配置键	默认	说明
`groupPolicy`	`open`	群聊触发策略：`open`（免 @ 全触发）/ `mention` / `keywords` / `reply`
`groupKeywords`	`["lark","bot"]`	`keywords` 模式下的触发词
`agentPreset`	`ptc`	Agent preset（shipped：standard/ptc/minimal/cordis，或 GUI 自建 id；历史别名 `code` 会自动映射为 `ptc`）
`permissionMode`	`danger-full-access`	权限：read-only / workspace-write / danger-full-access
`streaming.enabled`	`false`	CardKit 流式卡片（开=逐字打印）
`reactions.enabled`	`true`	表情回执
`allowlist`	`[]`	open_id 白名单，空 = 所有人可对话
`denyList`	`[]`	命令前缀拒绝兜底
`workspaceRoot`	``	桥会话工作区根目录（空 = process.cwd()）
`attachments.retentionHours`	`168`	入站图片/文件的保留时长（小时，默认 7 天；`0` = 永久保留）。默认存系统临时目录，到期自动清扫
`attachments.dir`	``	入站媒体根目录覆盖（空 = 系统 tmpdir；重启生效）

凭据（appId/appSecret）存放在 DSH credentials 服务，不进配置文件；/lark setup 扫码自动写入。

Key	Default	Meaning
`groupPolicy`	`open`	group trigger: open / mention / keywords / reply
`agentPreset`	`ptc`	agent preset (standard/ptc/minimal/cordis or custom; legacy alias `code` maps to `ptc`)
`permissionMode`	`danger-full-access`	read-only / workspace-write / danger-full-access
`streaming.enabled`	`false`	CardKit streaming cards
`reactions.enabled`	`true`	reaction receipts
`allowlist`	`[]`	open_id allowlist (empty = everyone)
`denyList`	`[]`	command-prefix deny
`workspaceRoot`	``	workspace root for bridge sessions
`attachments.retentionHours`	`168`	retention (hours) for inbound images/files (default 7 days; `0` = keep forever). Stored under the OS temp dir and swept by age
`attachments.dir`	``	inbound media root override (empty = OS tmpdir; applies after reload)

Credentials (appId/appSecret) live in the DSH credentials service, never in config files.

dsh-lark-link

インストール