feat(feishu): intelligent reply on document comments with 3-tier access control by teknium1 · Pull Request #11898 · NousResearch/hermes-agent

teknium1 · 2026-04-18T02:04:01Z

Salvage of #11023 onto current main, preserving @liujinkun2025's authorship on the feature commit.

Summary

Adds an event handler for Feishu/Lark drive comment notifications so users can @-mention the bot on document comments (local or whole-doc) and get LLM replies inline, with a 3-tier allowlist/pairing access control system.

Changes

New handler (gateway/platforms/feishu_comment.py, 1383 LOC): parses drive.notice.comment_add_v1 events, filters self-replies/non-bot-targeted, fetches doc + comment metadata in parallel, builds local-comment or whole-doc timeline (20/12 msg caps), runs agent with feishu_doc/feishu_drive toolsets, chunks replies at 4000 chars, per-doc session cache (1h TTL, 50 msg cap).
Access control (gateway/platforms/feishu_comment_rules.py, 424 LOC): exact-doc > wildcard > top-level > default resolution with per-field fallback. Policies: allowlist (static) or pairing (static ∪ runtime-approved store). Mtime-cached hot-reload. CLI: python -m gateway.platforms.feishu_comment_rules {status|check|pairing}. Explicit-grant only — no implicit allow-all mode.
5 new tools, scoped to the comment agent only (NOT added to _HERMES_CORE_TOOLS or any platform toolset): feishu_doc_read, feishu_drive_list_comments, feishu_drive_list_comment_replies, feishu_drive_reply_comment, feishu_drive_add_comment.
Adapter wiring (gateway/platforms/feishu.py): +25 lines to register the event handler on both WebSocket and Webhook transports.
Tests: 643 LOC across tests/gateway/test_feishu_comment{,_rules}.py and tests/tools/test_feishu_tools.py.

Follow-up polish on top of the contributor commit

feishu_comment_rules.py: replaced import-time ~/.hermes expanduser fallback with get_hermes_home() from hermes_constants (canonical, profile-safe).
feishu_doc_tool.py / feishu_drive_tool.py: dropped the asyncio.get_event_loop().run_until_complete(asyncio.to_thread(...)) dance — tool handlers run synchronously in a worker thread with no running loop, so the RuntimeError branch was always the one that executed. Now calls client.request directly. Unused asyncio import removed.
test_feishu.py: updated the mock EventDispatcher builder to include register_p2_customized_event for the new drive.notice.comment_add_v1 registration.
scripts/release.py: AUTHOR_MAP entry liujinkun@bytedance.com → liujinkun2025.

Validation

	Result
`scripts/run_tests.sh -k feishu`	221 passed
Rule engine (allowlist/wildcard/pairing semantics) E2E	PASS
Mtime hot-reload E2E	PASS
Pairing store CRUD (idempotent add/remove, list) E2E	PASS
CLI `status` / `check` / `pairing add	list` E2E
Tool registration + schemas + scoping (not in core) E2E	PASS
Event parsing: WebSocket + Webhook + malformed → None	PASS
HERMES_HOME isolation honored in all paths	PASS

Live Feishu tenant E2E not performed (no tenant available); the contributor has already verified that path internally per the original PR description.

Credit

Feature implementation by @liujinkun2025 in #11023. Their commit is preserved as the first commit on this salvage branch (rebase merge to retain authorship).

Closes #11465
Supersedes #11023

…s control - Full comment handler: parse drive.notice.comment_add_v1 events, build timeline, run agent, deliver reply with chunking support. - 5 tools: feishu_doc_read, feishu_drive_list_comments, feishu_drive_list_comment_replies, feishu_drive_reply_comment, feishu_drive_add_comment. - 3-tier access control rules (exact doc > wildcard "*" > top-level > defaults) with per-field fallback. Config via ~/.hermes/feishu_comment_rules.json, mtime-cached hot-reload. - Self-reply filter using generalized self_open_id (supports future user-identity subscriptions). Receiver check: only process events where the bot is the @mentioned target. - Smart timeline selection, long text chunking, semantic text extraction, session sharing per document, wiki link resolution. Change-Id: I31e82fd6355173dbcc400b8934b6d9799e3137b9

