Every field can come from the plugin config: block or an environment variable (env is the friendlier default).

Config	Env var	Default	Meaning
`appId`	`LARK_APP_ID`	—	Feishu app id (`cli_...`)
`appSecret`	`LARK_APP_SECRET`	—	Feishu app secret
`tenant`	`LARK_TENANT`	`feishu`	`feishu` (feishu.cn) or `lark` (larksuite.com)
`provider`	`DSH_LARK_PROVIDER`	dsh default	LLM provider route
`model`	`DSH_LARK_MODEL`	dsh default	Model for created agents
`workspaceRoot`	`DSH_LARK_WORKSPACE_ROOT`	`~/dsh-lark-workspaces`	Root for per-chat folders
`allowDm`	`DSH_LARK_ALLOW_DM`	`true`	Respond in direct messages
`requireMention`	`DSH_LARK_REQUIRE_MENTION`	`true`	In groups, require an `@`-mention
`turnTimeoutMs`	`DSH_LARK_TURN_TIMEOUT_MS`	`600000`	Hard deadline for one agent turn; timeout disposes the stuck session
`allowedChats`	`DSH_LARK_ALLOWED_CHATS`	`[]`	Chat ids allowed to use the bot (comma-separated). Empty = no group allowed (fail-closed)
`allowedUsers`	`DSH_LARK_ALLOWED_USERS`	`[]`	User open_ids allowed to DM the bot (comma-separated). Empty = only the owner may DM
`accessMode`	`DSH_LARK_ACCESS_MODE`	`workspace`	Default access tier: `read-only`, `workspace`, or `full`
`extraPresets`	`DSH_LARK_EXTRA_PRESETS`	`{}`	Extra `id:preset-name` pairs
`ssoGatedPresets`	`DSH_LARK_SSO_GATED_PRESETS`	`[]`	Preset ids that must pass host SSO on switch and on every turn
`ssoCheckCmd`	`DSH_LARK_SSO_CHECK_CMD`	—	SSO status command, parsed as argv without a shell
`ssoOkMarker`	`DSH_LARK_SSO_OK_MARKER`	`Authenticated`	Required text in successful SSO output
`presetModels`	`DSH_LARK_PRESET_MODELS`	`{}`	`presetId:provider:model` routes

Credentials are read in this order: inline config → environment variables → the file written by the registration wizard.

@bihangchi9/lark-agent-bridge

インストール