diff --git a/changelog.d/1263-feishu.added.md b/changelog.d/1263-feishu.added.md
new file mode 100644
index 000000000..b87d27659
--- /dev/null
+++ b/changelog.d/1263-feishu.added.md
@@ -0,0 +1 @@
+Feishu (Lark) connector, phase 1: paste a group's custom-bot webhook URL on Settings → Connectors and this instance can post a text message into that group. The row is a sender — no Bot tools, no per-Bot switch — it proves the webhook with one test message when you connect, shows the reason on the row when Feishu refuses, and sends on demand with the existing retry policy (a rate limit is retried, a refused signature is not). The URL is kept as a secret and never appears in `state.json`, the view or a log line. ([#1263](https://github.com/ThinkFlowLab/FlyBot/issues/1263))
diff --git a/core/client.js b/core/client.js
index 7a2adeb70..548a30796 100644
--- a/core/client.js
+++ b/core/client.js
@@ -318,6 +318,12 @@ var ZH = {
   "This DSH cannot load connectors": "这个 DSH 不能加载连接器",
   "No such connector": "没有这个连接器",
   "Gmail, Slack, Calendar, Notion and many more apps, through one Composio key": "Gmail、Slack、日历、Notion 等众多应用，一个 Composio key 就能连",
+  "Posts into one Feishu group through a custom bot webhook": "通过自定义机器人 webhook 发到你的一个飞书群",
+  "Feishu webhook URL": "飞书 webhook 地址",
+  "Get a webhook URL in Feishu": "去飞书获取 webhook 地址",
+  "Message to send to Feishu": "要发到飞书的消息",
+  "Type a message for the Feishu group": "输入要发到飞书群的消息",
+  Send: "发送",
   "Connected: {apps}": "已连接：{apps}",
   "Composio API key": "Composio API key",
   "Get a Composio API key": "去 Composio 获取 API key",
@@ -948,7 +954,6 @@ var ZH = {
   Remove: "删除",
   "Ask or update": "询问或更新",
   "Ask about or update {name}'s memory": "询问或更新 {name} 的记忆",
-  Send: "发送",
   "Added: {text}": "已添加：{text}",
   "Added to team memory: {text}": "已加入团队记忆：{text}",
   "Updated: {text}": "已更新：{text}",
@@ -12313,7 +12318,7 @@ function ownBots(roster) {
   const me = roster?.self?.memberId;
   return (roster?.bots ?? []).filter((bot) => !bot.remote && (me === void 0 || me === null || bot.ownerId === void 0 || bot.ownerId === me));
 }
-var connectedConnectors = (roster) => (roster?.connectors ?? []).filter((connector) => connector.state !== "off");
+var connectedConnectors = (roster) => (roster?.connectors ?? []).filter((connector) => connector.state !== "off" && connector.kind !== "sender");
 var isOn = (bot, id) => bot.connectors?.[id] !== false;
 function ownHint(bot, id) {
   return isOn(bot, id) ? t("On. This Bot can use it on every turn.") : t("Off. This Bot will not use it.");
@@ -15682,6 +15687,7 @@ button.bt-us-row:hover{background:var(--bt-hover)}
 var import_react36 = require("react");
 var TOKEN_URL = "https://github.com/settings/personal-access-tokens/new";
 var COMPOSIO_KEY_URL = "https://platform.composio.dev/";
+var FEISHU_WEBHOOK_URL = "https://open.feishu.cn/document/client-docs/bot-v3/add-custom-bot";
 var APPS = [
   ["gmail", "Gmail"],
   ["googlecalendar", "Google Calendar"],
@@ -15717,10 +15723,18 @@ var GitHubMark = () => (0, import_react36.createElement)(
   { width: 20, height: 20, viewBox: "0 0 16 16", fill: "currentColor", "aria-hidden": true },
   (0, import_react36.createElement)("path", { d: "M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" })
 );
-var MARKS = { github: GitHubMark, composio: ConnectorIcon };
+var FeishuMark = () => (0, import_react36.createElement)(
+  "svg",
+  { width: 20, height: 20, viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": true },
+  (0, import_react36.createElement)("path", { d: "M3.2 6.6c3 .1 6.4 1.5 8.6 3.9-1.9.4-3.5 1.4-4.7 2.9-1.9-.6-3.4-1.9-3.9-3.6-.2-.7-.2-1.5 0-3.2z" }),
+  (0, import_react36.createElement)("path", { d: "M16.8 5.4c-2.9.2-5.6 1.5-7.4 3.4 1.7 1.2 3.1 2.8 3.9 4.9 2.2-1.1 3.8-3.2 4-5.6.1-.9-.1-1.9-.4-2.7z" }),
+  (0, import_react36.createElement)("path", { d: "M8.6 12.1c.9.7 1.7 1.6 2.2 2.7-1.1.2-2.3 0-3.3-.6.2-.8.6-1.5 1.1-2.1z" })
+);
+var MARKS = { github: GitHubMark, composio: ConnectorIcon, feishu: FeishuMark };
 var ABOUT = {
   github: () => t("Repositories, issues, and pull requests"),
-  composio: () => t("Gmail, Slack, Calendar, Notion and many more apps, through one Composio key")
+  composio: () => t("Gmail, Slack, Calendar, Notion and many more apps, through one Composio key"),
+  feishu: () => t("Posts into one Feishu group through a custom bot webhook")
 };
 function statusText2(connector) {
   if (connector.state === "connecting") return t("Connecting…");
@@ -15801,6 +15815,7 @@ function ConnectorRow({ connector, roster, actions }) {
   const [picking, setPicking] = (0, import_react36.useState)(false);
   const [busy, setBusy] = (0, import_react36.useState)(false);
   const [error, setError] = (0, import_react36.useState)(null);
+  const [message, setMessage] = (0, import_react36.useState)("");
   const run = (task, after) => {
     setBusy(true);
     setError(null);
@@ -15809,6 +15824,7 @@ function ConnectorRow({ connector, roster, actions }) {
     }, (failure) => setError(failure?.message ?? String(failure))).finally(() => setBusy(false));
   };
   const gateway = connector.id === "composio";
+  const sender = connector.kind === "sender";
   const [statuses, setStatuses] = (0, import_react36.useState)({});
   const appsKey = (connector.apps ?? []).join(",");
   (0, import_react36.useEffect)(() => {
@@ -15871,22 +15887,33 @@ function ConnectorRow({ connector, roster, actions }) {
           setApps(connector.apps ?? []);
           setPicking(true);
         } }, t("Choose apps")) : null,
-        on ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", "aria-expanded": bots, onClick: () => setBots((value) => !value) }, bots ? t("Done") : t("Choose Bots")) : null,
+        on && !sender ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", "aria-expanded": bots, onClick: () => setBots((value) => !value) }, bots ? t("Done") : t("Choose Bots")) : null,
         on ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy, onClick: () => void run(actions.connectorDisconnect(connector.id)) }, t("Disconnect")) : form ? null : (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", onClick: () => setForm(true) }, t("Connect"))
       )
     ),
     on && gateway && !picking ? (0, import_react36.createElement)(AppStatusList, { apps: connector.apps ?? [], statuses }) : null,
-    on ? (0, import_react36.createElement)("span", { className: "bt-connector-uses" }, usageText(roster, connector.id)) : null,
+    on && !sender ? (0, import_react36.createElement)("span", { className: "bt-connector-uses" }, usageText(roster, connector.id)) : null,
     on && bots ? (0, import_react36.createElement)(ConnectorBots, { connector, roster, actions, run, SwitchRow }) : null,
+    on && sender ? (0, import_react36.createElement)(
+      "div",
+      { className: "bt-connector-form" },
+      (0, import_react36.createElement)("label", { className: "bt-q-field" }, (0, import_react36.createElement)("input", { className: "bt-input", type: "text", value: message, "aria-label": t("Message to send to Feishu"), placeholder: t("Type a message for the Feishu group"), onChange: (event) => setMessage(event.target.value) })),
+      (0, import_react36.createElement)(
+        "div",
+        { className: "bt-connector-form-row" },
+        (0, import_react36.createElement)("span", { className: "bt-connector-link" }),
+        (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy || message.trim() === "" || actions.connectorSend === void 0, onClick: () => void run(actions.connectorSend(connector.id, message), () => setMessage("")) }, t("Send"))
+      )
+    ) : null,
     !on && form ? (0, import_react36.createElement)(
       "div",
       { className: "bt-connector-form" },
-      (0, import_react36.createElement)("label", { className: "bt-q-field bt-secret-field" }, (0, import_react36.createElement)(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: gateway ? t("Composio API key") : t("GitHub token"), autoFocus: true })),
+      (0, import_react36.createElement)("label", { className: "bt-q-field bt-secret-field" }, (0, import_react36.createElement)(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: sender ? t("Feishu webhook URL") : gateway ? t("Composio API key") : t("GitHub token"), autoFocus: true })),
       gateway ? (0, import_react36.createElement)(AppPicker, { apps, onChange: setApps, search: token.trim() === "" ? void 0 : search }) : null,
       (0, import_react36.createElement)(
         "div",
         { className: "bt-connector-form-row" },
-        (0, import_react36.createElement)("a", { className: "bt-connector-link", href: gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: "_blank", rel: "noopener noreferrer" }, gateway ? t("Get a Composio API key") : t("Create a token on GitHub")),
+        (0, import_react36.createElement)("a", { className: "bt-connector-link", href: sender ? FEISHU_WEBHOOK_URL : gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: "_blank", rel: "noopener noreferrer" }, sender ? t("Get a webhook URL in Feishu") : gateway ? t("Get a Composio API key") : t("Create a token on GitHub")),
         (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy, onClick: () => {
           setForm(false);
           setToken("");
@@ -19821,6 +19848,7 @@ function apply(ctx) {
     connectorAppStatus: (id) => call("connector-app-status", { id }),
     connectorDisconnect: (id) => after(call("connector-disconnect", { id })),
     connectorRetry: (id) => after(call("connector-retry", { id })),
+    connectorSend: (id, text) => after(call("connector-send", { id, text })),
     saveCapability: (capability) => after(call("capability-save", capability)),
     deleteCapability: (name) => after(call("capability-delete", { name })),
     approveCapability: (name) => after(call("capability-approve", { name })),
diff --git a/core/src/client/connector-bots.js b/core/src/client/connector-bots.js
index 21a6d5143..27fd56edd 100644
--- a/core/src/client/connector-bots.js
+++ b/core/src/client/connector-bots.js
@@ -12,7 +12,9 @@ export function ownBots(roster) {
   return (roster?.bots ?? []).filter(bot => !bot.remote && (me === undefined || me === null || bot.ownerId === undefined || bot.ownerId === me))
 }
 
-export const connectedConnectors = roster => (roster?.connectors ?? []).filter(connector => connector.state !== 'off')
+// Connectors that give a Bot tools. A sender (#1263) has none: a per-Bot switch for it would be a
+// choice that never changes anything, so it is not offered.
+export const connectedConnectors = roster => (roster?.connectors ?? []).filter(connector => connector.state !== 'off' && connector.kind !== 'sender')
 
 // Only an explicit false turns it off; no record means on.
 export const isOn = (bot, id) => bot.connectors?.[id] !== false
diff --git a/core/src/client/connectors.js b/core/src/client/connectors.js
index 3221f0548..7d2564123 100644
--- a/core/src/client/connectors.js
+++ b/core/src/client/connectors.js
@@ -8,6 +8,8 @@ import { t } from './i18n.js'
 
 const TOKEN_URL = 'https://github.com/settings/personal-access-tokens/new'
 const COMPOSIO_KEY_URL = 'https://platform.composio.dev/'
+// Feishu's own page for a group's custom bot, where the webhook URL comes from.
+const FEISHU_WEBHOOK_URL = 'https://open.feishu.cn/document/client-docs/bot-v3/add-custom-bot'
 
 // Common apps, searched when Composio cannot be asked; any other app is found by the search.
 const APPS = [
@@ -23,10 +25,17 @@ const appName = slug => APPS.find(([id]) => id === slug)?.[1] ?? slug
 export const GitHubMark = () => h('svg', { width: 20, height: 20, viewBox: '0 0 16 16', fill: 'currentColor', 'aria-hidden': true },
   h('path', { d: 'M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z' }))
 
-const MARKS = { github: GitHubMark, composio: ConnectorIcon }
+// Feishu's mark: two stacked wings around a middle line, drawn here rather than copied.
+export const FeishuMark = () => h('svg', { width: 20, height: 20, viewBox: '0 0 20 20', fill: 'currentColor', 'aria-hidden': true },
+  h('path', { d: 'M3.2 6.6c3 .1 6.4 1.5 8.6 3.9-1.9.4-3.5 1.4-4.7 2.9-1.9-.6-3.4-1.9-3.9-3.6-.2-.7-.2-1.5 0-3.2z' }),
+  h('path', { d: 'M16.8 5.4c-2.9.2-5.6 1.5-7.4 3.4 1.7 1.2 3.1 2.8 3.9 4.9 2.2-1.1 3.8-3.2 4-5.6.1-.9-.1-1.9-.4-2.7z' }),
+  h('path', { d: 'M8.6 12.1c.9.7 1.7 1.6 2.2 2.7-1.1.2-2.3 0-3.3-.6.2-.8.6-1.5 1.1-2.1z' }))
+
+const MARKS = { github: GitHubMark, composio: ConnectorIcon, feishu: FeishuMark }
 const ABOUT = {
   github: () => t('Repositories, issues, and pull requests'),
   composio: () => t('Gmail, Slack, Calendar, Notion and many more apps, through one Composio key'),
+  feishu: () => t('Posts into one Feishu group through a custom bot webhook'),
 }
 
 function statusText(connector) {
@@ -104,12 +113,15 @@ function ConnectorRow({ connector, roster, actions }) {
   const [picking, setPicking] = useState(false)
   const [busy, setBusy] = useState(false)
   const [error, setError] = useState(null)
+  const [message, setMessage] = useState('')
   const run = (task, after) => {
     setBusy(true)
     setError(null)
     return task.then(() => { after?.() }, failure => setError(failure?.message ?? String(failure))).finally(() => setBusy(false))
   }
   const gateway = connector.id === 'composio'
+  // A sender posts through one webhook: no tools, so no per-Bot switch, and its own send field.
+  const sender = connector.kind === 'sender'
   const [statuses, setStatuses] = useState({})
   const appsKey = (connector.apps ?? []).join(',')
   // Asks Composio which picked apps are signed in, when the row is ready and again when the list changes.
@@ -143,18 +155,23 @@ function ConnectorRow({ connector, roster, actions }) {
       h('span', { className: 'bt-connector-actions' },
         connector.state === 'error' ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => void run(actions.connectorRetry(connector.id)) }, t('Try again')) : null,
         on && gateway && !picking ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => { setApps(connector.apps ?? []); setPicking(true) } }, t('Choose apps')) : null,
-        on ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', 'aria-expanded': bots, onClick: () => setBots(value => !value) }, bots ? t('Done') : t('Choose Bots')) : null,
+        on && !sender ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', 'aria-expanded': bots, onClick: () => setBots(value => !value) }, bots ? t('Done') : t('Choose Bots')) : null,
         on
           ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => void run(actions.connectorDisconnect(connector.id)) }, t('Disconnect'))
           : form ? null : h('button', { type: 'button', className: 'bt-soft bt-soft-sm', onClick: () => setForm(true) }, t('Connect')))),
     on && gateway && !picking ? h(AppStatusList, { apps: connector.apps ?? [], statuses }) : null,
-    on ? h('span', { className: 'bt-connector-uses' }, usageText(roster, connector.id)) : null,
+    on && !sender ? h('span', { className: 'bt-connector-uses' }, usageText(roster, connector.id)) : null,
     on && bots ? h(ConnectorBots, { connector, roster, actions, run, SwitchRow }) : null,
+    on && sender ? h('div', { className: 'bt-connector-form' },
+      h('label', { className: 'bt-q-field' }, h('input', { className: 'bt-input', type: 'text', value: message, 'aria-label': t('Message to send to Feishu'), placeholder: t('Type a message for the Feishu group'), onChange: event => setMessage(event.target.value) })),
+      h('div', { className: 'bt-connector-form-row' },
+        h('span', { className: 'bt-connector-link' }),
+        h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy || message.trim() === '' || actions.connectorSend === undefined, onClick: () => void run(actions.connectorSend(connector.id, message), () => setMessage('')) }, t('Send')))) : null,
     !on && form ? h('div', { className: 'bt-connector-form' },
-      h('label', { className: 'bt-q-field bt-secret-field' }, h(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: gateway ? t('Composio API key') : t('GitHub token'), autoFocus: true })),
+      h('label', { className: 'bt-q-field bt-secret-field' }, h(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: sender ? t('Feishu webhook URL') : gateway ? t('Composio API key') : t('GitHub token'), autoFocus: true })),
       gateway ? h(AppPicker, { apps, onChange: setApps, search: token.trim() === '' ? undefined : search }) : null,
       h('div', { className: 'bt-connector-form-row' },
-        h('a', { className: 'bt-connector-link', href: gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: '_blank', rel: 'noopener noreferrer' }, gateway ? t('Get a Composio API key') : t('Create a token on GitHub')),
+        h('a', { className: 'bt-connector-link', href: sender ? FEISHU_WEBHOOK_URL : gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: '_blank', rel: 'noopener noreferrer' }, sender ? t('Get a webhook URL in Feishu') : gateway ? t('Get a Composio API key') : t('Create a token on GitHub')),
         h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => { setForm(false); setToken(''); setError(null) } }, t('Cancel')),
         h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy || token.trim() === '', onClick: connect }, busy ? t('Connecting…') : t('Connect')))) : null,
     on && gateway && picking ? h('div', { className: 'bt-connector-form' },
diff --git a/core/src/client/i18n.js b/core/src/client/i18n.js
index 282f95bd2..06ac1cb50 100644
--- a/core/src/client/i18n.js
+++ b/core/src/client/i18n.js
@@ -282,6 +282,12 @@ const ZH = {
   'This DSH cannot load connectors': '这个 DSH 不能加载连接器',
   'No such connector': '没有这个连接器',
   'Gmail, Slack, Calendar, Notion and many more apps, through one Composio key': 'Gmail、Slack、日历、Notion 等众多应用，一个 Composio key 就能连',
+  'Posts into one Feishu group through a custom bot webhook': '通过自定义机器人 webhook 发到你的一个飞书群',
+  'Feishu webhook URL': '飞书 webhook 地址',
+  'Get a webhook URL in Feishu': '去飞书获取 webhook 地址',
+  'Message to send to Feishu': '要发到飞书的消息',
+  'Type a message for the Feishu group': '输入要发到飞书群的消息',
+  Send: '发送',
   'Connected: {apps}': '已连接：{apps}',
   'Composio API key': 'Composio API key',
   'Get a Composio API key': '去 Composio 获取 API key',
@@ -895,7 +901,6 @@ const ZH = {
   Remove: '删除',
   'Ask or update': '询问或更新',
   "Ask about or update {name}'s memory": '询问或更新 {name} 的记忆',
-  Send: '发送',
   'Added: {text}': '已添加：{text}',
   'Added to team memory: {text}': '已加入团队记忆：{text}',
   'Updated: {text}': '已更新：{text}',
diff --git a/core/src/client/index.js b/core/src/client/index.js
index 3594a08cb..069d0b047 100644
--- a/core/src/client/index.js
+++ b/core/src/client/index.js
@@ -602,6 +602,7 @@ export function apply(ctx) {
     connectorAppStatus: id => call('connector-app-status', { id }),
     connectorDisconnect: id => after(call('connector-disconnect', { id })),
     connectorRetry: id => after(call('connector-retry', { id })),
+    connectorSend: (id, text) => after(call('connector-send', { id, text })),
     saveCapability: capability => after(call('capability-save', capability)),
     deleteCapability: name => after(call('capability-delete', { name })),
     approveCapability: name => after(call('capability-approve', { name })),
diff --git a/core/src/host/authz.js b/core/src/host/authz.js
index e46b92211..e317a6de0 100644
--- a/core/src/host/authz.js
+++ b/core/src/host/authz.js
@@ -25,7 +25,7 @@ const NO_ACTOR_ALLOWED = new Set(['auth-redeem', 'auth-whoami', 'auth-invite'])
 // is one of them: there is at most one, and it carries no owner.
 const SHARED_BLOCKED = new Set([
   'secret-set', 'secret-allow', 'secret-cancel', 'secret-update', 'secret-delete',
-  'connector-connect', 'connector-apps', 'connector-app-search', 'connector-app-status', 'connector-disconnect', 'connector-retry', 'bot-connectors',
+  'connector-connect', 'connector-apps', 'connector-app-search', 'connector-app-status', 'connector-disconnect', 'connector-retry', 'connector-send', 'bot-connectors',
   'capability-save', 'capability-delete', 'capability-approve',
   'folders', 'folder-pick', 'folder-list',
   'browser-wait', 'browser-result',
diff --git a/core/src/host/channel.js b/core/src/host/channel.js
index 52b498f55..9f4fabe0e 100644
--- a/core/src/host/channel.js
+++ b/core/src/host/channel.js
@@ -491,6 +491,7 @@ export function install(rt) {
         case 'connector-app-status':
         case 'connector-disconnect':
         case 'connector-retry':
+        case 'connector-send':
           await rt.load()
           return ok(await rt.connectorEndpoint(endpoint, body))
         case 'capability-save':
diff --git a/core/src/host/connectors.js b/core/src/host/connectors.js
index 6b0e84c06..bdfc219c0 100644
--- a/core/src/host/connectors.js
+++ b/core/src/host/connectors.js
@@ -17,11 +17,14 @@
 // without touching the mount.
 
 import { randomUUID } from 'node:crypto'
+import { createNotifier } from './notify.js'
 
 export const GITHUB = 'github'
 export const GITHUB_SECRET = 'GITHUB_TOKEN'
 export const COMPOSIO = 'composio'
 export const COMPOSIO_SECRET = 'COMPOSIO_API_KEY'
+export const FEISHU = 'feishu'
+export const FEISHU_SECRET = 'FEISHU_WEBHOOK'
 // Names a saved capability may not take, because the mount already uses them.
 export const RESERVED_NAMES = [GITHUB, COMPOSIO]
 const MCP_CLIENT = '@deepseek-ai/dsh-mcp-client'
@@ -31,7 +34,15 @@ const GITHUB_DEFAULTS = {
   toolsets: 'context,repos,issues,pull_requests',
 }
 const COMPOSIO_DEFAULTS = { api: 'https://backend.composio.dev/api/v3.1' }
+const FEISHU_DEFAULTS = { api: 'https://open.feishu.cn' }
 const CHECK_TIMEOUT_MS = 15_000
+// A send waits longer than a connect: the connect is one small probe, while a message may sit
+// behind Feishu's own queue. The retry budget is notify.js's, not this deadline.
+const SEND_TIMEOUT_MS = 60_000
+// Feishu's custom-bot webhook answers HTTP 200 with the verdict in the body, so a rate limit has
+// to be read out of `code`; 9499 is the one code that means "the same call may work again".
+export const FEISHU_RATE_LIMITED = 9499
+const FEISHU_TEST_TEXT = 'FlyBot is connected.'
 const INSECURE = name => `${name} addresses must start with https://`
 const SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/
 const APP_SLUG = /^[a-z0-9][a-z0-9_-]{0,63}$/
@@ -237,6 +248,74 @@ async function composioEnsureSession(apiKey, { api, userId, apps, stored, fetch:
   return { id, url, apps }
 }
 
