oasis_test_v2 2.2.113 → 2.2.114

package/dist/index.js

@@ -20479,7 +20479,8 @@ var init_feishu = __esm({
         "FEISHU_REFRESH_TOKEN_EXPIRES_AT",
         FEISHU_USER_OPEN_ID_VAR,
         FEISHU_AUTHORIZED_BY_VAR,
-        FEISHU_USER_AUTH_INVALID_VAR
+        FEISHU_USER_AUTH_INVALID_VAR,
+        "FEISHU_AUTH_PENDING_APPROVAL"
       ];
       /** 宿主机登录态隔离，理由同 github（见接口注释）：由通用装配层无条件设。 */
       hostCredentialIsolationEnvKeys = ["LARKSUITE_CLI_CONFIG_DIR"];
@@ -20671,7 +20672,8 @@ async function pollFeishuDeviceToken(input) {
   const data = await resp.json();
   const errStr = data["error"];
   if (errStr === "authorization_pending" || errStr === "slow_down") return { status: "pending" };
-  if (!resp.ok || errStr) throw new Error(String(data["error_description"] ?? errStr ?? "login failed"));
+  if (errStr) throw new FeishuDeviceFlowError(errStr, String(data["error_description"] ?? errStr));
+  if (!resp.ok) throw new Error(String(data["error_description"] ?? "login failed"));
   if (!data["access_token"]) throw new Error("no access_token in response");
   return { status: "ok", data };
 }
@@ -20720,7 +20722,7 @@ function feishuUserAuthInvalidText(input) {
 ${input.link}` : `${head}
 \u8BF7\u5230 Oasis \u8BE5 Agent \u7684\u300C\u8FDE\u63A5\u5668\u300D\u9875\u91CD\u65B0\u6388\u6743\u98DE\u4E66\u3002`;
 }
-var FEISHU_DEVICE_AUTHORIZATION_URL, FEISHU_USER_INFO_URL, FEISHU_SEND_MESSAGE_URL, FEISHU_BATCH_GET_ID_URL;
+var FEISHU_DEVICE_AUTHORIZATION_URL, FEISHU_USER_INFO_URL, FEISHU_SEND_MESSAGE_URL, FEISHU_BATCH_GET_ID_URL, FeishuDeviceFlowError;
 var init_user_auth = __esm({
   "../connectors/src/feishu/user-auth.ts"() {
     "use strict";
@@ -20729,6 +20731,78 @@ var init_user_auth = __esm({
     FEISHU_USER_INFO_URL = "https://open.feishu.cn/open-apis/authen/v1/user_info";
     FEISHU_SEND_MESSAGE_URL = "https://open.feishu.cn/open-apis/im/v1/messages";
     FEISHU_BATCH_GET_ID_URL = "https://open.feishu.cn/open-apis/contact/v3/users/batch_get_id";
+    FeishuDeviceFlowError = class extends Error {
+      constructor(code2, message) {
+        super(message);
+        this.code = code2;
+        this.name = "FeishuDeviceFlowError";
+      }
+    };
+  }
+});
+
+// ../connectors/src/feishu/pending-approval.ts
+function feishuPendingApprovalScopes(input) {
+  const granted = input.granted ? new Set(input.granted) : null;
+  const missing = input.requested.filter((s2) => s2 !== "offline_access" && !granted?.has(s2));
+  if (!input.appScopes) return missing.filter((s2) => !AUTO_APPROVED2.has(s2));
+  const byName = userScopeIndex(input.appScopes);
+  return missing.filter((s2) => byName.has(s2) && !isGranted(byName.get(s2)));
+}
+function feishuPendingApprovalSettled(pending, appScopes) {
+  const byName = userScopeIndex(appScopes);
+  return pending.pendingScopes.every((s2) => isGranted(byName.get(s2)));
+}
+function feishuPendingApprovalModules(pending) {
+  const waiting = new Set(pending.pendingScopes);
+  return pending.modules.filter((m2) => (FEISHU_DOMAIN_SCOPES[m2]?.scopes ?? []).some((s2) => waiting.has(s2)));
+}
+async function readFeishuPendingApproval(store, actorId) {
+  const raw = await store.revealVariable(FEISHU_AUTH_PENDING_APPROVAL_VAR, actorId).catch(() => null);
+  if (!raw) return null;
+  try {
+    const p2 = JSON.parse(raw);
+    return typeof p2?.at === "string" && typeof p2.appId === "string" && Array.isArray(p2.modules) && Array.isArray(p2.pendingScopes) ? p2 : null;
+  } catch {
+    return null;
+  }
+}
+async function writeFeishuPendingApproval(store, actorId, pending) {
+  await store.putVariable({
+    key: FEISHU_AUTH_PENDING_APPROVAL_VAR,
+    value: JSON.stringify(pending),
+    ...actorId ? { scope: "personal", actorId } : { scope: "global" },
+    connectorId: "feishu",
+    encrypted: false
+  });
+}
