oasis_test_v2 2.2.115 → 2.2.117

package/dist/feishu/wrapper.sh

@@ -51,15 +51,17 @@ feishu_reply_blocked() {
 feishu_blocked() {
   # $1 = 规则要求的模块（逗号分隔，空 = 不属于任何模块）；$2 = 给人看的命令写法（已过滤成安全字符）。
   local mods="$1" shown="$2" need="" m entry label
-  local reconnect="请让配置人在 Oasis 里这个 agent 的飞书连接器详情点「重新连接」"
+  # 只勾模块、保存即可让机器人身份可用，不需要用户授权；用户身份才要本人另行授权。
+  local pick="请让配置人在 Oasis 里这个 agent 的飞书连接器详情「接入功能」"
+  local bot_ok="保存后机器人身份即可调用（不需要用户授权，应用须已开通对应权限）；只有需要以用户身份调用时，才需本人在同一处「去授权 / 重新授权」"
   case "${OASIS_FEISHU_POLICY:-}" in
     ok) ;;
     none)
       feishu_reply_blocked "本 agent 的飞书连接器还没有保存过可用模块的选择，Oasis 按「一个模块都没开放」处理，${shown} 已被拦下（机器人与用户身份都不可用）。" \
-        "${reconnect}，勾选需要的模块后完成授权。" ;;
+        "${pick}勾选需要的模块并保存；${bot_ok}。" ;;
     invalid)
       feishu_reply_blocked "本 agent 的飞书连接器保存的模块选择无法识别，Oasis 按「一个模块都没开放」处理，${shown} 已被拦下（机器人与用户身份都不可用）。" \
-        "${reconnect}，重新勾选模块后完成授权。" ;;
+        "${pick}重新勾选模块并保存；${bot_ok}。" ;;
     *)
       feishu_reply_blocked "本次运行没有拿到飞书模块放行表，Oasis 不放行 ${shown}（机器人与用户身份都不可用）。" \
         "请重新发起任务；仍出现请联系 Oasis 管理员检查飞书连接器。" ;;
@@ -73,7 +75,7 @@ feishu_blocked() {
       need="${need:+${need}」或「}${label}"
     done
     feishu_reply_blocked "本 agent 的飞书连接器没有开放「${need}」模块，${shown} 已被 Oasis 拦下（机器人与用户身份都不可用）。当前开放的模块：${OASIS_FEISHU_MODULES:-无}。" \
-      "如需使用，${reconnect}，勾选「${need}」后完成授权。"
+      "如需使用，${pick}点「调整接入功能」勾选「${need}」并保存；${bot_ok}。"
   fi
   feishu_reply_blocked "${shown} 不属于任何可勾选的飞书功能模块；本 agent 的飞书调用已按模块限制，Oasis 不放行它。当前开放的模块：${OASIS_FEISHU_MODULES:-无}。" \
     "请改用已开放模块对应的 lark-cli 命令；共用的 drive 子命令须紧跟在 drive 之后写。确需此能力请联系 Oasis 管理员。"

package/dist/index.js

@@ -20789,6 +20789,9 @@ ${input.link}` : `${head}
 function feishuPendingApprovalNotice(modules) {
   return `${moduleNames(modules)}\u542B\u9700\u98DE\u4E66\u7BA1\u7406\u5458\u5BA1\u6279\u7684\u6743\u9650\uFF0C\u5DF2\u63D0\u4EA4\u5BA1\u6279\u3002\u6279\u51C6\u540E\u4F1A\u5728\u98DE\u4E66\u79C1\u4FE1\u901A\u77E5\u4F60\uFF0C\u70B9\u4E00\u4E0B\u5373\u53EF\u8865\u4E0A\u8FD9\u90E8\u5206\u6743\u9650\uFF1B\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\u4E0D\u53D7\u5F71\u54CD\u3002`;
 }
+function feishuPendingApprovalKeptNotice(modules) {
+  return `${moduleNames(modules)}\u542B\u9700\u98DE\u4E66\u7BA1\u7406\u5458\u5BA1\u6279\u7684\u6743\u9650\uFF0C\u5DF2\u63D0\u4EA4\u5BA1\u6279\u3002\u98DE\u4E66\u8FD9\u4E00\u8F6E\u7ED9\u7684\u6388\u6743\u4E0D\u5305\u542B\u4F60\u73B0\u6709\u6388\u6743\u7684\u5168\u90E8\u6743\u9650\uFF0C\u4E3A\u4E0D\u5F71\u54CD\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3001\u8FD9\u4E00\u8F6E\u7684\u6388\u6743\u6CA1\u6709\u4FDD\u5B58\u3002\u6279\u51C6\u540E\u4F1A\u5728\u98DE\u4E66\u79C1\u4FE1\u901A\u77E5\u4F60\uFF0C\u70B9\u4E00\u4E0B\u5373\u53EF\u4E00\u5E76\u8865\u4E0A\u3002`;
+}
 function feishuApprovalUnconfirmedNotice(modules, expired) {
   return `${expired ? "\u6388\u6743\u9875\u5DF2\u8D85\u65F6\uFF0C" : ""}\u98DE\u4E66\u8FD9\u4E00\u8F6E\u6CA1\u6709\u7ED9\u51FA\u6388\u6743\uFF0COasis \u65E0\u6CD5\u786E\u8BA4\u4F60\u662F\u5426\u5728\u6388\u6743\u9875\u5BF9${moduleNames(modules)}\u7684\u6743\u9650\u70B9\u4E86\u300C\u7533\u8BF7\u300D\u3002\u5982\u679C\u70B9\u4E86\uFF0C\u8BF7\u9009\u300C\u6211\u70B9\u4E86\u7533\u8BF7\u300D\uFF0C\u6279\u51C6\u540E\u4F1A\u5728\u98DE\u4E66\u79C1\u4FE1\u901A\u77E5\u4F60\u8865\u6388\u6743\uFF1B\u6CA1\u70B9\uFF08\u6216\u70B9\u7684\u662F\u62D2\u7EDD\uFF09\u7684\u8BDD\u91CD\u65B0\u53D1\u8D77\u6388\u6743\u5373\u53EF\u3002\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\u4E0D\u53D7\u5F71\u54CD\u3002`;
