dsh-lark

One-Line Description

Connect DeepSeek Harness (DSH) Agent to Feishu/Lark chat—assign tasks in chat, view thinking and tool call processes, switch workspaces and models, and handle questions/planning/approvals all within the current chat; when needed, multiple bots can also collaborate in the same group via @ handoffs.

Core Capabilities

• Assign tasks to Agent directly in Feishu chat, with thinking process, tool calls, and results written back to chat as native thinking process messages, final answer as a separate message
• Use /ws to list available workspaces, use /cd to switch to a specified directory—each conversation × current directory corresponds to an independent Agent session
• Use /model card to switch the model for the current conversation (preserving context), or use one-liner /model use <provider/model> for direct switch
• Use /new to start a fresh session in place (clearing context, preserving workspace and model), use /sessions to list resumable sessions in the current workspace and resume with one click
• Use /permission card to select permission presets—question answering, plan confirmation, and tool approval all handled via interactive cards in chat (single select / multi-select / text)
• File transfer: files sent by users to chat land in .dsh-lark/inbox/<timestamp>-<message-hash>/ in the workspace for Agent to read; files sent by Agent are delivered directly in private chats, but each file in group chat triggers an approval card
• Multi-bot collaboration: dsh-lark-channel add <name> attaches a second bot instance; they hand off turns in the same group using @, default continuous bot turns limit is 6

Technical Implementation

• Language: TypeScript (ESM, package.json:5), bundled via tsdown into lib/index.js, also provides dsh-lark-channel CLI
• Key Dependencies: @deepseek-ai/cordis ^4.0.1 (peer dep, plugin host framework), @larksuite/channel ^0.4.1 (Feishu IM long-lived connection transport), @deepseek-ai/schemastery ^3.18.1 (config schema validation), qrcode-terminal ^0.12.0 (first-time QR scan)
• Architecture Pattern: Cordis function-plugin form—src/index.ts exports name='lark-channel', inject=['agents'], Config Schema and apply(ctx, config); cordis.patch.yml inserts this line into DSH profile bundles, mounted by host at startup; CLI dsh-lark-channel is a separate process, uses its own provision script to write independent profile + launchd/systemd user service for single-instance bots
• Entry Files: DSH profile entry src/runtime.ts (apply + startup guidance), CLI entry src/cli.ts (re-exports only provision.ts's main), QR scan + credential persistence see src/onboarding.ts

Use Cases

Suitable for users already running Agent in DSH and wanting to continue tasks via mobile/Feishu client: let DSH Agent advance work in Feishu private chat or group without staying at the terminal; or let multiple Agents share a set of project directories—combine workspace switching with multi-bot collaboration, let one bot make changes while another reviews. People needing instant chat distribution, file transfer, and approval retrieval will use this frequently; if you just want to run local commands or pure web UI, this plugin won't help.

Prerequisites & Compatibility

Installation

dsh plugin --profile web add github:omdsh-dev/dsh-lark

Alternatively, run npm i -g dsh-lark-channel + dsh-lark-channel start to generate QR code in terminal for standalone mode.

Configuration Options

FAQ

Q: After installation, how do I get the bot alive in Feishu?

A: After adding to DSH profile via dsh plugin --profile web add github:omdsh-dev/dsh-lark, start via dsh web; or run npm i -g dsh-lark-channel + dsh-lark-channel start, terminal prints QR code, scan with Feishu App to complete app creation. Credentials go to host secrets service, not plaintext settings.

Q: Bot only responds when @'d in group by default, how to change to passive response in group too?

A: Set requireMention to false in config and restart service. Note this is a session-level switch; who can add the bot is still determined by the Feishu app's visibility scope; changing this won't expand visibility.

Q: I switched workspace mid-way or don't want .dsh-lark in workspace git history, what to do?

A: Plugin reminds to add .dsh-lark/ to .gitignore when first file lands, but plugin itself won't modify this file. Inbound files are grouped by message, add-only no-delete (src/files.ts:42-46), cleanup is your own decision—explicit design, channel won't clean for you.

Q: Agent wants to send file back in group chat, do I have to click approval card every time?

A: Direct send in private chat, approval card pops for every file in group chat, and there's no switch to turn off group chat approval—hardcoded at source level (src/config.ts:177-180, README:159), positioned as "official backdoor for prompt injection exfiltration chain".

Q: Can I configure multiple bots to collaborate with each other?

A: Yes. dsh-lark-channel add reviewer adds a second Feishu app, forming independent profile line; after QR scan bots each have settings, credentials, and sessions. Add them to same group, use @ for turn handoff, default continuous bot turns limit is up to 9 (any human speech resets). dsh-lark-channel remove <name> can remove, name and credentials kept for next add.

