Build Parsar workspace with Feishu on public Agents API

[SaladDay]

Parsar is an optional, independently started task workspace using only the public /v1 Agents API. It preserves Parsar’s dense list/detail UI and connects Agents, projects, tasks, comments, conversations, capabilities and recurring work through public Sessions. Core builds, deployment and storage remain independent.

Web and Feishu are the entry points. Feishu supports multi-bot long connections, group/private routing, quoted/media context, progress and result cards, durable delivery/recovery, QR registration and scheduled delivery. Other IM integrations, accounts and fine-grained product permissions are deferred. Execution is bypass-only.

Feishu onboarding defaults to connecting a bot, choosing an Agent and enabling private chat. The private-chat route is created automatically and new bindings inherit the Agent environment. Group routing, application credentials and delivery diagnostics stay behind advanced controls. Existing routes and shared selections are preserved; re-enabling group access is explicit, and readiness follows the actual transport state.

Build centers on Agent templates and environment templates. Agents own model, harness, instructions, Skills, MCP and their default environment binding. Environment templates prepare npm/Python dependencies, initialization scripts, write-only environment variables and initial text files before execution. Parsar uses only Core-managed hosted environments. Preparation travels inline through the public Session contract; template changes affect future Sessions while retries retain their original request. Feishu entries inherit the Agent default environment or specify an override; existing topics retain their assignment.

Feishu is a template-composed case under examples/feishu/, including ordinary environment/Agent definitions and a client that imports them through Parsar resource APIs. Environments explicitly map account fields to tool variables; generic dispatch never selects Feishu CLI variables. The provider adapter owns OAuth wire behavior and the common lifecycle owns waiting, resume, refresh and revocation.

Personal Feishu connections are product-owned: Agent templates declare application/scopes, while users authorize through a link and QR code. Tasks wait before Core Session creation, then automatically resume after verified consent. Grants are bound to the local operator or matching Feishu sender, refreshed before new Sessions, and revocable. App secrets and refresh tokens remain server-side; only a short-lived user token enters the hosted CLI environment. Existing Session credentials cannot be replaced through the public API, so expired snapshots require a new Session.

The Agent editor groups a single system-prompt area (main instructions plus ordered reusable fragments), model/environment, tools/knowledge and account/behavior. Resource bindings share a searchable selector with inline creation, inspection/editing, version selection and unbinding. Nested resource edits preserve the Agent draft and do not submit it.

Portable product features include model/resource management, per-Agent editor drafts and inline resource creation, Skill versions and directory import, MCP/OAuth credentials, versioned instruction-fragment/knowledge/Plugin capabilities and frontend slots, local Agent MCP exposure, business questions, usage/history, file uploads and artifacts, interval/Cron plans, localization and themes. Sessions expose a safe creation-time configuration summary alongside public Core references. English and Chinese documentation describes configuration and the local access boundary.

Sandbox list/rebuild/renew and external HTTP/A2A Agent executors remain blocked by the public API boundary. No privileged Core endpoint or alternate executor is introduced.

Validation:

• 78 Node proxy/product/worker/connection tests, TypeScript and production build passed.
• Focused browser acceptance passed for private-chat setup, group configuration preservation and truthful connection status; personal connection authorization UI, retry and cancellation remain covered by browser fixtures.
• Naming, documentation and translation checks passed; fresh independent review found no remaining actionable issues.
• Deployed on mx; verified the live desktop onboarding, Agent selection, inherited environment and enablement prerequisites without saving configuration. The Mac localhost entry serves the current build.
• Real Codex/MiniMax-M3 execution through OAC completed: environment preparation installed and checksum-verified lark-cli 1.0.98 before the Agent ran. Six Agent commands succeeded, checking version/help, initial files and environment variables and producing a downloadable verification artifact. The Agent performed no installation.
• Real Feishu private-chat inbound/outbound delivery previously completed through OAC. Group delivery remains fixture-tested. Real personal consent verified Saladday, resumed the waiting task automatically, and was reused in a fresh Session without another consent prompt. Hosted CLI calls remain blocked by this deployment’s private Feishu gateway DNS/network configuration; this is not claimed as successful personal-resource execution. Temporary gateway/hosts experiments were rolled back. The Agent now uses the correct read-only user_info API in external-token mode rather than unsupported auth-management commands.
• Real Codex/MiniMax-M3 template-composition acceptance completed on mx: an existing personal grant was reused without consent, lark-cli 1.0.98 ran, all three mapped credential fields were present, and both user-mode settings matched. The Agent wrote outputs/template-check.md; credentials were checked as booleans only. This probe did not call Feishu business APIs.
• Current PR CI status is reported by the checks below.