base();
+    init_logger();
+    init_scopes();
+    execFileAsync2 = (0, import_node_util4.promisify)(import_node_child_process13.execFile);
+    __dirname2 = (0, import_node_path12.dirname)((0, import_node_url.fileURLToPath)(__esm_import_meta_url));
+    FEISHU_WELL_KNOWN_SKILLS_BASE = "https://open.feishu.cn/.well-known/skills";
+    FEISHU_TOKEN_URL = "https://open.feishu.cn/open-apis/authen/v2/oauth/token";
+    FEISHU_TENANT_TOKEN_URL = "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal";
+    FEISHU_USER_OPEN_ID_VAR = "FEISHU_USER_OPEN_ID";
+    FEISHU_AUTHORIZED_BY_VAR = "FEISHU_AUTHORIZED_BY";
+    FEISHU_USER_AUTH_INVALID_VAR = "FEISHU_USER_AUTH_INVALID";
+    FEISHU_REFRESH_REVOKED_CODES = /* @__PURE__ */ new Set([20024, 20026, 20037, 20064, 20073, 20074]);
+    TENANT_TOKEN_TIMEOUT_MS = 5e3;
+    FeishuConnector = class extends CliConnector {
+      config = {
+        slug: "feishu",
+        type: "cli",
+        // schema 要**声明本连接器实际消费的全部凭据**，不只是「让用户手填的那几个」。
+        // 历史上这里只写了 app_id，而 inject() 其实还要 app_secret / user_access_token
+        // （后两者由控制台 OAuth 流写进变量表，用户不手填）——于是 secret 标记缺失，
+        // 密钥黑名单只能在 serve.ts 另手写一份。现在黑名单从 sensitiveVars 推导，schema 必须诚实。
+        schema: [
+          { key: "app_id", description: "\u98DE\u4E66 App ID\uFF08\u7559\u7A7A\u5219\u81EA\u52A8\u521B\u5EFA\u65B0\u5E94\u7528\uFF09", secret: false, required: false },
+          { key: "app_secret", description: "\u98DE\u4E66 App Secret\uFF08\u63A7\u5236\u53F0\u6388\u6743\u6D41\u5199\u5165\uFF0C\u975E\u624B\u586B\uFF09", secret: true, required: true },
+          { key: "user_access_token", description: "\u98DE\u4E66\u7528\u6237 token\uFF08OAuth \u6388\u6743\u540E\u5199\u5165\uFF0C~2h \u8F6E\u6362\uFF09", secret: true, required: false },
+          { key: "auth_selection", description: "\u6388\u6743\u65F6\u52FE\u9009\u7684\u529F\u80FD\u6A21\u5757\uFF08\u63A7\u5236\u53F0\u6388\u6743\u6D41\u5199\u5165\u7684\u660E\u6587 JSON\uFF0C\u6309\u5B83\u9650\u5236 agent \u53EF\u7528\u6A21\u5757\uFF09", secret: false, required: false }
+        ]
+      };
+      commandName = "lark-cli";
+      requiredCommands = ["lark-cli"];
+      envPrefix = "FEISHU_";
+      /** server 侧从 actor 变量表组装凭据的声明（见 provision.ts）。这些会随 job 下发到节点。 */
+      credentialSources = [
+        { key: "app_id", from: "FEISHU_APP_ID", required: true },
+        { key: "app_secret", from: "FEISHU_APP_SECRET", required: true },
+        { key: "user_access_token", from: "FEISHU_USER_ACCESS_TOKEN", required: false },
+        // 按 Agent 限制可用模块：inject 据此写放行表，wrapper 拦（个人选择优先，缺失回落组织连接的选择）。
+        { key: "auth_selection", from: FEISHU_AUTH_SELECTION_VAR, required: false }
+      ];
+      /**
+       * 续期材料——**只在 server 侧读，不下发节点**。refresh_token 能换出新的 user token，
+       * 属于"长期材料"，没有任何理由让它出现在 agent 所在的机器上。
+       */
+      refreshCredentialSources = [
+        // App 凭据是**组织级**共享的（个人变量优先，缺失回落全局默认）；用户 token 类只认个人变量。
+        { key: "app_id", from: "FEISHU_APP_ID", orgDefault: true, required: true },
+        { key: "app_secret", from: "FEISHU_APP_SECRET", orgDefault: true, required: true },