+// The webhook URL is the credential, so it is checked against the API address before anything is
+// sent: https, on the host this instance was configured for. Never another host, never http.
+function webhookAddress(webhook, api) {
+  let url
+  try {
+    url = new URL(String(webhook).trim())
+  } catch {
+    throw new Error('Paste the webhook URL Feishu gave you')
+  }
+  const base = new URL(String(api))
+  if (url.protocol !== 'https:' || url.origin !== base.origin) throw new Error(`A Feishu webhook must be https on ${base.origin}`)
+  return url.href
+}
+
+// A fetch that ignores its abort signal would otherwise hang a connect (or a send) for ever.
+function withDeadline(promise, ms) {
+  let timer
+  const deadline = new Promise((resolve, reject) => { timer = setTimeout(() => reject(new Error('deadline')), Math.max(1, ms)) })
+  return Promise.race([promise, deadline]).finally(() => clearTimeout(timer))
+}
+
+// One text message through a custom-bot webhook, answered in notify.js's vocabulary: `{ ok, ts }`
+// or `{ ok: false, error }`, where `rate_limited` and `service_unavailable` may pass on their own
+// and every other error is a shape Feishu will refuse again. The URL is never part of the answer.
+export async function feishuPost(webhook, text, { fetch: request = fetch, timeoutMs = CHECK_TIMEOUT_MS } = {}) {
+  let response
+  try {
+    response = await withDeadline(request(webhook, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json; charset=utf-8' },
+      body: JSON.stringify({ msg_type: 'text', content: { text: String(text) } }),
+      redirect: 'error',
+      signal: AbortSignal.timeout(Math.max(1, timeoutMs)),
+    }), timeoutMs)
+  } catch {
+    return { ok: false, error: 'network' }
+  }
+  const body = await response.json().catch(() => ({}))
+  if (response.status === 429) {
+    const asked = Number(response.headers?.get?.('retry-after')) * 1000
+    return { ok: false, error: 'rate_limited', retryAfterMs: Number.isFinite(asked) && asked > 0 ? asked : 0 }
+  }
+  if (!response.ok) return { ok: false, error: response.status >= 500 ? 'service_unavailable' : `feishu/http-${response.status}` }
+  const code = Number(body?.code)
+  if (code === 0) {
+    const id = body?.data?.message_id
+    return { ok: true, ts: typeof id === 'string' && id !== '' ? id : 'sent' }
+  }
+  if (code === FEISHU_RATE_LIMITED) return { ok: false, error: 'rate_limited', retryAfterMs: 0 }
+  return { ok: false, error: `feishu/${Number.isFinite(code) ? code : 'unknown'}` }
+}
+
+// The connect step: one test message, so a webhook that cannot post is caught before it is relied
+// on. It throws a sentence for the row; nothing it says carries the URL.
+export async function feishuCheck(webhook, { api = FEISHU_DEFAULTS.api, fetch: request = fetch, timeoutMs = CHECK_TIMEOUT_MS } = {}) {
+  const answer = await feishuPost(webhookAddress(webhook, api), FEISHU_TEST_TEXT, { fetch: request, timeoutMs })
+  if (answer.ok) return {}
+  if (answer.error === 'network' || answer.error === 'service_unavailable') throw new Error('Could not reach Feishu')
+  if (answer.error === 'rate_limited') throw new Error('Feishu is rate-limiting this webhook; try again in a minute')
+  throw new Error(`Feishu did not accept the webhook (${answer.error})`)
+}
+
+// notify.js's transport for a Feishu webhook: the policy (attempts, backoff, idempotency) stays in
+// notify.js, and this only maps one message to one POST.
+export function feishuTransport(webhook, { fetch: request = fetch, timeoutMs = SEND_TIMEOUT_MS } = {}) {
+  return { postMessage: message => feishuPost(webhook, message?.text ?? '', { fetch: request, timeoutMs }) }
+}
+
 const DEFINITIONS = {
   [GITHUB]: {
     id: GITHUB,
@@ -293,6 +372,26 @@ const DEFINITIONS = {
     // Keeps the user id: a new key for the same FlyBot finds the apps already signed in.
     afterDisconnect: saved => saved?.userId === undefined ? undefined : { userId: saved.userId },
   },
+  // Feishu (Lark) is not an MCP server: a custom-bot webhook is one HTTPS POST into the instance's
+  // own group. So it is a *sender* — nothing is mounted, no Bot's tool list changes, and the only
+  // things it has are a status and a send (#1263). The app-credential path slots in behind the same
+  // send, without touching a caller.
+  [FEISHU]: {
+    id: FEISHU,
+    name: 'Feishu',
+    secret: FEISHU_SECRET,
+    purpose: 'Feishu webhook',
+    defaults: FEISHU_DEFAULTS,
+    addresses: options => [options.api],
+    kind: 'sender',
+    paste: 'Paste a webhook URL first',
+    async check({ token, options }) {
+      return feishuCheck(token, { api: options.api })
+    },
+    post: (webhook, text) => feishuPost(webhook, text, { timeoutMs: SEND_TIMEOUT_MS }),
+    mountKey: () => '',
+    account: () => null,
+  },
 }
 
 export function install(rt) {
@@ -322,6 +421,33 @@ export function install(rt) {
     if (fiber !== undefined) await Promise.resolve().then(() => fiber.dispose()).catch(() => { /* a fiber that fails to dispose must not block unloading */ })
   }
 
+  // A sender's retry policy is notify.js's, not a second one written here: one transport per
+  // sender, reading the saved webhook when it is called, so a reconnect needs no rebuild.
+  const notifiers = new Map(connectors.filter(c => c.def.kind === 'sender').map(c => [c.def.id, createNotifier({
+    channel: c.def.id,
+    log: (format, ...args) => rt.warn(`ds-bot: ${format}`, ...args),
+    transport: {
+      postMessage: (message) => {
+        const webhook = rt.secretValue(c.def.secret)
+        if (webhook === undefined) return { ok: false, error: 'channel_not_found' }
+        return c.def.post(webhook, message?.text ?? '')
+      },
+    },
+  })]))
+  const notifierOf = c => notifiers.get(c.def.id)
+
+  // The connect step of a sender: one test message, then ready or the reason. A sender is "ready"
+  // once this passes, and the failure is a row the owner can read and Try again from.
+  const probe = async (c, token) => {
+    try {
+      await c.def.check({ token, options: c.options })
+      c.status = { state: 'ready' }
+    } catch (error) {
+      c.status = { state: 'error', error: reason(error) }
+      rt.warn('ds-bot: %s connector failed: %s', c.def.name, c.status.error)
+    }
+  }
+
   // The MCP client wraps the server's answer (a 401, say) as the cause. The session address of a
   // mount in progress is not kept anywhere, so it is also taken out of what is shown or logged.
   let addresses = []
@@ -339,6 +465,7 @@ export function install(rt) {
     if (!force && c.mount !== null && c.mount.key === key) return
     await unmount(c)
     if (token === undefined) {
+      notifierOf(c)?.setEnabled(false)
       c.status = { state: 'off' }
       return
     }
@@ -348,6 +475,16 @@ export function install(rt) {
       return
     }
     c.status = { state: 'connecting' }
+    // A sender mounts nothing: the test POST belongs to the connect step, so a start-up (or a
+    // secret change) only reports that a webhook is saved — a restart must not post to the group
+    // again. `force` is a person pressing Try again, which is that person asking for the test.
+    if (def.kind === 'sender') {
+      notifierOf(c)?.setEnabled(true)
+      if (force) await probe(c, token)
+      else c.status = { state: 'ready' }
+      c.mount = { key }
+      return
+    }
     const loader = ctx.get?.('loader')
     if (typeof loader?.import !== 'function' || typeof ctx.plugin !== 'function') {
       c.mount = { key }
@@ -397,6 +534,7 @@ export function install(rt) {
     name: c.def.name,
     state: c.status.state,
     ...(c.status.error !== undefined ? { error: c.status.error } : {}),
+    ...(c.def.kind !== undefined ? { kind: c.def.kind } : {}),
     account: rt.secretValue(c.def.secret) !== undefined ? c.def.account(saved(c)) : null,
     ...(c.def.extra !== undefined ? c.def.extra(rt.secretValue(c.def.secret) !== undefined ? saved(c) : undefined) : {}),
   })
@@ -423,9 +561,25 @@ export function install(rt) {
     async 'connector-connect'(body) {
       const c = known(body.id)
       const token = typeof body.token === 'string' ? body.token.trim() : ''
-      if (token === '') throw new Error(c.def.id === GITHUB ? 'Paste a token first' : 'Paste a key first')
+      if (token === '') throw new Error(c.def.paste ?? (c.def.id === GITHUB ? 'Paste a token first' : 'Paste a key first'))
       if (c.insecure) throw new Error(INSECURE(c.def.name))
       await rt.loadSecrets()
+      // A sender has nothing to mount, so the webhook is saved first and then proved: a webhook
+      // Feishu refuses stays on the row as `error` with Try again beside it, the way a connector
+      // that fails its MCP mount does, instead of losing what the owner pasted.
+      if (c.def.kind === 'sender') {
+        c.saving += 1
+        try {
+          await rt.secretEndpoint('secret-set', { name: c.def.secret, value: token, purpose: c.def.purpose })
+          await keep(c, {})
+        } finally {
+          c.saving -= 1
+        }
+        await probe(c, token)
+        c.mount = { key: `${token}\n${c.def.mountKey(saved(c))}` }
+        notifierOf(c)?.setEnabled(true)
+        return connectorsView()
+      }
       const oldToken = rt.secretValue(c.def.secret)
       const previous = saved(c)
       const record = await c.def.check({ token, options: c.options, saved: previous, body })
@@ -518,6 +672,25 @@ export function install(rt) {
       await sync(c, true)
       return connectorsView()
     },
+    // One message, on demand, once. Nothing posts room traffic on its own: that is a spam
+    // decision the owner has not made (#1263).
+    async 'connector-send'(body) {
+      const c = known(body.id)
+      if (c.def.kind !== 'sender') throw new Error('This connector sends no messages')
+      const text = typeof body.text === 'string' ? body.text.trim() : ''
+      if (text === '') throw new Error('Type a message first')
+      if (c.insecure) throw new Error(INSECURE(c.def.name))
+      await rt.loadSecrets()
+      if (rt.secretValue(c.def.secret) === undefined) throw new Error(`Connect ${c.def.name} first`)
+      const notifier = notifierOf(c)
+      // A fresh key per call: two messages with the same text are two messages, not a duplicate.
+      const result = await notifier.send({ key: randomUUID(), text })
+      const sent = result.state === 'sent' || result.state === 'duplicate'
+      const failure = `Feishu refused the message (${result.error ?? result.reason ?? 'no answer'})`
+      await keep(c, { ...saved(c), ...(sent ? { lastOkAt: Date.now() } : { lastError: failure }) })
+      if (!sent) throw new Error(failure)
+      return connectorsView()
+    },
   }
 
   const connectorEndpoint = (endpoint, body) => endpoints[endpoint](body ?? {})
diff --git a/core/test/connectors.test.js b/core/test/connectors.test.js
index be57b6fba..b256ca55e 100644
--- a/core/test/connectors.test.js
+++ b/core/test/connectors.test.js
@@ -189,19 +189,25 @@ test('deleting GITHUB_TOKEN on the Secrets page unmounts GitHub', async (t) => {
   assert.equal(state.value.connectors[0].state, 'off')
 })
 
-test('github: false and composio: false hide the connectors', async (t) => {
+test('github: false, composio: false and feishu: false hide the connectors', async (t) => {
   const home = teamHome()
   const ctx = fakeContext()
   capture(ctx)
   apply(ctx, { home, github: false })
   t.after(async () => { await ctx.dispose(); await cleanHome(home) })
-  assert.deepEqual((await call(ctx, 'state', {})).value.connectors.map(entry => entry.id), ['composio'])
+  assert.deepEqual((await call(ctx, 'state', {})).value.connectors.map(entry => entry.id), ['composio', 'feishu'])
   const other = teamHome()
   const second = fakeContext()
   capture(second)
   apply(second, { home: other, github: false, composio: false })
   t.after(async () => { await second.dispose(); await cleanHome(other) })
-  assert.deepEqual((await call(second, 'state', {})).value.connectors, [])
+  assert.deepEqual((await call(second, 'state', {})).value.connectors.map(entry => entry.id), ['feishu'])
+  const third = teamHome()
+  const last = fakeContext()
+  capture(last)
+  apply(last, { home: third, github: false, composio: false, feishu: false })
+  t.after(async () => { await last.dispose(); await cleanHome(third) })
+  assert.deepEqual((await call(last, 'state', {})).value.connectors, [])
 })
 
 test('a GitHub address without https refuses to send the token', async (t) => {
@@ -409,7 +415,7 @@ test('deleting COMPOSIO_API_KEY on the Secrets page unmounts Composio, and GitHu
   const view = (await call(ctx, 'state', {})).value.connectors
   assert.equal(mounts[1].disposed, true)
   assert.equal(mounts[0].disposed, false)
-  assert.deepEqual(view.map(entry => [entry.id, entry.state]), [['github', 'ready'], ['composio', 'off']])
+  assert.deepEqual(view.map(entry => [entry.id, entry.state]), [['github', 'ready'], ['composio', 'off'], ['feishu', 'off']])
 })
 
 test('a Composio address without https refuses to send the key', async (t) => {
diff --git a/core/test/feishu.test.js b/core/test/feishu.test.js
new file mode 100644
index 000000000..f0755e2a3
--- /dev/null
+++ b/core/test/feishu.test.js
@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict'
+import { randomBytes } from 'node:crypto'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { runInNewContext } from 'node:vm'
+import { build } from 'esbuild'
+import { apply } from '../index.js'
+import { feishuPost } from '../src/host/connectors.js'
+import { createNotifier } from '../src/host/notify.js'
+import { fakeContext } from './fake-ctx.js'
+
+// #1263 phase 1: Feishu (Lark) outbound through a custom-bot webhook. Feishu is not an MCP
+// server, so it is a *sender* connector: a definition with no mount, one status and one POST.
+// Its verdict is the `code` in the body, not the HTTP status — a rate limit and a refused
+// signature both arrive as HTTP 200 — which is why the retry policy is notify.js's rather than
+// a second one written next to the mount code.
+
+const TEAM = {
+  version: 1,
+  mainBotIds: ['m1'],
+  revision: 1,
+  bots: { m1: { id: 'm1', sessionId: 'm1', name: 'Chief', role: 'Chief of Staff', instructions: '', createdAt: 1 } },
+  rooms: {},
+  exchanges: [],
+  exchangeTurns: {},
+  questions: {},
+}
+
+const teamHome = () => {
+  const home = mkdtempSync(join(tmpdir(), 'dsb-feishu-'))
+  writeFileSync(join(home, 'state.json'), JSON.stringify(TEAM))
+  return home
+}
+
+const cleanHome = home => rmSync(home, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 })
+
+const answer = (status, body) => ({ status, ok: status >= 200 && status < 300, body, json: async () => body })
+const hookToken = () => randomBytes(8).toString('hex')
+const webhookOf = token => `https://feishu.test/open-apis/bot/v2/hook/${token}`
+
+// The connector is installed with its own API address so a test never talks to Feishu. Every
+// warn call is kept whole, arguments and all: `reason()` only redacts a secret that is already
+// saved, so the argument a message is formatted from is exactly where a pasted webhook leaks.
+function setup({ home = teamHome(), fetch: reply, feishu = { api: 'https://feishu.test' } } = {}) {
+  const warns = []
+  const ctx = fakeContext()
+  const register = ctx.connection.fetch.register
+  ctx.connection.fetch.register = (route) => { ctx.route = route; return register(route) }
+  const original = ctx.logger.warn
+  ctx.logger.warn = (...args) => { warns.push(args); if (original) original(...args) }
+  apply(ctx, { home, feishu })
+  return { ctx, home, warns, reply }
+}
+
+async function call(ctx, endpoint, payload) {
+  const response = await ctx.route.fetch(new Request('http://localhost/api/bot', { method: 'POST', body: JSON.stringify({ endpoint, payload }) }))
+  return response.json()
+}
+
+const row = (view, id = 'feishu') => (view?.connectors ?? view ?? []).find(entry => entry.id === id)
+const said = (warns, needle) => warns.filter(args => args.some(value => String(value).includes(needle)))
+
+// A fake Feishu that records each POST and answers from the script (the last answer repeats).
+function fakeFeishu(script = [answer(200, { code: 0, msg: 'success', data: { message_id: 'om_1' } })]) {
+  const posts = []
+  const queue = [...script]
+  const fetch = async (url, init) => {
+    posts.push({ url, init, body: init?.body === undefined ? undefined : JSON.parse(init.body) })
+    return queue.length > 1 ? queue.shift() : queue[0]
+  }
+  return { posts, fetch }
+}
+
+test('#1263: Feishu is a sender row of its own, off until a webhook is pasted', async (t) => {
+  const { ctx, home } = setup()
+  t.after(async () => { await ctx.dispose(); cleanHome(home) })
+  const state = await call(ctx, 'state', {})
+  assert.deepEqual(row(state.value), { id: 'feishu', name: 'Feishu', state: 'off', kind: 'sender', account: null })
+  // A sender has no tools, so it is not a name a saved capability may take either way.
+  assert.deepEqual(state.value.connectors.map(entry => entry.id), ['github', 'composio', 'feishu'])
+})
+
+test('#1263: connecting posts one test message, turns ready, and keeps the webhook out of state, disk and the log', async (t) => {
+  const token = hookToken()
+  const webhook = webhookOf(token)
+  const feishu = fakeFeishu()
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home, warns } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const connected = await call(ctx, 'connector-connect', { id: 'feishu', token: ` ${webhook} ` })
+  assert.equal(connected.ok, true, JSON.stringify(connected))
+  assert.deepEqual(row(connected.value), { id: 'feishu', name: 'Feishu', state: 'ready', kind: 'sender', account: null })
+
+  assert.equal(feishu.posts.length, 1, 'one test POST on connect')
+  assert.equal(feishu.posts[0].url, webhook)
+  assert.equal(feishu.posts[0].init.method, 'POST')
+  assert.equal(feishu.posts[0].body.msg_type, 'text')
+  assert.equal(typeof feishu.posts[0].body.content.text, 'string')
+  assert.ok(feishu.posts[0].body.content.text.length > 0)
+
+  const state = await call(ctx, 'state', {})
+  assert.ok(!JSON.stringify(state).includes(token), 'the view and the state answer never carry the URL')
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token), 'state.json never carries the URL')
+  assert.deepEqual(said(warns, token), [], 'no warn line carries the URL, in any argument')
+})
+
+test('#1263: a webhook Feishu refuses stays on the row as an error that names no token', async (t) => {
+  const token = hookToken()
+  const feishu = fakeFeishu([answer(400, { code: 19021, msg: 'signature error' })])
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home, warns } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const refused = await call(ctx, 'connector-connect', { id: 'feishu', token: webhookOf(token) })
+  assert.equal(refused.ok, true, JSON.stringify(refused))
+  const refusedRow = row(refused.value)
+  assert.equal(refusedRow.state, 'error', 'the test POST is what decides ready')
+  assert.match(refusedRow.error, /Feishu/)
+  assert.ok(!JSON.stringify(refused).includes(token), 'the refusal never carries the URL')
+  assert.equal(feishu.posts.length, 1)
+
+  const state = await call(ctx, 'state', {})
+  assert.ok(!JSON.stringify(state).includes(token))
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token), 'state.json never carries the URL')
+  assert.ok(said(warns, 'Feishu').length > 0, 'the refusal is logged')
+  assert.deepEqual(said(warns, token), [], 'no warn line carries the URL, in any argument')
+  assert.deepEqual(state.value.secrets.map(secret => secret.name), ['FEISHU_WEBHOOK'])
+})
+
+test('#1263: a Feishu that never answers fails on the deadline instead of hanging', async () => {
+  const started = Date.now()
+  const answerOrNothing = await feishuPost(webhookOf('x'), 'hello', { fetch: () => new Promise(() => {}), timeoutMs: 25 })
+  assert.deepEqual(answerOrNothing, { ok: false, error: 'network' })
+  assert.ok(Date.now() - started < 2_000, 'the deadline, not the fetch, ends the wait')
+})
+
+test('#1263: a rate limit in the body is retried, a refused signature is not', async () => {
+  // Feishu answers HTTP 200 for both, so the classifier — not the status — decides.
+  const limited = fakeFeishu([answer(200, { code: 9499, msg: 'too many request' }), answer(200, { code: 0, msg: 'success', data: { message_id: 'om_2' } })])
+  const retried = createNotifier({ channel: 'feishu', transport: { postMessage: message => feishuPost(webhookOf('x'), message.text, { fetch: limited.fetch }) }, baseDelayMs: 1, delay: async () => {}, log: () => {} })
+  const sent = await retried.send({ key: 'k1', text: 'hello' })
+  assert.equal(sent.state, 'sent')
+  assert.equal(sent.attempts, 2, '9499 is transient: the same call is tried again')
+  assert.equal(limited.posts.length, 2)
+
+  const refused = fakeFeishu([answer(200, { code: 19021, msg: 'signature error' })])
+  const hopeless = createNotifier({ channel: 'feishu', transport: { postMessage: message => feishuPost(webhookOf('x'), message.text, { fetch: refused.fetch }) }, baseDelayMs: 1, delay: async () => {}, log: () => {} })
+  const failed = await hopeless.send({ key: 'k2', text: 'hello' })
+  assert.equal(failed.state, 'failed')
+  assert.equal(failed.permanent, true, 'a refused signature will be refused again')
+  assert.equal(failed.attempts, 1)
+  assert.equal(refused.posts.length, 1)
+  assert.match(failed.error, /19021/)
+})
+
+test('#1263: connector-send posts the text once and records when it last worked', async (t) => {
+  const token = hookToken()
+  const feishu = fakeFeishu()
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const early = await call(ctx, 'connector-send', { id: 'feishu', text: 'hello room' })
+  assert.equal(early.ok, false)
+  assert.match(early.error.message, /Connect Feishu/)
+
+  await call(ctx, 'connector-connect', { id: 'feishu', token: webhookOf(token) })
+  const sent = await call(ctx, 'connector-send', { id: 'feishu', text: '  hello room  ' })
+  assert.equal(sent.ok, true, JSON.stringify(sent))
+  assert.equal(feishu.posts.length, 2, 'the connect probe and this one message')
+  assert.equal(feishu.posts[1].body.content.text, 'hello room')
+  assert.equal(feishu.posts[1].url, webhookOf(token))
+
+  const saved = JSON.parse(readFileSync(join(home, 'state.json'), 'utf8')).connectors.feishu
+  assert.equal(typeof saved.lastOkAt, 'number')
+  assert.equal(typeof saved.connectedAt, 'number')
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token))
+
+  const empty = await call(ctx, 'connector-send', { id: 'feishu', text: '   ' })
+  assert.equal(empty.ok, false, 'an empty message is refused before anything is posted')
+  assert.equal(feishu.posts.length, 2)
+})
+
+// --- Settings → Connectors, the Feishu row ---
+
+const { outputFiles } = await build({
+  stdin: {
+    contents: "export { ConnectorsPage } from './src/client/connectors.js'",
+    resolveDir: fileURLToPath(new URL('..', import.meta.url)),
+  },
+  bundle: true, format: 'cjs', platform: 'browser', write: false, logLevel: 'silent',
+  external: ['react', 'react-dom', '@deepseek-ai/dsh-client-ui-primitives'],
+})
+const h = (type, props, ...children) => ({ type, props: { ...props, children } })
+let states = []
+const react = {
+  createElement: h, Fragment: Symbol('F'), useEffect() {}, useLayoutEffect() {},
+  useState: v => [states.length > 0 ? states.shift() : (typeof v === 'function' ? v() : v), () => {}],
+  useMemo: f => f(), useRef: current => ({ current }), useCallback: f => f, useSyncExternalStore: (_s, get) => get(),
+}
+const browser = { exports: {} }
+runInNewContext(outputFiles[0].text, {
+  module: browser, exports: browser.exports, document: { hidden: false }, navigator: { language: 'en' }, localStorage: { getItem: () => null, setItem() {} },
+  window: { matchMedia: () => ({ matches: false }) }, setTimeout, clearTimeout,
+  require: (name) => {
+    if (name === 'react') return react
+    if (name === 'react-dom') return { createPortal: node => node }
+    if (name === '@deepseek-ai/dsh-client-ui-primitives') return {}
+    throw new Error(`Unexpected platform module ${name}`)
+  },
+})
+const { ConnectorsPage } = browser.exports
+
+const expand = (node) => {
+  if (node === null || node === undefined || typeof node === 'boolean') return null
+  if (Array.isArray(node)) return node.map(expand)
+  if (typeof node !== 'object') return node
+  if (typeof node.type === 'function') return expand(node.type(node.props))
+  return { ...node, props: { ...node.props, children: expand(node.props.children) } }
+}
+const all = (node, out = []) => { if (node && typeof node === 'object') { if (Array.isArray(node)) node.forEach(child => all(child, out)); else { out.push(node); all(node.props?.children, out) } } return out }
+const text = node => (node === null || node === undefined ? '' : Array.isArray(node) ? node.map(text).join('') : typeof node === 'object' ? text(node.props.children) : String(node))
+
+const actions = { connectorConnect: async () => {}, connectorDisconnect: async () => {}, connectorRetry: async () => {}, connectorSend: async () => {} }
+const renderRow = (connector, given = []) => {
+  states = [...given]
+  const tree = expand(h(ConnectorsPage, { roster: { connectors: [connector], bots: [], self: { memberId: 'me' } }, actions }))
+  states = []
+  return tree
+}
+
+test('#1263: the Feishu row asks for a webhook URL and links to Feishu, not to GitHub', () => {
+  // form open, so the masked input and the link are drawn
+  const tree = renderRow({ id: 'feishu', name: 'Feishu', state: 'off', kind: 'sender', account: null }, [true, false, '', [], false, false, null])
+  const input = all(tree).find(node => node.type === 'input')
+  assert.equal(input.props['aria-label'], 'Feishu webhook URL')
+  const link = all(tree).find(node => node.type === 'a')
+  assert.doesNotMatch(link.props.href, /github\.com/, 'the row must not send the owner to GitHub for a Feishu webhook')
+  assert.match(link.props.href, /feishu/i)
+  assert.doesNotMatch(text(tree), /GitHub token/)
+})
+
+test('#1263: a connected Feishu offers no per-Bot switch, because it has no tools', () => {
+  const tree = renderRow({ id: 'feishu', name: 'Feishu', state: 'ready', kind: 'sender', account: null })
+  const labels = all(tree).filter(node => node.type === 'button').map(text)
+  assert.ok(labels.includes('Disconnect'), labels.join('|'))
+  assert.ok(!labels.includes('Choose Bots'), 'a sender has no tools, so a per-Bot switch would do nothing')
+  assert.doesNotMatch(text(tree), /On for all \d+ Bots/)
+})
diff --git a/docs/subsystems/core-client.md b/docs/subsystems/core-client.md
index 5ad7c1254..e8a76919f 100644
--- a/docs/subsystems/core-client.md
+++ b/docs/subsystems/core-client.md
@@ -222,6 +222,8 @@ A group or face room shows only its own work (#553, owner decision 2026-10-20 23
 