+async function clearFeishuPendingApproval(store, actorId) {
+  await store.deleteVariable(FEISHU_AUTH_PENDING_APPROVAL_VAR, actorId);
+}
+function feishuApprovalGrantedText(input) {
+  const head = `\u7BA1\u7406\u5458\u5DF2\u6279\u51C6\u300C${input.agentName}\u300D\u7533\u8BF7\u7684\u98DE\u4E66\u6743\u9650\uFF08${moduleNames(input.modules)}\uFF09\u3002\u8FD8\u5DEE\u4F60\u70B9\u4E00\u6B21\u6388\u6743\uFF0C\u8FD9\u90E8\u5206\u529F\u80FD\u624D\u80FD\u4EE5\u4F60\u7684\u8EAB\u4EFD\u4F7F\u7528\u3002`;
+  return input.link ? `${head}
+\u70B9\u8FD9\u4E2A\u94FE\u63A5\u8865\u4E0A\u6743\u9650\uFF08\u9700\u7528\u6536\u5230\u8FD9\u6761\u79C1\u4FE1\u7684\u98DE\u4E66\u8D26\u53F7\u767B\u5F55\uFF0C7 \u5929\u5185\u6709\u6548\uFF09\uFF1A
+${input.link}` : `${head}
+\u8BF7\u5230 Oasis \u8BE5 Agent \u7684\u300C\u8FDE\u63A5\u5668\u300D\u9875\u91CD\u65B0\u8FDE\u63A5\u98DE\u4E66\u3002`;
+}
+function feishuPendingApprovalNotice(modules) {
+  return `${moduleNames(modules)}\u542B\u9700\u98DE\u4E66\u7BA1\u7406\u5458\u5BA1\u6279\u7684\u6743\u9650\uFF0C\u5DF2\u63D0\u4EA4\u5BA1\u6279\u3002\u6279\u51C6\u540E\u4F1A\u5728\u98DE\u4E66\u79C1\u4FE1\u901A\u77E5\u4F60\uFF0C\u70B9\u4E00\u4E0B\u5373\u53EF\u8865\u4E0A\u8FD9\u90E8\u5206\u6743\u9650\uFF1B\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\u4E0D\u53D7\u5F71\u54CD\u3002`;
+}
+var FEISHU_AUTH_PENDING_APPROVAL_VAR, FEISHU_PENDING_APPROVAL_WATCH_MS, FEISHU_APPROVED_SUPPLEMENT_KEEP_MS, AUTO_APPROVED2, userScopeIndex, isGranted, moduleNames;
+var init_pending_approval = __esm({
+  "../connectors/src/feishu/pending-approval.ts"() {
+    "use strict";
+    init_scopes();
+    FEISHU_AUTH_PENDING_APPROVAL_VAR = "FEISHU_AUTH_PENDING_APPROVAL";
+    FEISHU_PENDING_APPROVAL_WATCH_MS = 30 * 24 * 36e5;
+    FEISHU_APPROVED_SUPPLEMENT_KEEP_MS = 7 * 24 * 36e5;
+    AUTO_APPROVED2 = new Set(FEISHU_BASIC_SCOPES);
+    userScopeIndex = (appScopes) => new Map(
+      appScopes.filter((s2) => s2.scope_name && (!s2.scope_type || s2.scope_type === "user")).map((s2) => [s2.scope_name, s2])
+    );
+    isGranted = (s2) => !!s2 && (s2.grant_status === void 0 || s2.grant_status === 1);
+    moduleNames = (modules) => modules.map((m2) => FEISHU_MODULE_LABELS[m2] ?? m2).join("\u3001") || "\u6240\u7533\u8BF7\u7684";
   }
 });
 
@@ -24653,6 +24727,7 @@ var init_src3 = __esm({
     init_host_isolation();
     init_feishu();
     init_user_auth();
+    init_pending_approval();
     init_scopes();
     init_oauth();
     init_scheduled_refresh();
@@ -24674,6 +24749,14 @@ var init_src3 = __esm({
 });
 
 // ../server/src/feishu-reauth.ts
+async function supplementSelection(store, actorId) {
+  const pending = await readFeishuPendingApproval(store, actorId);
+  if (!pending) return null;
+  const appId = await store.revealResolvedVariable("FEISHU_APP_ID", actorId).catch(() => null);
+  if (appId !== pending.appId) return null;
+  const sel = normalizeFeishuAuthSelection({ modules: pending.modules, sendAsUser: pending.sendAsUser });
+  return sel ? { sel, sendAsUser: pending.sendAsUserRequested, pending } : null;
+}
 async function reauthSelection(store, actorId) {
   const raw = await store.revealVariable(FEISHU_AUTH_SELECTION_VAR, actorId).catch(() => null);
   if (raw) {
@@ -24714,17 +24797,31 @@ function createFeishuReauth(deps) {
       };
     }
     await withConnectorCredentialLock("feishu", claims.actorId, async () => {
+      const pending2 = claims.purpose === "supplement" ? await readFeishuPendingApproval(store, claims.actorId) : null;
       await persistFeishuUserAuthorization(store, claims.actorId, data, now(), {
         openId: who.openId,
-        ...who.name ? { userName: who.name } : {}
+        ...who.name ? { userName: who.name } : {},
+        ...pending2?.applicant ? { authorizedBy: pending2.applicant } : {}
       });
+      const record10 = feishuAuthSelectionRecord(sel, sendAsUserRequested, data);
       await store.putVariable({
         key: FEISHU_AUTH_SELECTION_VAR,
-        value: JSON.stringify(feishuAuthSelectionRecord(sel, sendAsUserRequested, data)),
+        value: JSON.stringify(record10),
         ...claims.actorId ? { scope: "personal", actorId: claims.actorId } : { scope: "global" },
         connectorId: "feishu",
         encrypted: false
       });
+      if (pending2) {
+        const granted = record10.grantedScopes ? new Set(record10.grantedScopes) : null;
+        const still = granted ? pending2.pendingScopes.filter((x2) => !granted.has(x2)) : [];
+        if (still.length === 0) await clearFeishuPendingApproval(store, claims.actorId);
+        else {
+          const next = { ...pending2, pendingScopes: still };
+          delete next.approvedAt;
+          delete next.notice;
+          await writeFeishuPendingApproval(store, claims.actorId, next);
+        }
+      }
     });
     await deps.onRestored?.(claims, { openId: who.openId, ...who.name ? { userName: who.name } : {} }).catch((e) => warn(`onRestored: ${String(e)}`));
     return { state: "restored", ...who.name ? { userName: who.name } : {} };
@@ -24756,7 +24853,15 @@ function createFeishuReauth(deps) {
       if (!store) return { ok: false, status: 404, message: "\u627E\u4E0D\u5230\u8FD9\u4E2A\u94FE\u63A5\u6240\u5C5E\u7684\u7EC4\u7EC7\u3002" };
       const app = await appCredentials(store, claims.actorId);
       if (!app) return { ok: false, status: 409, message: "\u8FD9\u540D Agent \u7684\u98DE\u4E66\u5E94\u7528\u51ED\u636E\u5DF2\u4E0D\u5B58\u5728\uFF0C\u65E0\u6CD5\u91CD\u65B0\u6388\u6743\u3002\u8BF7\u5230 Oasis \u8FDE\u63A5\u5668\u9875\u91CD\u65B0\u8FDE\u63A5\u98DE\u4E66\u3002" };
-      const { sel, sendAsUser } = await reauthSelection(store, claims.actorId);
+      let picked;
+      if (claims.purpose === "supplement") {
+        const sup = await supplementSelection(store, claims.actorId);
+        if (!sup) return { ok: false, status: 410, message: "\u8FD9\u6B21\u8865\u6388\u6743\u5DF2\u7ECF\u5B8C\u6210\u6216\u5DF2\u5931\u6548\u3002\u8BF7\u5230 Oasis \u8BE5 Agent \u7684\u300C\u8FDE\u63A5\u5668\u300D\u9875\u67E5\u770B\uFF0C\u9700\u8981\u65F6\u91CD\u65B0\u8FDE\u63A5\u98DE\u4E66\u3002" };
+        picked = sup;
+      } else {
+        picked = await reauthSelection(store, claims.actorId);
+      }
+      const { sel, sendAsUser } = picked;
       const auth = await (deps.start ?? startFeishuDeviceAuthorization)({
         appId: app.appId,
         appSecret: app.appSecret,
@@ -24771,7 +24876,7 @@ function createFeishuReauth(deps) {
       const intervalSec = auth.interval ?? DEFAULT_POLL_INTERVAL_SEC;
       void watch(auth.deviceCode, entry, { store, ...app, sel, sendAsUser, intervalSec });
       const agentName = await deps.agentName?.(claims.companyId, claims.actorId).catch(() => void 0) ?? claims.actorId ?? "\u7EC4\u7EC7";
-      return { ok: true, verificationUrl: auth.verificationUrl, deviceCode: auth.deviceCode, agentName, intervalSec };
+      return { ok: true, verificationUrl: auth.verificationUrl, deviceCode: auth.deviceCode, agentName, intervalSec, purpose: claims.purpose };
     },
     /** 页面轮询结果。票与 deviceCode 必须是同一次 begin 发出来的。 */
     status(token2, deviceCode) {
@@ -24788,17 +24893,18 @@ function createFeishuReauth(deps) {
 function feishuReauthPageHtml(input) {
   const head = `<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>\u91CD\u65B0\u6388\u6743\u98DE\u4E66</title>
 <style>body{font-family:system-ui,-apple-system,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1.25rem;color:#1f2329;line-height:1.6}a.btn{display:inline-block;background:#1f2329;color:#fff;padding:.6rem 1.2rem;border-radius:.5rem;text-decoration:none}#s{margin-top:1.25rem}</style></head><body>`;
