wz-heng/dsh-feishu-bridge
40Last commit Aug 14, 2026
dsh-feishu-bridge DSH plugin
This plugin provides a bridge between Feishu (Lark) and DeepSeek Harness (dsh). It allows users to interact with dsh agents through a Feishu bot, supporting commands like /new, /sessions, /switch, /current, /quiet, /verbose, and /help. It features fail-closed security with allowlists, one-time card nonces, and sticky sessions. The plugin can be installed as a dsh plugin or run standalone.
How to install the dsh-feishu-bridge DSH plugin
dsh plugin --profile <name> add /path/to/dsh-feishu-bridgeThis source command needs manual review. Copying does not run it.
dsh-feishu-bridge DSH plugin data source
dsh-feishu-bridge DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-feishu-bridge DSH plugin can do
- Execute dsh agent turns via Feishu chat messages
- Manage multiple sessions with commands like /new, /sessions, /switch, /current
- Choose between verbose and quiet output modes
- Support both WebSocket and Webhook transports
- Enforce fail-closed security with allowlists and nonces
- Install as a dsh plugin with automatic process management
Where the dsh-feishu-bridge DSH plugin fits
- Interact with a DeepSeek Harness agent from a Feishu chat without leaving the app
- Summarize files in a workspace by sending a message to the bot
- Manage multiple agent sessions and switch between them
- Onboard new team members to use dsh via a familiar chat interface
Who the dsh-feishu-bridge DSH plugin is for
- DeepSeek Harness users who want a chat-based interface
- Teams using Feishu for collaboration and needing easy access to dsh agents
- Developers and operators who need to run dsh tasks without a terminal
dsh-feishu-bridge DSH plugin limitations
- No incremental streaming: the bot waits for the full turn to complete before replying
- No tool-approval flow: the bundled composition runs tools without interactive approval
- Sessions are tied to the chat that created them and cannot be accessed by other chats
dsh-feishu-bridge DSH plugin: from the repository README
Quoted from the wz-heng/dsh-feishu-bridge README, the upstream source of the dsh-feishu-bridge DSH plugin. Copyright remains with the original authors.
English | [中文](README.zh.md) [](https://github.com/wz-heng/dsh-feishu-bridge/actions/workflows/ci.yml) [](https://github.com/wz-heng/dsh-feishu-bridge/actions/workflows/canary.yml) The SDK canary runs daily against the *latest* `deepseek-harness-sdk` and `lark-channel-sdk` releases (not the pinned versions this repo ships), so a breaking upstream change gets caught within a day instead of silently bit-rotting. A Feishu (Lark) channel bridge for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (`dsh`): message a Feishu bot, it runs a `dsh` agent turn, the reply comes back to the chat. **This is an independent community project. It is not built, maintained, or endorsed by DeepSeek.** It drives `dsh` entirely through its public Python SDK (`deepseek-harness-sdk`) — a subprocess boundary, no forked/patched harness code. ## What this is - A production-grade Feishu bot bridge (fail-closed allowlist, one-time card nonces, per-chat verbosity, sticky sessions, both `ws` and `webhook` t
Read the full READMERepository license: MIT
dsh-feishu-bridge DSH plugin questions
How do I install dsh-feishu-bridge as a dsh plugin?
First, clone the repo and set up a Python virtual environment with dependencies. Then, set the required environment variables. Finally, run `dsh plugin --profile <name> add /path/to/dsh-feishu-bridge`. The plugin will be available the next time you boot the profile.
How do I get my open_id for the allowlist?
Send a message to the bot. It will be rejected because your open_id is not in the allowlist. Check the server log for a line like "Feishu: rejecting message from unauthorized open_id=ou_xxxxxxxxxxxxxxxx". Copy that open_id into the FEISHU_ALLOWED_OPEN_IDS environment variable and restart.
Can I use this bridge without a public URL?
Yes, set FEISHU_TRANSPORT=ws to use WebSocket mode. This does not require a public URL. For webhook mode, you need a public URL.
What environment variables are required to run the bridge?
You must set DEEPSEEK_API_KEY, FEISHU_APP_ID, FEISHU_APP_SECRET, and FEISHU_ALLOWED_OPEN_IDS. Optionally, you can set FEISHU_TRANSPORT (default ws), DSH_PROVIDER, DSH_MODEL, etc. See the configuration reference in the README.
How secure is this bridge?
It is fail-closed by default: no allowlist means no one can use the bot. It uses one-time card nonces, signature verification in webhook mode, and session ownership per chat. Run it with least privilege, as the default composition has full access to bash and file editing.