 Settings → Connectors (`src/client/connectors.js`) lists one row per connector from `roster.connectors`. The GitHub row takes a token. The Composio row takes an API key and an app choice: the picked apps as pills (click to remove) and a **Search Composio apps** box that asks `connector-app-search` (debounced; with the key being pasted before connecting, never saved by the search, and with the saved key after) and offers the results to add; without a key to search with, or when the search fails, it filters the built-in common apps instead (#359). It then shows `Connected: <apps>`, one line per picked app with **Ready** or **Needs sign-in** from `connector-app-status` (asked when the row is ready and again when the list or the picker changes; nothing is drawn until Composio answers), with **Choose apps** (the same picker, each pill also showing its status) (changes the list through `connector-apps`, no key) and **Disconnect**. The key goes from the masked input to `connector-connect` and is never read back. Copy is English with a zh entry for every string in `i18n.js`. Under a connected connector the row reads `On for all N Bots`, `On for K of N Bots` or `Off for every Bot. Choose which Bots may use it.`, and **Choose Bots** opens one switch per local Bot (`src/client/connector-bots.js`, `setBotConnector(botId, connector, enabled)` → `bot-connectors`, #335, #369, #601): the Bot's name, **on by default**; only an explicit `bot.connectors[id] === false` reads as off. Sharing a Bot changes nothing there; the footer line says it is on by default for each of the owner's Bots on every turn, and that a friend's own Bot never gets it (zh: `默认对你的每个 Bot 开启…`). The "also when others use it" switch is gone (#601). The same switch per connector is the **Connectors** card in each Bot's settings (`BotConnectorsCard`, shown only once a connector is connected). Connector tool notices from DSH (`Tool added/removed: mcp__github__*` / `mcp__composio__*`) are not drawn in the chat.
 
+The Feishu row (#1263) is a **sender** (`kind: 'sender'` from the host, not an id the client knows): the input is labelled **Feishu webhook URL** and its link goes to Feishu's custom-bot page, never to GitHub's token page. Because a sender has no tools there is no **Choose Bots** button and no *On for N Bots* line, and the Bot-settings **Connectors** card skips it (`connectedConnectors` drops `kind === 'sender'`), so no switch is offered that would change nothing. Once it is ready the row carries a text field with **Send**, which is the only caller of `connector-send`; a refused webhook shows **Could not connect: …** with **Try again** beside it.
+
 ### About FlyBot page (#374)
 
 `src/client/about.js` shows the FlyBot mark, `Version <core version> · <branch> <commit>` (the part after the version only for a git install), the Star button (the repository from `update.repoUrl`, the live count only when it came back) and the star request line, then **Updates** (the **FlyBot core** row and the **DeepSeek Harness (underlying)** row, zh `DeepSeek Harness（底层）`) and **Links** (Source code → the repository, Release notes → its releases, Report a problem → Settings → Feedback). For a git install on a branch the **FlyBot core** row reads `Installed from GitHub (main 082563a). Updates come from the maintainer: reinstall FlyBot to get them.`, and after **Check for updates** `Up to date with main.`, `1 commit behind main. …`, `N commits behind main. …` or `Could not compare with main. …` plus `· Checked <time>`; a row with no known commit keeps the first sentence. An install pinned to a commit (`build.pinned`) reads `Pinned to commit 6d04db6. Updates come from the maintainer: reinstall FlyBot to get them.` and the version line shows only the short commit (#379). Other installs keep their old lines (`Updates are not offered for this install.`, `Installed from a local folder; update it there.`, `Update checks are off.`). Every string has a zh entry.
diff --git a/docs/subsystems/core-host.md b/docs/subsystems/core-host.md
index fce8f2c18..62e46f229 100644
--- a/docs/subsystems/core-host.md
+++ b/docs/subsystems/core-host.md
@@ -331,10 +331,12 @@ Work a member hands a Bot with `message_bot` from its group Session runs in a hi
 - **A checkpoint is judged by the prompt that is left** (`parts.js` `pressureLeft`): the token meter stays anchored on the provider usage from before the span was replaced, and its surface delta only subtracts a 4-characters-per-token estimate of the removed text. A denser report — the mock's 3 characters per token, or CJK on a real model — can therefore still read above the check line after the checkpoint has replaced the span, and the part would move on even though the steward said to condense in place. After a compaction, the part stays when the heuristic size of the remaining surface plus the tool schemas is under the check line. A surface that is still over it moves on, as before. The decision to cross the line in the first place still uses the anchored total (#917).
 - **A part is committed before its handoff runs** (`parts.js` `moveOn`): the Bot's `sessionId` / `room.sessions`, the new segment and the `rescued` mark are saved first, so the turn the handoff starts can never see an uncommitted part — a failure handler that did would start a second switch against it and lose the previous part's note, and the rescue would not know it may only happen once. The handoff package is written next; if that fails, the pointer is rolled back (best effort saved, the fresh Session archived, the rescued mark dropped), so the old part is current and the finalizer hands the input on there. Two windows stay open, and both are written down rather than discovered later: a crash after that save and before the handoff package is flushed leaves the fresh part current with no package — the stopped turn's input still goes to it, so no work is lost, but the note is, and the rollback never runs; and the rollback's own save is best effort (`rt.save().catch(() => {})`), so a failing rollback leaves the file showing the fresh part while memory holds the old one, and the next start behaves like the first window. Neither is a reason to clear the pointer before the save: a note lost this way is a part without a handoff note, while clearing first loses the handoff package itself. The move is marked done only after the stopped turn's input and the old inbox messages are forwarded; a switch that never starts (no place, another switch, a read-only host) lets the step continue instead of rejecting its messages, which DSH has already taken out of the inbox. An armed scheduled task keeps the earlier Session active and DSH refuses to archive it, so the switch keeps the `moveSchedules` promise and waits for the move before archiving the earlier part; when the move failed and the refusal reports `schedule` as the only activity, the plain archive is retried with `{ stopActivity: true }` (the way a deletion does, `roster.js:450`), so a finished part is never left active with a task nobody sees; a refusal caused by a job, turn or subagent is not retried, because `stopActivity` would stop that too (#896). Covered by `core/test/work-dir.test.js`, `core/test/part-archive.test.js` and `core/test/bot-messages.test.js`.
 
-### Connectors: GitHub and the Composio gateway (#311)
+### Connectors: GitHub, the Composio gateway, and the Feishu sender (#311, #1263)
 
 `src/host/connectors.js` mounts one MCP server per connector through DSH's own MCP client, so a Bot's tools are `mcp__github__*` and `mcp__composio__*` **for the owner's own use of every Bot, and for other people's use of a Bot only when the owner allowed it** (per-Bot access, below). Composio is a gateway: one API key (`COMPOSIO_API_KEY`) and a list of apps the user picked; the host asks Composio's tool-router for a session limited to those apps (workbench off) and mounts the session's MCP address. The session is made once per connect or app-list change and kept as `state.connectors.composio.session` (`{ id, apps }`: never the key and, since #335, never the session's address): the key check, the mount and Try again reuse it while the apps are the same and `GET /tool_router/session/{id}` (`x-api-key`) still finds it, else a new one is made. The mount's address is the `mcp.url` that answer carries (Composio's reference lists it as required in both the create and the get answer), taken only when it is https on the API's own host and held in memory for that mount; a session whose answer names no usable address is treated as gone. Why the address is not stored (#335): Composio's docs show the session address always used together with the key header and say to treat the exported address-and-headers config as a secret, but they do not say the address alone cannot authenticate, so it is not kept in `state.json` (backups, exports and anything that reads the profile) and is rebuilt from the id and the key at each mount. A record an older version wrote with `url` is rewritten without it at start (`scrubAddresses`), and the in-memory address is also taken out of a connector error (`[session address]`) before it is shown or logged. A superseded session (the old one after Choose apps or a new key, the new one when saving it failed, the kept one on Disconnect) is deleted with `DELETE /tool_router/session/{id}`, using the key it was made with; the delete is best effort and never an error for the user, and stopping the host leaves the session for the next start. Composio asks for each app's sign-in the first time a Bot needs it, in the chat. A stable `flybot-<uuid>` user id kept in `state.connectors.composio` (kept across Disconnect) is what Composio ties signed-in apps to. Rules: the key is a secret kept for all of the owner's Bots like any key the owner saves (#545; until then a connector saved it with scope `[]`, no Bot's shell), sent only as the `x-api-key` MCP header and to the API address, never written to `state.json`, a profile or an error (errors go through `redactSecrets`); the API address must be https, the answer's MCP address must be https on the API's own host, and the session request does not follow redirects; the key is proved by creating the session before it is saved; `connector-apps` changes the app list without the key and keeps the old list when Composio refuses the new one; `connector-app-search { id, query, token? }` searches Composio's app list (`GET /toolkits?search=&sort_by=usage&limit=20`, `x-api-key`, no redirects) with the pasted `token` when given (not saved) or the saved key, and returns only `{ slug, name }` with slugs a session can take; `connector-app-status { id }` reads the kept session's apps (`GET /tool_router/session/{id}/toolkits?toolkits=…`) and returns `{ [slug]: 'ready' | 'sign-in' }`, ready when the app needs no sign-in or has an `ACTIVE` connected account (#359); `connector-*` writes are `SHARED_BLOCKED`; `github` and `composio` are reserved capability names; `composio: false` hides the connector. Which Composio tools run without asking is DSH's normal tool approval, not a FlyBot gate (a per-app approval is a later step).
 
+Feishu (Lark) is the first **sender** connector (#1263): a group's custom-bot webhook is one HTTPS POST into the instance's own group, so nothing is mounted, no Bot's tool list changes, and `connector-access.js`'s `CONNECTOR_IDS` does not list it. Its definition carries `kind: 'sender'`, which the view reports and the client reads instead of hard-coding an id. A sender stops at the status: a saved webhook reads `ready` without posting, because the test POST belongs to the **connect** step, so a restart never messages the group; `connector-retry` ("Try again") is the one path that proves it again. The webhook is `FEISHU_WEBHOOK`, saved through `secret-set` **before** the probe — so a refusal stays on the row as `error` with the reason and `redactSecrets` can mask it, the way a failed mount does for GitHub — and it must be https on the configured `feishu.api` origin, else `A Feishu webhook must be https on <origin>`: the URL is the credential, so it may never be posted to another host and never appears in `state.json`, the view or a warn line. `connector-send { id, text }` posts one message on demand and records `lastOkAt` / `lastError` in `state.connectors.feishu`; nothing posts room traffic by itself. Feishu answers HTTP 200 with the verdict in the body (`code: 0` success, `9499` a rate limit, `19021` a refused signature), so `feishuPost` maps the body into notify.js's vocabulary and the retry policy stays `notify.js`'s `createNotifier` (3 attempts, backoff, honour `retry-after`, structural errors not retried) rather than a second one written here; `connector-send` uses a fresh idempotency key per call, so two messages with the same text are two messages. The connect probe and a send both carry a deadline (15 s and 60 s) and `withDeadline` races the fetch, so a fetch that ignores its abort signal cannot hang either. `feishu: false` hides the row; `connector-send` is in `SHARED_BLOCKED` like the other connector writes.
+
 ### Secret scope defaults (#545)
 
 A key the owner saves is for **all of the owner's Bots** (`scope: 'all'`) unless the owner narrows it: a card's "Only <Bot>", the Secrets page's *Chosen Bots* or *No Bot*. That holds for a connector key too (`GITHUB_TOKEN`, `COMPOSIO_API_KEY`): `connector-connect` no longer passes `scope: []`, and a reconnect keeps the scope the key already has. A scope the owner chose is stored with `scopeSet: true` (`secret-update`, `secret-set` with a `scope`, a card's "Only <Bot>", and a deleted Bot leaving a picked list), so an empty list stays "No Bot". On load, an empty list **without** `scopeSet` is the old connector default and becomes `'all'` once (written back by the host that holds the team; a reading host widens it in memory only). An empty list the owner picked before #545 carries no marker and is widened too: there is no way to tell it apart. **Every turn of every one of the owner's own Bots** gets the keys its scope allows (owner decision 2026-10-22, #601: 「放开这个权限管理，我的bot都应该能看到」). Where the turn came from no longer matters for secrets: a group round, a Bot-to-Bot relay, a scheduled turn, a turn a friend started on a shared Bot, a turn with no recorded origin, and bash inside a sub-agent all get them. A sub-agent's shell resolves to its parent Bot along the same chain as the connector guard (`rt.whoseAgent`, from `connector-access.js`); a chain that cannot be followed to a Bot gets no value. The boundaries that stay: a friend's Bot (`remote`) never gets the owner's keys, and a key scoped to chosen Bots goes only to those Bots. A capability (`canUseSecret`) follows the same rule. This replaces the turn-origin rule of #545/#581, under which a shell got `'all'` keys only on a turn that `settled` as the owner's. The connector *tools* follow the same rule (#601, below); secrets no longer read `turn-origin.js`. Owner decision 2026-10-20 (#359, AGENTS.md hard rule 4).
diff --git a/patches/ds-bot/0001-core-fixes.patch b/patches/ds-bot/0001-core-fixes.patch
index 393a465df..71a652bb3 100644
--- a/patches/ds-bot/0001-core-fixes.patch
+++ b/patches/ds-bot/0001-core-fixes.patch
@@ -218,7 +218,7 @@ diff --git a/src/client/browser-pane.js b/src/client/browser-pane.js
 diff --git a/src/client/connectors.js b/src/client/connectors.js
 --- a/src/client/connectors.js
 +++ b/src/client/connectors.js
-@@ -1,26 +1,107 @@
+@@ -1,41 +1,151 @@
 -import { createElement as h, useRef, useState } from 'react'
 +import { createElement as h, useCallback, useEffect, useRef, useState } from 'react'
  import { useMorph } from './motion.js'
@@ -230,6 +230,8 @@ diff --git a/src/client/connectors.js b/src/client/connectors.js
  
  const TOKEN_URL = 'https://github.com/settings/personal-access-tokens/new'
 +const COMPOSIO_KEY_URL = 'https://platform.composio.dev/'
++// Feishu's own page for a group's custom bot, where the webhook URL comes from.
++const FEISHU_WEBHOOK_URL = 'https://open.feishu.cn/document/client-docs/bot-v3/add-custom-bot'
 +
 +// Common apps, searched when Composio cannot be asked; any other app is found by the search.
 +const APPS = [
@@ -247,10 +249,17 @@ diff --git a/src/client/connectors.js b/src/client/connectors.js
  
 -const MARKS = { github: GitHubMark }
 -const ABOUT = { github: () => t('Repositories, issues, and pull requests') }
-+const MARKS = { github: GitHubMark, composio: ConnectorIcon }
++// Feishu's mark: two stacked wings around a middle line, drawn here rather than copied.
++export const FeishuMark = () => h('svg', { width: 20, height: 20, viewBox: '0 0 20 20', fill: 'currentColor', 'aria-hidden': true },
++  h('path', { d: 'M3.2 6.6c3 .1 6.4 1.5 8.6 3.9-1.9.4-3.5 1.4-4.7 2.9-1.9-.6-3.4-1.9-3.9-3.6-.2-.7-.2-1.5 0-3.2z' }),
++  h('path', { d: 'M16.8 5.4c-2.9.2-5.6 1.5-7.4 3.4 1.7 1.2 3.1 2.8 3.9 4.9 2.2-1.1 3.8-3.2 4-5.6.1-.9-.1-1.9-.4-2.7z' }),
++  h('path', { d: 'M8.6 12.1c.9.7 1.7 1.6 2.2 2.7-1.1.2-2.3 0-3.3-.6.2-.8.6-1.5 1.1-2.1z' }))
++
++const MARKS = { github: GitHubMark, composio: ConnectorIcon, feishu: FeishuMark }
 +const ABOUT = {
 +  github: () => t('Repositories, issues, and pull requests'),
 +  composio: () => t('Gmail, Slack, Calendar, Notion and many more apps, through one Composio key'),
++  feishu: () => t('Posts into one Feishu group through a custom bot webhook'),
 +}
  
  function statusText(connector) {
@@ -329,12 +338,15 @@ diff --git a/src/client/connectors.js b/src/client/connectors.js
 +  const [picking, setPicking] = useState(false)
    const [busy, setBusy] = useState(false)
    const [error, setError] = useState(null)
++  const [message, setMessage] = useState('')
    const run = (task, after) => {
-@@ -28,14 +28,31 @@ function ConnectorRow({ connector, actions }) {
+     setBusy(true)
      setError(null)
      return task.then(() => { after?.() }, failure => setError(failure?.message ?? String(failure))).finally(() => setBusy(false))
    }
 +  const gateway = connector.id === 'composio'
++  // A sender posts through one webhook: no tools, so no per-Bot switch, and its own send field.
++  const sender = connector.kind === 'sender'
 +  const [statuses, setStatuses] = useState({})
 +  const appsKey = (connector.apps ?? []).join(',')
 +  // Asks Composio which picked apps are signed in, when the row is ready and again when the list changes.
@@ -364,25 +376,30 @@ diff --git a/src/client/connectors.js b/src/client/connectors.js
    return h('div', { ref: row, className: 'bt-connector', 'data-state': connector.state },
      h('div', { className: 'bt-connector-head' },
        h('span', { className: 'bt-connector-mark' }, Mark ? h(Mark) : null),
-@@ -44,15 +44,28 @@ function ConnectorRow({ connector, actions }) {
+@@ -44,15 +44,33 @@ function ConnectorRow({ connector, actions }) {
          h('span', { className: 'bt-connector-status' }, statusText(connector))),
        h('span', { className: 'bt-connector-actions' },
          connector.state === 'error' ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => void run(actions.connectorRetry(connector.id)) }, t('Try again')) : null,
 +        on && gateway && !picking ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => { setApps(connector.apps ?? []); setPicking(true) } }, t('Choose apps')) : null,
-+        on ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', 'aria-expanded': bots, onClick: () => setBots(value => !value) }, bots ? t('Done') : t('Choose Bots')) : null,
++        on && !sender ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', 'aria-expanded': bots, onClick: () => setBots(value => !value) }, bots ? t('Done') : t('Choose Bots')) : null,
          on
            ? h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => void run(actions.connectorDisconnect(connector.id)) }, t('Disconnect'))
            : form ? null : h('button', { type: 'button', className: 'bt-soft bt-soft-sm', onClick: () => setForm(true) }, t('Connect')))),
 +    on && gateway && !picking ? h(AppStatusList, { apps: connector.apps ?? [], statuses }) : null,
-+    on ? h('span', { className: 'bt-connector-uses' }, usageText(roster, connector.id)) : null,
++    on && !sender ? h('span', { className: 'bt-connector-uses' }, usageText(roster, connector.id)) : null,
 +    on && bots ? h(ConnectorBots, { connector, roster, actions, run, SwitchRow }) : null,
++    on && sender ? h('div', { className: 'bt-connector-form' },
++      h('label', { className: 'bt-q-field' }, h('input', { className: 'bt-input', type: 'text', value: message, 'aria-label': t('Message to send to Feishu'), placeholder: t('Type a message for the Feishu group'), onChange: event => setMessage(event.target.value) })),
++      h('div', { className: 'bt-connector-form-row' },
++        h('span', { className: 'bt-connector-link' }),
++        h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy || message.trim() === '' || actions.connectorSend === undefined, onClick: () => void run(actions.connectorSend(connector.id, message), () => setMessage('')) }, t('Send')))) : null,
      !on && form ? h('div', { className: 'bt-connector-form' },
 -      h('label', { className: 'bt-q-field bt-secret-field' }, h(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: t('GitHub token'), autoFocus: true })),
-+      h('label', { className: 'bt-q-field bt-secret-field' }, h(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: gateway ? t('Composio API key') : t('GitHub token'), autoFocus: true })),
++      h('label', { className: 'bt-q-field bt-secret-field' }, h(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: sender ? t('Feishu webhook URL') : gateway ? t('Composio API key') : t('GitHub token'), autoFocus: true })),
 +      gateway ? h(AppPicker, { apps, onChange: setApps, search: token.trim() === '' ? undefined : search }) : null,
        h('div', { className: 'bt-connector-form-row' },
 -        h('a', { className: 'bt-connector-link', href: TOKEN_URL, target: '_blank', rel: 'noopener noreferrer' }, t('Create a token on GitHub')),
-+        h('a', { className: 'bt-connector-link', href: gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: '_blank', rel: 'noopener noreferrer' }, gateway ? t('Get a Composio API key') : t('Create a token on GitHub')),
++        h('a', { className: 'bt-connector-link', href: sender ? FEISHU_WEBHOOK_URL : gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: '_blank', rel: 'noopener noreferrer' }, sender ? t('Get a webhook URL in Feishu') : gateway ? t('Get a Composio API key') : t('Create a token on GitHub')),
          h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy, onClick: () => { setForm(false); setToken(''); setError(null) } }, t('Cancel')),
          h('button', { type: 'button', className: 'bt-soft bt-soft-sm', disabled: busy || token.trim() === '', onClick: connect }, busy ? t('Connecting…') : t('Connect')))) : null,
 +    on && gateway && picking ? h('div', { className: 'bt-connector-form' },
@@ -693,13 +710,19 @@ diff --git a/src/client/i18n.js b/src/client/i18n.js
    Connected: '已连接',
    Disconnect: '断开',
    Connect: '连接',
-@@ -105,17 +105,44 @@ const ZH = {
+@@ -105,17 +105,50 @@ const ZH = {
    'GitHub addresses must start with https://': 'GitHub 地址必须以 https:// 开头',
    'This DSH cannot load connectors': '这个 DSH 不能加载连接器',
    'No such connector': '没有这个连接器',
 -  'Classic Agent mode': '经典 Agent 模式',
 -  'Switch': '切换',
 +  'Gmail, Slack, Calendar, Notion and many more apps, through one Composio key': 'Gmail、Slack、日历、Notion 等众多应用，一个 Composio key 就能连',
++  'Posts into one Feishu group through a custom bot webhook': '通过自定义机器人 webhook 发到你的一个飞书群',
++  'Feishu webhook URL': '飞书 webhook 地址',
++  'Get a webhook URL in Feishu': '去飞书获取 webhook 地址',
++  'Message to send to Feishu': '要发到飞书的消息',
++  'Type a message for the Feishu group': '输入要发到飞书群的消息',
++  Send: '发送',
 +  'Connected: {apps}': '已连接：{apps}',
 +  'Composio API key': 'Composio API key',
 +  'Get a Composio API key': '去 Composio 获取 API key',
@@ -1036,6 +1059,14 @@ diff --git a/src/client/i18n.js b/src/client/i18n.js
    'Save key': '保存密钥',
    'Keys your Bots asked for. Bots never see the values: they use them as ': '你的 Bot 请求过的密钥。Bot 永远看不到值：它们在 shell 里通过 ',
    ' in their shell, and every value is replaced by ': ' 使用，而且发给模型之前，每个值都会被替换成 ',
+@@ -568,7 +568,6 @@ const ZH = {
+   Remove: '删除',
+   'Ask or update': '询问或更新',
+   "Ask about or update {name}'s memory": '询问或更新 {name} 的记忆',
+-  Send: '发送',
+   'Added: {text}': '已添加：{text}',
+   'Added to team memory: {text}': '已加入团队记忆：{text}',
+   'Updated: {text}': '已更新：{text}',
 @@ -697,11 +697,11 @@ const ZH = {
    'Compared with the {count} days before': '与再往前 {count} 天相比',
    '{share}% of all usage from {span}': '占 {span} 全部用量的 {share}%',
@@ -2570,7 +2601,7 @@ diff --git a/src/host/chat-index.js b/src/host/chat-index.js
 diff --git a/src/host/connectors.js b/src/host/connectors.js
 --- a/src/host/connectors.js
 +++ b/src/host/connectors.js
-@@ -1,27 +1,44 @@
+@@ -1,27 +1,55 @@
 -// Connectors: outside services every Bot can use. GitHub is the first one. Its tools come
 -// from GitHub's MCP server through DSH's own MCP client, mounted on the plugin context,
 -// so every Bot and Session gets them as mcp__github__<tool>.
@@ -2599,11 +2630,14 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +// without touching the mount.
 +
 +import { randomUUID } from 'node:crypto'
++import { createNotifier } from './notify.js'
  