+        { key: "refresh_token", from: "FEISHU_REFRESH_TOKEN", required: true },
+        { key: "user_token_expires_at", from: "FEISHU_USER_TOKEN_EXPIRES_AT", required: false },
+        { key: "refresh_token_expires_at", from: "FEISHU_REFRESH_TOKEN_EXPIRES_AT", required: false },
+        { key: "user_access_token", from: "FEISHU_USER_ACCESS_TOKEN", required: false }
+      ];
+      /** 过期判定只认这个键——必须与注入时消费的 token 同源（见接口注释里的历史坑）。 */
+      expiresAtCredentialKey = "user_token_expires_at";
+      /**
+       * 下发前 user token 至少还要剩 40 分钟，不够就换新（Bug 0201）。
+       *
+       * 必须 > `SESSION_CREDENTIAL_RENEW_INTERVAL_MS`（30 分钟）：会话中途续期每 30 分钟问一次 server，
+       * 问的就是这条门槛。门槛若只有通用的 5 分钟，一张还剩 20 分钟的 token 会被原样发回，
+       * 20 分钟后失效、要再等 10 分钟才到下一拍——最坏断档近 25 分钟（`99991677 token expire`）。
+       * 取 40 = 30 分钟间隔 + 10 分钟调度余量：任一拍之后剩余 > 40，到下一拍仍 > 10。
+       *
+       * 不像 GitHub 那样取全寿命（每次都换）：飞书每次刷新都会轮换 refresh_token，
+       * 换得越勤，「飞书已轮换、我们还没落库」的窗口就越常被碰上，所以只取刚好够用的值。
+       */
+      minRemainingLifetimeMs = 40 * 6e4;
+      /**
+       * 只由服务端定时任务续期（Bug 0318）：refresh_token 一次性、每刷必轮换，派单与会话中途再各刷一次就是
+       * 多个写者并发打断续期链；懒续期又让闲置超过 refresh_token 寿命的员工悄悄失效。派单只读库里最新的 token。
+       */
+      scheduledRefreshOnly = true;
+      /** refresh_token 自身 ~30d 过期，过了只能重新授权。 */
+      refreshMaterialExpiresAtCredentialKey = "refresh_token_expires_at";
+      /**
+       * refresh_token 过期后该清掉的键——**只清这个员工的授权产物**。
+       * app_id / app_secret 刻意不在其中：它们代表组织级 App 凭据，与其他员工的连接无关。
+       */
+      clearOnExpiredCredentialKeys = [
+        "user_access_token",
+        "refresh_token",
+        "user_token_expires_at",
+        "refresh_token_expires_at"
+      ];
+      /**
+       * 绝不允许进入 agent 进程环境的原始变量。
+       * 含 APP_ID 与几个过期时间戳：它们本身不算密钥，但同属飞书凭据材料，一并挡在 agent 之外，
+       * 避免 agent 绕开 wrapper 自行拼凭据（沿用既有行为）。
+       */
+      sensitiveVars = [
+        "FEISHU_APP_ID",
+        "FEISHU_APP_SECRET",
+        "FEISHU_USER_ACCESS_TOKEN",
+        "FEISHU_REFRESH_TOKEN",
+        "FEISHU_USER_TOKEN_EXPIRES_AT",
+        "FEISHU_REFRESH_TOKEN_EXPIRES_AT",
+        FEISHU_USER_OPEN_ID_VAR,
+        FEISHU_AUTHORIZED_BY_VAR,
+        FEISHU_USER_AUTH_INVALID_VAR
+      ];
+      /** 宿主机登录态隔离，理由同 github（见接口注释）：由通用装配层无条件设。 */
+      hostCredentialIsolationEnvKeys = ["LARKSUITE_CLI_CONFIG_DIR"];
+      /** inject() 写进 sessionEnv 的全部键——通用 cleanup() 按它逐个删。 */
+      injectedEnvKeys = [
+        "LARK_BIN",
+        "FEISHU_CREDS_FILE",
+        "FEISHU_RUN_TMPDIR",
+        "LARKSUITE_CLI_CONFIG_DIR"
+      ];
+      /**
+       * 自检：拿 user_access_token 问飞书「我是谁」，回 `{ok, identity, data:{name, open_id}}`。
+       *
+       * **不能用 `lark-cli auth status`**：注入外部凭据后整个 auth 命名空间会被拒
+       * （"credentials are provided externally and do not support interactive management"），
+       * 自检会恒为失败。实测 2026-08-03 踩到——`auth status` 只在**读宿主机 profile** 时才有输出，
+       * 恰恰是我们要隔离掉的那条路径。
+       */
+      verifyArgs = ["api", "GET", "/open-apis/authen/v1/user_info"];
+      /** 厂商技能包源——平台自动拉取飞书官方技能包时用。 */
+      wellKnownSkillsBase = FEISHU_WELL_KNOWN_SKILLS_BASE;
