feat(lark): honour bot reach, retire group PAIR, fix walled copy on DM-less bots - #604
Draft
jacoblee-io wants to merge 1 commit into
Draft
jacoblee-io wants to merge 1 commit into
jacoblee-io wants to merge 1 commit into
Conversation
…M-less bots Follows the sicore change that adds two settings next to access_mode: reach (where a bot may be used) and group_policy (which groups count). See sicore docs/design/feishu-bot-reach-and-pair-retirement.md. Group PAIR is retired. A group is served by the dedicated app that was added to it, and by nothing else, so the command word is swallowed here rather than forwarded — a stale code typed into a group neither binds anything nor produces a refusal the room did not ask for. The PERSONAL pairing code in a DM is untouched: that one links a Feishu identity to a Sicore account, which the strict tiers need. reach=group_only refuses every DM entry point. The frontend refuses them independently (its personalDM registrar is the authority); declining locally just saves the round trip. One short reply rather than silence — a DM is a place the sender deliberately opened, and no answer there reads as the bot being broken. Both group refusal texts tell the sender to DM the bot, which is a dead end on a group_only bot. The refusal now carries dmDisabled, and dmCanResolveAccess reads it, so those senders get the console link instead. An extra field rather than a new reason: reason is the contract this runtime localizes, and a new value would drop an un-updated build into its generic fallback, whereas an unknown boolean is ignored.
jacoblee-io
marked this pull request as draft
September 14, 2026 12:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runtime half of the sicore change that adds two settings next to
access_mode: reach (where a bot may be used) and group_policy (which groups count). Ships with sicore MR !1232.Group PAIR is retired
A group is served by the dedicated app that was added to it, and by nothing else. The command word is now swallowed rather than forwarded, so a stale code typed into a group neither binds anything nor produces a refusal the room did not ask for.
The personal pairing code in a DM is untouched — that one links a Feishu identity to a Sicore account, which the strict tiers need.
Retiring it also closes a bypass on the sicore side: the shared-app branch that served PAIRed groups reached session creation without calling
access.Decideeven once.reach=group_onlyrefuses every DM entry pointThe frontend refuses them independently (its
personalDMregistrar is the authority); declining locally just saves the round trip. One short reply rather than silence — a DM is a place the sender deliberately opened, and no answer there reads as the bot being broken.Walled copy on a DM-less bot
Both group refusal texts tell the sender to DM the bot, which is a dead end when DMs are closed. The refusal now carries
dmDisabled, anddmCanResolveAccessreads it, so those senders are pointed at the console instead.An extra field rather than a new
reason: reason is the contract this runtime localizes, and a new value would drop an un-updated build into its generic fallback, whereas an unknown boolean is simply ignored.Verified
Ten-step e2e against real Feishu on sicore-test, all passing — including the two invariants easiest to get wrong:
group_onlydoes not close groups as a side effect, and turninggroup_policy=approvalon does not silence groups that were already serving.DM refused … reach=group_onlyandgroup PAIR ignored … group pairing is retiredboth confirmed in the runtime log.Design: sicore
docs/design/feishu-bot-reach-and-pair-retirement.md.