  export const GITHUB = 'github'
  export const GITHUB_SECRET = 'GITHUB_TOKEN'
 +export const COMPOSIO = 'composio'
 +export const COMPOSIO_SECRET = 'COMPOSIO_API_KEY'
++export const FEISHU = 'feishu'
++export const FEISHU_SECRET = 'FEISHU_WEBHOOK'
 +// Names a saved capability may not take, because the mount already uses them.
 +export const RESERVED_NAMES = [GITHUB, COMPOSIO]
  const MCP_CLIENT = '@deepseek-ai/dsh-mcp-client'
@@ -2614,8 +2648,16 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
    toolsets: 'context,repos,issues,pull_requests',
  }
 +const COMPOSIO_DEFAULTS = { api: 'https://backend.composio.dev/api/v3.1' }
++const FEISHU_DEFAULTS = { api: 'https://open.feishu.cn' }
  const CHECK_TIMEOUT_MS = 15_000
 -const INSECURE = 'GitHub addresses must start with https://'
++// A send waits longer than a connect: the connect is one small probe, while a message may sit
++// behind Feishu's own queue. The retry budget is notify.js's, not this deadline.
++const SEND_TIMEOUT_MS = 60_000
++// Feishu's custom-bot webhook answers HTTP 200 with the verdict in the body, so a rate limit has
++// to be read out of `code`; 9499 is the one code that means "the same call may work again".
++export const FEISHU_RATE_LIMITED = 9499
++const FEISHU_TEST_TEXT = 'FlyBot is connected.'
 +const INSECURE = name => `${name} addresses must start with https://`
 +const SESSION_ID = /^[A-Za-z0-9_-]{1,128}$/
 +const APP_SLUG = /^[a-z0-9][a-z0-9_-]{0,63}$/
@@ -2627,7 +2669,7 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
    let response
    try {
      response = await request(`${api.replace(/\/$/, '')}/user`, {
-@@ -38,132 +38,491 @@ export async function signIn(token, { api = DEFAULTS.api, fetch: request = fetch
+@@ -38,132 +38,653 @@ export async function signIn(token, { api = DEFAULTS.api, fetch: request = fetch
    return { login: user.login }
  }
  
@@ -2813,6 +2855,74 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +  return { id, url, apps }
 +}
 +
++// The webhook URL is the credential, so it is checked against the API address before anything is
++// sent: https, on the host this instance was configured for. Never another host, never http.
++function webhookAddress(webhook, api) {
++  let url
++  try {
++    url = new URL(String(webhook).trim())
++  } catch {
++    throw new Error('Paste the webhook URL Feishu gave you')
++  }
++  const base = new URL(String(api))
++  if (url.protocol !== 'https:' || url.origin !== base.origin) throw new Error(`A Feishu webhook must be https on ${base.origin}`)
++  return url.href
++}
++
++// A fetch that ignores its abort signal would otherwise hang a connect (or a send) for ever.
++function withDeadline(promise, ms) {
++  let timer
++  const deadline = new Promise((resolve, reject) => { timer = setTimeout(() => reject(new Error('deadline')), Math.max(1, ms)) })
++  return Promise.race([promise, deadline]).finally(() => clearTimeout(timer))
++}
++
++// One text message through a custom-bot webhook, answered in notify.js's vocabulary: `{ ok, ts }`
++// or `{ ok: false, error }`, where `rate_limited` and `service_unavailable` may pass on their own
++// and every other error is a shape Feishu will refuse again. The URL is never part of the answer.
++export async function feishuPost(webhook, text, { fetch: request = fetch, timeoutMs = CHECK_TIMEOUT_MS } = {}) {
++  let response
++  try {
++    response = await withDeadline(request(webhook, {
++      method: 'POST',
++      headers: { 'content-type': 'application/json; charset=utf-8' },
++      body: JSON.stringify({ msg_type: 'text', content: { text: String(text) } }),
++      redirect: 'error',
++      signal: AbortSignal.timeout(Math.max(1, timeoutMs)),
++    }), timeoutMs)
++  } catch {
++    return { ok: false, error: 'network' }
++  }
++  const body = await response.json().catch(() => ({}))
++  if (response.status === 429) {
++    const asked = Number(response.headers?.get?.('retry-after')) * 1000
++    return { ok: false, error: 'rate_limited', retryAfterMs: Number.isFinite(asked) && asked > 0 ? asked : 0 }
++  }
++  if (!response.ok) return { ok: false, error: response.status >= 500 ? 'service_unavailable' : `feishu/http-${response.status}` }
++  const code = Number(body?.code)
++  if (code === 0) {
++    const id = body?.data?.message_id
++    return { ok: true, ts: typeof id === 'string' && id !== '' ? id : 'sent' }
++  }
++  if (code === FEISHU_RATE_LIMITED) return { ok: false, error: 'rate_limited', retryAfterMs: 0 }
++  return { ok: false, error: `feishu/${Number.isFinite(code) ? code : 'unknown'}` }
++}
++
++// The connect step: one test message, so a webhook that cannot post is caught before it is relied
++// on. It throws a sentence for the row; nothing it says carries the URL.
++export async function feishuCheck(webhook, { api = FEISHU_DEFAULTS.api, fetch: request = fetch, timeoutMs = CHECK_TIMEOUT_MS } = {}) {
++  const answer = await feishuPost(webhookAddress(webhook, api), FEISHU_TEST_TEXT, { fetch: request, timeoutMs })
++  if (answer.ok) return {}
++  if (answer.error === 'network' || answer.error === 'service_unavailable') throw new Error('Could not reach Feishu')
++  if (answer.error === 'rate_limited') throw new Error('Feishu is rate-limiting this webhook; try again in a minute')
++  throw new Error(`Feishu did not accept the webhook (${answer.error})`)
++}
++
++// notify.js's transport for a Feishu webhook: the policy (attempts, backoff, idempotency) stays in
++// notify.js, and this only maps one message to one POST.
++export function feishuTransport(webhook, { fetch: request = fetch, timeoutMs = SEND_TIMEOUT_MS } = {}) {
++  return { postMessage: message => feishuPost(webhook, message?.text ?? '', { fetch: request, timeoutMs }) }
++}
++
 +const DEFINITIONS = {
 +  [GITHUB]: {
 +    id: GITHUB,
@@ -2869,6 +2979,26 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +    // Keeps the user id: a new key for the same FlyBot finds the apps already signed in.
 +    afterDisconnect: saved => saved?.userId === undefined ? undefined : { userId: saved.userId },
 +  },
++  // Feishu (Lark) is not an MCP server: a custom-bot webhook is one HTTPS POST into the instance's
++  // own group. So it is a *sender* — nothing is mounted, no Bot's tool list changes, and the only
++  // things it has are a status and a send (#1263). The app-credential path slots in behind the same
++  // send, without touching a caller.
++  [FEISHU]: {
++    id: FEISHU,
++    name: 'Feishu',
++    secret: FEISHU_SECRET,
++    purpose: 'Feishu webhook',
++    defaults: FEISHU_DEFAULTS,
++    addresses: options => [options.api],
++    kind: 'sender',
++    paste: 'Paste a webhook URL first',
++    async check({ token, options }) {
++      return feishuCheck(token, { api: options.api })
++    },
++    post: (webhook, text) => feishuPost(webhook, text, { timeoutMs: SEND_TIMEOUT_MS }),
++    mountKey: () => '',
++    account: () => null,
++  },
 +}
 +
  export function install(rt) {
@@ -2909,6 +3039,33 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
    }
  
 -  // The MCP client wraps the server's answer (a 401, say) as the cause.
++  // A sender's retry policy is notify.js's, not a second one written here: one transport per
++  // sender, reading the saved webhook when it is called, so a reconnect needs no rebuild.
++  const notifiers = new Map(connectors.filter(c => c.def.kind === 'sender').map(c => [c.def.id, createNotifier({
++    channel: c.def.id,
++    log: (format, ...args) => rt.warn(`ds-bot: ${format}`, ...args),
++    transport: {
++      postMessage: (message) => {
++        const webhook = rt.secretValue(c.def.secret)
++        if (webhook === undefined) return { ok: false, error: 'channel_not_found' }
++        return c.def.post(webhook, message?.text ?? '')
++      },
++    },
++  })]))
++  const notifierOf = c => notifiers.get(c.def.id)
++
++  // The connect step of a sender: one test message, then ready or the reason. A sender is "ready"
++  // once this passes, and the failure is a row the owner can read and Try again from.
++  const probe = async (c, token) => {
++    try {
++      await c.def.check({ token, options: c.options })
++      c.status = { state: 'ready' }
++    } catch (error) {
++      c.status = { state: 'error', error: reason(error) }
++      rt.warn('ds-bot: %s connector failed: %s', c.def.name, c.status.error)
++    }
++  }
++
 +  // The MCP client wraps the server's answer (a 401, say) as the cause. The session address of a
 +  // mount in progress is not kept anywhere, so it is also taken out of what is shown or logged.
 +  let addresses = []
@@ -2932,6 +3089,7 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +    await unmount(c)
      if (token === undefined) {
 -      status = { state: 'off' }
++      notifierOf(c)?.setEnabled(false)
 +      c.status = { state: 'off' }
        return
      }
@@ -2941,10 +3099,20 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +    if (c.insecure) {
 +      c.mount = { key }
 +      c.status = { state: 'error', error: INSECURE(def.name) }
++      return
++    }
++    c.status = { state: 'connecting' }
++    // A sender mounts nothing: the test POST belongs to the connect step, so a start-up (or a
++    // secret change) only reports that a webhook is saved — a restart must not post to the group
++    // again. `force` is a person pressing Try again, which is that person asking for the test.
++    if (def.kind === 'sender') {
++      notifierOf(c)?.setEnabled(true)
++      if (force) await probe(c, token)
++      else c.status = { state: 'ready' }
++      c.mount = { key }
        return
      }
 -    status = { state: 'connecting' }
-+    c.status = { state: 'connecting' }
      const loader = ctx.get?.('loader')
      if (typeof loader?.import !== 'function' || typeof ctx.plugin !== 'function') {
 -      mount = { token }
@@ -3017,6 +3185,7 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 +    name: c.def.name,
 +    state: c.status.state,
 +    ...(c.status.error !== undefined ? { error: c.status.error } : {}),
++    ...(c.def.kind !== undefined ? { kind: c.def.kind } : {}),
 +    account: rt.secretValue(c.def.secret) !== undefined ? c.def.account(saved(c)) : null,
 +    ...(c.def.extra !== undefined ? c.def.extra(rt.secretValue(c.def.secret) !== undefined ? saved(c) : undefined) : {}),
 +  })
@@ -3047,7 +3216,7 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
        const token = typeof body.token === 'string' ? body.token.trim() : ''
 -      if (token === '') throw new Error('Paste a token first')
 -      if (insecure) throw new Error(INSECURE)
-+      if (token === '') throw new Error(c.def.id === GITHUB ? 'Paste a token first' : 'Paste a key first')
++      if (token === '') throw new Error(c.def.paste ?? (c.def.id === GITHUB ? 'Paste a token first' : 'Paste a key first'))
 +      if (c.insecure) throw new Error(INSECURE(c.def.name))
        await rt.loadSecrets()
 -      const kept = rt.secretValue(GITHUB_SECRET) !== undefined
@@ -3056,6 +3225,22 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
 -      state.connectors = { ...state.connectors, [GITHUB]: { login, connectedAt: Date.now() } }
 -      await rt.save()
 -      await sync()
++      // A sender has nothing to mount, so the webhook is saved first and then proved: a webhook
++      // Feishu refuses stays on the row as `error` with Try again beside it, the way a connector
++      // that fails its MCP mount does, instead of losing what the owner pasted.
++      if (c.def.kind === 'sender') {
++        c.saving += 1
++        try {
++          await rt.secretEndpoint('secret-set', { name: c.def.secret, value: token, purpose: c.def.purpose })
++          await keep(c, {})
++        } finally {
++          c.saving -= 1
++        }
++        await probe(c, token)
++        c.mount = { key: `${token}\n${c.def.mountKey(saved(c))}` }
++        notifierOf(c)?.setEnabled(true)
++        return connectorsView()
++      }
 +      const oldToken = rt.secretValue(c.def.secret)
 +      const previous = saved(c)
 +      const record = await c.def.check({ token, options: c.options, saved: previous, body })
@@ -3153,6 +3338,25 @@ diff --git a/src/host/connectors.js b/src/host/connectors.js
        await rt.loadSecrets()
 -      await sync(true)
 +      await sync(c, true)
++      return connectorsView()
++    },
++    // One message, on demand, once. Nothing posts room traffic on its own: that is a spam
++    // decision the owner has not made (#1263).
++    async 'connector-send'(body) {
++      const c = known(body.id)
++      if (c.def.kind !== 'sender') throw new Error('This connector sends no messages')
++      const text = typeof body.text === 'string' ? body.text.trim() : ''
++      if (text === '') throw new Error('Type a message first')
++      if (c.insecure) throw new Error(INSECURE(c.def.name))
++      await rt.loadSecrets()
++      if (rt.secretValue(c.def.secret) === undefined) throw new Error(`Connect ${c.def.name} first`)
++      const notifier = notifierOf(c)
++      // A fresh key per call: two messages with the same text are two messages, not a duplicate.
++      const result = await notifier.send({ key: randomUUID(), text })
++      const sent = result.state === 'sent' || result.state === 'duplicate'
++      const failure = `Feishu refused the message (${result.error ?? result.reason ?? 'no answer'})`
++      await keep(c, { ...saved(c), ...(sent ? { lastOkAt: Date.now() } : { lastError: failure }) })
++      if (!sent) throw new Error(failure)
        return connectorsView()
      },
    }
@@ -6143,12 +6347,12 @@ diff --git a/test/connectors.test.js b/test/connectors.test.js
    await call(ctx, 'connector-connect', { id: 'github', token: fresh() })
    await call(ctx, 'secret-delete', { name: 'GITHUB_TOKEN' })
    const state = await call(ctx, 'state', {})
-@@ -150,13 +150,19 @@ test('deleting GITHUB_TOKEN on the Secrets page unmounts GitHub', async (t) => {
+@@ -150,13 +150,25 @@ test('deleting GITHUB_TOKEN on the Secrets page unmounts GitHub', async (t) => {
    assert.equal(state.value.connectors[0].state, 'off')
  })
  
 -test('github: false hides the connector', async (t) => {
-+test('github: false and composio: false hide the connectors', async (t) => {
++test('github: false, composio: false and feishu: false hide the connectors', async (t) => {
    const home = teamHome()
    const ctx = fakeContext()
    capture(ctx)
@@ -6156,17 +6360,23 @@ diff --git a/test/connectors.test.js b/test/connectors.test.js
 -  t.after(async () => { await ctx.dispose(); rmSync(home, { recursive: true, force: true, maxRetries: 5 }) })
 -  assert.deepEqual((await call(ctx, 'state', {})).value.connectors, [])
 +  t.after(async () => { await ctx.dispose(); await cleanHome(home) })
-+  assert.deepEqual((await call(ctx, 'state', {})).value.connectors.map(entry => entry.id), ['composio'])
++  assert.deepEqual((await call(ctx, 'state', {})).value.connectors.map(entry => entry.id), ['composio', 'feishu'])
 +  const other = teamHome()
 +  const second = fakeContext()
 +  capture(second)
 +  apply(second, { home: other, github: false, composio: false })
 +  t.after(async () => { await second.dispose(); await cleanHome(other) })
-+  assert.deepEqual((await call(second, 'state', {})).value.connectors, [])
++  assert.deepEqual((await call(second, 'state', {})).value.connectors.map(entry => entry.id), ['feishu'])
++  const third = teamHome()
++  const last = fakeContext()
++  capture(last)
++  apply(last, { home: third, github: false, composio: false, feishu: false })
++  t.after(async () => { await last.dispose(); await cleanHome(third) })
++  assert.deepEqual((await call(last, 'state', {})).value.connectors, [])
  })
  
  test('a GitHub address without https refuses to send the token', async (t) => {
-@@ -165,10 +165,614 @@
+@@ -165,10 +165,614 @@ test('a GitHub address without https refuses to send the token', async (t) => {
    let asked = false
    globalThis.fetch = async () => { asked = true; return answer(200, { login: 'octo' }) }
    const { ctx, home, mounts } = setup({ github: { url: 'http://mcp.test/', api: 'https://gh.test' } })
@@ -6370,7 +6580,7 @@ diff --git a/test/connectors.test.js b/test/connectors.test.js
 +  const view = (await call(ctx, 'state', {})).value.connectors
 +  assert.equal(mounts[1].disposed, true)
 +  assert.equal(mounts[0].disposed, false)
-+  assert.deepEqual(view.map(entry => [entry.id, entry.state]), [['github', 'ready'], ['composio', 'off']])
++  assert.deepEqual(view.map(entry => [entry.id, entry.state]), [['github', 'ready'], ['composio', 'off'], ['feishu', 'off']])
 +})
 +
 +test('a Composio address without https refuses to send the key', async (t) => {
diff --git a/patches/ds-bot/0003-flybot-api-client.patch b/patches/ds-bot/0003-flybot-api-client.patch
index 75bf36de2..8c1b67f13 100644
--- a/patches/ds-bot/0003-flybot-api-client.patch
+++ b/patches/ds-bot/0003-flybot-api-client.patch
@@ -1467,7 +1467,7 @@ diff --git a/src/client/index.js b/src/client/index.js
      stopMemberWork: (roomId, botId) => after(call('stop-member-work', { roomId, botId })),
      // Values go out in these requests and never come back in a response.
      secretSet: payload => after(call('secret-set', payload)),
-@@ -539,15 +539,28 @@ export function apply(ctx) {
+@@ -539,15 +539,29 @@ export function apply(ctx) {
      secretCancel: requestId => after(call('secret-cancel', { requestId })),
      secretUpdate: (name, scope) => after(call('secret-update', { name, scope })),
      secretDelete: name => after(call('secret-delete', { name })),
@@ -1478,6 +1478,7 @@ diff --git a/src/client/index.js b/src/client/index.js
 +    connectorAppStatus: id => call('connector-app-status', { id }),
      connectorDisconnect: id => after(call('connector-disconnect', { id })),
      connectorRetry: id => after(call('connector-retry', { id })),
++    connectorSend: (id, text) => after(call('connector-send', { id, text })),
      saveCapability: capability => after(call('capability-save', capability)),
      deleteCapability: name => after(call('capability-delete', { name })),
      approveCapability: name => after(call('capability-approve', { name })),
diff --git a/patches/ds-bot/0005-social-seams.patch b/patches/ds-bot/0005-social-seams.patch
index 9834a17a8..28b0f89ec 100644
--- a/patches/ds-bot/0005-social-seams.patch
+++ b/patches/ds-bot/0005-social-seams.patch
@@ -719,7 +719,7 @@ diff --git a/src/host/channel.js b/src/host/channel.js
          case 'stop-member-work':
            return ok(await rt.stopMemberWork(String(body.roomId ?? ''), String(body.botId ?? '')))
          case 'dismiss-question':
-@@ -231,6 +231,9 @@ export function install(rt) {
+@@ -231,8 +231,12 @@ export function install(rt) {
            await rt.load()
            return ok(await rt.secretEndpoint(endpoint, body))
          case 'connector-connect':
@@ -728,7 +728,10 @@ diff --git a/src/host/channel.js b/src/host/channel.js
 +        case 'connector-app-status':
          case 'connector-disconnect':
          case 'connector-retry':
++        case 'connector-send':
            await rt.load()
+           return ok(await rt.connectorEndpoint(endpoint, body))
+         case 'capability-save':
 @@ -241,11 +241,22 @@ export function install(rt) {
          case 'bot-capability':
            await rt.load()
diff --git a/patches/ds-bot/0008-client-bundle.patch b/patches/ds-bot/0008-client-bundle.patch
index b59eced6c..6ac254b6f 100644
--- a/patches/ds-bot/0008-client-bundle.patch
+++ b/patches/ds-bot/0008-client-bundle.patch
@@ -225,13 +225,19 @@ diff --git a/client.js b/client.js
    Connected: "已连接",
    Disconnect: "断开",
    Connect: "连接",
-@@ -141,17 +141,44 @@ var ZH = {
+@@ -141,17 +141,50 @@ var ZH = {
    "GitHub addresses must start with https://": "GitHub 地址必须以 https:// 开头",
    "This DSH cannot load connectors": "这个 DSH 不能加载连接器",
    "No such connector": "没有这个连接器",
 -  "Classic Agent mode": "经典 Agent 模式",
 -  "Switch": "切换",
 +  "Gmail, Slack, Calendar, Notion and many more apps, through one Composio key": "Gmail、Slack、日历、Notion 等众多应用，一个 Composio key 就能连",
++  "Posts into one Feishu group through a custom bot webhook": "通过自定义机器人 webhook 发到你的一个飞书群",
++  "Feishu webhook URL": "飞书 webhook 地址",
++  "Get a webhook URL in Feishu": "去飞书获取 webhook 地址",
++  "Message to send to Feishu": "要发到飞书的消息",
++  "Type a message for the Feishu group": "输入要发到飞书群的消息",
++  Send: "发送",
 +  "Connected: {apps}": "已连接：{apps}",
 +  "Composio API key": "Composio API key",
 +  "Get a Composio API key": "去 Composio 获取 API key",
@@ -566,6 +572,14 @@ diff --git a/client.js b/client.js
    "Save key": "保存密钥",
    "Keys your Bots asked for. Bots never see the values: they use them as ": "你的 Bot 请求过的密钥。Bot 永远看不到值：它们在 shell 里通过 ",
    " in their shell, and every value is replaced by ": " 使用，而且发给模型之前，每个值都会被替换成 ",
+@@ -621,7 +621,6 @@ var ZH = {
+   Remove: "删除",
+   "Ask or update": "询问或更新",
+   "Ask about or update {name}'s memory": "询问或更新 {name} 的记忆",
+-  Send: "发送",
+   "Added: {text}": "已添加：{text}",
+   "Added to team memory: {text}": "已加入团队记忆：{text}",
+   "Updated: {text}": "已更新：{text}",
 @@ -747,11 +747,11 @@ var ZH = {
    "Compared with the {count} days before": "与再往前 {count} 天相比",
    "{share}% of all usage from {span}": "占 {span} 全部用量的 {share}%",
@@ -1512,16 +1526,7 @@ diff --git a/client.js b/client.js
 -    else delete SHAPES[id];
 -    refresh();
 -  };
-+// src/client/cluster-order.js
-+function clusterOrder(people2) {
-+  const list = Array.isArray(people2) ? people2 : [];
-+  const remote = (bot) => Boolean(bot?.remote);
-+  if (!list.some(remote)) return list;
-+  const locals = list.filter((bot) => !remote(bot));
-+  const remotes = list.filter(remote);
-+  if (list.length <= 4) return [...remotes, ...locals];
-+  return [...locals, ...remotes];
- }
+-}
 -function registerTheme(id, theme) {
 -  if (typeof id !== "string" || !/^[a-z][\w-]{0,31}$/.test(id)) throw new Error("Theme ids are lowercase words");
 -  for (const mode of ["light", "dark"]) {
@@ -1535,7 +1540,16 @@ diff --git a/client.js b/client.js
 -    else delete customThemes[id];
 -    registry.set((value) => value + 1);
 -  };
--}
++// src/client/cluster-order.js
++function clusterOrder(people2) {
++  const list = Array.isArray(people2) ? people2 : [];
++  const remote = (bot) => Boolean(bot?.remote);
++  if (!list.some(remote)) return list;
++  const locals = list.filter((bot) => !remote(bot));
++  const remotes = list.filter(remote);
++  if (list.length <= 4) return [...remotes, ...locals];
++  return [...locals, ...remotes];
+ }
 -var allThemes = () => ({ ...THEMES, ...customThemes });
  
