Credentials and multi-project configuration

Pass app credentials through the process environment. Never commit them:

export DSH_LARK_APP_ID='cli_xxxxxxxxxxxxxxxx'
export DSH_LARK_APP_SECRET='xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'

Edit ~/.dsh/profiles/lark/cordis.patch.yml. A later profile patch replaces the Bridge's entire config, so keep every non-default value together:

- id: dsh-lark-bridge
  config:
    allowedOpenIds:
      - ou_owner_xxxxxxxxx
    requireMention: true
    groupSessionScope: thread
    defaultProjectId: web
    cardPreset: standard
    nativeImageInput: false
    progressCards: true
    provideUserQuestions: true
    enableApprovals: true
    projects:
      - id: web
        name: Web App
        chatIds:
          - oc_web_topic_group_xxxxxxxxx
        allowedOpenIds:
          - ou_owner_xxxxxxxxx
        cwd: /absolute/path/to/web-app
        workspaceRoot: /absolute/path/to/web-app
        inboundDir: .dsh-lark-bridge/inbox
        cardPreset: developer
      - id: ios
        name: iOS App
        chatIds:
          - oc_ios_topic_group_xxxxxxxxx
        cwd: /absolute/path/to/ios-app
        workspaceRoot: /absolute/path/to/ios-app
        inboundDir: .dsh-lark-bridge/inbox
        cardPreset: compact

The global and Project-specific user allowlists are restrictive intersections: when a Project list is non-empty, an operator must pass both. Project lists do not widen the global policy.

Safe ID bootstrap:

Leave the allowlists empty and start the Bridge.
Have the intended user send a DM or group mention.
Copy the rejected sender and chat IDs from the local log.
Add only those IDs and restart.

Do not enable allowAllUsers or allowAllGroups in production. Comma-separated environment allowlists are also supported:

export DSH_LARK_ALLOWED_OPEN_IDS='ou_xxx,ou_yyy'
export DSH_LARK_ALLOWED_CHAT_IDS='oc_xxx'

Validate the composed profile before starting:

dsh --profile lark --dump-config
dsh --profile lark

Configuration reference

Field	Default	Meaning
`allowedOpenIds`	`[]`	Bridge-wide user allowlist; all users are denied by default
`allowedChatIds`	`[]`	Legacy/single-Project group allowlist; Project `chatIds` are preferred
`allowAllUsers` / `allowAllGroups`	`false`	Development-only open-policy switches
`requireMention`	`true`	Require a bot mention in groups
`groupSessionScope`	`thread`	`thread` recommended; alternatives are `sender` and `chat`
`defaultProjectId`	first Project	Project selected initially in DM
`projects`	one `default` Project	Project bindings for chat, model, cwd, files, access, and card view
`provider` / `model`	Harness selection	Global model route; each Project may override it
`cwd`	process cwd	Global Agent working directory default
`workspaceRoot`	`cwd`	Outermost directory from which `lark_deliver` may send files
`inboundDir`	`.dsh-lark-bridge/inbox`	Private attachment directory inside `workspaceRoot`
`cardPreset`	`standard`	Global card density; each Project may override it
`nativeImageInput`	`false`	Also inject received images through the Harness attachment service
`progressCards`	`true`	Use one mutable live execution card per turn
`progressUpdateMs`	`1000`	Card update throttle, minimum 250 ms
`maxInboundFileBytes`	`20 MiB`	Per-attachment streaming limit
`maxOutboundFileBytes`	`30 MiB`	Per-file limit; long Markdown truncates on a UTF-8 boundary
`interactiveTimeoutMs`	`10 min`	Approval and question timeout
`provideUserQuestions`	`true`	Register the Lark question provider
`enableApprovals`	`true`	Route approvals for Lark-owned Sessions to Lark
`cardBodyMaxChars`	`12000`	Card output preview, from 1000 to 28000 characters

Each Project supports id, name, chatIds, allowedOpenIds, provider, model, cwd, workspaceRoot, inboundDir, and cardPreset.

dsh-lark-bridge

AI 分析

安裝

說明文件

Credentials and multi-project configuration

Configuration reference