…; AUTHOR_MAP Follow-up polish on top of the cherry-picked #11023 commit. - feishu_comment_rules.py: replace import-time "~/.hermes" expanduser fallback with get_hermes_home() from hermes_constants (canonical, profile-safe). - tools/feishu_doc_tool.py, tools/feishu_drive_tool.py: drop the asyncio.get_event_loop().run_until_complete(asyncio.to_thread(...)) dance. Tool handlers run synchronously in a worker thread with no running loop, so the RuntimeError branch was always the one that executed. Calls client.request directly now. Unused asyncio import removed. - tests/gateway/test_feishu.py: add register_p2_customized_event to the mock EventDispatcher builder so the existing adapter test matches the new handler registration for drive.notice.comment_add_v1. - scripts/release.py: map liujinkun@bytedance.com -> liujinkun2025 for contributor attribution on release notes.

Fills documentation gaps that accumulated as features merged ahead of their docs updates. All additions are verified against code and the originating PRs. Providers: - Ollama Cloud (#10782) — new provider section, env vars, quickstart/fallback rows - xAI Grok Responses API + TTS (#10783) — provider note, TTS table + config - Google Gemini CLI OAuth (#11270) — quickstart/fallback/cli-commands entries - NVIDIA NIM (#11774) — NVIDIA_API_KEY / NVIDIA_BASE_URL in env-vars reference - HERMES_INFERENCE_PROVIDER enum updated Messaging: - DISCORD_ALLOWED_ROLES (#11608) — env-vars, discord.md access control section - DingTalk QR device-flow (#11574) — wizard path in Option A + openClaw disclosure - Feishu document comment intelligent reply (#11898) — full section + 3-tier access control + CLI Skills / commands: - concept-diagrams skill (#11363) — optional-skills-catalog entry - /gquota (#11270) — slash-commands reference Build: docusaurus build passes, ascii-guard lint 0 errors.

liujinkun2025 · 2026-04-18T09:27:44Z

Hey @teknium1 — thanks again for merging. Coming back with fresh
eyes, I think the current design has a few structural issues (most
importantly: delivery actions leaking into the global tool surface,
and tool count that doesn't fit Hermes conventions) that are cleaner
to rework than fix-forward. Would you be OK with reverting this so
I can submit a V2?

Happy to open the revert PR myself if that's simpler.

Reverts commits 85cdb04 and b449a0e. Change-Id: I41236562bdc6a22ab10ae07ab3fc232aed994d54

…ed logs Reworks the feishu document-comment integration (introduced in NousResearch#11898) to align with hermes's core session architecture and to close several session bloat, tool scoping, and log leakage concerns flagged in review. Session management - Replace the in-memory _session_cache dict (1h hard TTL, pure memory) with hermes's generic SessionStore pipeline (SessionSource + SessionDB). Sessions now persist through gateway restart and auto-reset on daily / idle policy, matching IM. - Local comments key on comment_id (per-thread isolation). - Whole-doc comments collapse onto a __whole_doc__ sentinel thread_id so all whole-document comments on the same doc share one document-level session. - Persist only the user's actual comment text + optional quote anchor, not the rendered prompt (~50x smaller per user row). Tool scoping - Delete tools/feishu_doc_tool.py and tools/feishu_drive_tool.py. These are feishu-specific document / comment operations, not cross-cutting agent capabilities -- yet they lived in the global tool registry alongside core tools like memory, session_search, and send_message. The global registry should host tools any agent on any platform legitimately uses; feishu-scoped surfaces belong inside the feishu handler, not next to memory / session_search. - Document content now flows through a two-pass <NEED_DOC_READ> sentinel protocol owned by the comment handler: the agent lists tokens it needs, business code fetches them against a whitelist (source doc + comment-referenced docs, docx only), and the agent responds on the second turn. - Drop the thread-local client injection; the lark client is built from config at call time. Log hardening - Strip user comment text, quote text, agent response text, and full prompts from all log statements. ~/.hermes/logs/agent.log now stores only identifiers, lengths, and status codes -- closes the multi- operator leak risk where operators sharing a hermes instance could read each other's document content through log files. Adapter wiring - handle_drive_comment_event now takes the FeishuAdapter instance instead of the bare client so it can reach the gateway-injected SessionStore. The change stays fully off the IM message path. Tests cover session source construction, sentinel parsing, whitelist enforcement, doc-content truncation, history persistence, compact user- turn rendering, and error-path degradation. Full tests/gateway/ regression passes; live smoke verified local + whole-doc + multi-doc sentinel fetch and cross-restart history replay. Change-Id: Icc69e499f5db982973ccd9cc0b7b691f0e68ee74

