fix: feishu P2P 单聊入站和出站修复 - #1
Merged
Merged
Conversation
- pushMessage fromId 从 chatId 改为 senderId（P2P 入站 allowlist 匹配） - send() 根据 to 前缀选择 --chat-id 或 --user-id（P2P 出站 lark-cli 兼容） - 未处理事件类型（如 bot_p2p_chat_entered_v1）graceful ignore 不计 error Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
LinekForge
added a commit
that referenced
this pull request
Apr 17, 2026
Four documentation patches surfacing gotchas Light hit on her first
clean install — each would otherwise re-trap every new user.
README.md:
- Prerequisites: clarify bun must be on PATH. Default install puts bun
at ~/.bun/bin which isn't on macOS default PATH. Without this,
`fh` CLI and the MCP subprocess both fail to resolve bun.
- [!IMPORTANT] block for server:hub mode: approval_channels must be
configured before use. Without it every Bash/Write/Edit is auto-denied
(see S1 commit for the code-side hint path).
- [!NOTE] block for first-run MCP tool approval: CC default behavior,
/allowed-tools to persist. Without this hint users see "消息进来了
但回不出去" on first use and blame forge-hub.
配置.md 飞书 section:
- Three sequential developer-console traps:
1. im.message.receive_v1 associated permissions must be enabled in
the event panel separately — "permission management" isn't enough.
2. Bot capability needs to be enabled under 应用能力 → 机器人.
3. Event/permission changes require publishing a new version to take
effect, not just save.
Light spent significant time on #1; documenting all three now.
Co-authored-by: Forge <270260515+ForgeLinek@users.noreply.github.com>
LinekForge
added a commit
that referenced
this pull request
May 14, 2026
…rd, token rotation, canonical hash Kai 全仓安全审查修复（P1 #1-#4 + P2 #5-#7）： - install 白名单保留 evidence/security-events/audit，升级不再丢证据 - 通道第一层未授权拦截接入 SecurityEventAggregator（HubAPI.recordSecurityEvent） - Dashboard Origin guard 不再信任请求 Host，固定 localhost/127.0.0.1/[::1] - token 轮换改为 temp file + rename 原子替换，失败 die 退出 - evidence entry hash 递归 canonical stringify，覆盖嵌套字段 - CLI fh hub ps / doctor 改用 fetch，token 不再进 curl argv - WeChat context_token 写入移到 allowlist 之后 Co-authored-by: Kai <kai@codex.local> Co-authored-by: Forge <270260515+ForgeLinek@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
LinekForge
added a commit
that referenced
this pull request
May 14, 2026
… engine path guard Kai 安全全仓审核修复（P1 #1-#2 + P2 #3-#4）： - Native App: curl shell-out 全部改 URLSession，token 不再进 argv - WeChat: allowlist 检查移到 extractContent 之前，未授权媒体不下载 - formatUnauthorizedNotice: displayName/senderId 走 sanitize 净化 - fh engine remove: 拒绝路径穿越（/、\、..），只匹配 engine.d 内 basename - channel-plugin-guide 文档更新、echo.ts 示例更新 - 新增测试：未授权媒体不下载、notice 注入净化、路径穿越拒绝 Co-authored-by: Kai <kai@codex.local> Co-authored-by: Forge <270260515+ForgeLinek@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
LinekForge
added a commit
that referenced
this pull request
May 14, 2026
…idence dedup, docs sync Kai 全仓风险复审修复（P2 #1-#3 + P3 #4-#7）： - 安全事件告警前同步 flush，CLI 立即可查 - hub-client 区分 /health liveness 和 /status auth，401 不再误判为 Hub 未运行 - Native/Dashboard 通道选择：显式"全部通道"选项，零选择禁用 - 删除 Dashboard 未接通的 sendFile bridge（v1 = 发路径文本） - stripMarkdown 移到可导出 helper，测试真实函数 - evidence 空 updateId 生成唯一 fallback，不再去重合并 - /status 暴露通道 stoppedReason，WeChat auth 判定改用稳定枚举 - SECURITY.md + 架构.md 同步更新 Co-authored-by: Kai <kai@codex.local> Co-authored-by: Forge <270260515+ForgeLinek@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pushMessage的fromId从chatId（oc_）改为senderId（ou_），修复 P2P 入站 allowlist 不匹配send()根据to前缀选择--chat-id/--user-id，修复 P2P 出站 lark-cli 报错bot_p2p_chat_entered_v1误判通道 degradedTest
飞书 P2P 单聊测试：