Files

T

History

Hunter B 0dfe9170a1 chore(deps): patch npm lockfiles for Dependabot alerts

Apply `npm audit fix --package-lock-only` across npm workspaces to
resolve the 17 open Dependabot alerts (7 high, 10 moderate) on the
v0.9.1 merged tree:

- integrations/feishu-bridge: protobufjs 7.6.4 → 7.6.5
- extensions/vscode: brace-expansion 5.0.6 → 5.0.7, js-yaml 4.2.0 → 4.3.0,
  fast-uri 3.1.2 → 3.1.4, linkify-it 5.0.1 → 5.0.2
- web: brace-expansion/js-yaml and other transitive dev deps updated to
  patched versions; build, lint, tests, and `check:facts` still pass
- root package-lock: refreshed transitive lockfile metadata

Remaining npm audit findings:
- sharp <0.35.0 (via miniflare/next/wrangler) in web and root: no
  non-breaking patch available; miniflare pins sharp 0.34.5. Website is
  not deployed for v0.9.1, so exposure is build-time only.
- axios in feishu-bridge lockfile is already resolved to 1.18.1; the
  Dependabot alerts appear stale against the current lockfile.

All affected workspace checks pass:
- integrations/feishu-bridge: `npm run check && npm run test` — 19 passed
- extensions/vscode: `npm run check` — compiles
- web: `npm run prebuild && npm run check:facts && npm test && npm run lint
  && npm run build` — green

Refs #4713

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-07-22 17:48:52 -07:00

scripts

fix(feishu-bridge): read CODEWHALE_* env, fall back to DEEPSEEK_*

2026-06-14 16:40:55 -07:00

src

wip(v0.8.67): fleet roster + whaleflow-js cutover checkpoint

2026-07-05 10:02:37 -07:00

test

fix(feishu): preserve per-chat model state

2026-05-30 23:55:00 -07:00

.env.example

fix(feishu-bridge): read CODEWHALE_* env, fall back to DEEPSEEK_*

2026-06-14 16:40:55 -07:00

package-lock.json

chore(deps): patch npm lockfiles for Dependabot alerts

2026-07-22 17:48:52 -07:00

package.json

chore(deps): bump axios

2026-07-21 08:46:33 +00:00

README.md

release: prepare Codewhale v0.9.0

2026-07-15 23:44:37 -07:00

README.md

Feishu / Lark Bridge

This bridge lets a Feishu or Lark chat control a local codewhale serve --http runtime from a phone. It uses the official Lark/Feishu Node SDK long-connection mode, so the first version does not need a public webhook URL.

Security model:

codewhale serve --http stays bound to 127.0.0.1.
/v1/* runtime calls use CODEWHALE_RUNTIME_TOKEN.
Feishu/Lark chats must be allowlisted in CODEWHALE_CHAT_ALLOWLIST unless CODEWHALE_ALLOW_UNLISTED=true is set for first pairing.
Direct messages are the intended MVP control surface. Group chat control is disabled unless FEISHU_ALLOW_GROUPS=true.
Tool approvals are text commands: /allow <approval_id> or /deny <approval_id>.
Feishu/Lark only sees the prompts, status, thread summaries, and approval messages the bridge sends. The workspace, shell, and runtime HTTP listener stay local behind the Codewhale runtime token.

Setup

cd /opt/codewhale/feishu-bridge
npm install --omit=dev
cp .env.example /etc/codewhale/feishu-bridge.env
sudoedit /etc/codewhale/feishu-bridge.env
node src/index.mjs

Validate the env files before starting the service:

npm run validate:config -- \
  --env /etc/codewhale/feishu-bridge.env \
  --runtime-env /etc/codewhale/runtime.env \
  --workspace-root /opt/whalebro \
  --check-filesystem

For first pairing, temporarily set CODEWHALE_ALLOW_UNLISTED=true, send the bot /status, copy the returned chat_id, open_id, or union_id into CODEWHALE_CHAT_ALLOWLIST, then turn CODEWHALE_ALLOW_UNLISTED=false.

For a Tencent Lighthouse deployment, use:

sudo systemctl enable --now codewhale-runtime codewhale-feishu-bridge
sudo journalctl -u codewhale-feishu-bridge -f

Commands

/status
/threads
/new
/resume <thread_id>
/model <name|default>
/interrupt
/compact
/allow <approval_id> [remember]
/deny <approval_id>

Anything else is sent as a prompt. If group control is explicitly enabled, messages should start with the Codewhale prefix /cw, for example:

/cw check git status and tell me what is dirty