Repository navigation
Bridge tracer: Lark file cards with download and safe open-with #1022
Description
Parent
#1020 — Authorized Bridge media in Channel history. Coordination: #48.
What to build
Human uses real Lark/Feishu files from their original Channel bubble through known metadata, download and existing safe open-with behavior.
Acceptance criteria
- Qualify native file/parent resource association, multiple file items and mixed text/file order where the provider supports them.
- Show filename, known type and known size; unknown data stays unknown. Download the actual bounded original bytes.
- Offer existing safe open-with only when the applicable Host/device supports it. Unavailable native opening still permits an authorized download. Never automatically execute, introduce a new launcher or write edits back to the provider.
- Deliver one production-shaped path through qualified Provider intake, canonical Source Event, realtime and historical Channel projection, authorized Host media access and operable bubble UI. Do not start a competing receiver or a second message store.
- Preserve external author, source-name button/Modal, message boundary and known item ordering. Multiple and mixed media remain one native message; unknown ordering/metadata is honest. Provider URLs, tokens, AES keys and credentials remain private.
- Human Channel access resolves trusted media authorization without choosing or borrowing a Bot identity. Recheck placement, source/media identity, current Channel access and independent valid source authorization during acquisition and serving.
- Visible-image previews acquire on visibility; audio/video and file actions acquire on explicit action. Reuse existing Host Attachment management; keep the default 25 MiB bound, cancellation and bounded concurrency. Display loading, too-large, unsupported, failure and retry states honestly.
- After acquisition, refresh and Host restart retain authorized history access. Ordinary Bridge reception stop allows acquired-media viewing but no new acquisition through that stopped path. Unbind/media revocation prevents acquisition and serving through that authorization; independent valid paths remain independent. Do not resurrect Content Purge content.
- Human viewing creates no Bot Observation, model-context change, Inbox admission, wake or external send authority. Inbox-only creates no Channel history. Bot understanding and own-identity permissions remain unchanged.
- Complete focused observable regression coverage and real platform/media E2E: receive a uniquely identifiable native message, inspect actual bytes/preview/play/download as applicable, refresh/restart, and demonstrate relevant stop/revoke/error recovery. Mock payloads, flags and HTTP success alone are not platform proof.
- Provide GitHub-renderable matched before/after light/dark screenshots, relevant playback/recovery recording and usable Human verification steps. Follow DSH tokens/primitives and keyboard/accessibility conventions; keep private chat content and secrets out of evidence.
- Update applicable canonical English/Chinese user guidance and bilingual release ledgers for delivered behavior; do not edit generated docs. Deliver one issue-linked PR with task claim/trace and review-risk classification, then pause for Human QA before expanding dependent slices. Merge/deployment require separate authorization.
Blocked by
Planning and authority
Project: V1.1 · IM Identities & Messaging (#10). Milestone: v1.2, explicitly selected by Human; Project title does not override milestone. Human approved ticket granularity and blocking edges before publication. This publication does not claim implementation or take over existing WeChat work.
Activity
7 remaining items
DoodleBears commentedon Oct 7, 2026
Agent work claim — remaining media qualification resumed. Task codex/local/01a112f7-dccf-7c81-b6c5-6624e3098722 resumes on codex/1022-lark-file-cards after Human requested continuing remaining issues. Scope: normal isolated QA Profile setup with the existing authorized BotHarness Onboarding QA 824 app, mutually exclusive reception, fresh native file and matched light evidence; keep exact candidate Provider and existing permission boundaries. Prior machine receiver was explicitly stopped in the handoff; this continuation has configured no local QA app receiver. Chrome read-only lookup confirms the dedicated QA app is distinct from the active production app used by the separate 1029 task. No production interruption, app-scope expansion, other-task takeover or 1023 implementation. State active; supersedes this task previous paused outcome.
DoodleBears commentedon Oct 15, 2026
Agent work claim — current-main Lark file slice
codex/local/01a13902-0d72-7872-ac0f-440e152155d5(not a DSH Session).codex/1022-lark-files-main, current-main basee6abf667.DoodleBears commentedon Oct 15, 2026
Agent work checkpoint
codex/local/01a13902-0d72-7872-ac0f-440e152155d583bad0dee7f841ed2ff96e1d3913f2bcc5c3ff2cThe real QA2 path now reaches a checked quoted-parent file, canonical Source Event and Channel card. The actual card and CLI downloaded the exact original 32-byte synthetic CSV with matching SHA-256. Viewing added no Source, Admission, model usage or Outbox. Reception stop retained the acquired original; identity unbind refused cached access with
source-unavailable.The dedicated isolated receiver was stopped early and QA2 released. Other Apps and receivers were not changed. T3 browser control recovered in a fresh tab but disappeared again after the application-menu click; that click's visible outcome, refresh/restart, matched light/dark GitHub evidence, installed-product acceptance and Human feedback remain open. Issue closure, merge and deployment are not claimed.
Focused tests passed 46/46, and the complete media file passed 12/12 serially. The original broader run's 152/153 with one image-case timeout remains recorded; its immediate variants and full serial media rerun passed. Detailed evidence and boundaries: verification record.
fix(cli): isolate the packaged command entry from Host peers
test(messaging): qualify installed Lark files and retained access
feat: Lark referenced file cards with authorized download (#1943)
DoodleBears commentedon Oct 15, 2026
Agent work outcome — completed
codex/local/01a13902-0d72-7872-ac0f-440e152155d5ba53c5fbf69f05e91c81c4caa3fe645cb16465a3a425ddb12ab3520e683913dbd630631bc7bf0a79; full three-shard CI, lint/typecheck/build, docs and isolated Host smoke passed. Real-model CI scenarios were skipped; actual model/platform evidence came from the isolated QA2 runs.The real native request reached its original Channel bubble and exact filename-only file card. Browser and actual installed CLI downloaded the same 32-byte original and SHA-256. Refresh and same-Profile packaged cold restart retained history and original bytes. Reception stop preserved acquired access; identity unbind produced a coded and visible refusal, including Retry. After the ordinary Bot turn settled, these actions added no Source, Admission, settled usage or Outbox. Five genuine matched light/dark/refusal images were verified rendered on GitHub, with two short real UI recordings.
Limits stay explicit: this Provider qualifies one quoted parent file, not direct/multiple/rich mixed file intake. This Windows Host's native application query failed; its truthful download fallback passed, with no positive native application-launch claim. Native Session/appearance blank-page evidence remains separate under the existing #1251 investigation; no speculative fix or attribution is claimed. Stop-before-acquisition, independent paths, oversize/cancellation and purge retain controlled coverage, not a claim that each was separately exercised on Lark.
The Human authorized merge after qualification and continuation to #1023. QA2 and both task-owned Hosts were stopped/released. No publication or deployment was performed. Current qualification: verification, visual evidence. The head-bound HTML review aid was rendered and visually checked locally at desktop/narrow widths; it remains a local artifact, not a hosted reviewer link.