 }
@@ -24751,6 +24754,74 @@ var init_src3 = __esm({
   }
 });
 
+// ../server/src/feishu-pending-approval.ts
+async function recordFeishuPendingApproval(input) {
+  const pendingScopes = input.pendingScopes ?? await pendingApprovalScopes(input);
+  if (pendingScopes.length === 0) {
+    if (input.granted) {
+      await withConnectorCredentialLock("feishu", input.actorId, () => clearFeishuPendingApproval(input.store, input.actorId));
+    }
+    return null;
+  }
+  const record10 = {
+    at: new Date(input.now).toISOString(),
+    appId: input.appId,
+    ...input.applicant ? { applicant: input.applicant } : {},
+    modules: input.selection.modules,
+    sendAsUser: input.selection.sendAsUser,
+    sendAsUserRequested: input.sendAsUserRequested,
+    pendingScopes
+  };
+  await withConnectorCredentialLock("feishu", input.actorId, () => writeFeishuPendingApproval(input.store, input.actorId, record10));
+  const modules = feishuPendingApprovalModules(record10);
+  return { modules, scopes: pendingScopes, notice: input.keptExisting ? feishuPendingApprovalKeptNotice(modules) : feishuPendingApprovalNotice(modules) };
+}
+function feishuStillPendingScopes(input) {
+  return pendingApprovalScopes(input);
+}
+async function pendingApprovalScopes(input) {
+  const requested = scopesForSelection(input.selection, input.sendAsUserRequested);
+  let appScopes = null;
+  try {
+    appScopes = await (input.fetchScopes ?? fetchFeishuAppScopes)(input.appId, input.appSecret);
+  } catch (e) {
+    (input.warn ?? ((m2) => console.warn(`[feishu-oauth] ${m2}`)))(`\u5E94\u7528\u6743\u9650\u5217\u8868\u67E5\u8BE2\u5931\u8D25\uFF0C\u5F85\u5BA1\u6279\u6309\u514D\u5BA1\u96C6\u5408\u4F30\u7B97: ${String(e)}`);
+  }
+  return feishuPendingApprovalScopes({ requested, granted: input.granted, appScopes });
+}
+async function assessFeishuApprovalUnconfirmed(input) {
+  const scopes = await pendingApprovalScopes(input);
+  if (scopes.length === 0) return null;
+  const modules = feishuPendingApprovalModules({ modules: input.selection.modules, pendingScopes: scopes });
+  return { modules, scopes, notice: feishuApprovalUnconfirmedNotice(modules, input.expired) };
+}
+async function feishuExistingGrantAtRisk(input) {
+  const { store, actorId } = input;
+  const read3 = (key2) => store.revealVariable(key2, actorId).catch(() => null);
+  if (await read3(FEISHU_USER_AUTH_INVALID_VAR)) return { keep: false };
+  if (await store.revealResolvedVariable("FEISHU_APP_ID", actorId).catch(() => null) !== input.appId) return { keep: false };
+  const alive2 = (token2, expiresAt2) => !!token2 && (!expiresAt2 || !Number.isFinite(Number(expiresAt2)) || Number(expiresAt2) > input.now);
+  const usable = alive2(await read3("FEISHU_REFRESH_TOKEN"), await read3("FEISHU_REFRESH_TOKEN_EXPIRES_AT")) || !!await read3("FEISHU_USER_TOKEN_EXPIRES_AT") && alive2(await read3("FEISHU_USER_ACCESS_TOKEN"), await read3("FEISHU_USER_TOKEN_EXPIRES_AT"));
+  if (!usable) return { keep: false };
+  let oldGranted = null;
+  try {