  // src/shared/mentions.js
@@ -1545,8 +1559,6 @@ diff --git a/client.js b/client.js
    return spans;
  }
 -
--// src/client/text.js
--var MENTION_ORIGIN = "https://bots.local/";
 +function unmatchedMentions(text, bots, { references = [] } = {}) {
 +  const value = String(text ?? "");
 +  const skip = [
@@ -1569,8 +1581,8 @@ diff --git a/client.js b/client.js
 +  return missing;
 +}
 +
-+// src/client/text.js
-+var MENTION_ORIGIN = "https://bots.local/";
+ // src/client/text.js
+ var MENTION_ORIGIN = "https://bots.local/";
  function linkMentions(text, bots, selfId) {
    if (!text || !text.includes("@")) return text;
 +  const ordered = [...bots ?? []].sort((a, b) => Number(Boolean(a?.remote)) - Number(Boolean(b?.remote)));
@@ -1697,7 +1709,7 @@ diff --git a/client.js b/client.js
    }
    return "";
  }
-@@ -1624,212 +1624,1120 @@ function usageOf(list, ids) {
+@@ -1624,220 +1624,1129 @@ function usageOf(list, ids) {
    const hit = input > 0 ? Math.round(cacheRead / input * 100) : 0;
    return t("{tokens} tok · Cache hit {hit}%", { tokens: formatTokens(input + output), hit });
  }
@@ -1990,6 +2002,8 @@ diff --git a/client.js b/client.js
  }
  
 -// src/client/styles.js
+-var SHELL_CSS = `
+-body{--bt-ink:#141414;--bt-ink-2:rgba(20,20,20,.6);--bt-ink-3:rgba(20,20,20,.36);--bt-bubble:#eeeeee;--bt-sidebar:#f7f7f7;--bt-main:#fcfcfc;--bt-line:rgba(20,20,20,.08);--bt-line-2:rgba(20,20,20,.15);--bt-line-weak:rgba(20,20,20,.1);--bt-hover:rgba(119,119,119,.09);--bt-active:rgba(119,119,119,.17);--bt-card:#ffffff;--bt-accent:#4d6bfe;--bt-green:#00c972;--bt-star:#ff9800;--bt-user:#070707;--bt-user-ink:#fcfcfc;--bt-tag-bg:rgba(20,20,20,.06);--bt-tag-ink:rgba(20,20,20,.56)}
 +// src/client/mark.js
 +var import_react = require("react");
 +var STATES = ["idle", "thinking", "searching", "working", "sending", "orbit", "alert", "done"];
@@ -3009,10 +3023,11 @@ diff --git a/client.js b/client.js
 +}
 +
 +// src/client/styles.js
- var SHELL_CSS = `
- body{--bt-ink:#141414;--bt-ink-2:rgba(20,20,20,.6);--bt-ink-3:rgba(20,20,20,.36);--bt-bubble:#eeeeee;--bt-sidebar:#f7f7f7;--bt-main:#fcfcfc;--bt-line:rgba(20,20,20,.08);--bt-line-2:rgba(20,20,20,.15);--bt-line-weak:rgba(20,20,20,.1);--bt-hover:rgba(119,119,119,.09);--bt-active:rgba(119,119,119,.17);--bt-card:#ffffff;--bt-accent:#4d6bfe;--bt-green:#00c972;--bt-star:#ff9800;--bt-user:#070707;--bt-user-ink:#fcfcfc;--bt-tag-bg:rgba(20,20,20,.06);--bt-tag-ink:rgba(20,20,20,.56)}
++var SHELL_CSS = `
++body{--bt-ink:#141414;--bt-ink-2:rgba(20,20,20,.6);--bt-ink-3:rgba(20,20,20,.36);--bt-bubble:#eeeeee;--bt-sidebar:#f7f7f7;--bt-main:#fcfcfc;--bt-line:rgba(20,20,20,.08);--bt-line-2:rgba(20,20,20,.15);--bt-line-weak:rgba(20,20,20,.1);--bt-hover:rgba(119,119,119,.09);--bt-active:rgba(119,119,119,.17);--bt-card:#ffffff;--bt-accent:#4d6bfe;--bt-green:#00c972;--bt-star:#ff9800;--bt-user:#070707;--bt-user-ink:#fcfcfc;--bt-tag-bg:rgba(20,20,20,.06);--bt-tag-ink:rgba(20,20,20,.56)}
  body[data-ds-dark-theme]{--bt-ink:#f2f2f2;--bt-ink-2:rgba(242,242,242,.6);--bt-ink-3:rgba(242,242,242,.36);--bt-bubble:#262626;--bt-sidebar:#1b1b1b;--bt-main:#141414;--bt-line:rgba(255,255,255,.08);--bt-line-2:rgba(255,255,255,.15);--bt-line-weak:rgba(255,255,255,.1);--bt-hover:rgba(160,160,160,.12);--bt-active:rgba(160,160,160,.2);--bt-card:#1f1f1f;--bt-user:#f2f2f2;--bt-user-ink:#141414;--bt-tag-bg:rgba(255,255,255,.09);--bt-tag-ink:rgba(242,242,242,.62)}
-@@ -1838,6 +1838,7 @@ ${Object.entries(INKS).map(([name, [, dark]]) => `body[data-ds-dark-theme]{--bt-
+ ${Object.entries(INKS).map(([name, [light]]) => `body{--bt-ink-${name}:${light}}`).join("")}
+ ${Object.entries(INKS).map(([name, [, dark]]) => `body[data-ds-dark-theme]{--bt-ink-${name}:${dark}}`).join("")}
  .bt-mark{display:inline-block;flex:none;position:relative;line-height:0}
  .bt-mark svg{width:100%;height:100%;overflow:visible}
  .bt-mark-img{width:100%;height:100%;border-radius:50%;object-fit:cover;display:block;box-shadow:inset 0 0 0 1px var(--bt-line)}
@@ -4483,36 +4498,7 @@ diff --git a/client.js b/client.js
 +  const waiting = (roster.secretRequests?.[bot.id] ?? []).filter((entry) => entry.status === "pending" && !drawn(entry));
 +  if (waiting.length === 0) return null;
 +  return (0, import_react7.createElement)("div", { className: "bt-q-dock bt-secret-dock" }, waiting.map((request) => (0, import_react7.createElement)(SecretCard, { key: `${request.id}:${request.kind}`, bot, request, roster, actions })));
- }
--var FIDGETS = ["hop", "sway", "stretch", "look"];
--function BotMark({ bot, look: given, size = 36, state = "idle", live = false, gaze = false, pokeable = false, label }) {
--  const look = given ?? lookOf(bot);
--  const ref = (0, import_react2.useRef)(null);
--  const maskId = (0, import_react2.useRef)("");
--  if (maskId.current === "") maskId.current = `bt-mark-${nextMarkSerial()}`;
--  const [poked, setPoked] = (0, import_react2.useState)(false);
--  useGaze(ref, gaze);
--  const common = {
--    ref,
--    className: poked ? "bt-mark bt-mark-poke" : "bt-mark",
--    "data-shape": look.image ? "image" : shapeId(look.shape),
--    "data-state": STATES.includes(state) ? state : "idle",
--    "data-live": live ? "" : void 0,
--    "data-fidget": live ? FIDGETS[fnv1a(`${bot?.id ?? ""}:fidget`) % FIDGETS.length] : void 0,
--    "data-gaze": gaze ? "" : void 0,
--    "data-poke": pokeable ? "" : void 0,
--    style: { width: size, height: size, ...live ? { "--bt-delay": `${-(fnv1a(String(bot?.id ?? "")) % 5e3) / 1e3}s`, "--bt-fidget-delay": `${-(fnv1a(`${bot?.id ?? ""}:when`) % 9e3) / 1e3}s` } : {} },
--    role: label ? "img" : void 0,
--    "aria-label": label,
--    "aria-hidden": label ? void 0 : true,
--    onClick: pokeable ? () => setPoked(true) : void 0,
--    onAnimationEnd: poked ? (event) => {
--      if (/^bt-poke/.test(event.animationName)) setPoked(false);
--    } : void 0
--  };
--  if (look.image) return (0, import_react2.createElement)("span", common, (0, import_react2.createElement)("img", { className: "bt-mark-img", src: look.image, alt: "", draggable: false }));
--  const box = shapeOf(look.shape).size;
--  return (0, import_react2.createElement)("span", common, (0, import_react2.createElement)("svg", { viewBox: `0 0 ${box} ${box}`, dangerouslySetInnerHTML: { __html: characterMarkup(look.shape, look.color).replaceAll(MASK_ID, maskId.current) } }));
++}
 +var scopeMode = (scope) => scope === "all" ? "all" : scope.length === 0 ? "none" : "some";
 +function ScopeEditor({ secret, roster, onSave }) {
 +  const [mode, setMode] = (0, import_react7.useState)(scopeMode(secret.scope));
@@ -4548,11 +4534,31 @@ diff --git a/client.js b/client.js
 +    )
 +  );
  }
--function StarIcon({ size = 8 }) {
--  return (0, import_react2.createElement)(
--    "svg",
--    { width: size, height: size, viewBox: "0 0 10 10", "aria-hidden": true },
--    (0, import_react2.createElement)("path", { d: "M5 .6l1.3 2.8 3 .3-2.3 2 .7 3L5 7.2 2.3 8.7l.7-3L.7 3.7l3-.3z", fill: "#fff" })
+-var FIDGETS = ["hop", "sway", "stretch", "look"];
+-function BotMark({ bot, look: given, size = 36, state = "idle", live = false, gaze = false, pokeable = false, label }) {
+-  const look = given ?? lookOf(bot);
+-  const ref = (0, import_react2.useRef)(null);
+-  const maskId = (0, import_react2.useRef)("");
+-  if (maskId.current === "") maskId.current = `bt-mark-${nextMarkSerial()}`;
+-  const [poked, setPoked] = (0, import_react2.useState)(false);
+-  useGaze(ref, gaze);
+-  const common = {
+-    ref,
+-    className: poked ? "bt-mark bt-mark-poke" : "bt-mark",
+-    "data-shape": look.image ? "image" : shapeId(look.shape),
+-    "data-state": STATES.includes(state) ? state : "idle",
+-    "data-live": live ? "" : void 0,
+-    "data-fidget": live ? FIDGETS[fnv1a(`${bot?.id ?? ""}:fidget`) % FIDGETS.length] : void 0,
+-    "data-gaze": gaze ? "" : void 0,
+-    "data-poke": pokeable ? "" : void 0,
+-    style: { width: size, height: size, ...live ? { "--bt-delay": `${-(fnv1a(String(bot?.id ?? "")) % 5e3) / 1e3}s`, "--bt-fidget-delay": `${-(fnv1a(`${bot?.id ?? ""}:when`) % 9e3) / 1e3}s` } : {} },
+-    role: label ? "img" : void 0,
+-    "aria-label": label,
+-    "aria-hidden": label ? void 0 : true,
+-    onClick: pokeable ? () => setPoked(true) : void 0,
+-    onAnimationEnd: poked ? (event) => {
+-      if (/^bt-poke/.test(event.animationName)) setPoked(false);
+-    } : void 0
 +function ValueEditor({ secret, onSave }) {
 +  const [value, setValue] = (0, import_react7.useState)("");
 +  const [replaced, setReplaced] = (0, import_react7.useState)(false);
@@ -4565,7 +4571,16 @@ diff --git a/client.js b/client.js
 +        setReplaced(true);
 +      }
 +    });
-+  };
+   };
+-  if (look.image) return (0, import_react2.createElement)("span", common, (0, import_react2.createElement)("img", { className: "bt-mark-img", src: look.image, alt: "", draggable: false }));
+-  const box = shapeOf(look.shape).size;
+-  return (0, import_react2.createElement)("span", common, (0, import_react2.createElement)("svg", { viewBox: `0 0 ${box} ${box}`, dangerouslySetInnerHTML: { __html: characterMarkup(look.shape, look.color).replaceAll(MASK_ID, maskId.current) } }));
+-}
+-function StarIcon({ size = 8 }) {
+-  return (0, import_react2.createElement)(
+-    "svg",
+-    { width: size, height: size, viewBox: "0 0 10 10", "aria-hidden": true },
+-    (0, import_react2.createElement)("path", { d: "M5 .6l1.3 2.8 3 .3-2.3 2 .7 3L5 7.2 2.3 8.7l.7-3L.7 3.7l3-.3z", fill: "#fff" })
 +  const edit = (next) => {
 +    setValue(next);
 +    setReplaced(false);
@@ -5728,22 +5743,11 @@ diff --git a/client.js b/client.js
 +      setBusy("");
      }
 -  });
-+  };
-+  return (0, import_react9.createElement)(
-+    "div",
-+    { className: "bt-file-chips" },
-+    files.map((file) => (0, import_react9.createElement)(
-+      "button",
-+      { key: file.id, type: "button", className: "bt-file-chip", disabled: busy === file.id, title: `Download ${file.name} (untrusted file from a remote Bot)`, onClick: () => download2(file) },
-+      `📎 ${file.name} · ${fileSize(file.size)}`
-+    )),
-+    error ? (0, import_react9.createElement)("span", { className: "bt-file-error", role: "alert" }, error) : null
-+  );
- }
+-}
 -function ScopeSwitch({ value, onChange, bot }) {
 -  const options = [["all", t("All Bots")], ["bot", t("Only {name}", { name: bot.name })]];
 -  return (0, import_react5.createElement)(
-+function GroupEvent({ prefix, room: room2, name, roster, actions }) {
++  };
 +  return (0, import_react9.createElement)(
      "div",
 -    { className: "bt-secret-scope", role: "radiogroup", "aria-label": t("Who may use it") },
@@ -5756,21 +5760,18 @@ diff --git a/client.js b/client.js
 -      className: "bt-secret-seg",
 -      onClick: () => onChange(id)
 -    }, text))
-+    { className: "bt-event" },
-+    (0, import_react9.createElement)("span", null, prefix),
-+    room2 ? (0, import_react9.createElement)("button", { type: "button", onClick: () => actions.openSession(room2.id) }, (0, import_react9.createElement)(RoomAvatar, { room: room2, roster, size: 16 }), room2.name) : name ? (0, import_react9.createElement)("span", null, name) : null
++    { className: "bt-file-chips" },
++    files.map((file) => (0, import_react9.createElement)(
++      "button",
++      { key: file.id, type: "button", className: "bt-file-chip", disabled: busy === file.id, title: `Download ${file.name} (untrusted file from a remote Bot)`, onClick: () => download2(file) },
++      `📎 ${file.name} · ${fileSize(file.size)}`
++    )),
++    error ? (0, import_react9.createElement)("span", { className: "bt-file-error", role: "alert" }, error) : null
    );
  }
 -function SecretHead({ bot, title, detail, name, onClose }) {
 -  return (0, import_react5.createElement)(
-+function MemoryEvent({ sessionId, scope, result, roster, actions, findBot }) {
-+  if (!/^(Saved to|Updated in|Removed from) /.test(result)) return null;
-+  const self = roster.byId[sessionId];
-+  const team = /^(team|团队|共享)$/i.test(String(scope ?? "").trim());
-+  const other = team || !scope ? void 0 : findBot(scope);
-+  const target = other && other.id !== self?.id ? other : self;
-+  if (!target) return null;
-+  const label = team ? t("Team memory updated") : target === self ? t("Memory updated") : t("Updated {name}'s memory", { name: target.name });
++function GroupEvent({ prefix, room: room2, name, roster, actions }) {
 +  return (0, import_react9.createElement)(
      "div",
 -    { className: "bt-q-head bt-secret-head" },
@@ -5783,7 +5784,8 @@ diff --git a/client.js b/client.js
 -    ),
 -    onClose ? (0, import_react5.createElement)("button", { type: "button", className: "bt-q-x", "aria-label": t("Cancel the request"), title: t("Cancel"), onClick: onClose }, (0, import_react5.createElement)(CloseIcon)) : null
 +    { className: "bt-event" },
-+    (0, import_react9.createElement)("button", { type: "button", title: result, onClick: () => actions.openMemory(target.id) }, (0, import_react9.createElement)(MemoryIcon), label)
++    (0, import_react9.createElement)("span", null, prefix),
++    room2 ? (0, import_react9.createElement)("button", { type: "button", onClick: () => actions.openSession(room2.id) }, (0, import_react9.createElement)(RoomAvatar, { room: room2, roster, size: 16 }), room2.name) : name ? (0, import_react9.createElement)("span", null, name) : null
    );
  }
 -function SecretCard({ bot, request, roster, actions }) {
@@ -5806,6 +5808,20 @@ diff --git a/client.js b/client.js
 -  };
 -  const allow = () => {
 -    if (!busy) void run(actions.secretAllow(request.id));
++function MemoryEvent({ sessionId, scope, result, roster, actions, findBot }) {
++  if (!/^(Saved to|Updated in|Removed from) /.test(result)) return null;
++  const self = roster.byId[sessionId];
++  const team = /^(team|团队|共享)$/i.test(String(scope ?? "").trim());
++  const other = team || !scope ? void 0 : findBot(scope);
++  const target = other && other.id !== self?.id ? other : self;
++  if (!target) return null;
++  const label = team ? t("Team memory updated") : target === self ? t("Memory updated") : t("Updated {name}'s memory", { name: target.name });
++  return (0, import_react9.createElement)(
++    "div",
++    { className: "bt-event" },
++    (0, import_react9.createElement)("button", { type: "button", title: result, onClick: () => actions.openMemory(target.id) }, (0, import_react9.createElement)(MemoryIcon), label)
++  );
++}
 +function PartLine({ time }) {
 +  return (0, import_react9.createElement)("div", { className: "bt-part-line", role: "separator" }, Number.isFinite(time) ? (0, import_react9.createElement)("span", null, dayLabel(time)) : null);
 +}
@@ -7465,6 +7481,8 @@ diff --git a/client.js b/client.js
 -var scrollParent = (node) => {
 -  for (let at = node.parentElement; at; at = at.parentElement) {
 -    if (/(auto|scroll)/.test(getComputedStyle(at).overflowY)) return at;
+-  }
+-  return null;
 +var MEMBER_CSS = `
 +.bt-mw-dock-stack{box-sizing:border-box;display:flex;flex-direction:column;align-items:flex-start;gap:2px;width:var(--dsh-chat-content-width,min(960px,100%));margin:0 auto 6px;pointer-events:none}
 +.bt-mw-row{pointer-events:auto;display:flex;align-items:center;gap:10px;min-width:0;max-width:calc(100% + 6px);height:32px;margin-inline-start:-6px;padding:0 12px 0 6px;border:0;border-radius:16px;background:none;color:var(--bt-ink-2);font:inherit;font-size:14px;cursor:pointer;animation:bt-mw-in .32s cubic-bezier(.23,1,.32,1) backwards;transition:background-color .16s ease-out}
@@ -7507,7 +7525,26 @@ diff --git a/client.js b/client.js
 +var line = (d) => (0, import_react13.createElement)("path", { d });
 +var icon = (...paths) => function StatusIcon() {
 +  return (0, import_react13.createElement)("svg", { width: 14, height: 14, viewBox: "0 0 20 20", fill: "none", stroke: "currentColor", strokeWidth: 1.8, strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": true }, paths.map(line));
-+};
+ };
+-function EarlierParts({ sessionId, roster, actions }) {
+-  const [view, setView] = (0, import_react6.useState)({ items: [], cursor: void 0, loading: true, failed: false, startedAt: null });
+-  const top = (0, import_react6.useRef)(null);
+-  const busy = (0, import_react6.useRef)(false);
+-  const alive = (0, import_react6.useRef)(true);
+-  const restore = (0, import_react6.useRef)(null);
+-  const load = (cursor) => {
+-    if (busy.current) return;
+-    busy.current = true;
+-    setView((current) => ({ ...current, loading: true, failed: false }));
+-    actions.earlier(sessionId, cursor).then((page) => {
+-      busy.current = false;
+-      if (!alive.current) return;
+-      const scroller = top.current && scrollParent(top.current);
+-      if (scroller) restore.current = { scroller, fromEnd: scroller.scrollHeight - scroller.scrollTop };
+-      setView((current) => ({ items: [...page.items, ...current.items], cursor: page.cursor, loading: false, failed: false, startedAt: page.startedAt ?? current.startedAt }));
+-    }, () => {
+-      busy.current = false;
+-      if (alive.current) setView((current) => ({ ...current, loading: false, failed: true }));
 +var RING = "M10 3.25a6.75 6.75 0 1 1 0 13.5 6.75 6.75 0 0 1 0-13.5z";
 +var InboxIcon = icon("M3.5 11.5l1.9-6.1A1.5 1.5 0 0 1 6.83 4.35h6.34a1.5 1.5 0 0 1 1.43 1.05l1.9 6.1", "M3.5 11.5v3.25a1.5 1.5 0 0 0 1.5 1.5h10a1.5 1.5 0 0 0 1.5-1.5V11.5", "M3.5 11.5h3.75l1 1.75h3.5l1-1.75h3.75");
 +var AskIcon = icon(RING, "M10 6.75v3.75", "M10 13.25h.01");
@@ -7551,9 +7588,14 @@ diff --git a/client.js b/client.js
 +    }).catch(() => {
 +    }).finally(() => {
 +      if (!stopped) timer = setTimeout(load, POLL_MS2);
-+    });
+     });
+-  };
+-  (0, import_react6.useEffect)(() => {
+-    alive.current = true;
+-    load(void 0);
 +    load();
-+    return () => {
+     return () => {
+-      alive.current = false;
 +      stopped = true;
 +      clearTimeout(timer);
 +      taskListeners.delete(setTasks);
@@ -7578,29 +7620,9 @@ diff --git a/client.js b/client.js
 +    if (question == null || typeof question !== "object" || roster.roomsById?.[key]) continue;
 +    if (question.question !== text) continue;
 +    if (key === bot.id || key === currentPart(bot)) return bot.id;
-   }
--  return null;
++  }
 +  return void 0;
- };
--function EarlierParts({ sessionId, roster, actions }) {
--  const [view, setView] = (0, import_react6.useState)({ items: [], cursor: void 0, loading: true, failed: false, startedAt: null });
--  const top = (0, import_react6.useRef)(null);
--  const busy = (0, import_react6.useRef)(false);
--  const alive = (0, import_react6.useRef)(true);
--  const restore = (0, import_react6.useRef)(null);
--  const load = (cursor) => {
--    if (busy.current) return;
--    busy.current = true;
--    setView((current) => ({ ...current, loading: true, failed: false }));
--    actions.earlier(sessionId, cursor).then((page) => {
--      busy.current = false;
--      if (!alive.current) return;
--      const scroller = top.current && scrollParent(top.current);
--      if (scroller) restore.current = { scroller, fromEnd: scroller.scrollHeight - scroller.scrollTop };
--      setView((current) => ({ items: [...page.items, ...current.items], cursor: page.cursor, loading: false, failed: false, startedAt: page.startedAt ?? current.startedAt }));
--    }, () => {
--      busy.current = false;
--      if (alive.current) setView((current) => ({ ...current, loading: false, failed: true }));
++};
 +var placeKey = (botId, roomId) => `${botId}|${roomId ?? ""}`;
 +var partOf = (roster, chat) => roster.roomsById?.[chat] || !roster.byId?.[chat] ? chat : currentPart(roster.byId[chat]);
 +var runningIn = (work, botId, roomId) => roomId === void 0 ? work.bots?.[botId]?.roomId === void 0 ? work.bots?.[botId] : void 0 : (work.rooms?.[roomId] ?? []).find((entry) => entry.botId === botId) ?? (work.bots?.[botId]?.roomId === roomId ? work.bots[botId] : void 0);
@@ -7735,13 +7757,7 @@ diff --git a/client.js b/client.js
 +      place: placeOf(roster, entry.roomId),
 +      chat,
 +      ...people(roster, bot.id)
-     });
--  };
--  (0, import_react6.useEffect)(() => {
--    alive.current = true;
--    load(void 0);
--    return () => {
--      alive.current = false;
++    });
 +  }
 +  for (const task of tasks) {
 +    const bot = ownBot(roster, task.ownerBotId);
@@ -11009,21 +11025,32 @@ diff --git a/client.js b/client.js
    );
    const toLatest = () => {
      const scroller = document.querySelector("[data-conversation-scroll]");
-@@ -5704,8 +5704,8 @@ function NewMessagePills({ sessionId, useSessions, useUi, useTurnClock }) {
+@@ -5702,31 +5702,129 @@ function NewMessagePills({ sessionId, useSessions, useUi, useTurnClock }) {
+     if (back) back.click();
+     else scroller?.scrollTo({ top: scroller.scrollHeight, behavior: "smooth" });
    };
-   const toDivider = () => document.querySelector("[data-conversation-scroll] .bt-new-sep")?.scrollIntoView({ block: "center", behavior: "smooth" });
-   return (0, import_react_dom4.createPortal)(
+-  const toDivider = () => document.querySelector("[data-conversation-scroll] .bt-new-sep")?.scrollIntoView({ block: "center", behavior: "smooth" });
+-  return (0, import_react_dom4.createPortal)(
 -    (0, import_react9.createElement)(
 -      import_react9.Fragment,
+-      null,
+-      showUp ? pill("up", unread, { left: view.center, top: view.top }, toDivider, () => setAbove((state) => ({ ...state, dismissed: true }))) : null,
+-      showDown ? pill("down", fresh, { left: view.center, bottom: view.bottom }, toLatest, () => setRelease((state) => ({ ...state, dismissed: true }))) : null
+-    ),
+-    document.body
+-  );
++  const toDivider = () => document.querySelector("[data-conversation-scroll] .bt-new-sep")?.scrollIntoView({ block: "center", behavior: "smooth" });
++  return (0, import_react_dom4.createPortal)(
 +    (0, import_react18.createElement)(
 +      import_react18.Fragment,
-       null,
-       showUp ? pill("up", unread, { left: view.center, top: view.top }, toDivider, () => setAbove((state) => ({ ...state, dismissed: true }))) : null,
-       showDown ? pill("down", fresh, { left: view.center, bottom: view.bottom }, toLatest, () => setRelease((state) => ({ ...state, dismissed: true }))) : null
-@@ -5714,19 +5714,117 @@ function NewMessagePills({ sessionId, useSessions, useUi, useTurnClock }) {
-   );
- }
- 
++      null,
++      showUp ? pill("up", unread, { left: view.center, top: view.top }, toDivider, () => setAbove((state) => ({ ...state, dismissed: true }))) : null,
++      showDown ? pill("down", fresh, { left: view.center, bottom: view.bottom }, toLatest, () => setRelease((state) => ({ ...state, dismissed: true }))) : null
++    ),
++    document.body
++  );
++}
++
 +// src/client/composer-label.js
 +var ATTRIBUTES = ["aria-label", "data-placeholder"];
 +function holdComposerLabel(doc, label) {
@@ -11120,8 +11147,8 @@ diff --git a/client.js b/client.js
 +    for (const held of slots.values()) held.off();
 +    slots.clear();
 +  };
-+}
-+
+ }
+ 
  // src/client/composer.js
 -var import_react10 = require("react");
 +var import_react19 = require("react");
@@ -11465,23 +11492,10 @@ diff --git a/client.js b/client.js
  // src/client/speech.js
  var VOICE_BUNDLE = "@deepseek-ai/dsh-experimental-voice-input-bundle";
  var USABLE = /* @__PURE__ */ new Set(["ready", "standby", "waking"]);
-@@ -6100,253 +6100,29 @@ async function openCapture() {
-     }
-   };
- }
--async function transcribeWave(speech, catalog, wave, signal) {
--  if (wave.byteLength > catalog.maxAudioBytes) throw captureError("too-long");
--  const result = await speech.transcribe({ audioBase64: base64Of(wave), ...catalog.selection }, signal);
--  if (!result?.ok) throw Object.assign(new Error(result?.error?.message ?? "Transcription failed"), { kind: "service" });
--  return String(result.value?.text ?? "").trim();
--}
--function turnDetector({ loud = 0.12, quiet = 0.06, quietMs = 1200 } = {}) {
--  let spokeAt = 0;
--  let quietSince = 0;
--  return (level, now) => {
--    if (level >= loud) {
--      spokeAt ||= now;
--      quietSince = 0;
+@@ -6113,240 +6113,16 @@ function turnDetector({ loud = 0.12, quiet = 0.06, quietMs = 1200 } = {}) {
+     if (level >= loud) {
+       spokeAt ||= now;
+       quietSince = 0;
 -      return "speech";
 -    }
 -    if (!spokeAt) return "waiting";
@@ -11712,27 +11726,13 @@ diff --git a/client.js b/client.js
 -      )
 -    )
 -  );
--}
-+async function transcribeWave(speech, catalog, wave, signal) {
-+  if (wave.byteLength > catalog.maxAudioBytes) throw captureError("too-long");
-+  const result = await speech.transcribe({ audioBase64: base64Of(wave), ...catalog.selection }, signal);
-+  if (!result?.ok) throw Object.assign(new Error(result?.error?.message ?? "Transcription failed"), { kind: "service" });
-+  return String(result.value?.text ?? "").trim();
-+}
-+function turnDetector({ loud = 0.12, quiet = 0.06, quietMs = 1200 } = {}) {
-+  let spokeAt = 0;
-+  let quietSince = 0;
-+  return (level, now) => {
-+    if (level >= loud) {
-+      spokeAt ||= now;
-+      quietSince = 0;
 +      return "speech";
 +    }
 +    if (!spokeAt) return "waiting";
 +    if (level < quiet) quietSince ||= now;
 +    return quietSince && now - quietSince >= quietMs ? "done" : "speech";
 +  };
-+}
+ }
  
