fix(feishu): bound quick action launcher expiry

steipete · steipete · commit 05634708e053 · 2026-05-30T11:38:50.000-04:00
diff --git a/extensions/feishu/src/card-ux-launcher.test.ts b/extensions/feishu/src/card-ux-launcher.test.ts
@@ -88,6 +88,25 @@ describe("feishu quick-action launcher", () => {
     expectFirstSentCardUsesFillWidthOnly(sendCardFeishuMock);
   });
 
+  it("does not send launcher cards when expiry would exceed a valid Date", async () => {
+    const runtime: RuntimeEnv = createRuntimeEnv();
+
+    const handled = await maybeHandleFeishuQuickActionMenu({
+      cfg,
+      eventKey: "quick-actions",
+      operatorOpenId: "u123",
+      accountId: "main",
+      runtime,
+      now: 8_640_000_000_000_000,
+    });
+
+    expect(handled).toBe(false);
+    expect(sendCardFeishuMock).not.toHaveBeenCalled();
+    expect(runtime.log).toHaveBeenCalledWith(
+      "feishu[main]: failed to open quick-action launcher for u123: invalid expiry clock",
+    );
+  });
+
   it("falls back to legacy menu handling when launcher send fails", async () => {
     sendCardFeishuMock.mockRejectedValueOnce(new Error("network"));
     const runtime: RuntimeEnv = createRuntimeEnv();
diff --git a/extensions/feishu/src/card-ux-launcher.ts b/extensions/feishu/src/card-ux-launcher.ts
@@ -1,3 +1,7 @@
+import {
+  asDateTimestampMs,
+  resolveExpiresAtMsFromDurationMs,
+} from "openclaw/plugin-sdk/number-runtime";
 import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import type { ClawdbotConfig, RuntimeEnv } from "../runtime-api.js";
 import { createFeishuCardInteractionEnvelope } from "./card-interaction.js";
@@ -96,7 +100,17 @@ export async function maybeHandleFeishuQuickActionMenu(params: {
     return false;
   }
 
-  const expiresAt = (params.now ?? Date.now()) + FEISHU_QUICK_ACTION_CARD_TTL_MS;
+  const now = asDateTimestampMs(params.now ?? Date.now());
+  const expiresAt =
+    now === undefined
+      ? undefined
+      : resolveExpiresAtMsFromDurationMs(FEISHU_QUICK_ACTION_CARD_TTL_MS, { nowMs: now });
+  if (expiresAt === undefined) {
+    params.runtime?.log?.(
+      `feishu[${params.accountId ?? "default"}]: failed to open quick-action launcher for ${params.operatorOpenId}: invalid expiry clock`,
+    );
+    return false;
+  }
   try {
     await sendCardFeishu({
       cfg: params.cfg,
