[DoodleBears]

BotHarness #1031 | Agent claim

Task: codex/local/01a1131c-b268-7212-9ac8-d1c7bf9b6e28.

Why the change

Native Human questions need a checked Lark form and actual SDK answer provenance so the original BotHarness question owner can accept an answer from its paired private DM.

Special things to note

• Merge risk: two-way door — revert this commit and question capability becomes unavailable; medium blast radius — shared Lark callback parsing and checked private-card writes change, with wrong receipt or forged actor as the main failure risks. Review the SDK context, account transition, consumer lease and final write fence.
• Candidate only: no package release, production deployment, account scope change or BotHarness qualified pin update. Native Windows focused contracts: 791 passed, 5 existing platform-related skips; the broader Provider suite has pre-existing Windows updater/POSIX failures and is not claimed green.
• The first guarded #1031 window hit the actual Lark form maximum: max_length: 2000 returned platform error 11310 before card creation. Source a9f6cbc now renders and validates form fields at 1000 characters; boundary assertions, package verification and all 791 contracts pass. Zero answers were accepted, no uncertain send was replayed, QA authority was revoked and production restored within ten minutes; the Human confirmed normal replies on both platforms. Real Lark form screenshots and SDK callback/final-card qualification still require a new window. Keep draft until they are captured.

Change outline

dshIm.questionCardVersion = 1
dshIm.questionCardChecked(... expectedFingerprint, beforeSend, signal)
  → current Registration
  → current account transition + exclusive consumer lease
  → SDK verifies original actor/private chat or own interactive receipt
  → final Host fence
  → full question form / update original card

SDK card.action.trigger
  operator.open_id + context.open_message_id/open_chat_id
  action.form_value[qN_choices / qN_custom]
  → bounded opaque choices + custom values
  → question-action consumer acknowledgement (queued/refused)
  → BotHarness owns permission, native answer and final state

The form submits all one-to-three original questions together, including headers, details and option descriptions. Answered, cancelled, expired and Web-required cards contain no form controls. Approval actions retain their existing namespace and shape.

Each form custom field accepts at most 1000 characters, as enforced by the real platform and the checked SDK callback parser. BotHarness's separate explicit-text/native answer bound remains unchanged.

 lib/index.js                      rebuilt package entry
 plugin-src/host/                  optional checked public contract
 src/channels/feishu/
+ external-questions.mjs           full form + strict SDK value normalization
  external-cards.mjs               shared real-context parsing and own-receipt updates
  feishu-runtime.mjs               checked writes on current external consumer
  multi-bot-controller.mjs         account transition and lease
+ test/.../external-questions      forms, provenance, private writes, refusal fences

Runnable review path: install this candidate into an IM-disabled isolated Profile, pair the Human during a newly approved receiver window, grant Answer only, trigger a native two-question request, choose an option and enter free text, then verify the original Session continues and the original card becomes Answered. A separate single-question request exercises an explicit /answer <reference> <text> reply. Capture the pending/final real cards and restore production before the cutoff; do not reconnect the shared app outside that window.

[DoodleBears]

Synced with latest main at f671b67. Core counterpart is now BotHarness/DeepSeekBot#3314 (replacing closed #1104).