  // src/client/model-menu.js
 -var import_react13 = require("react");
@@ -13040,7 +13040,7 @@ diff --git a/client.js b/client.js
 +  const me = roster?.self?.memberId;
 +  return (roster?.bots ?? []).filter((bot) => !bot.remote && (me === void 0 || me === null || bot.ownerId === void 0 || bot.ownerId === me));
 +}
-+var connectedConnectors = (roster) => (roster?.connectors ?? []).filter((connector) => connector.state !== "off");
++var connectedConnectors = (roster) => (roster?.connectors ?? []).filter((connector) => connector.state !== "off" && connector.kind !== "sender");
 +var isOn = (bot, id) => bot.connectors?.[id] !== false;
 +function ownHint(bot, id) {
 +  return isOn(bot, id) ? t("On. This Bot can use it on every turn.") : t("Off. This Bot will not use it.");
@@ -13715,7 +13715,7 @@ diff --git a/client.js b/client.js
          const file = event.target.files?.[0];
          event.target.value = "";
          upload(file);
-@@ -7982,178 +7982,825 @@ function AvatarEditor({ bot, actions, run, onClose }) {
+@@ -7982,26 +7982,27 @@ function AvatarEditor({ bot, actions, run, onClose }) {
  function MemoryCard({ bot, actions }) {
    const count = useMemoryCount(bot.id, actions);
    const label = count === null ? t("Loading…") : count === 0 ? t("Nothing saved yet") : count === 1 ? t("1 entry") : t("{count} entries", { count });
@@ -13751,41 +13751,49 @@ diff --git a/client.js b/client.js
    const isMainBot = isMainOf(roster, bot.id);
    const onlyMain = isMainBot && (roster.mainBotIds ?? []).length === 1;
    const isTile = roster.mainBotId === bot.id;
-   const save = (patch) => run(actions.updateBot(bot.id, patch));
-   const duplicate = () => run(actions.duplicateBot(bot.id).then((copy2) => actions.openSession(copy2.id)));
-   const remove = () => {
--    if (confirming) void run(actions.deleteBot(bot.id));
--    else setConfirming(true);
-+    if (confirming) void run(actions.deleteBot(bot.id));
-+    else setConfirming(true);
-+  };
+@@ -8011,149 +8011,795 @@ function BotSettingsForm({ bot, roster, actions, run }) {
+     if (confirming) void run(actions.deleteBot(bot.id));
+     else setConfirming(true);
+   };
+-  (0, import_react18.useEffect)(() => {
 +  (0, import_react28.useEffect)(() => {
-+    void actions.refreshModels?.();
-+  }, [bot.id]);
+     void actions.refreshModels?.();
+   }, [bot.id]);
+-  return (0, import_react18.createElement)(
 +  return (0, import_react28.createElement)(
-+    "div",
-+    { className: "bt-bs" },
+     "div",
+     { className: "bt-bs" },
+-    (0, import_react18.createElement)(
 +    (0, import_react28.createElement)(
-+      "div",
-+      { className: "bt-bs-hero" },
+       "div",
+       { className: "bt-bs-hero" },
+-      (0, import_react18.createElement)(
 +      (0, import_react28.createElement)(
-+        "div",
-+        { className: "bt-avatar-anchor" },
+         "div",
+         { className: "bt-avatar-anchor" },
+-        (0, import_react18.createElement)(
 +        (0, import_react28.createElement)(
-+          "button",
-+          { type: "button", className: "bt-avatar-trigger", "aria-label": t("Edit Bot avatar"), "aria-expanded": editing, onClick: () => setEditing((value) => !value) },
+           "button",
+           { type: "button", className: "bt-avatar-trigger", "aria-label": t("Edit Bot avatar"), "aria-expanded": editing, onClick: () => setEditing((value) => !value) },
+-          (0, import_react18.createElement)(BotMark, { bot, size: 64, live: true }),
+-          (0, import_react18.createElement)("span", { className: "bt-avatar-pencil", "aria-hidden": true }, (0, import_react18.createElement)(PencilIcon))
 +          (0, import_react28.createElement)(BotMark, { bot, size: 64, live: true }),
 +          (0, import_react28.createElement)("span", { className: "bt-avatar-pencil", "aria-hidden": true }, (0, import_react28.createElement)(PencilIcon))
-+        ),
+         ),
+-        editing ? (0, import_react18.createElement)(AvatarEditor, { bot, actions, run, onClose: closeEditor }) : null
 +        editing ? (0, import_react28.createElement)(AvatarEditor, { bot, actions, run, onClose: closeEditor }) : null
-+      ),
+       ),
+-      (0, import_react18.createElement)(
 +      (0, import_react28.createElement)(
-+        "div",
-+        { className: "bt-bs-who" },
+         "div",
+         { className: "bt-bs-who" },
+-        (0, import_react18.createElement)("span", { className: "bt-bs-name" }, bot.name),
+-        (0, import_react18.createElement)("span", { className: "bt-bs-sub" }, [bot.role, isMainBot ? t("Main Bot") : ""].filter(Boolean).join(" · ") || t("Bot"))
 +        (0, import_react28.createElement)("span", { className: "bt-bs-name" }, bot.name),
 +        (0, import_react28.createElement)("span", { className: "bt-bs-sub" }, [bot.role, isMainBot ? t("Main Bot") : ""].filter(Boolean).join(" · ") || t("Bot"))
-+      )
-+    ),
+       )
+     ),
+-    (0, import_react18.createElement)(
 +    (0, import_react28.createElement)(
 +      Card,
 +      { title: t("Profile") },
@@ -14076,41 +14084,21 @@ diff --git a/client.js b/client.js
 +    void Promise.resolve(run(actions.deleteRoom(room2.id))).then((done) => {
 +      if (done) onDeleted?.();
 +    });
-   };
--  (0, import_react18.useEffect)(() => {
--    void actions.refreshModels?.();
--  }, [bot.id]);
--  return (0, import_react18.createElement)(
++  };
 +  return (0, import_react29.createElement)(
-     "div",
-     { className: "bt-bs" },
--    (0, import_react18.createElement)(
++    "div",
++    { className: "bt-bs" },
 +    (0, import_react29.createElement)(
-       "div",
-       { className: "bt-bs-hero" },
--      (0, import_react18.createElement)(
--        "div",
--        { className: "bt-avatar-anchor" },
--        (0, import_react18.createElement)(
--          "button",
--          { type: "button", className: "bt-avatar-trigger", "aria-label": t("Edit Bot avatar"), "aria-expanded": editing, onClick: () => setEditing((value) => !value) },
--          (0, import_react18.createElement)(BotMark, { bot, size: 64, live: true }),
--          (0, import_react18.createElement)("span", { className: "bt-avatar-pencil", "aria-hidden": true }, (0, import_react18.createElement)(PencilIcon))
--        ),
--        editing ? (0, import_react18.createElement)(AvatarEditor, { bot, actions, run, onClose: closeEditor }) : null
--      ),
--      (0, import_react18.createElement)(
++      "div",
++      { className: "bt-bs-hero" },
 +      (0, import_react29.createElement)(RoomAvatar, { room: room2, roster, size: 64 }),
 +      (0, import_react29.createElement)(
-         "div",
-         { className: "bt-bs-who" },
--        (0, import_react18.createElement)("span", { className: "bt-bs-name" }, bot.name),
--        (0, import_react18.createElement)("span", { className: "bt-bs-sub" }, [bot.role, isMainBot ? t("Main Bot") : ""].filter(Boolean).join(" · ") || t("Bot"))
++        "div",
++        { className: "bt-bs-who" },
 +        (0, import_react29.createElement)("span", { className: "bt-bs-name" }, room2.name),
 +        (0, import_react29.createElement)("span", { className: "bt-bs-sub" }, roomSubtitle(room2, roster))
-       )
-     ),
--    (0, import_react18.createElement)(
++      )
++    ),
 +    (0, import_react29.createElement)(
        Card,
        { title: t("Profile") },
@@ -14175,22 +14163,36 @@ diff --git a/client.js b/client.js
 -        { label: t("What this Bot does"), hint: t("Its job on the team. Part of the Bot's system prompt."), stack: true },
 -        (0, import_react18.createElement)(InlineText, { label: t("Instructions"), value: bot.instructions, multiline: true, placeholder: t("What this Bot is responsible for…"), onSave: (instructions) => save({ instructions }) })
 -      )
+-    ),
+-    (0, import_react18.createElement)(BotCapabilitiesCard, { bot, roster, actions, run, Card, SwitchRow }),
+-    roster.memory === false ? null : (0, import_react18.createElement)(MemoryCard, { bot, actions }),
+-    (0, import_react18.createElement)(BotSchedules, { bot, roster, actions }),
+-    (0, import_react18.createElement)(
 +      { title: t("Members · {count}", { count: people2.length }) },
 +      people2.map((person) => (0, import_react29.createElement)(FacePersonRow, { key: person.key, person, roster, onOpenBot: openBot, lead: room2.face?.lead?.handle }))
 +    ) : null,
 +    face ? null : (0, import_react29.createElement)(
-+      Card,
+       Card,
+-      { title: t("Main Bot") },
+-      onlyMain ? (0, import_react18.createElement)(
 +      { title: t("Members · {count}", { count: members.length + humans.length + remotes.length }) },
 +      humans.map((person) => (0, import_react29.createElement)(
-+        "div",
+         "div",
+-        { className: "bt-set-row bt-bs-row" },
+-        (0, import_react18.createElement)(
 +        { key: person.id, className: "bt-set-row bt-bs-row bt-gs-member" },
 +        (0, import_react29.createElement)(
-+          "span",
+           "span",
+-          { className: "bt-set-copy" },
+-          (0, import_react18.createElement)("span", { className: "bt-bs-label" }, t("Main Bot")),
+-          (0, import_react18.createElement)("span", { className: "bt-set-hint" }, t("The only Main Bot. To hand the role to another Bot, use Main Bot on the Bots page."))
 +          { className: "bt-gs-who" },
 +          (0, import_react29.createElement)("span", { className: "bt-row-title" }, person.displayName || person.id),
 +          (0, import_react29.createElement)("span", { className: "bt-tag" }, t("Human")),
 +          person.role === "admin" ? (0, import_react29.createElement)("span", { className: "bt-tag" }, t("Admin")) : null
-+        ),
+         ),
+-        (0, import_react18.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", onClick: () => actions.openSettings("bots") }, t("Change"))
+-      ) : (0, import_react18.createElement)(SwitchRow, { label: t("Main Bot"), hint: t("Can create and change Bots, and runs every group chat."), on: isMainBot, onChange: (on) => run(actions.setMain(bot.id, on)) })
 +        humans.length + members.length + remotes.length > 2 && person.id !== roster.self?.memberId ? (0, import_react29.createElement)("button", { type: "button", className: "bt-x", "aria-label": t("Remove {name} from the group", { name: person.displayName || person.id }), title: t("Remove from group"), onClick: () => update({ removeParticipants: [{ kind: "human", id: person.id }] }) }, "×") : null
 +      )),
 +      members.map((member) => {
@@ -14271,24 +14273,28 @@ diff --git a/client.js b/client.js
 +      // the note on who leads, so that note stays with the members it is about (#892).
 +      room2.origin === "face-to-face" || room2.origin === "inbound-share" ? null : (0, import_react29.createElement)(FlyBotRoomMembers, { room: room2, roster, actions })
      ),
--    (0, import_react18.createElement)(BotCapabilitiesCard, { bot, roster, actions, run, Card, SwitchRow }),
--    roster.memory === false ? null : (0, import_react18.createElement)(MemoryCard, { bot, actions }),
--    (0, import_react18.createElement)(BotSchedules, { bot, roster, actions }),
--    (0, import_react18.createElement)(
+-    // The Main Bot tile is always first and always shown, like in the context menu.
+-    isTile ? null : (0, import_react18.createElement)(
 +    (0, import_react29.createElement)(StandingApprovalsCard, { scope: "room", target: room2, roster, actions, run, Card }),
 +    (0, import_react29.createElement)(
        Card,
--      { title: t("Main Bot") },
--      onlyMain ? (0, import_react18.createElement)(
-+      { title: t("Sidebar") },
+       { title: t("Sidebar") },
+-      (0, import_react18.createElement)(SwitchRow, { label: t("Pin"), hint: t("Kept above the other chats."), on: bot.pinned === true, onChange: (pinned) => run(actions.setFlags(bot.id, { pinned })) }),
+-      isMainBot ? null : (0, import_react18.createElement)(SwitchRow, { label: t("Hide from sidebar"), hint: t("Search still finds it."), on: bot.hidden === true, onChange: (hidden) => run(actions.setFlags(bot.id, { hidden })) })
 +      (0, import_react29.createElement)(SwitchRow, { label: t("Pin"), hint: t("Kept above the other chats."), on: room2.pinned === true, onChange: (pinned) => run(actions.setFlags(room2.id, { pinned })) }),
 +      (0, import_react29.createElement)(SwitchRow, { label: t("Hide from sidebar"), hint: t("Search still finds it."), on: room2.hidden === true, onChange: (hidden) => run(actions.setFlags(room2.id, { hidden })) })
-+    ),
+     ),
+-    (0, import_react18.createElement)(
 +    (0, import_react29.createElement)(
-+      Card,
+       Card,
+-      { title: t("Manage") },
+-      (0, import_react18.createElement)(
 +      { title: t("More") },
 +      (0, import_react29.createElement)(
-+        "button",
+         "button",
+-        { type: "button", className: "bt-set-row bt-bs-row", onClick: duplicate },
+-        (0, import_react18.createElement)("span", { className: "bt-set-copy" }, (0, import_react18.createElement)("span", { className: "bt-bs-label" }, t("Duplicate")), (0, import_react18.createElement)("span", { className: "bt-set-hint" }, t("A copy with the same job and model, and fresh memory."))),
+-        (0, import_react18.createElement)("span", { className: "bt-chevron" }, (0, import_react18.createElement)(ChevronRightIcon))
 +        { type: "button", className: "bt-set-row bt-bs-row bt-bs-danger", "data-confirm": confirming || void 0, onClick: remove },
 +        (0, import_react29.createElement)(
 +          "span",
@@ -14513,32 +14519,7 @@ diff --git a/client.js b/client.js
 +      "div",
 +      { className: "bt-palette", role: "dialog", "aria-label": t("Search"), "aria-modal": true },
 +      (0, import_react30.createElement)(
-         "div",
--        { className: "bt-set-row bt-bs-row" },
--        (0, import_react18.createElement)(
--          "span",
--          { className: "bt-set-copy" },
--          (0, import_react18.createElement)("span", { className: "bt-bs-label" }, t("Main Bot")),
--          (0, import_react18.createElement)("span", { className: "bt-set-hint" }, t("The only Main Bot. To hand the role to another Bot, use Main Bot on the Bots page."))
--        ),
--        (0, import_react18.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", onClick: () => actions.openSettings("bots") }, t("Change"))
--      ) : (0, import_react18.createElement)(SwitchRow, { label: t("Main Bot"), hint: t("Can create and change Bots, and runs every group chat."), on: isMainBot, onChange: (on) => run(actions.setMain(bot.id, on)) })
--    ),
--    // The Main Bot tile is always first and always shown, like in the context menu.
--    isTile ? null : (0, import_react18.createElement)(
--      Card,
--      { title: t("Sidebar") },
--      (0, import_react18.createElement)(SwitchRow, { label: t("Pin"), hint: t("Kept above the other chats."), on: bot.pinned === true, onChange: (pinned) => run(actions.setFlags(bot.id, { pinned })) }),
--      isMainBot ? null : (0, import_react18.createElement)(SwitchRow, { label: t("Hide from sidebar"), hint: t("Search still finds it."), on: bot.hidden === true, onChange: (hidden) => run(actions.setFlags(bot.id, { hidden })) })
--    ),
--    (0, import_react18.createElement)(
--      Card,
--      { title: t("Manage") },
--      (0, import_react18.createElement)(
--        "button",
--        { type: "button", className: "bt-set-row bt-bs-row", onClick: duplicate },
--        (0, import_react18.createElement)("span", { className: "bt-set-copy" }, (0, import_react18.createElement)("span", { className: "bt-bs-label" }, t("Duplicate")), (0, import_react18.createElement)("span", { className: "bt-set-hint" }, t("A copy with the same job and model, and fresh memory."))),
--        (0, import_react18.createElement)("span", { className: "bt-chevron" }, (0, import_react18.createElement)(ChevronRightIcon))
++        "div",
 +        { className: "bt-palette-head" },
 +        (0, import_react30.createElement)("span", { className: "bt-palette-glyph", "aria-hidden": true }, (0, import_react30.createElement)(SearchIcon)),
 +        (0, import_react30.createElement)("input", {
@@ -15305,10 +15286,37 @@ diff --git a/client.js b/client.js
        if (stopped) {
          media.getTracks().forEach((track) => track.stop());
          return;
-@@ -8716,18 +8716,18 @@ function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }
-     const entry = Array.isArray(outline) ? outline[outline.length - 1] : void 0;
-     return entry ? `${outline.length}|${entry.response ?? ""}` : "0|";
-   });
+@@ -8689,477 +8689,233 @@ function useMicLevel(enabled) {
+         let sum = 0;
+         for (const value of data) sum += ((value - 128) / 128) ** 2;
+         smooth = smooth * 0.8 + Math.min(1, Math.sqrt(sum / data.length) * 4) * 0.2;
+-        setLevel(Math.round(smooth * 100) / 100);
+-        frame = requestAnimationFrame(tick);
+-      };
+-      tick();
+-    }).catch(() => {
+-    });
+-    return () => {
+-      stopped = true;
+-      cancelAnimationFrame(frame);
+-      stream?.getTracks().forEach((track) => track.stop());
+-      void audio?.close().catch(() => {
+-      });
+-      setLevel(0);
+-    };
+-  }, [enabled]);
+-  return level;
+-}
+-function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }) {
+-  const bot = roster.byId[sessionId];
+-  const room2 = roster.roomsById[sessionId];
+-  const name = bot?.name ?? room2?.name ?? t("Bot");
+-  const running = useSessionStatus((map) => map.get(sessionId)?.running === true);
+-  const lastReply = useSessions((list) => {
+-    const outline = list.projectionsBySession?.[sessionId]?.values?.turnOutline ?? list.byId[sessionId]?.projectionValues?.turnOutline;
+-    const entry = Array.isArray(outline) ? outline[outline.length - 1] : void 0;
+-    return entry ? `${outline.length}|${entry.response ?? ""}` : "0|";
+-  });
 -  const [speech] = (0, import_react22.useState)(() => actions.speech());
 -  const [phase, setPhase] = (0, import_react22.useState)(speech ? "starting" : speechApi() ? "listening" : "unsupported");
 -  const [catalog, setCatalog] = (0, import_react22.useState)(null);
@@ -15319,85 +15327,186 @@ diff --git a/client.js b/client.js
 -  const [cycle, setCycle] = (0, import_react22.useState)(0);
 -  const waiting = (0, import_react22.useRef)(null);
 -  const reply = (0, import_react22.useRef)(lastReply);
-+  const [speech] = (0, import_react34.useState)(() => actions.speech());
-+  const [phase, setPhase] = (0, import_react34.useState)(speech ? "starting" : speechApi() ? "listening" : "unsupported");
-+  const [catalog, setCatalog] = (0, import_react34.useState)(null);
-+  const [heard, setHeard] = (0, import_react34.useState)("");
-+  const [said, setSaid] = (0, import_react34.useState)("");
-+  const [note, setNote] = (0, import_react34.useState)("");
-+  const [serviceLevel, setServiceLevel] = (0, import_react34.useState)(0);
-+  const [cycle, setCycle] = (0, import_react34.useState)(0);
-+  const waiting = (0, import_react34.useRef)(null);
-+  const reply = (0, import_react34.useRef)(lastReply);
-   reply.current = lastReply;
+-  reply.current = lastReply;
 -  const turn = (0, import_react22.useRef)(0);
-+  const turn = (0, import_react34.useRef)(0);
-   const paneLeft = usePaneLeft();
-   const close = () => {
-     turn.current += 1;
-@@ -8747,12 +8747,12 @@ function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }
-     dictation.stop();
-     submit(text);
-   });
+-  const paneLeft = usePaneLeft();
+-  const close = () => {
+-    turn.current += 1;
+-    window.speechSynthesis?.cancel();
+-    actions.closeVoice();
+-  };
+-  useEscape(close);
+-  const submit = (text) => {
+-    setHeard(text);
+-    setPhase("thinking");
+-    waiting.current = reply.current.split("|")[0];
+-    void actions.send(sessionId, text.trim()).catch(() => setPhase("listening"));
+-  };
+-  const dictation = useDictation((text, final) => {
+-    setHeard(text);
+-    if (!final) return;
+-    dictation.stop();
+-    submit(text);
+-  });
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (!note) return void 0;
-     const timer = setTimeout(() => setNote(""), 2600);
-     return () => clearTimeout(timer);
-   }, [note]);
+-    if (!note) return void 0;
+-    const timer = setTimeout(() => setNote(""), 2600);
+-    return () => clearTimeout(timer);
+-  }, [note]);
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (!speech) return void 0;
-     let live = true;
-     speechCatalog(speech).then(({ catalog: next, usable }) => {
-@@ -8767,16 +8767,16 @@ function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }
-     };
-   }, [speech]);
-   const listen = phase === "listening";
+-    if (!speech) return void 0;
+-    let live = true;
+-    speechCatalog(speech).then(({ catalog: next, usable }) => {
+-      if (!live) return;
+-      setCatalog(next);
+-      setPhase(usable ? "listening" : "setup");
+-    }, () => {
+-      if (live) setPhase("setup");
+-    });
+-    return () => {
+-      live = false;
+-    };
+-  }, [speech]);
+-  const listen = phase === "listening";
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (speech || !listen || dictation.listening) return void 0;
-     const timer = setTimeout(() => dictation.start({ continuous: false, onEnd: () => {
-     } }), 250);
-     return () => clearTimeout(timer);
-   }, [listen, dictation.listening]);
+-    if (speech || !listen || dictation.listening) return void 0;
+-    const timer = setTimeout(() => dictation.start({ continuous: false, onEnd: () => {
+-    } }), 250);
+-    return () => clearTimeout(timer);
+-  }, [listen, dictation.listening]);
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (phase !== "listening") dictation.stop();
-   }, [phase]);
+-    if (phase !== "listening") dictation.stop();
+-  }, [phase]);
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (!speech || !catalog || !listen) return void 0;
-     const own = turn.current;
-     let capture = null;
-@@ -8838,7 +8838,7 @@ function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }
-       setServiceLevel(0);
+-    if (!speech || !catalog || !listen) return void 0;
+-    const own = turn.current;
+-    let capture = null;
+-    let frame = 0;
+-    let stopped = false;
+-    let smooth = 0;
+-    const detect = turnDetector();
+-    const limit = Math.max(1, catalog.maxDurationSeconds - 1) * 1e3;
+-    const finish = async (current) => {
+-      setPhase("transcribing");
+-      try {
+-        const wave = await current.finish(catalog.maxDurationSeconds);
+-        const text = wave ? await transcribeWave(speech, catalog, wave, new AbortController().signal) : "";
+-        if (turn.current !== own) return;
+-        if (text) submit(text);
+-        else setPhase("listening");
+-      } catch (error) {
+-        if (turn.current !== own) return;
+-        setNote(t(CAPTURE_NOTES[error?.kind] ?? "Couldn't hear that"));
+-        setPhase("listening");
+-      }
+-    };
+-    openCapture().then((opened) => {
+-      if (stopped) {
+-        opened.cancel();
+-        return;
+-      }
+-      capture = opened;
+-      const began = performance.now();
+-      const tick = () => {
+-        const now = performance.now();
+-        const level2 = capture.level();
+-        smooth = smooth * 0.8 + level2 * 0.2;
+-        setServiceLevel(Math.round(smooth * 100) / 100);
+-        const state = detect(level2, now);
+-        if (state === "done" || state === "speech" && now - began >= limit) {
+-          const current = capture;
+-          capture = null;
+-          setServiceLevel(0);
+-          void finish(current);
+-          return;
+-        }
+-        if (state === "waiting" && now - began >= limit) {
+-          setCycle((value) => value + 1);
+-          return;
+-        }
++        setLevel(Math.round(smooth * 100) / 100);
+         frame = requestAnimationFrame(tick);
+       };
+       tick();
+-    }, (error) => {
+-      if (stopped) return;
+-      setNote(t(CAPTURE_NOTES[error?.kind] ?? "Couldn't hear that"));
+-      setPhase("paused");
++    }).catch(() => {
+     });
+     return () => {
+       stopped = true;
+       cancelAnimationFrame(frame);
+-      capture?.cancel();
+-      setServiceLevel(0);
++      stream?.getTracks().forEach((track) => track.stop());
++      void audio?.close().catch(() => {
++      });
++      setLevel(0);
      };
-   }, [speech, catalog, listen, cycle]);
+-  }, [speech, catalog, listen, cycle]);
 -  (0, import_react22.useEffect)(() => {
-+  (0, import_react34.useEffect)(() => {
-     if (phase !== "thinking" || running || waiting.current === null) return;
-     const [count, text] = [lastReply.slice(0, lastReply.indexOf("|")), lastReply.slice(lastReply.indexOf("|") + 1)];