Q: I want to clear context to start fresh, but keep workspace and model, how?

A: Use /new. It starts a fresh session in place, clears message history, workspace and current model stay unchanged. To fully switch context (including workspace) use /cd <new-path>.

Q: How long after modifying config options does it take effect?

A: Config is read at startup, modifications require service restart to take effect (README.md:165). On macOS it's launchctl kickstart -k, on systemd Linux systemctl --user restart dsh-lark.

Getting Started Difficulty

Beginner — enable with one DSH plugin command, or after npm i -g one start command to get started; most common "scan QR and use" path doesn't require understanding internal structure. Advanced option tuning requires understanding concepts like allowlists, session granularity, thinking process format.

Known Issues & Limitations

• Group chat file approval count hardcoded to 3: In group chat, max 3 pending approval files can be attached simultaneously, 4th is directly rejected with prompt to wait for previous results; this limit is not configurable (README.md:161-162 / src/config.ts:179-182)
• Group chat approval always persists, no switch: Direct send in private, approval card pops for every file in group chat (src/config.ts:177-180), source code explicitly refuses to provide off option to avoid prompt injection exfiltration chain backdoor
• macOS / Linux behavioral difference: macOS uses launchd, systemd Linux uses systemd-user; Windows and non-systemd Linux CLI entry start degrades to foreground execution (src/provision.ts:11-14,290-296)
• Image attachments not sent to model by default: Images sent in chat land on disk by default but not passed as visual content to model, need to confirm model supports vision then enable attachImages in config—otherwise one screenshot can drag down entire session (src/config.ts:128-143)
• Document attachments have no online preview: pdf / xlsx / docx after upload can only be downloaded, not previewed—this is a limitation from upstream @larksuite/channel fixing ordinary files as stream type upload (README.md:163)
• Voice messages only land on disk, no transcription: Plugin doesn't do speech recognition (README:164)
• Outbound file paths truncated to within workspace: Any text shown to people or model only says "relative path within workspace", including send_file failure's own filesystem error line; intentional to avoid exfiltrating host page prefix during prompt injection
• Maintenance commands queued per session: Two users clicking maintenance commands during idle time execute one queue per Agent in sequence, timeout fails (src/maintenance.ts:1-19)
• Config changes require restart to take effect: Cordis reads config at startup, runtime changes to cordis.patch.yml won't auto-reload, need to restart host service (README.md:165)

简体中文 | English

把你正在使用的 DeepSeek Harness（DSH）接进飞书。

直接在聊天里给 Agent 派任务、看执行过程、切换工作区和模型。遇到提问、计划确认或工具审批，也不用回到终端，直接在飞书里处理。需要时，还能把多个 Agent 放进同一个群里协作。

快速开始

npm i -g dsh-lark-channel
dsh-lark-channel start

终端会显示二维码。用飞书扫码完成应用创建，然后私聊机器人，或在群里 @ 它即可开始。

启动命令会在首次安装依赖前写好 profile 的 pnpm 构建策略：未经批准的依赖构建脚本一律警告并跳过，而不是让安装失败；protobufjs 那个只打印提示的 postinstall 还会被按名字记为跳过。因此不需要手工执行 pnpm approve-builds。

不想装到全局也可以直接跑，只是之后每条命令都要带 npx：

npx dsh-lark-channel@latest start

如果还没有安装 DeepSeek Harness，先运行：

npm i -g @deepseek-ai/dsh

无需公网服务器，也无需配置回调地址。

为什么值得装

• 不用守着终端：从飞书发起任务，随时查看进度和结果。
• 不只是聊天机器人：可以切换真实工作区和模型，执行 Harness 已有的命令与工具。
• 关键决定仍由你控制：模型提问、计划审阅和工具审批都会回到当前聊天，按钮或文字都能作答。
• 上下文不会混在一起：不同聊天、话题和工作区可以保留各自的会话。
• Agent 之间也能协作：一条命令添加更多机器人，让它们在群聊中通过 @ 交接回合，并用轮数上限防止无限对话。

可以这样开始

先看看当前状态和可用工作区：

/status
/ws
/cd my-project
/model

然后直接派一个任务：

检查这个项目为什么构建失败。先给我计划，需要操作时让我确认。

Agent 的执行过程会显示在飞书中；需要你参与时，会发送提问、计划或审批卡片。渠道自带文案会按每位读者的飞书语言显示中文或英文。

主要能力

常用命令

日常运行

macOS 和采用 systemd 的 Linux 会使用用户级后台服务，关闭终端后仍可运行：

dsh-lark-channel status
dsh-lark-channel logs -f
dsh-lark-channel restart
dsh-lark-channel stop

