Bug Description

When using the Feishu/Lark gateway, Hermes routes user reactions on messages sent by other bots in the same group as synthetic text events such as reaction:added:THUMBSUP.

This can happen even when normal group messages are correctly gated by mention or group policy, because reaction events are handled through a separate Feishu event path.

Steps to Reproduce

1. Configure Hermes with the Feishu/Lark gateway in a group chat.
2. Add another Feishu bot or app to the same group.
3. Let the other bot send a message.
4. React to that other bot's message with an emoji.
5. Observe that Hermes receives and processes a synthetic reaction message.

Expected Behavior

Hermes should only route reactions on messages sent by the current Hermes bot.

Reactions on messages sent by other bots or apps in the same Feishu group should be ignored.

Actual Behavior

Hermes fetches the reacted-to message and only checks whether the message sender has sender_type == "app".

Since other Feishu bots also send messages as app senders, reactions on those messages can be treated as reactions on Hermes messages and routed into the agent as synthetic text.

Affected Component

Gateway: Feishu/Lark adapter

Root Cause Analysis

The issue is in gateway/platforms/feishu.py.

_handle_reaction_event() fetches the reacted-to message to verify whether the reaction was added to a bot message. However, the check only validates that the target message sender is an app:

sender = getattr(msg, "sender", None)
sender_type = str(getattr(sender, "sender_type", "") or "").lower()
if sender_type != "app":
    return

This filters out normal user messages, but it does not distinguish the current Hermes bot from other Feishu bots/apps in the same group.

The normal message mention gate is not involved here because im.message.reaction.created_v1 events are routed through the reaction event handler, not the regular im.message.receive_v1 path.

Proposed Fix

After fetching the reacted-to message, compare the target message sender identity with the current Hermes bot identity.

A reaction should only be routed when the target message sender matches the Hermes bot open_id or user_id.

This is implemented in:

• PR: https://github.com/NousResearch/hermes-agent/pull/17812

Validation

The PR adds regression coverage for:

• user reactions on another app/bot message are ignored
• user reactions on the current Hermes bot message are still routed

Validation command:

scripts/run_tests.sh tests/gateway/test_feishu.py