+    const rec2 = JSON.parse(await read3(FEISHU_AUTH_SELECTION_VAR) ?? "null");
+    if (Array.isArray(rec2?.grantedScopes)) oldGranted = rec2.grantedScopes.filter((s2) => typeof s2 === "string");
+  } catch {
+  }
+  if (!input.newGranted) return { keep: true, missing: null };
+  if (!oldGranted) return { keep: true, missing: null };
+  const granted = new Set(input.newGranted);
+  const missing = oldGranted.filter((s2) => s2 !== "offline_access" && !granted.has(s2));
+  return missing.length > 0 ? { keep: true, missing } : { keep: false };
+}
+var init_feishu_pending_approval = __esm({
+  "../server/src/feishu-pending-approval.ts"() {
+    "use strict";
+    init_src3();
+  }
+});
+
 // ../server/src/feishu-reauth.ts
 async function supplementSelection(store, actorId) {
   const pending = await readFeishuPendingApproval(store, actorId);
@@ -24787,7 +24858,7 @@ function createFeishuReauth(deps) {
     const appSecret = await store.revealResolvedVariable("FEISHU_APP_SECRET", actorId);
     return appId && appSecret ? { appId, appSecret } : null;
   };
-  const settle = async (claims, store, data, sel, sendAsUserRequested) => {
+  const settle = async (claims, store, data, sel, sendAsUserRequested, appId) => {
     const who = await (deps.identity ?? fetchFeishuUserIdentity)(String(data["access_token"] ?? ""));
     if (!who.openId) {
       return { state: "error", message: "\u6388\u6743\u5B8C\u6210\u4E86\uFF0C\u4F46\u6CA1\u80FD\u5411\u98DE\u4E66\u786E\u8BA4\u6388\u6743\u4EBA\u662F\u8C01\uFF0C\u672C\u6B21\u6388\u6743\u672A\u4FDD\u5B58\u3002\u8BF7\u7A0D\u540E\u91CD\u65B0\u70B9\u94FE\u63A5\u518D\u8BD5\u3002" };
@@ -24801,59 +24872,61 @@ function createFeishuReauth(deps) {
     }
     const supplement = await withConnectorCredentialLock("feishu", claims.actorId, async () => {
       const pending2 = claims.purpose === "supplement" ? await readFeishuPendingApproval(store, claims.actorId) : null;
-      await persistFeishuUserAuthorization(store, claims.actorId, data, now(), {
-        openId: who.openId,
-        ...who.name ? { userName: who.name } : {},
-        ...pending2?.applicant ? { authorizedBy: pending2.applicant } : {}
-      });
       const record10 = feishuAuthSelectionRecord(sel, sendAsUserRequested, data);
-      await store.putVariable({
-        key: FEISHU_AUTH_SELECTION_VAR,
-        value: JSON.stringify(record10),
-        ...claims.actorId ? { scope: "personal", actorId: claims.actorId } : { scope: "global" },
-        connectorId: "feishu",
-        encrypted: false
-      });
-      if (claims.purpose !== "supplement") return null;
-      if (!record10.grantedScopes) return "unknown";
-      if (!pending2) {
-        const granted2 = new Set(record10.grantedScopes);
-        const wanted = scopesForSelection(sel, sendAsUserRequested).filter((x2) => x2 !== "offline_access");
-        return wanted.every((x2) => granted2.has(x2)) ? "complete" : "short";
-      }
-      const granted = new Set(record10.grantedScopes);
-      const still = pending2.pendingScopes.filter((x2) => !granted.has(x2));
-      if (still.length === 0) {
-        await clearFeishuPendingApproval(store, claims.actorId);
-        return "complete";
-      }
-      const next = { ...pending2, pendingScopes: still };
-      delete next.approvedAt;
-      delete next.notice;