-  if (!input.ok) return `${head}<h2>\u65E0\u6CD5\u91CD\u65B0\u6388\u6743</h2><p>${escapeHtml(input.message)}</p></body></html>`;
-  const cfg = JSON.stringify({ t: input.token, d: input.deviceCode, i: Math.max(2, input.intervalSec) }).replace(/</g, "\\u003c");
-  return `${head}<h2>\u91CD\u65B0\u6388\u6743\u98DE\u4E66\uFF1A${escapeHtml(input.agentName)}</h2>
-<p>\u8BF7\u7528<strong>\u539F\u6388\u6743\u4EBA</strong>\u7684\u98DE\u4E66\u8D26\u53F7\u5B8C\u6210\u6388\u6743\u3002\u6362\u6210\u522B\u7684\u8D26\u53F7\u6388\u6743\u4F1A\u88AB\u62D2\u7EDD\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3002</p>
+  if (!input.ok) return `${head}<h2>\u65E0\u6CD5\u5B8C\u6210\u6388\u6743</h2><p>${escapeHtml(input.message)}</p></body></html>`;
+  const supplement = input.purpose === "supplement";
+  const cfg = JSON.stringify({ t: input.token, d: input.deviceCode, i: Math.max(2, input.intervalSec), s: supplement }).replace(/</g, "\\u003c");
+  return `${head}<h2>${supplement ? "\u8865\u6388\u6743\u98DE\u4E66\uFF08\u7BA1\u7406\u5458\u5DF2\u6279\u51C6\uFF09" : "\u91CD\u65B0\u6388\u6743\u98DE\u4E66"}\uFF1A${escapeHtml(input.agentName)}</h2>
+<p>\u8BF7\u7528<strong>${supplement ? "\u7533\u8BF7\u4EBA" : "\u539F\u6388\u6743\u4EBA"}</strong>\u7684\u98DE\u4E66\u8D26\u53F7\u5B8C\u6210\u6388\u6743\u3002\u6362\u6210\u522B\u7684\u8D26\u53F7\u6388\u6743\u4F1A\u88AB\u62D2\u7EDD\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3002</p>
 <p><a class="btn" href="${escapeHtml(input.verificationUrl)}" target="_blank" rel="noopener">\u53BB\u98DE\u4E66\u6388\u6743</a></p>
 <p id="s">\u7B49\u5F85\u4F60\u5728\u98DE\u4E66\u70B9\u300C\u6388\u6743\u300D\u2026</p>
 <script>(function(){var c=${cfg};var el=document.getElementById("s");
 function tick(){fetch("reauth/status",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({t:c.t,deviceCode:c.d})})
 .then(function(r){return r.json()}).then(function(b){
 if(b.state==="pending"){setTimeout(tick,c.i*1000);return}
-if(b.state==="restored"){el.textContent="\u5DF2\u6062\u590D\uFF1A"+(b.userName?b.userName+" \u7684":"")+"\u98DE\u4E66\u7528\u6237\u6388\u6743\u91CD\u65B0\u751F\u6548\uFF0C\u53EF\u4EE5\u5173\u6389\u8FD9\u4E2A\u9875\u9762\u4E86\u3002";return}
+if(b.state==="restored"){el.textContent=(c.s?"\u5DF2\u8865\u4E0A\uFF1A":"\u5DF2\u6062\u590D\uFF1A")+(b.userName?b.userName+" \u7684":"")+(c.s?"\u98DE\u4E66\u7528\u6237\u6388\u6743\u5DF2\u5305\u542B\u7BA1\u7406\u5458\u6279\u51C6\u7684\u6743\u9650":"\u98DE\u4E66\u7528\u6237\u6388\u6743\u91CD\u65B0\u751F\u6548")+"\uFF0C\u53EF\u4EE5\u5173\u6389\u8FD9\u4E2A\u9875\u9762\u4E86\u3002";return}
 el.textContent=b.message||"\u6388\u6743\u6CA1\u6709\u5B8C\u6210\uFF0C\u53EF\u4EE5\u91CD\u65B0\u70B9\u94FE\u63A5\u518D\u8BD5\u3002"}).catch(function(){setTimeout(tick,c.i*1000)})}
 setTimeout(tick,c.i*1000)})();</script></body></html>`;
 }
@@ -212197,6 +212303,42 @@ var init_feishu_module_access = __esm({
   }
 });
 
+// ../server/src/feishu-pending-approval.ts
+async function recordFeishuPendingApproval(input) {
+  const requested = scopesForSelection(input.selection, input.sendAsUserRequested);
+  let appScopes = null;
+  try {
+    appScopes = await (input.fetchScopes ?? fetchFeishuAppScopes)(input.appId, input.appSecret);
+  } catch (e) {
+    (input.warn ?? ((m2) => console.warn(`[feishu-oauth] ${m2}`)))(`\u5E94\u7528\u6743\u9650\u5217\u8868\u67E5\u8BE2\u5931\u8D25\uFF0C\u5F85\u5BA1\u6279\u6309\u514D\u5BA1\u96C6\u5408\u4F30\u7B97: ${String(e)}`);
+  }
+  const pendingScopes = feishuPendingApprovalScopes({ requested, granted: input.granted, appScopes });
+  if (pendingScopes.length === 0) {
+    if (input.granted) {
+      await withConnectorCredentialLock("feishu", input.actorId, () => clearFeishuPendingApproval(input.store, input.actorId));
+    }
+    return null;
+  }
+  const record10 = {
+    at: new Date(input.now).toISOString(),
+    appId: input.appId,
+    ...input.applicant ? { applicant: input.applicant } : {},
+    modules: input.selection.modules,
+    sendAsUser: input.selection.sendAsUser,
+    sendAsUserRequested: input.sendAsUserRequested,
+    pendingScopes
+  };
+  await withConnectorCredentialLock("feishu", input.actorId, () => writeFeishuPendingApproval(input.store, input.actorId, record10));
+  const modules = feishuPendingApprovalModules(record10);
+  return { modules, scopes: pendingScopes, notice: feishuPendingApprovalNotice(modules) };
+}
+var init_feishu_pending_approval = __esm({
+  "../server/src/feishu-pending-approval.ts"() {
+    "use strict";
+    init_src3();
+  }
+});
+
 // ../server/src/github-app-inventory.ts
 async function collectOasisGithubApps(svc) {
   const rows = (await svc.listVariables()).filter((r) => r.scope === "global" || r.scope === "personal");
@@ -218498,12 +218640,40 @@ ${composed}`;
               const pollSvc = await connectorActorsService();
               const appSecret = pollSvc ? await pollSvc.revealResolvedVariable("FEISHU_APP_SECRET", actorId) : null;
               if (!appSecret) throw new Error("FEISHU_APP_SECRET not found \u2014 please complete app setup first");
-              const polled = await pollFeishuDeviceToken({ appId, appSecret, deviceCode });
+              let polled;
+              try {
+                polled = await pollFeishuDeviceToken({ appId, appSecret, deviceCode });
+              } catch (e) {
+                if (!(e instanceof FeishuDeviceFlowError) || !pollSvc) throw e;
+                const pendingApproval2 = await recordFeishuPendingApproval({
+                  store: pollSvc,
+                  actorId,
+                  appId,
+                  appSecret,
+                  selection: startedSelection.selection,
+                  sendAsUserRequested: startedSelection.sendAsUserRequested,
+                  ...isHumanActorId(actor) ? { applicant: actor } : {},
+                  now: Date.now()
+                });
+                const expired = e.code === "expired_token" || e.code === "invalid_grant";
+                res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(pendingApproval2 ? {
+                  ok: false,
+                  final: true,
+                  pendingApproval: { modules: pendingApproval2.modules, scopes: pendingApproval2.scopes },
+                  notice: expired ? `\u6388\u6743\u9875\u5DF2\u8D85\u65F6\u3002\u5982\u679C\u4F60\u5728\u6388\u6743\u9875\u70B9\u4E86\u300C\u7533\u8BF7\u300D\uFF1A${pendingApproval2.notice}\u6CA1\u70B9\u7684\u8BDD\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u5373\u53EF\u3002` : pendingApproval2.notice
+                } : {
+                  ok: false,
+                  final: true,
+                  error: expired ? "\u6388\u6743\u8D85\u65F6\uFF08\u8BBE\u5907\u7801\u5DF2\u8FC7\u671F\uFF09\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u6388\u6743" : `\u98DE\u4E66\u6CA1\u6709\u5B8C\u6210\u6388\u6743\uFF08${e.message.slice(0, 200)}\uFF09\uFF0C\u53EF\u4EE5\u91CD\u65B0\u53D1\u8D77\u6388\u6743`
+                }));
+                return;
+              }
               if (polled.status === "pending") {
                 res.writeHead(200).end(JSON.stringify({ ok: false, error: "authorization_pending" }));
                 return;
               }
               const data = polled.data;
+              let pendingApproval = null;
               const svc = await connectorActorsService();
               if (svc) {
                 if (actorId) {
@@ -218528,6 +218698,23 @@ ${composed}`;
                   connectorId: "feishu",
                   encrypted: false
                 });
+                if (record10.grantedScopes) {
+                  try {
+                    pendingApproval = await recordFeishuPendingApproval({
+                      store: svc,