+      larkBin;
+      fetchTenantToken;
+      /** `fetchTenantToken` 只给测试替换（不打真飞书）；生产一律用 {@link fetchFeishuTenantAccessToken}。 */
+      constructor(larkBin, opts = {}) {
+        super(__dirname2);
+        this.larkBin = larkBin ?? this.resolveLarkBin();
+        this.fetchTenantToken = opts.fetchTenantToken ?? fetchFeishuTenantAccessToken;
+      }
+      /**
+       * 解析 user_info 的 JSON。lark-cli 的 `ok:false` 也是**退出码 0** 的正常输出，
+       * 所以必须在这里判 ok——只看子进程退出码会把「凭据失效」当成自检通过。
+       */
+      parseIdentity(stdout) {
+        let parsed;
+        try {
+          parsed = JSON.parse(stdout);
+        } catch {
+          return null;
+        }
+        const obj2 = parsed;
+        if (obj2.ok !== true) return null;
+        const openId = typeof obj2.data?.open_id === "string" ? obj2.data.open_id : "";
+        if (!openId) return null;
+        const name = typeof obj2.data?.name === "string" ? obj2.data.name : "";
+        return name ? `${name} (${openId})` : openId;
+      }
+      async connect(options = {}) {
+        if (this.isSimulated()) {
+          return { credentials: { app_id: options["app_id"] ?? "cli_simulated" } };
+        }
+        const app_id = options["app_id"] ?? await this.initNewApp();
+        await this.runAuthLogin(app_id);
+        return { credentials: { app_id } };
+      }
+      /**
+       * Agent run 开始：把凭据作为 lark-cli「外部凭据」写进凭据文件（不进 agent env）。
+       * credentials 接受：app_id, app_secret, user_access_token?（及其 FEISHU_* 别名）。
+       * 企业 token 不随 job 下发，由这里用 app_id/app_secret 现换（换不到只是本轮没有 bot 身份，不抛）。
+       *
+       * 注入的 sessionEnv 键（全部非敏感）：
+       *   FEISHU_CREDS_FILE — 凭据文件路径，wrapper source 它
+       *   FEISHU_RUN_TMPDIR — 本轮临时目录，cleanup 整个删掉
+       *   LARK_BIN          — 真实 lark-cli 绝对路径（防 wrapper 递归调用自身）
+       */
+      async inject(credentials2, sessionEnv) {
+        const appId = credentials2["app_id"] ?? credentials2["FEISHU_APP_ID"];
+        const appSecret = credentials2["app_secret"] ?? credentials2["FEISHU_APP_SECRET"];
+        if (!appId) throw new Error("feishu inject: missing app_id");
+        if (!appSecret) throw new Error("feishu inject: missing app_secret");
+        const userAccessToken = credentials2["user_access_token"] ?? credentials2["FEISHU_USER_ACCESS_TOKEN"];
+        const modulePolicy = feishuModulePolicyEnv(
+          feishuSelectedModules(credentials2["auth_selection"] ?? credentials2[FEISHU_AUTH_SELECTION_VAR])
+        );
+        const tenantAccessToken = this.isSimulated() ? null : await this.fetchTenantToken(appId, appSecret) ?? previousTenantToken(sessionEnv.get("FEISHU_CREDS_FILE"), appId);
+        const creds = await writeSessionCredsFile(this.config.slug, {
+          LARKSUITE_CLI_APP_ID: appId,
+          LARKSUITE_CLI_APP_SECRET: appSecret,
+          ...tenantAccessToken ? { LARKSUITE_CLI_TENANT_ACCESS_TOKEN: tenantAccessToken } : {},
+          ...userAccessToken ? { LARKSUITE_CLI_USER_ACCESS_TOKEN: userAccessToken } : {},
+          ...modulePolicy ?? {}
+        }, sessionEnv.get("FEISHU_RUN_TMPDIR"));