-      await writeFeishuPendingApproval(store, claims.actorId, next);
-      return "partial";
+      let outcome = null;
+      let still = [];
+      if (claims.purpose === "supplement") {
+        if (!record10.grantedScopes) {
+          outcome = "unknown";
+        } else if (!pending2) {
+          const granted = new Set(record10.grantedScopes);
+          const wanted = scopesForSelection(sel, sendAsUserRequested).filter((x2) => x2 !== "offline_access");
+          outcome = wanted.every((x2) => granted.has(x2)) ? "complete" : "short";
+        } else {
+          const granted = new Set(record10.grantedScopes);
+          still = pending2.pendingScopes.filter((x2) => !granted.has(x2));
+          outcome = still.length === 0 ? "complete" : "partial";
+        }
+      }
+      const kept = outcome !== null && outcome !== "complete" && (await feishuExistingGrantAtRisk({
+        store,
+        actorId: claims.actorId,
+        appId,
+        ...record10.grantedScopes ? { newGranted: record10.grantedScopes } : {},
+        now: now()
+      })).keep;
+      if (!kept) {
+        await persistFeishuUserAuthorization(store, claims.actorId, data, now(), {
+          openId: who.openId,
+          ...who.name ? { userName: who.name } : {},
+          ...pending2?.applicant ? { authorizedBy: pending2.applicant } : {}
+        });
+        await store.putVariable({
+          key: FEISHU_AUTH_SELECTION_VAR,
+          value: JSON.stringify(record10),
+          ...claims.actorId ? { scope: "personal", actorId: claims.actorId } : { scope: "global" },
+          connectorId: "feishu",
+          encrypted: false
+        });
+      }
+      if (outcome === "complete" && pending2) await clearFeishuPendingApproval(store, claims.actorId);
+      if (outcome === "partial" && pending2) {
+        const next = { ...pending2, pendingScopes: still };
+        delete next.approvedAt;
+        delete next.notice;
+        await writeFeishuPendingApproval(store, claims.actorId, next);
+      }
+      return outcome === null ? null : { outcome, kept };
     });
     const userName = who.name ? { userName: who.name } : {};
-    if (supplement === "partial") {
-      return {
-        state: "incomplete",
-        ...userName,
-        message: "\u6388\u6743\u5DF2\u4FDD\u5B58\uFF0C\u4F46\u98DE\u4E66\u8FD9\u6B21\u6CA1\u6709\u7ED9\u9F50\u7BA1\u7406\u5458\u6279\u51C6\u7684\u6743\u9650\uFF0C\u8FD8\u5DEE\u7684\u90E8\u5206\u7EE7\u7EED\u7B49\u5F85\u5BA1\u6279\uFF1B\u6279\u51C6\u540E\u4F1A\u518D\u79C1\u4FE1\u901A\u77E5\u4F60\u3002\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\u4E0D\u53D7\u5F71\u54CD\u3002"
-      };
-    }
-    if (supplement === "short") {
-      return {
-        state: "incomplete",
-        ...userName,
-        message: "\u6388\u6743\u5DF2\u4FDD\u5B58\uFF0C\u4F46\u98DE\u4E66\u8FD9\u6B21\u6CA1\u6709\u7ED9\u9F50\u6240\u7533\u8BF7\u7684\u6743\u9650\u3002\u53EF\u5728 Oasis \u8FDE\u63A5\u5668\u8BE6\u60C5\u67E5\u770B\u5DF2\u5F00\u901A\u7684\u529F\u80FD\uFF0C\u9700\u8981\u65F6\u91CD\u65B0\u8FDE\u63A5\u98DE\u4E66\u3002"
-      };
-    }
-    if (supplement === "unknown") {
-      return {
-        state: "incomplete",
-        ...userName,
