fix(feishu): avoid logging raw duplicate card-action tokens by VectorPeak · Pull Request #104498 · openclaw/openclaw

VectorPeak · 2026-07-11T13:51:08Z

What Problem This Solves

Fixes an issue where duplicate Feishu card-action callbacks could write the raw provider callback token into runtime diagnostics when the same callback token was received again inside the account-scoped dedupe window.

The callback token is still used internally as the dedupe key, but the operator-facing duplicate diagnostic no longer echoes that raw provider value back into logs.

Why This Change Was Made

Duplicate card-action handling now keeps the existing replay suppression behavior while changing only the duplicate diagnostic text. A repeated callback still produces a useful operational signal, but the log line no longer contains provider callback token material.

This does not change Feishu webhook authentication, callback parsing, card-action dispatch, retry handling, synthetic message routing, or the dedupe key used internally.

User Impact

Operators can still see when duplicate Feishu card-action callbacks are skipped, without logs containing the raw callback token from the provider event.

AI-assisted.

Evidence

Live Feishu callback + duplicate replay transcript

Captured from a real Feishu workspace card click via lark-cli event consume card.action.trigger --as bot --output-dir, then replayed through the current OpenClaw Feishu card-action handler twice with the same real provider callback token. Tenant identifiers and the callback token are redacted.

live event source: real Feishu card.action.trigger from interactive card button click
sent card message_id: om_x100b6a11b9...len=35
captured event file: .feishu-proof-104498/event-output-20260711-232118/1783783317756622300_20392_1.json
event type: card.action.trigger
event_id: 32ccfc0b...len=32
operator_id: ou_9ea19...len=35
chat_id: oc_5da7c...len=35
callback token: <redacted:c-d...len=42>
action_tag: button
action_value: {"nonce":"20260711-232118","proof":"openclaw-104498"}

OpenClaw replay using the captured real callback token:
first handleFeishuCardAction(...) call: dispatch count = 1
second handleFeishuCardAction(...) call with same account/token: duplicate skip count = 1
captured duplicate diagnostic: feishu[live-proof-account]: skipping duplicate card action token
raw callback token present in captured runtime logs: false

The replay command used the Feishu extension Vitest config so the event enters handleFeishuCardAction with the same token, message id, chat id, operator id, action tag, and action value captured from Feishu. This proves the live callback token still suppresses duplicate dispatch while the duplicate diagnostic no longer logs the raw token.

Local validation

pnpm exec vitest run --config test/vitest/vitest.extension-feishu.config.ts extensions/feishu/src/live-feishu-duplicate-replay.proof.test.ts --reporter=verbose - passed, live captured event replay proof
node scripts/run-vitest.mjs run extensions/feishu/src/bot.card-action.test.ts - passed, 23 tests
node scripts/run-vitest.mjs run extensions/feishu/src/bot.card-action.test.ts -t "does not log raw duplicate callback tokens" - passed, focused duplicate-token regression
rg -n -F -- 'skipping duplicate card action token ${event.token}' extensions/feishu/src - no matches
rg -n -F -- 'card action token ${' extensions/feishu/src - no matches
git diff --check - passed

Remote CI note

Most PR checks passed on the current head. The remaining checks-node-compact-large-3 failure is in src/agents/session-write-lock.test.ts, outside the Feishu extension files changed by this PR. The Real behavior proof check is passing on the latest body update.

Avoid writing the raw Feishu card-action callback token into duplicate callback diagnostics while preserving duplicate suppression behavior. Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

clawsweeper · 2026-07-11T13:56:55Z

Codex review: needs maintainer review before merge. Reviewed July 11, 2026, 12:22 PM ET / 16:22 UTC.

Summary
The PR removes the raw Feishu callback token from duplicate-card-action diagnostics and adds regression coverage that preserves duplicate suppression.

PR surface: Source 0, Tests +17. Total +17 across 2 files.

Reproducibility: yes. from source. Replaying the same valid callback token for one account within the dedupe window deterministically reaches the current-main branch that logs the raw token; the contributor also supplied convincing after-fix live replay proof.

Review metrics: none identified.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

No automated repair is needed because the existing PR already provides the narrow correct implementation, regression coverage, real behavior proof, and green exact-head validation.

Security
Cleared: The patch reduces sensitive provider-token exposure and introduces no authentication, permission, dependency, workflow, persistence, executable, or supply-chain changes.

Review details

Best possible solution:

Merge the diagnostic-only redaction with its regression test, retaining the existing account-scoped replay guard, retry lifecycle, callback routing, and synthetic event behavior.

Do we have a high-confidence way to reproduce the issue?

Yes from source. Replaying the same valid callback token for one account within the dedupe window deterministically reaches the current-main branch that logs the raw token; the contributor also supplied convincing after-fix live replay proof.

Is this the best way to solve the issue?

Yes. Removing only the token interpolation is the narrowest maintainable repair because operators retain the useful duplicate signal while all token-dependent callback behavior remains unchanged.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b769964e82ab.

Label changes

Label justifications:

P2: The PR fixes a bounded sensitive callback-token exposure in Feishu diagnostics without changing authentication, delivery, configuration, or persisted state.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): A redacted real Feishu card action was replayed twice through the handler, directly showing one dispatch, one duplicate skip, and no raw callback token in captured runtime logs after the fix.
proof: sufficient: Contributor real behavior proof is sufficient. A redacted real Feishu card action was replayed twice through the handler, directly showing one dispatch, one duplicate skip, and no raw callback token in captured runtime logs after the fix.