+        const configDir = (0, import_node_path12.join)(creds.dir, "lark-config");
+        await (0, import_promises5.mkdir)(configDir, { recursive: true, mode: 448 });
+        sessionEnv.set("LARK_BIN", await this.resolveAbsoluteLarkBin());
+        sessionEnv.set("FEISHU_CREDS_FILE", creds.file);
+        sessionEnv.set("FEISHU_RUN_TMPDIR", creds.dir);
+        sessionEnv.set("LARKSUITE_CLI_CONFIG_DIR", configDir);
+      }
+      /**
+       * 用 refresh_token 换一对新的 user token（飞书 v2 OAuth）。
+       *
+       * **纯换取，不落库**——持久化由调用方做（server 侧 `oauth.ts`）。这样平台知识
+       * （端点、字段名、~2h/~30d 的寿命）全部收在连接器里，与 GitHub App 的续期共用
+       * `_base/refresh.ts` 那套判定。
+       *
+       * 返回 null＝没有可用的续期材料（未完成授权）。平台报错则抛，由上层收敛成 failed。
+       */
+      async refreshCredentials(credentials2) {
+        const appId = credentials2["app_id"];
+        const appSecret = credentials2["app_secret"];
+        const refreshToken = credentials2["refresh_token"];
+        if (!appId || !appSecret || !refreshToken) return null;
+        const resp = await fetch(FEISHU_TOKEN_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: appId,
+            client_secret: appSecret
+          }).toString()
+        });
+        const data = await resp.json();
+        if (!resp.ok || data["error"]) {
+          const code2 = Number(data["code"]);
+          const msg = `feishu refresh failed: HTTP ${resp.status} code=${String(data["code"] ?? "")} ${String(data["error"] ?? "")}`.trim();
+          if (data["error"] === "invalid_grant" || FEISHU_REFRESH_REVOKED_CODES.has(code2)) throw new CredentialRevokedError(msg);
+          throw new Error(msg);
+        }
+        return parseFeishuTokenResponse(data, Date.now());
+      }
+      async initNewApp() {
+        await new Promise((resolve11, reject) => {
+          const proc = (0, import_node_child_process13.spawn)(this.larkBin, ["config", "init", "--new"], { stdio: "inherit" });
+          proc.on("close", (code2) => code2 === 0 ? resolve11() : reject(new Error(`lark-cli config init exited ${code2}`)));
+          proc.on("error", reject);
+        });
+        const { stdout } = await execFileAsync2(this.larkBin, ["config", "show", "--json"]);
+        const cfg = JSON.parse(stdout);
+        if (!cfg.appId) throw new Error("feishu connector: could not determine app_id after config init");
+        return cfg.appId;
+      }
+      async runAuthLogin(app_id) {
+        await new Promise((resolve11, reject) => {
+          const proc = (0, import_node_child_process13.spawn)(this.larkBin, ["--profile", app_id, "auth", "login"], { stdio: "inherit" });
+          proc.on("close", (code2) => code2 === 0 ? resolve11() : reject(new Error(`lark-cli auth login exited ${code2}`)));
+          proc.on("error", reject);
+        });
+      }
+      resolveLarkBin() {
+        return process.env["LARK_CLI_BIN"] ?? "lark-cli";
+      }
+      async resolveAbsoluteLarkBin() {
+        if (this.larkBin.includes("/")) return this.larkBin;
+        return this.resolveRealBin(this.larkBin);
+      }
+    };
+  }
+});
+
+// ../connectors/src/feishu/user-auth.ts
