hermes - 💡(How to fix) Fix [Feature Request] Add Feishu User OAuth support for enhanced message access [1 participants]

🚀 Feature Description

Problem

Hermes-Feishu integration currently uses only Bot Token authentication (tenant_access_token), which is limited to reading messages sent directly to the Hermes bot itself. This prevents users from:

• Viewing and learning from other bot sessions in shared chats
• Searching across their full Feishu message history
• Accessing messages from other agents for capability analysis

Proposed Solution

Implement RFC 8628 Device Authorization Grant flow to obtain and maintain a User Access Token (UAT), enabling:

• im.v1.message.list by user open_id for all personal messages
• search:message scope for full-text message search across all conversations
• Ability to read messages from other bots in shared chats (learning from other agents)
• Persistent token refresh (UAT + Refresh Token)

Reference Implementation

OpenClaw's Lark extension already implements this pattern. The key components are:

• device-flow.js — OAuth 2.0 Device Authorization Grant (RFC 8628)
• uat-client.js — Token refresh logic
• token-store.js — Cross-platform secure token storage

Scope Comparison

Implementation Notes

• OAuth is user-initiated — users explicitly authorize Hermes to access their Feishu data
• Tokens should be stored securely (similar to how OpenClaw stores UAT in platform-specific secure storage: Keychain on macOS, encrypted file on Linux)
• The existing lark_oapi SDK in the codebase can be leveraged for the OAuth flow
• No privacy concerns — this is an opt-in feature, bot-token mode remains the default

Priority

This would unblock the "learn from other agents" workflow that users expect from Feishu's bot platform, and enable features like cross-bot session analysis and comprehensive message search.