[Feature] Support @bot mentions and agent replies in Feishu document comments

Feature Area

Platform (Feishu, DingTalk, Telegram, Slack, etc.)

Problem or Motivation

cc-connect currently handles Feishu IM mentions, but it cannot handle a bot mention inside a Feishu document comment.

We tested this with cc-connect v1.5.1-beta.1 in Feishu WebSocket mode. Feishu successfully delivers the document comment event to cc-connect:

event type: drive.notice.comment_add_v1, not found handler

Because the Feishu adapter does not register a handler for drive.notice.comment_add_v1, the event is not converted into a cc-connect message, never reaches the configured agent, and cannot be replied to in the document.

Document comments are a useful collaboration surface for coding and data-analysis agents: a user can mention the bot next to the exact paragraph, table, report, or decision that needs analysis without copying the context into a chat.

Proposed Solution

Add opt-in support for Feishu document comment mentions.

Suggested behavior:

1. Register and handle drive.notice.comment_add_v1 for the Feishu platform.
2. Process only comments that explicitly mention the current bot.
3. Reuse the existing allow_from authorization policy and add an optional document/file allowlist if needed.
4. Fetch the triggering comment and a bounded amount of relevant document context, then pass them to the configured agent as a normal turn.
5. Reply to the triggering comment through the Feishu Drive/Docs comment API.
6. Use an isolated session key such as feishu-doc:<file-token>:<comment-id> so unrelated documents and comment threads do not share context.
7. Deduplicate redelivered events, ignore comments created by the bot itself, and prevent reply loops.
8. Keep the feature disabled by default, for example:

[projects.platforms.options]
enable_document_comments = true
document_context_max_chars = 12000

The exact option names and session shape can follow the project's conventions.

Security and Privacy Considerations

• Fail closed when the sender is not authorized.
• Do not fetch an entire document by default; use bounded context around the comment.
• Respect the app's existing Feishu document permissions rather than attempting to broaden access.
• Do not include document contents in logs.
• Treat document text as untrusted agent input because it can contain prompt injection.
• Preserve event idempotency because Feishu retries unacknowledged or failed events.

Alternatives Considered

• Forward document events through a separate service into cc-connect Bridge/Webhook, then reply through Feishu OpenAPI. This works but duplicates Feishu authentication, authorization, session routing, deduplication, and reply handling.
• Ask users to copy the document excerpt into a Feishu chat. This loses the document-native collaboration context.

Implementing this in the existing Feishu platform adapter appears to be the cleanest long-term design.

Acceptance Criteria

• Mentioning the bot in a Feishu document comment creates exactly one agent turn.
• The response is posted as a reply in the same comment thread.
• Non-mention comments and unauthorized users do not trigger the agent.
• Redelivered events and bot-authored replies do not create duplicate turns or loops.
• Existing Feishu IM, thread isolation, Card 2.0, and allowlist behavior remain unchanged.
• WebSocket mode is covered; webhook mode should either work as well or be explicitly documented.

Willingness to Contribute

• I'd be willing to submit a PR for this feature.

We are willing to implement this and contribute tests and documentation after maintainers confirm the preferred event-to-session and reply abstraction.