+                      actorId,
+                      appId,
+                      appSecret,
+                      selection: startedSelection.selection,
+                      sendAsUserRequested: startedSelection.sendAsUserRequested,
+                      ...isHumanActorId(actor) ? { applicant: actor } : {},
+                      granted: record10.grantedScopes,
+                      now: Date.now()
+                    });
+                  } catch (e) {
+                    console.error(`[feishu-oauth] \u5F85\u5BA1\u6279\u8BB0\u5F55\u5199\u5165\u5931\u8D25: ${String(e)}`);
+                  }
+                }
                 if (!who.openId) console.error("[feishu-oauth] user_info \u672A\u53D6\u5230\u6388\u6743\u4EBA open_id\uFF1A\u6388\u6743\u5931\u6548\u65F6\u65E0\u6CD5\u79C1\u4FE1\u672C\u4EBA\u3001\u4E5F\u7B7E\u4E0D\u51FA\u4E00\u952E\u91CD\u65B0\u6388\u6743\u94FE\u63A5");
                 try {
                   const secret = await svc.revealResolvedVariable("FEISHU_APP_SECRET", actorId);
@@ -218552,7 +218739,12 @@ ${composed}`;
                   }
                 }
               }
-              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true, appId, stored: true }));
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({
+                ok: true,
+                appId,
+                stored: true,
+                ...pendingApproval ? { pendingApproval: { modules: pendingApproval.modules, scopes: pendingApproval.scopes }, notice: pendingApproval.notice } : {}
+              }));
             } catch (e) {
               res.writeHead(500).end(JSON.stringify({ error: String(e) }));
             }
@@ -218895,6 +219087,7 @@ var init_server3 = __esm({
     init_child_live_turn();
     init_registry_audit_sink();
     init_feishu_module_access();
+    init_feishu_pending_approval();
     init_src3();
     init_github_app_inventory();
     init_github_app_timing();
@@ -287145,6 +287338,122 @@ function createConnectorRenewalRuntime(options) {
     }
     for (const k2 of handledThisSweep) if (JSON.parse(k2)[0] === companyId) handledThisSweep.delete(k2);
   };
+  const applicantOpenId = async (companyId, store, actorId, app, applicant) => {
+    if (!applicant || !isHumanActorId(applicant)) return null;
+    const by = await store.revealVariable(FEISHU_AUTHORIZED_BY_VAR, actorId).catch(() => null);
+    const stored = by === applicant ? await store.revealVariable(FEISHU_USER_OPEN_ID_VAR, actorId).catch(() => null) : null;
+    return stored || recoverOpenId(companyId, app, applicant);
+  };
+  const deliverApprovalNotice = async (companyId, store, actorId, pending, app) => {
+    const prev = pending.notice ?? { inApp: false, dm: "pending", attempts: 0 };
+    const state = { ...prev, attempts: prev.attempts + 1 };
+    const who = `actor=${actorId ?? "-"} \u7B2C ${state.attempts}/${MAX_NOTICE_ATTEMPTS} \u6B21`;
+    const name = await agentName(companyId, actorId);
+    const modules = feishuPendingApprovalModules(pending);
+    if (!state.inApp) {
+      try {
+        const ledger = await options.notifications(companyId);
+        if (!ledger) throw new Error("\u8BE5\u516C\u53F8\u7684\u901A\u77E5\u53F0\u8D26\u4E0D\u53EF\u7528");
+        const recipients = pending.applicant && isHumanActorId(pending.applicant) ? [pending.applicant] : (await recipientsFor(companyId, store, actorId)).recipients;
+        if (recipients.length === 0) throw new Error("\u6CA1\u6709\u6536\u4EF6\u4EBA\uFF08\u6CA1\u8BB0\u7533\u8BF7\u4EBA\u3001\u5458\u5DE5\u4E5F\u6CA1\u6709\u7ED1\u5B9A\u771F\u4EBA\uFF09");
+        const rows = [];
+        for (const recipient of recipients) {
+          rows.push(await ledger.insert({
+            recipient,
+            category: "connector",
+            kind: "feishu-approval-granted",