+async function startFeishuDeviceAuthorization(input) {
+  const basicAuth = Buffer.from(`${input.appId}:${input.appSecret}`).toString("base64");
+  const resp = await (input.fetchImpl ?? fetch)(FEISHU_DEVICE_AUTHORIZATION_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      "Authorization": `Basic ${basicAuth}`
+    },
+    body: new URLSearchParams({ client_id: input.appId, scope: input.scopes.join(" ") }).toString()
+  });
+  const data = await resp.json();
+  if (!resp.ok || data["error"]) {
+    throw new Error(String(data["error_description"] ?? data["error"] ?? "device authorization failed"));
+  }
+  const verificationUrl = String(data["verification_uri_complete"] ?? data["verification_uri"] ?? "");
+  if (!verificationUrl) throw new Error("no verification_uri in response");
+  const expiresIn = Number(data["expires_in"]);
+  const interval = Number(data["interval"]);
+  return {
+    verificationUrl,
+    deviceCode: String(data["device_code"] ?? ""),
+    ...Number.isFinite(expiresIn) && expiresIn > 0 ? { expiresIn } : {},
+    ...Number.isFinite(interval) && interval > 0 ? { interval } : {}
+  };
+}
+async function pollFeishuDeviceToken(input) {
+  const resp = await (input.fetchImpl ?? fetch)(FEISHU_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: input.deviceCode,
+      client_id: input.appId,
+      client_secret: input.appSecret
+    }).toString()
+  });
+  const data = await resp.json();
+  const errStr = data["error"];
+  if (errStr === "authorization_pending" || errStr === "slow_down") return { status: "pending" };
+  if (!resp.ok || errStr) throw new Error(String(data["error_description"] ?? errStr ?? "login failed"));
+  if (!data["access_token"]) throw new Error("no access_token in response");
+  return { status: "ok", data };
+}
+async function fetchFeishuUserIdentity(accessToken, fetchImpl = fetch) {
+  try {
+    const resp = await fetchImpl(FEISHU_USER_INFO_URL, { headers: { authorization: `Bearer ${accessToken}` } });
+    const ui = await resp.json();
+    if (!resp.ok || ui.code !== 0) return {};
+    const name = ui.data?.name || ui.data?.en_name;
+    return {
+      ...ui.data?.open_id ? { openId: ui.data.open_id } : {},
+      ...name ? { name } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+async function sendFeishuBotTextToUser(input) {
+  const token2 = await (input.fetchTenantToken ?? fetchFeishuTenantAccessToken)(input.appId, input.appSecret);
+  if (!token2) throw new Error("\u6362\u4F01\u4E1A token \u5931\u8D25\uFF0Cbot \u79C1\u4FE1\u672A\u53D1\u51FA");
+  const resp = await (input.fetchImpl ?? fetch)(`${FEISHU_SEND_MESSAGE_URL}?receive_id_type=open_id`, {
+    method: "POST",
+    headers: { "content-type": "application/json; charset=utf-8", authorization: `Bearer ${token2}` },
+    body: JSON.stringify({ receive_id: input.openId, msg_type: "text", content: JSON.stringify({ text: input.text }) })
+  });
+  const body2 = await resp.json();
+  if (body2.code !== 0) throw new Error(`feishu bot \u79C1\u4FE1\u5931\u8D25: code=${String(body2.code)} ${body2.msg ?? ""}`.trim());