-        message: "\u6388\u6743\u5DF2\u4FDD\u5B58\uFF0C\u4F46\u98DE\u4E66\u6CA1\u6709\u56DE\u62A5\u8FD9\u6B21\u6388\u4E88\u4E86\u54EA\u4E9B\u6743\u9650\uFF0C\u65E0\u6CD5\u786E\u8BA4\u7BA1\u7406\u5458\u6279\u51C6\u7684\u6743\u9650\u662F\u5426\u5DF2\u8865\u4E0A\u3002\u53EF\u5728 Oasis \u8FDE\u63A5\u5668\u8BE6\u60C5\u67E5\u770B\uFF1B\u4ECD\u663E\u793A\u5F85\u8865\u6388\u6743\u7684\u8BDD\uFF0C\u518D\u70B9\u4E00\u6B21\u94FE\u63A5\u5373\u53EF\u3002"
-      };
+    if (supplement && supplement.outcome !== "complete") {
+      const saved = supplement.kept ? "\u4E3A\u4E0D\u5F71\u54CD\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3001\u8FD9\u6B21\u6388\u6743\u6CA1\u6709\u4FDD\u5B58\uFF08\u98DE\u4E66\u8FD9\u6B21\u7ED9\u7684\u6388\u6743\u4E0D\u5305\u542B\u4F60\u73B0\u6709\u6388\u6743\u7684\u5168\u90E8\u6743\u9650\uFF09\u3002" : "\u6388\u6743\u5DF2\u4FDD\u5B58\u3002";
+      const message = {
+        partial: `\u98DE\u4E66\u8FD9\u6B21\u6CA1\u6709\u7ED9\u9F50\u7BA1\u7406\u5458\u6279\u51C6\u7684\u6743\u9650\uFF0C\u8FD8\u5DEE\u7684\u90E8\u5206\u7EE7\u7EED\u7B49\u5F85\u5BA1\u6279\uFF0C\u6279\u51C6\u540E\u4F1A\u518D\u79C1\u4FE1\u901A\u77E5\u4F60\u3002${saved}`,
+        short: `\u98DE\u4E66\u8FD9\u6B21\u6CA1\u6709\u7ED9\u9F50\u6240\u7533\u8BF7\u7684\u6743\u9650\u3002${saved}\u53EF\u5728 Oasis \u8FDE\u63A5\u5668\u8BE6\u60C5\u67E5\u770B\u5DF2\u5F00\u901A\u7684\u529F\u80FD\uFF0C\u9700\u8981\u65F6\u91CD\u65B0\u8FDE\u63A5\u98DE\u4E66\u3002`,
+        unknown: `\u98DE\u4E66\u6CA1\u6709\u56DE\u62A5\u8FD9\u6B21\u6388\u4E88\u4E86\u54EA\u4E9B\u6743\u9650\uFF0C\u65E0\u6CD5\u786E\u8BA4\u7BA1\u7406\u5458\u6279\u51C6\u7684\u6743\u9650\u662F\u5426\u5DF2\u8865\u4E0A\u3002${saved}\u53EF\u5728 Oasis \u8FDE\u63A5\u5668\u8BE6\u60C5\u67E5\u770B\uFF1B\u4ECD\u663E\u793A\u5F85\u8865\u6388\u6743\u7684\u8BDD\uFF0C\u518D\u70B9\u4E00\u6B21\u94FE\u63A5\u5373\u53EF\u3002`
+      }[supplement.outcome];
+      return { state: "incomplete", ...userName, message };
     }
     await deps.onRestored?.(claims, { openId: who.openId, ...userName }).catch((e) => warn(`onRestored: ${String(e)}`));
     return { state: "restored", ...who.name ? { userName: who.name } : {} };
@@ -24864,7 +24937,7 @@ function createFeishuReauth(deps) {
       try {
         const r = await (deps.poll ?? pollFeishuDeviceToken)({ appId: ctx.appId, appSecret: ctx.appSecret, deviceCode });
         if (r.status === "pending") continue;
-        entry.result = await settle(entry.claims, ctx.store, r.data, ctx.sel, ctx.sendAsUser);
+        entry.result = await settle(entry.claims, ctx.store, r.data, ctx.sel, ctx.sendAsUser, ctx.appId);
         return;
       } catch (e) {
         entry.result = { state: "error", message: `\u98DE\u4E66\u6CA1\u6709\u5B8C\u6210\u6388\u6743\uFF1A${String(e?.message ?? e).slice(0, 200)}\u3002\u53EF\u4EE5\u91CD\u65B0\u70B9\u94FE\u63A5\u518D\u8BD5\u3002` };
@@ -24959,6 +25032,7 @@ var init_feishu_reauth = __esm({
   "../server/src/feishu-reauth.ts"() {
     "use strict";
     init_src3();
+    init_feishu_pending_approval();
     DEFAULT_DEVICE_CODE_TTL_SEC = 240;
     DEFAULT_POLL_INTERVAL_SEC = 5;
     escapeHtml = (s2) => s2.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
@@ -212364,51 +212438,6 @@ var init_feishu_module_access = __esm({
   }
 });
 
-// ../server/src/feishu-pending-approval.ts
-async function recordFeishuPendingApproval(input) {