+            // 每次申请一条（键里带提交时刻）；同一次批准补发 / 重复扫描不重发（唯一约束）。
+            sourceKey: `connector:feishu:${actorId ?? "org"}@approved:${pending.at}`,
+            title: `\u7BA1\u7406\u5458\u5DF2\u6279\u51C6\u300C${name}\u300D\u7533\u8BF7\u7684\u98DE\u4E66\u6743\u9650\uFF0C\u8865\u6388\u6743\u540E\u5373\u53EF\u4F7F\u7528`,
+            ...actorId ? { actorId } : {},
+            enteredAt: pending.approvedAt ?? new Date(now()).toISOString()
+          }));
+        }
+        options.onNotifications?.(companyId, rows);
+        state.inApp = true;
+      } catch (err) {
+        options.warn(new Error(`\u98DE\u4E66\u6743\u9650\u6279\u51C6\u7AD9\u5185\u901A\u77E5\u672A\u5199\u5165\uFF08${who}\uFF0C\u4E0B\u4E00\u62CD\u91CD\u8BD5\uFF09: ${String(err)}`));
+      }
+    }
+    if (state.dm === "pending") {
+      try {
+        const openId = await applicantOpenId(companyId, store, actorId, app, pending.applicant);
+        if (!openId) {
+          state.dm = "unavailable";
+          console.warn(`[credential-refresh] \u98DE\u4E66\u6743\u9650\u6279\u51C6\u79C1\u4FE1\u65E0\u4ECE\u53D1\u51FA\uFF08${pending.applicant ? "\u901A\u8BAF\u5F55\u6CA1\u6309\u7533\u8BF7\u4EBA\u7684\u8D26\u53F7\u90AE\u7BB1\u627E\u5230\u4ED6" : "\u6CA1\u8BB0\u7533\u8BF7\u4EBA"}\uFF09actor=${actorId ?? "-"}\uFF1B\u53EA\u6709\u7AD9\u5185\u901A\u77E5\uFF0C\u9700\u5230\u8FDE\u63A5\u5668\u9875\u91CD\u65B0\u8FDE\u63A5`);
+        } else {
+          const token2 = options.links.issue({
+            companyId,
+            ...actorId ? { actorId } : {},
+            connectorId: "feishu",
+            purpose: "supplement",
+            subject: openId
+          });
+          const link = options.apiBase ? feishuReauthUrl(options.apiBase, token2) : void 0;
+          await notifyFeishuUser(store, actorId, feishuApprovalGrantedText({ agentName: name, modules, ...link ? { link } : {} }), openId);
+          state.dm = "sent";
+        }
+      } catch (err) {
+        options.warn(new Error(`\u98DE\u4E66\u6743\u9650\u6279\u51C6\u79C1\u4FE1\u53D1\u9001\u5931\u8D25\uFF08${who}\uFF0C\u4E0B\u4E00\u62CD\u91CD\u8BD5\uFF09: ${String(err)}`));
+      }
+    }
+    if ((!state.inApp || state.dm === "pending") && state.attempts >= MAX_NOTICE_ATTEMPTS) {
+      options.warn(new Error(`\u98DE\u4E66\u6743\u9650\u6279\u51C6\u901A\u77E5\u8865\u53D1 ${state.attempts} \u6B21\u4ECD\u672A\u9001\u5230\uFF0C\u653E\u5F03 actor=${actorId ?? "-"} \u7AD9\u5185=${String(state.inApp)} \u79C1\u4FE1=${state.dm}`));
+    }
+    return state;
+  };
+  const savePendingApproval = async (store, actorId, at2, next) => {
+    await withConnectorCredentialLock("feishu", actorId, async () => {
+      const current = await readFeishuPendingApproval(store, actorId);
+      if (current?.at !== at2) return;
+      if (next) await writeFeishuPendingApproval(store, actorId, next);
+      else await clearFeishuPendingApproval(store, actorId);
+    });
+  };
+  const checkPendingApproval = async (companyId, store, actorId) => {
+    const pending = await readFeishuPendingApproval(store, actorId);
+    if (!pending) return;
+    const t = now();
+    const app = await appCredentials(store, actorId);
+    if (!app || app.appId !== pending.appId) {
+      console.warn(`[credential-refresh] \u98DE\u4E66\u5F85\u5BA1\u6279\u8BB0\u5F55\u4F5C\u5E9F\uFF08\u5E94\u7528\u51ED\u636E${app ? "\u5DF2\u6362\u6210\u522B\u7684\u5E94\u7528" : "\u4E0D\u5B58\u5728"}\uFF09actor=${actorId ?? "-"}`);
+      await savePendingApproval(store, actorId, pending.at, null);
+      return;
+    }
+    let next;
+    if (!pending.approvedAt) {
+      if (t - Date.parse(pending.at) > FEISHU_PENDING_APPROVAL_WATCH_MS) {
+        options.warn(new Error(`\u98DE\u4E66\u5F85\u5BA1\u6279 ${pending.at} \u8D77 30 \u5929\u672A\u68C0\u6D4B\u5230\u6279\u51C6\uFF0C\u4E0D\u518D\u68C0\u6D4B actor=${actorId ?? "-"} \u6743\u9650=${pending.pendingScopes.join(",")}`));