Evidence reviewed

PR surface:

Source 0, Tests +17. Total +17 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	1	1	0
Tests	1	17	0	+17
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	18	1	+17

What I checked:

Current-main bug: After the account-scoped replay guard rejects a repeated callback, current main interpolates the raw provider token into the operator-facing log message. (extensions/feishu/src/card-action.ts:355, b769964e82ab)
Narrow production repair: The PR removes only the token interpolation; callback parsing, account-scoped deduplication, retry release, completion, routing, and dispatch remain unchanged. (extensions/feishu/src/card-action.ts:355, 6351f188ed3a)
Regression coverage: The new test replays one structured callback twice, verifies only one dispatch, retains the duplicate diagnostic, and asserts that the raw token is absent from captured logs. (extensions/feishu/src/bot.card-action.test.ts:568, 6351f188ed3a)
Production entry point: The Feishu monitor parses provider card-action payloads and invokes the reviewed handler with the account, runtime, and channel runtime context. (extensions/feishu/src/monitor.account.ts:426, b769964e82ab)
Sibling logging search: An exact-head search found no other Feishu production diagnostic that logs event.token; its remaining uses are internal token lifecycle and synthetic message identity. (extensions/feishu/src/card-action.ts:141, 6351f188ed3a)
Replay-guard provenance: The affected account-scoped replay behavior appears to date to the merged Feishu webhook replay-guard hardening in commit c8003f1. (extensions/feishu/src/card-action.ts:42, c8003f1b33ed)

Likely related people:

eleqtrizit: Authored the merged Feishu webhook replay-guard hardening that established the affected deduplication behavior. (role: introduced replay guard; confidence: high; commits: c8003f1b33ed; files: extensions/feishu/src/card-action.ts)
steipete: Recently maintained card-action token expiry and operator-log safety on the same Feishu handler and tests. (role: recent area contributor; confidence: high; commits: ac0fb976c8e2, ac24461252b0; files: extensions/feishu/src/card-action.ts, extensions/feishu/src/bot.card-action.test.ts)
Takhoffman: Authored the merged structured card-action and interactive approval foundation used by this callback path. (role: introduced structured card actions; confidence: medium; commits: fa62231afca3; files: extensions/feishu/src/card-action.ts, extensions/feishu/src/bot.card-action.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (6 earlier review cycles)

reviewed 2026-07-11T13:55:31.518Z sha c712962 :: needs real behavior proof before merge. :: none
reviewed 2026-07-11T14:01:36.686Z sha c712962 :: needs real behavior proof before merge. :: none
reviewed 2026-07-11T14:51:06.825Z sha c712962 :: needs real behavior proof before merge. :: none
reviewed 2026-07-11T15:36:28.535Z sha c712962 :: needs maintainer review before merge. :: none
reviewed 2026-07-11T15:43:36.824Z sha c712962 :: needs maintainer review before merge. :: none
reviewed 2026-07-11T16:15:07.144Z sha 6351f18 :: needs maintainer review before merge. :: none

VectorPeak · 2026-07-11T14:33:01Z

@clawsweeper re-review

Updated the PR body with a BOM-free authored problem/evidence section and a redacted runtime-level duplicate callback transcript. Also reran focused Feishu validation locally; no code changes were needed.

clawsweeper · 2026-07-11T14:33:04Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29158274292
Updated: 2026-07-11T15:45:05.948Z

VectorPeak · 2026-07-11T15:31:10Z

@clawsweeper re-review

Updated the PR body with live Feishu runtime proof: a real card.action.trigger event captured via lark-cli event consume --output-dir, replayed through the current OpenClaw Feishu card-action handler twice with the same redacted provider callback token. The transcript shows one dispatch, one duplicate skip, and rawTokenPresentInLogs: false.

steipete · 2026-07-11T22:30:22Z

Merged via squash.

Prepared head SHA: 5ee708179c4bb590487ffc1467575e14a1f04bf2
Landed commit: d5569a98dba2369903de1ab801c5a5257a6c839f

…#104498) * fix(feishu): avoid logging raw duplicate card-action tokens Avoid writing the raw Feishu card-action callback token into duplicate callback diagnostics while preserving duplicate suppression behavior. Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com> * test(feishu): use neutral callback token fixture * test(feishu): mark callback fixture as placeholder --------- Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com> Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added channel: feishu Channel integration: feishu size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 11, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 11, 2026

Merge branch 'main' into fix/feishu-redact-duplicate-card-token

6351f18

steipete self-assigned this Jul 11, 2026

steipete added 2 commits July 11, 2026 18:20

test(feishu): use neutral callback token fixture

2edba19

test(feishu): mark callback fixture as placeholder

5ee7081

steipete merged commit d5569a9 into openclaw:main Jul 11, 2026
94 checks passed

github-actions Bot mentioned this pull request Jul 11, 2026

📡 Upstream Digest — 2026-07-11 22:39 UTC curtismercier/openclaw-mods#1266

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(feishu): avoid logging raw duplicate card-action tokens#104498

fix(feishu): avoid logging raw duplicate card-action tokens#104498
steipete merged 4 commits into
openclaw:mainfrom
VectorPeak:fix/feishu-redact-duplicate-card-token

VectorPeak commented Jul 11, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

VectorPeak commented Jul 11, 2026

Uh oh!

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

VectorPeak commented Jul 11, 2026

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

VectorPeak commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Live Feishu callback + duplicate replay transcript

Local validation

Remote CI note

Uh oh!

clawsweeper Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

VectorPeak commented Jul 11, 2026

Uh oh!

clawsweeper Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

VectorPeak commented Jul 11, 2026

Uh oh!

Uh oh!

steipete commented Jul 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

VectorPeak commented Jul 11, 2026 •

edited

Loading

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading

clawsweeper Bot commented Jul 11, 2026 •

edited

Loading