-  const pendingScopes = await pendingApprovalScopes(input);
-  if (pendingScopes.length === 0) {
-    if (input.granted) {
-      await withConnectorCredentialLock("feishu", input.actorId, () => clearFeishuPendingApproval(input.store, input.actorId));
-    }
-    return null;
-  }
-  const record10 = {
-    at: new Date(input.now).toISOString(),
-    appId: input.appId,
-    ...input.applicant ? { applicant: input.applicant } : {},
-    modules: input.selection.modules,
-    sendAsUser: input.selection.sendAsUser,
-    sendAsUserRequested: input.sendAsUserRequested,
-    pendingScopes
-  };
-  await withConnectorCredentialLock("feishu", input.actorId, () => writeFeishuPendingApproval(input.store, input.actorId, record10));
-  const modules = feishuPendingApprovalModules(record10);
-  return { modules, scopes: pendingScopes, notice: feishuPendingApprovalNotice(modules) };
-}
-async function pendingApprovalScopes(input) {
-  const requested = scopesForSelection(input.selection, input.sendAsUserRequested);
-  let appScopes = null;
-  try {
-    appScopes = await (input.fetchScopes ?? fetchFeishuAppScopes)(input.appId, input.appSecret);
-  } catch (e) {
-    (input.warn ?? ((m2) => console.warn(`[feishu-oauth] ${m2}`)))(`\u5E94\u7528\u6743\u9650\u5217\u8868\u67E5\u8BE2\u5931\u8D25\uFF0C\u5F85\u5BA1\u6279\u6309\u514D\u5BA1\u96C6\u5408\u4F30\u7B97: ${String(e)}`);
-  }
-  return feishuPendingApprovalScopes({ requested, granted: input.granted, appScopes });
-}
-async function assessFeishuApprovalUnconfirmed(input) {
-  const scopes = await pendingApprovalScopes(input);
-  if (scopes.length === 0) return null;
-  const modules = feishuPendingApprovalModules({ modules: input.selection.modules, pendingScopes: scopes });
-  return { modules, scopes, notice: feishuApprovalUnconfirmedNotice(modules, input.expired) };
-}
-var init_feishu_pending_approval = __esm({
-  "../server/src/feishu-pending-approval.ts"() {
-    "use strict";
-    init_src3();
-  }
-});
-
 // ../server/src/github-app-inventory.ts
 async function collectOasisGithubApps(svc) {
   const rows = (await svc.listVariables()).filter((r) => r.scope === "global" || r.scope === "personal");
@@ -218811,6 +218840,44 @@ ${composed}`;
               const data = polled.data;
               let pendingApproval = null;
               const svc = await connectorActorsService();
+              const grantedNow = feishuAuthSelectionRecord(startedSelection.selection, startedSelection.sendAsUserRequested, data).grantedScopes;
+              let stillPending;
+              if (svc) {
+                stillPending = await feishuStillPendingScopes({
+                  appId,
+                  appSecret,
+                  selection: startedSelection.selection,
+                  sendAsUserRequested: startedSelection.sendAsUserRequested,
+                  ...grantedNow ? { granted: grantedNow } : {}
+                });
+                const risk = stillPending.length > 0 ? await feishuExistingGrantAtRisk({ store: svc, actorId, appId, ...grantedNow ? { newGranted: grantedNow } : {}, now: Date.now() }) : { keep: false };
+                if (risk.keep) {
+                  console.error(`[feishu-oauth] \u65B0 token \u672A\u8BC1\u5B9E\u5305\u542B\u5DF2\u6709\u6388\u6743\uFF08\u7F3A ${risk.missing?.join(" ") ?? "\u672A\u56DE\u62A5 scope"}\uFF09\uFF0C\u4FDD\u7559\u539F\u6388\u6743\u3001\u4E0D\u843D\u65B0 token`);