+}
+async function lookupFeishuOpenIdByEmail(input) {
+  const token2 = await (input.fetchTenantToken ?? fetchFeishuTenantAccessToken)(input.appId, input.appSecret);
+  if (!token2) throw new Error("\u6362\u4F01\u4E1A token \u5931\u8D25\uFF0C\u672A\u80FD\u6309\u90AE\u7BB1\u67E5\u98DE\u4E66\u7528\u6237");
+  const resp = await (input.fetchImpl ?? fetch)(`${FEISHU_BATCH_GET_ID_URL}?user_id_type=open_id`, {
+    method: "POST",
+    headers: { "content-type": "application/json; charset=utf-8", authorization: `Bearer ${token2}` },
+    body: JSON.stringify({ emails: [input.email], include_resigned: false })
+  });
+  const body2 = await resp.json();
+  if (body2.code !== 0) throw new Error(`feishu \u6309\u90AE\u7BB1\u67E5\u7528\u6237\u5931\u8D25: code=${String(body2.code)} ${body2.msg ?? ""}`.trim());
+  const hit = body2.data?.user_list?.find((u) => u.email?.toLowerCase() === input.email.toLowerCase() && u.user_id);
+  return hit?.user_id ?? null;
+}
+function feishuUserAuthInvalidText(input) {
+  const head = `\u300C${input.agentName}\u300D\u7684\u98DE\u4E66\u7528\u6237\u6388\u6743\u5DF2\u5931\u6548\uFF08\u6388\u6743\u88AB\u64A4\u9500\u6216\u957F\u65F6\u95F4\u65E0\u6CD5\u7EED\u671F\uFF09\uFF0C\u4EE5\u4F60\u8EAB\u4EFD\u8C03\u7528\u98DE\u4E66\u7684\u529F\u80FD\u6682\u65F6\u7528\u4E0D\u4E86\uFF0Cbot \u8EAB\u4EFD\u4E0D\u53D7\u5F71\u54CD\u3002`;
+  return input.link ? `${head}
+\u70B9\u8FD9\u4E2A\u94FE\u63A5\u91CD\u65B0\u6388\u6743\uFF08\u9700\u7528\u6536\u5230\u8FD9\u6761\u79C1\u4FE1\u7684\u98DE\u4E66\u8D26\u53F7\u767B\u5F55\uFF0C7 \u5929\u5185\u6709\u6548\uFF09\uFF1A
+${input.link}` : `${head}
+\u8BF7\u5230 Oasis \u8BE5 Agent \u7684\u300C\u8FDE\u63A5\u5668\u300D\u9875\u91CD\u65B0\u6388\u6743\u98DE\u4E66\u3002`;
+}
+var FEISHU_DEVICE_AUTHORIZATION_URL, FEISHU_USER_INFO_URL, FEISHU_SEND_MESSAGE_URL, FEISHU_BATCH_GET_ID_URL;
+var init_user_auth = __esm({
+  "../connectors/src/feishu/user-auth.ts"() {
+    "use strict";
+    init_feishu();
+    FEISHU_DEVICE_AUTHORIZATION_URL = "https://accounts.feishu.cn/oauth/v1/device_authorization";
+    FEISHU_USER_INFO_URL = "https://open.feishu.cn/open-apis/authen/v1/user_info";
+    FEISHU_SEND_MESSAGE_URL = "https://open.feishu.cn/open-apis/im/v1/messages";
+    FEISHU_BATCH_GET_ID_URL = "https://open.feishu.cn/open-apis/contact/v3/users/batch_get_id";
   }
 });
 
@@ -211892,6 +212000,54 @@ var init_registry_audit_sink = __esm({
   }
 });
 
+// ../server/src/feishu-module-access.ts
+async function feishuModuleAccess(store, actorId, fetchScopes = fetchFeishuAppScopes) {
+  const read3 = (key2) => store.revealResolvedVariable(key2, actorId).catch(() => null);
+  const appId = await read3("FEISHU_APP_ID");
+  const appSecret = await read3("FEISHU_APP_SECRET");
+  if (!appId || !appSecret) return { configured: false };
+  const rawSelection = await read3(FEISHU_AUTH_SELECTION_VAR);
+  const modules = feishuSelectedModules(rawSelection);
+  let parsed = {};
+  try {
+    parsed = rawSelection ? JSON.parse(rawSelection) : {};
+  } catch {
+    parsed = {};
+  }