用 npx 启动的话，这些命令同样要带 npx dsh-lark-channel@latest 前缀——工具会按你实际的启动方式打印提示，读到什么就能直接粘贴。

升级：

dsh-lark-channel upgrade

它会装上最新的 CLI 并在新版本上重启机器人。用 npx 的话不需要这一步，npx dsh-lark-channel@latest start 本来就是最新。有新版本时，start 和 status 会顺带提醒你一行。

连接异常时，插件会在限额和退避控制下自动重建 WebSocket，避免进程仍在但机器人已经静默离线。

添加更多 Agent

给第二个飞书应用添加一套独立的 Agent：

dsh-lark-channel add reviewer

命令会写入新实例、重启服务并显示二维码。扫码后，这个机器人拥有自己的设置、App Secret 和 session，不会与第一个机器人共享上下文。

把两个机器人加入同一个群后，它们可以通过 @ 把回合交给对方。例如，让一个 Agent 完成修改后 @ 另一个 Agent 复核，后者也可以 @ 回去要求调整。默认最多连续进行 6 个机器人轮次；任何人发言都会恢复额度。需要移除时：

dsh-lark-channel remove reviewer

移除会保留该实例的凭据和设置，之后用同一个名字重新添加即可恢复。

如果希望飞书和 dsh web 共用同一个 profile：

dsh plugin --profile web add dsh-lark-channel@latest
dsh web

权限与高级选项

• 飞书应用的可用范围决定谁能找到机器人；senderAllowlist、groupAllowlist 和 approvers 可以进一步收窄权限。
• workspaceRoots 可以限制聊天中允许切换到的目录。
• sessionScope 支持 chat、chat-thread 和 chat-sender 三种会话粒度。
• instance 用于命名额外的机器人实例；第一个机器人保持未命名，以兼容已有设置和会话。
• botPeers 可以限制允许对话的机器人，botHops 控制连续机器人轮次，默认是 6。
• 会改变状态的卡片绑定原聊天，转发到其他聊天后不能操作原会话。
• 部署提供 credentials 服务时，扫码得到的 App Secret 会存入其中；旧版本写在 settings 中的 secret 会在下次启动时自动迁移。
• 图片附件默认关闭；只有确认当前模型支持视觉时，才应开启 attachImages。
• receiveFiles 默认开：入站文件落在当前会话工作区的 .dsh-lark/inbox/<时间戳>-<消息哈希>/ 下，只增不删，清理是你的决定；首次落地时会提醒把 .dsh-lark/ 加进 .gitignore，但不会替你去改这个文件。
• sendFiles 默认开：私聊直接发，群聊每次弹审批卡片，卡片上是文件在工作区内的位置、工作区名和大小（不是宿主的绝对路径——群里每个人都会看到它）；没有关闭群聊审批的开关，因为那会是提示注入外泄链的官方后门。
• 出站文件的路径一律只说"工作区内的相对位置"，宿主绝对前缀不会出现在任何一句给人或给模型看的话里——包括读取失败时文件系统自己那句报错（/get 的回复和 send_file 给模型的报错都在内）。失败分支恰恰是提示注入能主动触发的那条。
• 一个群同时最多挂 3 个待审文件：群聊发送会在问群之前就把整个文件读进内存，好让群里批的和最终发出去的是同一份，所以待审数量必须有上限。第 4 次会被直接拒绝并告诉模型等前面几个先有结果。这个数字不可配置，调大等于同时买回内存风险和审批疲劳。
• 审批结束卡会记录决定人：回调未带姓名时，渠道会尽力从当前聊天成员名单解析；没有成员查询权限、查询失败或成员已不在群内时仍安全显示 open_id，绝不会影响审批或文件发送。
• 单文件上限默认 20 MiB，收发分别由 maxReceiveFileBytes / maxSendFileBytes 配置；文档类产物（pdf / xlsx / docx）在聊天里只能下载、没有在线预览，这是上游 SDK 把普通文件固定按 stream 类型上传带来的已知取舍。
• 语音消息只落盘，不会被转写成文字。
• 配置在启动时读取，修改后需要重启服务。

环境要求

• Node.js ^22.19.0 || >=24
• DeepSeek Harness 0.1.0-rc.6 或更新版本
• 飞书或 Lark 租户

原生思考过程需要飞书 PC 7.70、移动端 7.74 或更新版本；旧客户端可以使用 output: 'stream'。

开发

pnpm install
pnpm test
pnpm build

License

BSD-3-Clause

本项目是非官方社区插件，与 DeepSeek、飞书或 Lark 不存在隶属、授权或背书关系。