+                  const kept = grantedNow ? await recordFeishuPendingApproval({
+                    store: svc,
+                    actorId,
+                    appId,
+                    appSecret,
+                    selection: startedSelection.selection,
+                    sendAsUserRequested: startedSelection.sendAsUserRequested,
+                    ...isHumanActorId(actor) ? { applicant: actor } : {},
+                    granted: grantedNow,
+                    pendingScopes: stillPending,
+                    keptExisting: true,
+                    now: Date.now()
+                  }).catch((e) => {
+                    console.error(`[feishu-oauth] \u5F85\u5BA1\u6279\u8BB0\u5F55\u5199\u5165\u5931\u8D25: ${String(e)}`);
+                    return null;
+                  }) : null;
+                  res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(kept ? { ok: false, final: true, keptExisting: true, pendingApproval: { modules: kept.modules, scopes: kept.scopes }, notice: kept.notice } : {
+                    ok: false,
+                    final: true,
+                    keptExisting: true,
+                    error: grantedNow ? "\u98DE\u4E66\u8FD9\u4E00\u8F6E\u7ED9\u7684\u6388\u6743\u4E0D\u5305\u542B\u4F60\u73B0\u6709\u6388\u6743\u7684\u5168\u90E8\u6743\u9650\uFF0C\u4E3A\u4E0D\u5F71\u54CD\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3001\u8FD9\u4E00\u8F6E\u7684\u6388\u6743\u6CA1\u6709\u4FDD\u5B58\u3002" : "\u98DE\u4E66\u6CA1\u6709\u56DE\u62A5\u8FD9\u4E00\u8F6E\u6388\u4E88\u4E86\u54EA\u4E9B\u6743\u9650\uFF0C\u65E0\u6CD5\u786E\u8BA4\u662F\u5426\u5305\u542B\u4F60\u73B0\u6709\u6388\u6743\u7684\u5168\u90E8\u6743\u9650\u3002\u4E3A\u4E0D\u5F71\u54CD\u5DF2\u6709\u7684\u98DE\u4E66\u80FD\u529B\uFF0C\u539F\u6388\u6743\u4FDD\u6301\u4E0D\u53D8\u3001\u8FD9\u4E00\u8F6E\u7684\u6388\u6743\u6CA1\u6709\u4FDD\u5B58\u3002"
+                  }));
+                  return;
+                }
+              }
               if (svc) {
                 if (actorId) {
                   await svc.putVariable({ key: "FEISHU_APP_ID", value: appId, scope: "personal", actorId, connectorId: "feishu", encrypted: true });
@@ -218845,6 +218912,7 @@ ${composed}`;
                       sendAsUserRequested: startedSelection.sendAsUserRequested,
                       ...isHumanActorId(actor) ? { applicant: actor } : {},
                       granted: record10.grantedScopes,
+                      ...stillPending ? { pendingScopes: stillPending } : {},
                       now: Date.now()
                     });
                   } catch (e) {
@@ -301535,7 +301603,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.115" ? "2.2.115" : "dev";
+var CLI_VERSION = "2.2.117" ? "2.2.117" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -305706,7 +305774,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.115" : "dev";
+var PKG_VERSION = true ? "2.2.117" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.115",
+  "version": "2.2.117",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "9c025c6edd39870a4e40a29026007109bbec04cf"
+    "sourceHead": "5abfe31a5f1f2ad0ffa56221ddd536173a1c8f62"
   }
 }