-     if (count === waiting.current || !text.trim()) return;
-@@ -8858,308 +8858,64 @@ function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }
-     window.speechSynthesis.cancel();
-     window.speechSynthesis.speak(utterance);
-   }, [phase, running, lastReply]);
+-    if (phase !== "thinking" || running || waiting.current === null) return;
+-    const [count, text] = [lastReply.slice(0, lastReply.indexOf("|")), lastReply.slice(lastReply.indexOf("|") + 1)];
+-    if (count === waiting.current || !text.trim()) return;
+-    waiting.current = null;
+-    const spoken = plainSpeech(text);
+-    setSaid(spoken);
+-    setHeard("");
+-    if (!window.speechSynthesis || !spoken) {
+-      setPhase("listening");
+-      return;
+-    }
+-    const utterance = new SpeechSynthesisUtterance(spoken);
+-    utterance.lang = /[\u3400-\u9fff]/.test(spoken) ? "zh-CN" : "en-US";
+-    utterance.onend = () => setPhase((current) => current === "speaking" ? "listening" : current);
+-    utterance.onerror = utterance.onend;
+-    setPhase("speaking");
+-    window.speechSynthesis.cancel();
+-    window.speechSynthesis.speak(utterance);
+-  }, [phase, running, lastReply]);
 -  (0, import_react22.useEffect)(() => () => window.speechSynthesis?.cancel(), []);
-+  (0, import_react34.useEffect)(() => () => window.speechSynthesis?.cancel(), []);
-   const micLevel = useMicLevel(!speech && phase === "listening" && dictation.listening);
-   const level = speech ? serviceLevel : micLevel;
-   const markState = phase === "thinking" || phase === "transcribing" ? "thinking" : phase === "speaking" ? "sending" : "idle";
-   const blocked = phase === "unsupported" || phase === "setup" || phase === "starting";
-   const togglePause = () => {
-     if (phase === "paused") {
+-  const micLevel = useMicLevel(!speech && phase === "listening" && dictation.listening);
+-  const level = speech ? serviceLevel : micLevel;
+-  const markState = phase === "thinking" || phase === "transcribing" ? "thinking" : phase === "speaking" ? "sending" : "idle";
+-  const blocked = phase === "unsupported" || phase === "setup" || phase === "starting";
+-  const togglePause = () => {
+-    if (phase === "paused") {
 -      setPhase("listening");
 -      return;
 -    }
--    turn.current += 1;
--    window.speechSynthesis?.cancel();
++  }, [enabled]);
++  return level;
++}
++function VoiceMode({ sessionId, roster, actions, useSessions, useSessionStatus }) {
++  const bot = roster.byId[sessionId];
++  const room2 = roster.roomsById[sessionId];
++  const name = bot?.name ?? room2?.name ?? t("Bot");
++  const running = useSessionStatus((map) => map.get(sessionId)?.running === true);
++  const lastReply = useSessions((list) => {
++    const outline = list.projectionsBySession?.[sessionId]?.values?.turnOutline ?? list.byId[sessionId]?.projectionValues?.turnOutline;
++    const entry = Array.isArray(outline) ? outline[outline.length - 1] : void 0;
++    return entry ? `${outline.length}|${entry.response ?? ""}` : "0|";
++  });
++  const [speech] = (0, import_react34.useState)(() => actions.speech());
++  const [phase, setPhase] = (0, import_react34.useState)(speech ? "starting" : speechApi() ? "listening" : "unsupported");
++  const [catalog, setCatalog] = (0, import_react34.useState)(null);
++  const [heard, setHeard] = (0, import_react34.useState)("");
++  const [said, setSaid] = (0, import_react34.useState)("");
++  const [note, setNote] = (0, import_react34.useState)("");
++  const [serviceLevel, setServiceLevel] = (0, import_react34.useState)(0);
++  const [cycle, setCycle] = (0, import_react34.useState)(0);
++  const waiting = (0, import_react34.useRef)(null);
++  const reply = (0, import_react34.useRef)(lastReply);
++  reply.current = lastReply;
++  const turn = (0, import_react34.useRef)(0);
++  const paneLeft = usePaneLeft();
++  const close = () => {
+     turn.current += 1;
+     window.speechSynthesis?.cancel();
 -    setPhase("paused");
--  };
++    actions.closeVoice();
+   };
 -  const openSetup = phase === "setup" ? actions.voiceSetup() : null;
 -  const caption = phase === "speaking" ? said : heard;
 -  const shownNote = note || dictation.note;
@@ -15471,37 +15580,160 @@ diff --git a/client.js b/client.js
 -  const openBot = (id) => {
 -    actions.closeSettings();
 -    actions.openSession(id);
--  };
++  useEscape(close);
++  const submit = (text) => {
++    setHeard(text);
++    setPhase("thinking");
++    waiting.current = reply.current.split("|")[0];
++    void actions.send(sessionId, text.trim()).catch(() => setPhase("listening"));
+   };
 -  const remove = () => {
 -    if (!confirming) {
 -      setConfirming(true);
-+      setPhase("listening");
-       return;
-     }
+-      return;
+-    }
 -    void Promise.resolve(run(actions.deleteRoom(room2.id))).then((done) => {
 -      if (done) onDeleted?.();
--    });
++  const dictation = useDictation((text, final) => {
++    setHeard(text);
++    if (!final) return;
++    dictation.stop();
++    submit(text);
++  });
++  (0, import_react34.useEffect)(() => {
++    if (!note) return void 0;
++    const timer = setTimeout(() => setNote(""), 2600);
++    return () => clearTimeout(timer);
++  }, [note]);
++  (0, import_react34.useEffect)(() => {
++    if (!speech) return void 0;
++    let live = true;
++    speechCatalog(speech).then(({ catalog: next, usable }) => {
++      if (!live) return;
++      setCatalog(next);
++      setPhase(usable ? "listening" : "setup");
++    }, () => {
++      if (live) setPhase("setup");
+     });
++    return () => {
++      live = false;
++    };
++  }, [speech]);
++  const listen = phase === "listening";
++  (0, import_react34.useEffect)(() => {
++    if (speech || !listen || dictation.listening) return void 0;
++    const timer = setTimeout(() => dictation.start({ continuous: false, onEnd: () => {
++    } }), 250);
++    return () => clearTimeout(timer);
++  }, [listen, dictation.listening]);
++  (0, import_react34.useEffect)(() => {
++    if (phase !== "listening") dictation.stop();
++  }, [phase]);
++  (0, import_react34.useEffect)(() => {
++    if (!speech || !catalog || !listen) return void 0;
++    const own = turn.current;
++    let capture = null;
++    let frame = 0;
++    let stopped = false;
++    let smooth = 0;
++    const detect = turnDetector();
++    const limit = Math.max(1, catalog.maxDurationSeconds - 1) * 1e3;
++    const finish = async (current) => {
++      setPhase("transcribing");
++      try {
++        const wave = await current.finish(catalog.maxDurationSeconds);
++        const text = wave ? await transcribeWave(speech, catalog, wave, new AbortController().signal) : "";
++        if (turn.current !== own) return;
++        if (text) submit(text);
++        else setPhase("listening");
++      } catch (error) {
++        if (turn.current !== own) return;
++        setNote(t(CAPTURE_NOTES[error?.kind] ?? "Couldn't hear that"));
++        setPhase("listening");
++      }
++    };
++    openCapture().then((opened) => {
++      if (stopped) {
++        opened.cancel();
++        return;
++      }
++      capture = opened;
++      const began = performance.now();
++      const tick = () => {
++        const now = performance.now();
++        const level2 = capture.level();
++        smooth = smooth * 0.8 + level2 * 0.2;
++        setServiceLevel(Math.round(smooth * 100) / 100);
++        const state = detect(level2, now);
++        if (state === "done" || state === "speech" && now - began >= limit) {
++          const current = capture;
++          capture = null;
++          setServiceLevel(0);
++          void finish(current);
++          return;
++        }
++        if (state === "waiting" && now - began >= limit) {
++          setCycle((value) => value + 1);
++          return;
++        }
++        frame = requestAnimationFrame(tick);
++      };
++      tick();
++    }, (error) => {
++      if (stopped) return;
++      setNote(t(CAPTURE_NOTES[error?.kind] ?? "Couldn't hear that"));
++      setPhase("paused");
++    });
++    return () => {
++      stopped = true;
++      cancelAnimationFrame(frame);
++      capture?.cancel();
++      setServiceLevel(0);
++    };
++  }, [speech, catalog, listen, cycle]);
++  (0, import_react34.useEffect)(() => {
++    if (phase !== "thinking" || running || waiting.current === null) return;
++    const [count, text] = [lastReply.slice(0, lastReply.indexOf("|")), lastReply.slice(lastReply.indexOf("|") + 1)];
++    if (count === waiting.current || !text.trim()) return;
++    waiting.current = null;
++    const spoken = plainSpeech(text);
++    setSaid(spoken);
++    setHeard("");
++    if (!window.speechSynthesis || !spoken) {
++      setPhase("listening");
++      return;
++    }
++    const utterance = new SpeechSynthesisUtterance(spoken);
++    utterance.lang = /[\u3400-\u9fff]/.test(spoken) ? "zh-CN" : "en-US";
++    utterance.onend = () => setPhase((current) => current === "speaking" ? "listening" : current);
++    utterance.onerror = utterance.onend;
++    setPhase("speaking");
++    window.speechSynthesis.cancel();
++    window.speechSynthesis.speak(utterance);
++  }, [phase, running, lastReply]);
++  (0, import_react34.useEffect)(() => () => window.speechSynthesis?.cancel(), []);
++  const micLevel = useMicLevel(!speech && phase === "listening" && dictation.listening);
++  const level = speech ? serviceLevel : micLevel;
++  const markState = phase === "thinking" || phase === "transcribing" ? "thinking" : phase === "speaking" ? "sending" : "idle";
++  const blocked = phase === "unsupported" || phase === "setup" || phase === "starting";
++  const togglePause = () => {
++    if (phase === "paused") {
++      setPhase("listening");
++      return;
++    }
 +    turn.current += 1;
 +    window.speechSynthesis?.cancel();
 +    setPhase("paused");
    };
 -  return (0, import_react23.createElement)(
-+  const openSetup = phase === "setup" ? actions.voiceSetup() : null;
-+  const caption = phase === "speaking" ? said : heard;
-+  const shownNote = note || dictation.note;
-+  return (0, import_react34.createElement)(
-     "div",
+-    "div",
 -    { className: "bt-bs" },
 -    (0, import_react23.createElement)(
-+    { className: "bt-pane bt-voice-pane", style: { left: paneLeft } },
-+    (0, import_react34.createElement)(
-       "div",
+-      "div",
 -      { className: "bt-bs-hero" },
 -      (0, import_react23.createElement)(RoomAvatar, { room: room2, roster, size: 64 }),
 -      (0, import_react23.createElement)(
-+      { className: "bt-voice-stage", role: "dialog", "aria-label": t("Voice chat with {name}", { name }), "data-phase": phase === "transcribing" ? "thinking" : phase },
-+      (0, import_react34.createElement)(
-         "div",
+-        "div",
 -        { className: "bt-bs-who" },
 -        (0, import_react23.createElement)("span", { className: "bt-bs-name" }, room2.name),
 -        (0, import_react23.createElement)("span", { className: "bt-bs-sub" }, roomSubtitle(room2, roster))
@@ -15514,11 +15746,7 @@ diff --git a/client.js b/client.js
 -        Row,
 -        { label: t("Name"), hint: t("Leave it empty to name the group after its members.") },
 -        (0, import_react23.createElement)(InlineText, { label: t("Group name"), value: room2.named ? room2.name : "", placeholder: t("Name after members"), maxLength: 60, onSave: (name) => update({ name }) })
-+        { className: "bt-voice-orb", style: { "--bt-level": level } },
-+        (0, import_react34.createElement)("span", { className: "bt-voice-ring", "aria-hidden": true }),
-+        (0, import_react34.createElement)("span", { className: "bt-voice-ring bt-voice-ring-2", "aria-hidden": true }),
-+        bot ? (0, import_react34.createElement)(BotMark, { bot, size: 112, state: markState, live: true, gaze: phase === "listening" }) : room2 ? (0, import_react34.createElement)(RoomAvatar, { room: room2, roster, size: 112 }) : null
-       ),
+-      ),
 -      (0, import_react23.createElement)(
 -        Row,
 -        { label: t("Notice"), hint: t("Every member reads it before speaking in this group."), stack: true },
@@ -15645,14 +15873,20 @@ diff --git a/client.js b/client.js
 -    onClick
 -  }, (0, import_react23.createElement)(BotAvatar, { bot, size: 22, badge: false, live: false }), (0, import_react23.createElement)("span", { className: "bt-ng-name" }, bot.name), on && role === "radio" ? (0, import_react23.createElement)(AdminStar) : null);
 -  return (0, import_react23.createElement)(
--    "div",
++  const openSetup = phase === "setup" ? actions.voiceSetup() : null;
++  const caption = phase === "speaking" ? said : heard;
++  const shownNote = note || dictation.note;
++  return (0, import_react34.createElement)(
+     "div",
 -    { className: "bt-set-card bt-ng" },
 -    (0, import_react23.createElement)(
--      "div",
++    { className: "bt-pane bt-voice-pane", style: { left: paneLeft } },
++    (0, import_react34.createElement)(
+       "div",
 -      { className: "bt-set-row bt-bs-row bt-bs-stack" },
 -      (0, import_react23.createElement)("span", { className: "bt-set-copy" }, (0, import_react23.createElement)("span", { className: "bt-bs-label bt-ng-label" }, (0, import_react23.createElement)(AdminStar), t("Choose the group admin"))),
 -      (0, import_react23.createElement)(
-+      (0, import_react34.createElement)("div", { className: "bt-voice-name" }, name),
++      { className: "bt-voice-stage", role: "dialog", "aria-label": t("Voice chat with {name}", { name }), "data-phase": phase === "transcribing" ? "thinking" : phase },
 +      (0, import_react34.createElement)(
          "div",
 -        { className: "bt-ng-picks", role: "radiogroup", "aria-label": t("Group admin") },
@@ -15664,7 +15898,14 @@ diff --git a/client.js b/client.js
 -      { className: "bt-set-row bt-bs-row bt-bs-stack bt-ng-step" },
 -      (0, import_react23.createElement)("span", { className: "bt-set-copy" }, (0, import_react23.createElement)("span", { className: "bt-bs-label" }, t("Who to chat with…"))),
 -      (0, import_react23.createElement)(
--        "div",
++        { className: "bt-voice-orb", style: { "--bt-level": level } },
++        (0, import_react34.createElement)("span", { className: "bt-voice-ring", "aria-hidden": true }),
++        (0, import_react34.createElement)("span", { className: "bt-voice-ring bt-voice-ring-2", "aria-hidden": true }),
++        bot ? (0, import_react34.createElement)(BotMark, { bot, size: 112, state: markState, live: true, gaze: phase === "listening" }) : room2 ? (0, import_react34.createElement)(RoomAvatar, { room: room2, roster, size: 112 }) : null
++      ),
++      (0, import_react34.createElement)("div", { className: "bt-voice-name" }, name),
++      (0, import_react34.createElement)(
+         "div",
 -        { className: "bt-ng-picks", role: "group", "aria-label": t("Members") },
 -        roster.bots.filter((bot) => bot.id !== admin).map((bot) => chip(bot, members.includes(bot.id), () => toggle(bot.id), "checkbox"))
 -      )
@@ -16417,7 +16658,7 @@ diff --git a/client.js b/client.js
      body
    );
  }
-@@ -10150,33 +10150,135 @@ button.bt-us-row:hover{background:var(--bt-hover)}
+@@ -10150,33 +10150,145 @@ button.bt-us-row:hover{background:var(--bt-hover)}
  @keyframes bt-us-drop{from{opacity:0;transform:translateY(-4px) scale(.96)}}
  @keyframes bt-us-fade{from{opacity:0}}
  @keyframes bt-us-cell{from{opacity:0;transform:scale(.5)}}
@@ -16434,6 +16675,7 @@ diff --git a/client.js b/client.js
  var TOKEN_URL = "https://github.com/settings/personal-access-tokens/new";
 -var GitHubMark = () => (0, import_react25.createElement)(
 +var COMPOSIO_KEY_URL = "https://platform.composio.dev/";
++var FEISHU_WEBHOOK_URL = "https://open.feishu.cn/document/client-docs/bot-v3/add-custom-bot";
 +var APPS = [
 +  ["gmail", "Gmail"],
 +  ["googlecalendar", "Google Calendar"],
@@ -16469,13 +16711,21 @@ diff --git a/client.js b/client.js
    { width: 20, height: 20, viewBox: "0 0 16 16", fill: "currentColor", "aria-hidden": true },
 -  (0, import_react25.createElement)("path", { d: "M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" })
 +  (0, import_react36.createElement)("path", { d: "M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" })
++);
++var FeishuMark = () => (0, import_react36.createElement)(
++  "svg",
++  { width: 20, height: 20, viewBox: "0 0 20 20", fill: "currentColor", "aria-hidden": true },
++  (0, import_react36.createElement)("path", { d: "M3.2 6.6c3 .1 6.4 1.5 8.6 3.9-1.9.4-3.5 1.4-4.7 2.9-1.9-.6-3.4-1.9-3.9-3.6-.2-.7-.2-1.5 0-3.2z" }),
++  (0, import_react36.createElement)("path", { d: "M16.8 5.4c-2.9.2-5.6 1.5-7.4 3.4 1.7 1.2 3.1 2.8 3.9 4.9 2.2-1.1 3.8-3.2 4-5.6.1-.9-.1-1.9-.4-2.7z" }),
++  (0, import_react36.createElement)("path", { d: "M8.6 12.1c.9.7 1.7 1.6 2.2 2.7-1.1.2-2.3 0-3.3-.6.2-.8.6-1.5 1.1-2.1z" })
  );
 -var MARKS = { github: GitHubMark };
 -var ABOUT = { github: () => t("Repositories, issues, and pull requests") };
-+var MARKS = { github: GitHubMark, composio: ConnectorIcon };
++var MARKS = { github: GitHubMark, composio: ConnectorIcon, feishu: FeishuMark };
 +var ABOUT = {
 +  github: () => t("Repositories, issues, and pull requests"),
-+  composio: () => t("Gmail, Slack, Calendar, Notion and many more apps, through one Composio key")
++  composio: () => t("Gmail, Slack, Calendar, Notion and many more apps, through one Composio key"),
++  feishu: () => t("Posts into one Feishu group through a custom bot webhook")
 +};
  function statusText2(connector) {
    if (connector.state === "connecting") return t("Connecting…");
@@ -16561,14 +16811,16 @@ diff --git a/client.js b/client.js
 +  const [picking, setPicking] = (0, import_react36.useState)(false);
 +  const [busy, setBusy] = (0, import_react36.useState)(false);
 +  const [error, setError] = (0, import_react36.useState)(null);
++  const [message, setMessage] = (0, import_react36.useState)("");
    const run = (task, after) => {
      setBusy(true);
      setError(null);
-@@ -10184,72 +10184,128 @@ function ConnectorRow({ connector, actions }) {
+@@ -10184,72 +10184,140 @@ function ConnectorRow({ connector, actions }) {
        after?.();
      }, (failure) => setError(failure?.message ?? String(failure))).finally(() => setBusy(false));
    };
 +  const gateway = connector.id === "composio";
++  const sender = connector.kind === "sender";
 +  const [statuses, setStatuses] = (0, import_react36.useState)({});
 +  const appsKey = (connector.apps ?? []).join(",");
 +  (0, import_react36.useEffect)(() => {
@@ -16643,27 +16895,38 @@ diff --git a/client.js b/client.js
 +          setApps(connector.apps ?? []);
 +          setPicking(true);
 +        } }, t("Choose apps")) : null,
-+        on ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", "aria-expanded": bots, onClick: () => setBots((value) => !value) }, bots ? t("Done") : t("Choose Bots")) : null,
++        on && !sender ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", "aria-expanded": bots, onClick: () => setBots((value) => !value) }, bots ? t("Done") : t("Choose Bots")) : null,
 +        on ? (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy, onClick: () => void run(actions.connectorDisconnect(connector.id)) }, t("Disconnect")) : form ? null : (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", onClick: () => setForm(true) }, t("Connect"))
        )
      ),
 -    !on && form ? (0, import_react25.createElement)(
 +    on && gateway && !picking ? (0, import_react36.createElement)(AppStatusList, { apps: connector.apps ?? [], statuses }) : null,
-+    on ? (0, import_react36.createElement)("span", { className: "bt-connector-uses" }, usageText(roster, connector.id)) : null,
++    on && !sender ? (0, import_react36.createElement)("span", { className: "bt-connector-uses" }, usageText(roster, connector.id)) : null,
 +    on && bots ? (0, import_react36.createElement)(ConnectorBots, { connector, roster, actions, run, SwitchRow }) : null,
++    on && sender ? (0, import_react36.createElement)(
++      "div",
++      { className: "bt-connector-form" },
++      (0, import_react36.createElement)("label", { className: "bt-q-field" }, (0, import_react36.createElement)("input", { className: "bt-input", type: "text", value: message, "aria-label": t("Message to send to Feishu"), placeholder: t("Type a message for the Feishu group"), onChange: (event) => setMessage(event.target.value) })),
++      (0, import_react36.createElement)(
++        "div",
++        { className: "bt-connector-form-row" },
++        (0, import_react36.createElement)("span", { className: "bt-connector-link" }),
++        (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy || message.trim() === "" || actions.connectorSend === void 0, onClick: () => void run(actions.connectorSend(connector.id, message), () => setMessage("")) }, t("Send"))
++      )
++    ) : null,
 +    !on && form ? (0, import_react36.createElement)(
        "div",
        { className: "bt-connector-form" },
 -      (0, import_react25.createElement)("label", { className: "bt-q-field bt-secret-field" }, (0, import_react25.createElement)(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: t("GitHub token"), autoFocus: true })),
 -      (0, import_react25.createElement)(
-+      (0, import_react36.createElement)("label", { className: "bt-q-field bt-secret-field" }, (0, import_react36.createElement)(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: gateway ? t("Composio API key") : t("GitHub token"), autoFocus: true })),
++      (0, import_react36.createElement)("label", { className: "bt-q-field bt-secret-field" }, (0, import_react36.createElement)(MaskedInput, { value: token, onChange: setToken, onEnter: connect, label: sender ? t("Feishu webhook URL") : gateway ? t("Composio API key") : t("GitHub token"), autoFocus: true })),
 +      gateway ? (0, import_react36.createElement)(AppPicker, { apps, onChange: setApps, search: token.trim() === "" ? void 0 : search }) : null,
 +      (0, import_react36.createElement)(
          "div",
          { className: "bt-connector-form-row" },
 -        (0, import_react25.createElement)("a", { className: "bt-connector-link", href: TOKEN_URL, target: "_blank", rel: "noopener noreferrer" }, t("Create a token on GitHub")),
 -        (0, import_react25.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy, onClick: () => {
-+        (0, import_react36.createElement)("a", { className: "bt-connector-link", href: gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: "_blank", rel: "noopener noreferrer" }, gateway ? t("Get a Composio API key") : t("Create a token on GitHub")),
++        (0, import_react36.createElement)("a", { className: "bt-connector-link", href: sender ? FEISHU_WEBHOOK_URL : gateway ? COMPOSIO_KEY_URL : TOKEN_URL, target: "_blank", rel: "noopener noreferrer" }, sender ? t("Get a webhook URL in Feishu") : gateway ? t("Get a Composio API key") : t("Create a token on GitHub")),
 +        (0, import_react36.createElement)("button", { type: "button", className: "bt-soft bt-soft-sm", disabled: busy, onClick: () => {
            setForm(false);
            setToken("");
@@ -19694,7 +19957,7 @@ diff --git a/client.js b/client.js
      stopMemberWork: (roomId, botId) => after(call("stop-member-work", { roomId, botId })),
      // Values go out in these requests and never come back in a response.
      secretSet: (payload) => after(call("secret-set", payload)),
-@@ -13819,15 +13819,28 @@ function apply(ctx) {
+@@ -13819,15 +13819,29 @@ function apply(ctx) {
      secretCancel: (requestId) => after(call("secret-cancel", { requestId })),
      secretUpdate: (name, scope) => after(call("secret-update", { name, scope })),
      secretDelete: (name) => after(call("secret-delete", { name })),
@@ -19705,6 +19968,7 @@ diff --git a/client.js b/client.js
 +    connectorAppStatus: (id) => call("connector-app-status", { id }),
      connectorDisconnect: (id) => after(call("connector-disconnect", { id })),
      connectorRetry: (id) => after(call("connector-retry", { id })),
++    connectorSend: (id, text) => after(call("connector-send", { id, text })),
      saveCapability: (capability) => after(call("capability-save", capability)),
      deleteCapability: (name) => after(call("capability-delete", { name })),
      approveCapability: (name) => after(call("capability-approve", { name })),
diff --git a/patches/ds-bot/files/src/client/connector-bots.js b/patches/ds-bot/files/src/client/connector-bots.js
index 21a6d5143..27fd56edd 100644
--- a/patches/ds-bot/files/src/client/connector-bots.js
+++ b/patches/ds-bot/files/src/client/connector-bots.js
@@ -12,7 +12,9 @@ export function ownBots(roster) {
   return (roster?.bots ?? []).filter(bot => !bot.remote && (me === undefined || me === null || bot.ownerId === undefined || bot.ownerId === me))
 }
 