) Fills documentation gaps that accumulated as features merged ahead of their docs updates. All additions are verified against code and the originating PRs. Providers: - Ollama Cloud (NousResearch#10782) — new provider section, env vars, quickstart/fallback rows - xAI Grok Responses API + TTS (NousResearch#10783) — provider note, TTS table + config - Google Gemini CLI OAuth (NousResearch#11270) — quickstart/fallback/cli-commands entries - NVIDIA NIM (NousResearch#11774) — NVIDIA_API_KEY / NVIDIA_BASE_URL in env-vars reference - HERMES_INFERENCE_PROVIDER enum updated Messaging: - DISCORD_ALLOWED_ROLES (NousResearch#11608) — env-vars, discord.md access control section - DingTalk QR device-flow (NousResearch#11574) — wizard path in Option A + openClaw disclosure - Feishu document comment intelligent reply (NousResearch#11898) — full section + 3-tier access control + CLI Skills / commands: - concept-diagrams skill (NousResearch#11363) — optional-skills-catalog entry - /gquota (NousResearch#11270) — slash-commands reference Build: docusaurus build passes, ascii-guard lint 0 errors.

liujinkun2025 and others added 2 commits April 17, 2026 18:55

teknium1 merged commit b449a0e into main Apr 18, 2026
4 of 5 checks passed

teknium1 deleted the hermes/hermes-7049b547 branch April 18, 2026 02:04

teknium1 mentioned this pull request Apr 18, 2026

feat: Feishu document comment intelligent reply with 3-tier access control #11023

Closed

10 tasks

teknium1 mentioned this pull request Apr 18, 2026

docs: backfill coverage for recently-merged features #11942

Merged

liujinkun2025 mentioned this pull request Apr 18, 2026

revert: revert Feishu document comment feature (#11898) for V2 redesign #12097

Open

3 tasks

liujinkun2025 added a commit to liujinkun2025/hermes-agent that referenced this pull request Apr 18, 2026

revert: revert PR NousResearch#11898 (Feishu document comment feature)

47ce9a8

Reverts commits 85cdb04 and b449a0e. Change-Id: I41236562bdc6a22ab10ae07ab3fc232aed994d54

liujinkun2025 mentioned this pull request Apr 20, 2026

refactor(feishu-comment): use SessionStore, sentinel doc-read, redacted logs #13045

Open

3 tasks

liujinkun2025 mentioned this pull request Apr 23, 2026

chore(feishu): remove unused feishu_drive tools from global registry #14427

Open

2 tasks

github-actions Bot mentioned this pull request Apr 24, 2026

chore: bump NousResearch/hermes-agent version from v2026.4.16 to v2026.4.23 Docker-Hub-sirmark/docker-hermes-agent#3

Merged

liujinkun2025 mentioned this pull request Apr 25, 2026

fix(discord): end-to-end Discord support — toolset loading, tool split, and context injection #15091

Open

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(feishu): intelligent reply on document comments with 3-tier access control#11898

feat(feishu): intelligent reply on document comments with 3-tier access control#11898
teknium1 merged 2 commits into
mainfrom
hermes/hermes-7049b547

teknium1 commented Apr 18, 2026

Uh oh!

Uh oh!

liujinkun2025 commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

teknium1 commented Apr 18, 2026

Summary

Changes

Follow-up polish on top of the contributor commit

Validation

Credit

Uh oh!

Uh oh!

liujinkun2025 commented Apr 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants