[zhaozhaozz]

No tracking issue. Builds on the Feishu connector work of #1266 (webhook sender and inbound long connection).

What changed

Before: Feishu was a custom group webhook plus an inbound long-connection row. After: an owner can connect a Feishu application and have a local Bot answer in Feishu chats.

• Guided setup. One Connect entry on the Feishu connector row and on the shared Connections page. The long-connection guide has six steps and the HTTP event-address guide has seven. It shows a permission JSON to import, live connection state and event status.
• Credentials. Kept in an encrypted per-instance vault (feishu-credentials.json, mode-0600 host key). They never enter state projections, Bot schemas or Bot environments. The long connection uses the official SDK. HTTP mode uses a separate event-only listener with no console routes.
• Messages. Inbound messages are persisted before acknowledgement, deduplicated across restarts, routed per chat to a local Bot and answered in their thread through a durable outbox. Get reactions mark accepted requests.
• Cards and files. feishu_card cards bind the original message and the actual linked clicker. feishu_file sends Session attachments within the Feishu limits (images 10 MB, files 30 MB) and fails as a tool error beyond them. No console links are sent into Feishu.
• Tools. feishu_tool gives per-Bot, per-product access to calendar, documents, tables, sheets, meetings and tasks. Ask-mode writes go through the native approval seam.
• Gateway. The authenticated feishu endpoint is added to scripts/api-contracts.mjs and the OpenAPI artifact.
• Docker. The image now installs ds-bot's runtime dependencies. A link: profile installs none of them, and the Feishu SDK import is lazy, so the container started healthy and only the dial failed. The build now fails when a declared dependency is missing. The image grows from about 1.6 GB to 2.7 GB, mostly the Claude and Codex executor binaries; the Feishu SDK is about 29 MB. docker/compose.local.yaml publishes the console on all interfaces and requires FLYBOT_TRUSTED_HOST, so browser API requests are admitted.
• Diagnostics. A dial that cannot import the SDK is reported as a missing install, not as a network or credential failure.
• Docs. docs/feishu.md, the core-host, core-client, project-workbench and backend-service subsystem docs, the Docker guide (en/zh) and the third-party integration counts. Changelog fragments are in changelog.d/.

Verification at the tip

Tip SHA: 8a8d8d0 (base e11ba3b)
Ran:

• npm run verify: exit 0, 5120 tests, 0 failures. It covers core lint with arch-docs, plugin lint, the client and workbench bundle checks, the ds-bot patch check and canonical form, the core and plugin suites, the .github/scripts tests, and the interop, live-e2e and demo checks.
• docker compose -f compose.yaml -f docker/compose.local.yaml build and up --wait at this tip: both containers healthy. Against a real Feishu application, the long connection reports ready. Unauthenticated API requests from the published address still return 401.
• On the same branch before the rebase:
  • A real inbound message arrived over the long connection. The sender allow-list refused it, as designed.
  • The setup path (Connect → credentials step → subscription step) was driven in headless Chromium against the local instance, with 0 page errors.
• New regressions fail without their change: the missing-SDK diagnosis, the Docker dependency check, and the feishu_file limits with no console address.

Not run (and why):

• A full Feishu round trip (Bot reply, card callback, product tools) against a real tenant, and HTTP event-address mode behind a public HTTPS address: no allowed sender or public address has been set up yet.
• The smoke test (dev/smoke.mjs) and real-model runs.
• CI and the Docker workflow: they have not run on this fork PR yet.
• Independent review: none yet.

Checkpoint

{
  "pr": 2527,
  "claim": "zhaozhaozz",
  "issue": 0,
  "summary": "Connect a Feishu application to the existing Feishu channel: guided long-connection or HTTP setup, an encrypted credential vault, persisted and deduplicated inbound messages answered in thread through a durable outbox, cards bound to the linked clicker, and per-Bot product tools behind native approvals. The Docker image now carries ds-bot's runtime dependencies so the long connection can load its SDK.",
  "files": ["core/src/host/feishu-service.js", "core/src/host/feishu-sdk.js", "core/src/host/feishu-tools.js", "core/src/host/feishu-vault.js", "core/src/client/feishu-setup.js", "Dockerfile", "docker/profile.mjs", "docs/feishu.md"],
  "checks": { "ran": "npm run verify", "result": "green", "at": "8a8d8d09abd67f98a01c9c59a8da10c74e769d4b" },
  "next": "none — ready for review"
}