+        await savePendingApproval(store, actorId, pending.at, null);
+        return;
+      }
+      const scopes = await (options.fetchAppScopes ?? fetchFeishuAppScopes)(app.appId, app.appSecret);
+      if (!feishuPendingApprovalSettled(pending, scopes)) return;
+      next = { ...pending, approvedAt: new Date(t).toISOString(), notice: { inApp: false, dm: "pending", attempts: 0 } };
+      console.warn(`[credential-refresh] \u98DE\u4E66\u5F85\u5BA1\u6279\u5DF2\u6279\u51C6 actor=${actorId ?? "-"} \u6743\u9650=${pending.pendingScopes.join(",")}`);
+    } else {
+      if (t - Date.parse(pending.approvedAt) > FEISHU_APPROVED_SUPPLEMENT_KEEP_MS) {
+        await savePendingApproval(store, actorId, pending.at, null);
+        return;
+      }
+      const n = pending.notice;
+      if (!n || n.inApp && n.dm !== "pending" || n.attempts >= MAX_NOTICE_ATTEMPTS) return;
+      next = pending;
+    }
+    await savePendingApproval(store, actorId, pending.at, { ...next, notice: await deliverApprovalNotice(companyId, store, actorId, next, app) });
+  };
+  const checkPendingApprovals = async (companyId, store) => {
+    const svc = await options.actors(companyId);
+    if (!svc) return;
+    const ids2 = [void 0, ...(await svc.listActors({ status: "active" })).map((a) => a.id)];
+    for (const actorId of ids2) {
+      try {
+        await checkPendingApproval(companyId, store, actorId);
+      } catch (err) {
+        options.warn(new Error(`\u98DE\u4E66\u5F85\u5BA1\u6279\u68C0\u6D4B\u5931\u8D25\uFF08\u4E0B\u4E00\u62CD\u91CD\u8BD5\uFF09actor=${actorId ?? "-"}: ${String(err)}`));
+      }
+    }
+  };
   const onFeishuRenewed = async (e, store) => {
     if (await store.revealVariable(FEISHU_USER_OPEN_ID_VAR, e.actorId)) return;
     const accessToken = e.outcome.credentials?.["user_access_token"];
@@ -287183,7 +287492,13 @@ function createConnectorRenewalRuntime(options) {
     onRenewed: async (e, store) => {
       if (e.connector.config.slug === "feishu") await onFeishuRenewed(e, store);
     },
-    afterCompany: retryPendingNotices,
+    afterCompany: async (companyId, store) => {
+      try {
+        await retryPendingNotices(companyId, store);
+      } finally {
+        await checkPendingApprovals(companyId, store);
+      }
+    },
     warn: options.warn,
     ...options.now ? { now: options.now } : {}
   });
@@ -287195,7 +287510,7 @@ function createConnectorRenewalRuntime(options) {
       const store = await options.actors(claims.companyId);
       if (!store) return;
       const name = await agentName(claims.companyId, claims.actorId);
-      await notifyFeishuUser(store, claims.actorId, `\u300C${name}\u300D\u7684\u98DE\u4E66\u7528\u6237\u6388\u6743\u5DF2\u6062\u590D\u3002`).catch(() => void 0);
+      await notifyFeishuUser(store, claims.actorId, claims.purpose === "supplement" ? `\u300C${name}\u300D\u7684\u98DE\u4E66\u6743\u9650\u5DF2\u8865\u4E0A\uFF0C\u7BA1\u7406\u5458\u6279\u51C6\u7684\u529F\u80FD\u73B0\u5728\u53EF\u4EE5\u4F7F\u7528\u4E86\u3002` : `\u300C${name}\u300D\u7684\u98DE\u4E66\u7528\u6237\u6388\u6743\u5DF2\u6062\u590D\u3002`).catch(() => void 0);
     },
     onRejected: async (claims, who) => {
       const store = await options.actors(claims.companyId);
@@ -301084,7 +301399,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.113" ? "2.2.113" : "dev";
+var CLI_VERSION = "2.2.114" ? "2.2.114" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -305255,7 +305570,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.113" : "dev";
+var PKG_VERSION = true ? "2.2.114" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.113",
+  "version": "2.2.114",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "590c9d80c3286fa10fdb0eb14de96140b1520130"
+    "sourceHead": "46e4f9275679ea8eec37f0f1e30b45cc48e3e70c"
   }
 }