+  const grantedScopes = Array.isArray(parsed.grantedScopes) ? parsed.grantedScopes.filter((s2) => typeof s2 === "string") : void 0;
+  const hasUserAuth = Boolean(await read3("FEISHU_USER_ACCESS_TOKEN") || await read3("FEISHU_REFRESH_TOKEN"));
+  const userAuthInvalid = Boolean(await read3(FEISHU_USER_AUTH_INVALID_VAR));
+  let appScopes = null;
+  let botCheckError;
+  if (modules.length > 0) {
+    try {
+      appScopes = await fetchScopes(appId, appSecret);
+    } catch (e) {
+      botCheckError = String(e?.message ?? e).slice(0, 200);
+    }
+  }
+  return {
+    configured: true,
+    restricted: modules.length > 0,
+    modules: feishuModuleAccessReport({ modules, grantedScopes, hasUserAuth, userAuthInvalid, appScopes }),
+    hasUserAuth,
+    userAuthInvalid,
+    sendAsUser: feishuSendAsUserState({
+      sendAsUser: parsed.sendAsUser === true,
+      sendAsUserRequested: parsed.sendAsUserRequested === true,
+      grantedScopes
+    }),
+    appConsoleUrl: feishuAppPermissionConsoleUrl(appId),
+    ...botCheckError ? { botCheckError } : {}
+  };
+}
+var init_feishu_module_access = __esm({
+  "../server/src/feishu-module-access.ts"() {
+    "use strict";
+    init_src3();
+  }
+});
+
 // ../server/src/github-app-inventory.ts
 async function collectOasisGithubApps(svc) {
   const rows = (await svc.listVariables()).filter((r) => r.scope === "global" || r.scope === "personal");
@@ -218085,6 +218241,17 @@ ${composed}`;
             else html(false, result.error);
             return;
           }
+          if (url.pathname === "/api/connectors/feishu/app/permissions" && req.method === "POST") {
+            try {
+              const { actorId } = JSON.parse(rawBody || "{}");
+              const svc = await connectorActorsService();
+              if (!svc) throw new Error("actors service unavailable");
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(await feishuModuleAccess(svc, actorId)));
+            } catch (e) {
+              res.writeHead(500).end(JSON.stringify({ error: String(e) }));
+            }
+            return;
+          }
           if (url.pathname === "/api/connectors/feishu/login/start" && req.method === "POST") {
             const startBody = JSON.parse(rawBody);
             const { appId, actorId } = startBody;
@@ -218578,6 +218745,7 @@ var init_server3 = __esm({
     init_assembly();
     init_child_live_turn();
     init_registry_audit_sink();
+    init_feishu_module_access();
     init_src3();
     init_github_app_inventory();
     init_github_app_timing();
@@ -300776,7 +300944,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.111" ? "2.2.111" : "dev";
+var CLI_VERSION = "2.2.112" ? "2.2.112" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -304947,7 +305115,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.111" : "dev";
+var PKG_VERSION = true ? "2.2.112" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.111",
+  "version": "2.2.112",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "05ed7c1a9a41f19b4919fc9398095d0b3ceefaf7"
+    "sourceHead": "278bdc2558b23bd381c4c3007a8d40330244edc1"
   }
 }