Secure remote Feishu TUI watch over tunnel

[ApolloZhangOnGithub]

Problem

Feishu remote control is not credible if the user can only send messages but cannot inspect the live TUI from a phone. The current bridge can start a local read-only Web TUI, but the safe remote story needs explicit product support instead of an ad hoc localhost link.

Current stopgap

• Reuse the existing ngrok webhook tunnel instead of starting a second public tunnel.
• Serve a read-only /watch route from the local Feishu webhook process.
• Require a random watch_token in the URL/query or bearer header before exposing TUI HTML or snapshot JSON.
• Keep the TUI read-only: no keyboard input, tmux attach, or command execution through the web view.

Follow-up support plan

1. Add first-class config and CLI support for remote watch URLs:
   • watch_public_url
   • watch_token
   • token rotation command
   • redacted status output by default
2. Add tunnel provider abstraction:
   • ngrok
   • Cloudflare Tunnel
   • localhost-only fallback
   • clear handling when only one ngrok tunnel is available
3. Add mobile-oriented UX:
   • stable /watch route
   • auto-refresh snapshot
   • visible session/project label
   • stale snapshot indicator
4. Add safety controls:
   • read-only by default
   • random unguessable tokens
   • optional allowlisted Feishu chat/sender binding
   • no token in logs or ordinary status output
5. Add tests and docs:
   • unauthenticated /watch returns 403
   • authenticated /watch and /watch/snapshot return 200
   • /cnb_watch replies with the configured public URL when present
   • README/README_zh setup notes for phone access

Acceptance criteria

• A user can ask from Feishu for an observation link and receive a phone-openable HTTPS URL.
• The URL shows the current device-supervisor TUI within a few seconds.
• The public route is inaccessible without the configured token.
• Restarting cnb feishu start preserves the configured public watch route.
• Documentation clearly distinguishes message control, TUI snapshot, read-only watch, and any future interactive remote-control mode.

[ApolloZhangOnGithub]

Implementation note from local verification:

• cnb feishu setup now carries watch_public_url / watch_token config and can derive a /watch URL from the configured public webhook/ngrok URL.
• The local webhook serves token-gated read-only watch routes, including prefixed paths such as /cnb/feishu/watch for deployments that put the webhook behind a path prefix.
• cnb feishu status redacts the tokenized Web TUI URL; cnb feishu watch remains the intentional command that returns the full shareable URL.
• README and README_zh now mention that ngrok must be installed and authenticated by each user/deployment, and list Feishu event subscription / permission deployment prompts.
• Local targeted verification: python3 -m pytest tests/test_feishu_bridge.py -k 'setup_config or watch_url or watch_request or watch_route or watch_page_html or cnb_watch' passed 8/8, and python3 -m py_compile lib/feishu_bridge.py passed.

Remaining product work for this issue: token rotation CLI, provider abstraction beyond ngrok, and deeper end-to-end deployment tests.

[ApolloZhangOnGithub]

Verified and closing as implemented. The current Feishu bridge includes first-class read-only watch support: watch_public_url/watch_token config, generated token setup, redacted status output, /cnb_watch command replies, tokenized /watch and /watch/snapshot routes, read-only built-in viewer with auto-refresh, and README/README_zh/docs coverage distinguishing message control, TUI snapshot, and read-only watch. Regression check: python3 -m pytest tests/test_feishu_bridge.py -q -k 'watch or cnb_watch' --tb=short passed (11 selected tests).