-export const connectedConnectors = roster => (roster?.connectors ?? []).filter(connector => connector.state !== 'off')
+// Connectors that give a Bot tools. A sender (#1263) has none: a per-Bot switch for it would be a
+// choice that never changes anything, so it is not offered.
+export const connectedConnectors = roster => (roster?.connectors ?? []).filter(connector => connector.state !== 'off' && connector.kind !== 'sender')
 
 // Only an explicit false turns it off; no record means on.
 export const isOn = (bot, id) => bot.connectors?.[id] !== false
diff --git a/patches/ds-bot/files/src/host/authz.js b/patches/ds-bot/files/src/host/authz.js
index e46b92211..e317a6de0 100644
--- a/patches/ds-bot/files/src/host/authz.js
+++ b/patches/ds-bot/files/src/host/authz.js
@@ -25,7 +25,7 @@ const NO_ACTOR_ALLOWED = new Set(['auth-redeem', 'auth-whoami', 'auth-invite'])
 // is one of them: there is at most one, and it carries no owner.
 const SHARED_BLOCKED = new Set([
   'secret-set', 'secret-allow', 'secret-cancel', 'secret-update', 'secret-delete',
-  'connector-connect', 'connector-apps', 'connector-app-search', 'connector-app-status', 'connector-disconnect', 'connector-retry', 'bot-connectors',
+  'connector-connect', 'connector-apps', 'connector-app-search', 'connector-app-status', 'connector-disconnect', 'connector-retry', 'connector-send', 'bot-connectors',
   'capability-save', 'capability-delete', 'capability-approve',
   'folders', 'folder-pick', 'folder-list',
   'browser-wait', 'browser-result',
diff --git a/patches/ds-bot/files/test/feishu.test.js b/patches/ds-bot/files/test/feishu.test.js
new file mode 100644
index 000000000..f0755e2a3
--- /dev/null
+++ b/patches/ds-bot/files/test/feishu.test.js
@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict'
+import { randomBytes } from 'node:crypto'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+import { runInNewContext } from 'node:vm'
+import { build } from 'esbuild'
+import { apply } from '../index.js'
+import { feishuPost } from '../src/host/connectors.js'
+import { createNotifier } from '../src/host/notify.js'
+import { fakeContext } from './fake-ctx.js'
+
+// #1263 phase 1: Feishu (Lark) outbound through a custom-bot webhook. Feishu is not an MCP
+// server, so it is a *sender* connector: a definition with no mount, one status and one POST.
+// Its verdict is the `code` in the body, not the HTTP status — a rate limit and a refused
+// signature both arrive as HTTP 200 — which is why the retry policy is notify.js's rather than
+// a second one written next to the mount code.
+
+const TEAM = {
+  version: 1,
+  mainBotIds: ['m1'],
+  revision: 1,
+  bots: { m1: { id: 'm1', sessionId: 'm1', name: 'Chief', role: 'Chief of Staff', instructions: '', createdAt: 1 } },
+  rooms: {},
+  exchanges: [],
+  exchangeTurns: {},
+  questions: {},
+}
+
+const teamHome = () => {
+  const home = mkdtempSync(join(tmpdir(), 'dsb-feishu-'))
+  writeFileSync(join(home, 'state.json'), JSON.stringify(TEAM))
+  return home
+}
+
+const cleanHome = home => rmSync(home, { recursive: true, force: true, maxRetries: 5, retryDelay: 20 })
+
+const answer = (status, body) => ({ status, ok: status >= 200 && status < 300, body, json: async () => body })
+const hookToken = () => randomBytes(8).toString('hex')
+const webhookOf = token => `https://feishu.test/open-apis/bot/v2/hook/${token}`
+
+// The connector is installed with its own API address so a test never talks to Feishu. Every
+// warn call is kept whole, arguments and all: `reason()` only redacts a secret that is already
+// saved, so the argument a message is formatted from is exactly where a pasted webhook leaks.
+function setup({ home = teamHome(), fetch: reply, feishu = { api: 'https://feishu.test' } } = {}) {
+  const warns = []
+  const ctx = fakeContext()
+  const register = ctx.connection.fetch.register
+  ctx.connection.fetch.register = (route) => { ctx.route = route; return register(route) }
+  const original = ctx.logger.warn
+  ctx.logger.warn = (...args) => { warns.push(args); if (original) original(...args) }
+  apply(ctx, { home, feishu })
+  return { ctx, home, warns, reply }
+}
+
+async function call(ctx, endpoint, payload) {
+  const response = await ctx.route.fetch(new Request('http://localhost/api/bot', { method: 'POST', body: JSON.stringify({ endpoint, payload }) }))
+  return response.json()
+}
+
+const row = (view, id = 'feishu') => (view?.connectors ?? view ?? []).find(entry => entry.id === id)
+const said = (warns, needle) => warns.filter(args => args.some(value => String(value).includes(needle)))
+
+// A fake Feishu that records each POST and answers from the script (the last answer repeats).
+function fakeFeishu(script = [answer(200, { code: 0, msg: 'success', data: { message_id: 'om_1' } })]) {
+  const posts = []
+  const queue = [...script]
+  const fetch = async (url, init) => {
+    posts.push({ url, init, body: init?.body === undefined ? undefined : JSON.parse(init.body) })
+    return queue.length > 1 ? queue.shift() : queue[0]
+  }
+  return { posts, fetch }
+}
+
+test('#1263: Feishu is a sender row of its own, off until a webhook is pasted', async (t) => {
+  const { ctx, home } = setup()
+  t.after(async () => { await ctx.dispose(); cleanHome(home) })
+  const state = await call(ctx, 'state', {})
+  assert.deepEqual(row(state.value), { id: 'feishu', name: 'Feishu', state: 'off', kind: 'sender', account: null })
+  // A sender has no tools, so it is not a name a saved capability may take either way.
+  assert.deepEqual(state.value.connectors.map(entry => entry.id), ['github', 'composio', 'feishu'])
+})
+
+test('#1263: connecting posts one test message, turns ready, and keeps the webhook out of state, disk and the log', async (t) => {
+  const token = hookToken()
+  const webhook = webhookOf(token)
+  const feishu = fakeFeishu()
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home, warns } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const connected = await call(ctx, 'connector-connect', { id: 'feishu', token: ` ${webhook} ` })
+  assert.equal(connected.ok, true, JSON.stringify(connected))
+  assert.deepEqual(row(connected.value), { id: 'feishu', name: 'Feishu', state: 'ready', kind: 'sender', account: null })
+
+  assert.equal(feishu.posts.length, 1, 'one test POST on connect')
+  assert.equal(feishu.posts[0].url, webhook)
+  assert.equal(feishu.posts[0].init.method, 'POST')
+  assert.equal(feishu.posts[0].body.msg_type, 'text')
+  assert.equal(typeof feishu.posts[0].body.content.text, 'string')
+  assert.ok(feishu.posts[0].body.content.text.length > 0)
+
+  const state = await call(ctx, 'state', {})
+  assert.ok(!JSON.stringify(state).includes(token), 'the view and the state answer never carry the URL')
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token), 'state.json never carries the URL')
+  assert.deepEqual(said(warns, token), [], 'no warn line carries the URL, in any argument')
+})
+
+test('#1263: a webhook Feishu refuses stays on the row as an error that names no token', async (t) => {
+  const token = hookToken()
+  const feishu = fakeFeishu([answer(400, { code: 19021, msg: 'signature error' })])
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home, warns } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const refused = await call(ctx, 'connector-connect', { id: 'feishu', token: webhookOf(token) })
+  assert.equal(refused.ok, true, JSON.stringify(refused))
+  const refusedRow = row(refused.value)
+  assert.equal(refusedRow.state, 'error', 'the test POST is what decides ready')
+  assert.match(refusedRow.error, /Feishu/)
+  assert.ok(!JSON.stringify(refused).includes(token), 'the refusal never carries the URL')
+  assert.equal(feishu.posts.length, 1)
+
+  const state = await call(ctx, 'state', {})
+  assert.ok(!JSON.stringify(state).includes(token))
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token), 'state.json never carries the URL')
+  assert.ok(said(warns, 'Feishu').length > 0, 'the refusal is logged')
+  assert.deepEqual(said(warns, token), [], 'no warn line carries the URL, in any argument')
+  assert.deepEqual(state.value.secrets.map(secret => secret.name), ['FEISHU_WEBHOOK'])
+})
+
+test('#1263: a Feishu that never answers fails on the deadline instead of hanging', async () => {
+  const started = Date.now()
+  const answerOrNothing = await feishuPost(webhookOf('x'), 'hello', { fetch: () => new Promise(() => {}), timeoutMs: 25 })
+  assert.deepEqual(answerOrNothing, { ok: false, error: 'network' })
+  assert.ok(Date.now() - started < 2_000, 'the deadline, not the fetch, ends the wait')
+})
+
+test('#1263: a rate limit in the body is retried, a refused signature is not', async () => {
+  // Feishu answers HTTP 200 for both, so the classifier — not the status — decides.
+  const limited = fakeFeishu([answer(200, { code: 9499, msg: 'too many request' }), answer(200, { code: 0, msg: 'success', data: { message_id: 'om_2' } })])
+  const retried = createNotifier({ channel: 'feishu', transport: { postMessage: message => feishuPost(webhookOf('x'), message.text, { fetch: limited.fetch }) }, baseDelayMs: 1, delay: async () => {}, log: () => {} })
+  const sent = await retried.send({ key: 'k1', text: 'hello' })
+  assert.equal(sent.state, 'sent')
+  assert.equal(sent.attempts, 2, '9499 is transient: the same call is tried again')
+  assert.equal(limited.posts.length, 2)
+
+  const refused = fakeFeishu([answer(200, { code: 19021, msg: 'signature error' })])
+  const hopeless = createNotifier({ channel: 'feishu', transport: { postMessage: message => feishuPost(webhookOf('x'), message.text, { fetch: refused.fetch }) }, baseDelayMs: 1, delay: async () => {}, log: () => {} })
+  const failed = await hopeless.send({ key: 'k2', text: 'hello' })
+  assert.equal(failed.state, 'failed')
+  assert.equal(failed.permanent, true, 'a refused signature will be refused again')
+  assert.equal(failed.attempts, 1)
+  assert.equal(refused.posts.length, 1)
+  assert.match(failed.error, /19021/)
+})
+
+test('#1263: connector-send posts the text once and records when it last worked', async (t) => {
+  const token = hookToken()
+  const feishu = fakeFeishu()
+  const realFetch = globalThis.fetch
+  globalThis.fetch = feishu.fetch
+  const { ctx, home } = setup({ fetch: feishu.fetch })
+  t.after(async () => { globalThis.fetch = realFetch; await ctx.dispose(); cleanHome(home) })
+
+  const early = await call(ctx, 'connector-send', { id: 'feishu', text: 'hello room' })
+  assert.equal(early.ok, false)
+  assert.match(early.error.message, /Connect Feishu/)
+
+  await call(ctx, 'connector-connect', { id: 'feishu', token: webhookOf(token) })
+  const sent = await call(ctx, 'connector-send', { id: 'feishu', text: '  hello room  ' })
+  assert.equal(sent.ok, true, JSON.stringify(sent))
+  assert.equal(feishu.posts.length, 2, 'the connect probe and this one message')
+  assert.equal(feishu.posts[1].body.content.text, 'hello room')
+  assert.equal(feishu.posts[1].url, webhookOf(token))
+
+  const saved = JSON.parse(readFileSync(join(home, 'state.json'), 'utf8')).connectors.feishu
+  assert.equal(typeof saved.lastOkAt, 'number')
+  assert.equal(typeof saved.connectedAt, 'number')
+  assert.ok(!readFileSync(join(home, 'state.json'), 'utf8').includes(token))
+
+  const empty = await call(ctx, 'connector-send', { id: 'feishu', text: '   ' })
+  assert.equal(empty.ok, false, 'an empty message is refused before anything is posted')
+  assert.equal(feishu.posts.length, 2)
+})
+
+// --- Settings → Connectors, the Feishu row ---
+
+const { outputFiles } = await build({
+  stdin: {
+    contents: "export { ConnectorsPage } from './src/client/connectors.js'",
+    resolveDir: fileURLToPath(new URL('..', import.meta.url)),
+  },
+  bundle: true, format: 'cjs', platform: 'browser', write: false, logLevel: 'silent',
+  external: ['react', 'react-dom', '@deepseek-ai/dsh-client-ui-primitives'],
+})
+const h = (type, props, ...children) => ({ type, props: { ...props, children } })
+let states = []
+const react = {
+  createElement: h, Fragment: Symbol('F'), useEffect() {}, useLayoutEffect() {},
+  useState: v => [states.length > 0 ? states.shift() : (typeof v === 'function' ? v() : v), () => {}],
+  useMemo: f => f(), useRef: current => ({ current }), useCallback: f => f, useSyncExternalStore: (_s, get) => get(),
+}
+const browser = { exports: {} }
+runInNewContext(outputFiles[0].text, {
+  module: browser, exports: browser.exports, document: { hidden: false }, navigator: { language: 'en' }, localStorage: { getItem: () => null, setItem() {} },
+  window: { matchMedia: () => ({ matches: false }) }, setTimeout, clearTimeout,
+  require: (name) => {
+    if (name === 'react') return react
+    if (name === 'react-dom') return { createPortal: node => node }
+    if (name === '@deepseek-ai/dsh-client-ui-primitives') return {}
+    throw new Error(`Unexpected platform module ${name}`)
+  },
+})
+const { ConnectorsPage } = browser.exports
+
+const expand = (node) => {
+  if (node === null || node === undefined || typeof node === 'boolean') return null
+  if (Array.isArray(node)) return node.map(expand)
+  if (typeof node !== 'object') return node
+  if (typeof node.type === 'function') return expand(node.type(node.props))
+  return { ...node, props: { ...node.props, children: expand(node.props.children) } }
+}
+const all = (node, out = []) => { if (node && typeof node === 'object') { if (Array.isArray(node)) node.forEach(child => all(child, out)); else { out.push(node); all(node.props?.children, out) } } return out }
+const text = node => (node === null || node === undefined ? '' : Array.isArray(node) ? node.map(text).join('') : typeof node === 'object' ? text(node.props.children) : String(node))
+
+const actions = { connectorConnect: async () => {}, connectorDisconnect: async () => {}, connectorRetry: async () => {}, connectorSend: async () => {} }
+const renderRow = (connector, given = []) => {
+  states = [...given]
+  const tree = expand(h(ConnectorsPage, { roster: { connectors: [connector], bots: [], self: { memberId: 'me' } }, actions }))
+  states = []
+  return tree
+}
+
+test('#1263: the Feishu row asks for a webhook URL and links to Feishu, not to GitHub', () => {
+  // form open, so the masked input and the link are drawn
+  const tree = renderRow({ id: 'feishu', name: 'Feishu', state: 'off', kind: 'sender', account: null }, [true, false, '', [], false, false, null])
+  const input = all(tree).find(node => node.type === 'input')
+  assert.equal(input.props['aria-label'], 'Feishu webhook URL')
+  const link = all(tree).find(node => node.type === 'a')
+  assert.doesNotMatch(link.props.href, /github\.com/, 'the row must not send the owner to GitHub for a Feishu webhook')
+  assert.match(link.props.href, /feishu/i)
+  assert.doesNotMatch(text(tree), /GitHub token/)
+})
+
+test('#1263: a connected Feishu offers no per-Bot switch, because it has no tools', () => {
+  const tree = renderRow({ id: 'feishu', name: 'Feishu', state: 'ready', kind: 'sender', account: null })
+  const labels = all(tree).filter(node => node.type === 'button').map(text)
+  assert.ok(labels.includes('Disconnect'), labels.join('|'))
+  assert.ok(!labels.includes('Choose Bots'), 'a sender has no tools, so a per-Bot switch would do nothing')
+  assert.doesNotMatch(text(tree), /On for all \d+ Bots/)
+})