@alexanys/feishu-bridge
BConnect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning.
Install
agr install @alexanys/feishu-bridge --target claudeWrites 8 files into .claude/skills/, pinned to git-509b7a4b.
- .claude/skills/feishu-bridge/.env.example
- .claude/skills/feishu-bridge/.gitignore
- .claude/skills/feishu-bridge/README.md
- .claude/skills/feishu-bridge/SKILL.md
- .claude/skills/feishu-bridge/bridge.mjs
- .claude/skills/feishu-bridge/package-lock.json
- .claude/skills/feishu-bridge/package.json
- .claude/skills/feishu-bridge/setup-service.mjs
Document
name: feishu-bridge description: Connect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning.
Feishu Bridge
Bridge Feishu bot messages to Clawdbot Gateway over local WebSocket.
Architecture
Feishu user → Feishu cloud ←WS→ bridge.mjs (local) ←WS→ Clawdbot Gateway → AI agent
- Feishu SDK connects outbound (no inbound port / public IP needed)
- Bridge authenticates to Gateway using the existing gateway token
- Each Feishu chat maps to a Clawdbot session (
feishu:<chatId>)
Setup
1. Create Feishu bot
- Go to open.feishu.cn/app → Create self-built app → Add Bot capability
- Enable permissions:
im:message,im:message.group_at_msg,im:message.p2p_msg - Events: add
im.message.receive_v1, set delivery to WebSocket long-connection - Publish the app (create version → request approval)
- Note the App ID and App Secret
2. Store secret
mkdir -p ~/.clawdbot/secrets
echo "YOUR_APP_SECRET" > ~/.clawdbot/secrets/feishu_app_secret
chmod 600 ~/.clawdbot/secrets/feishu_app_secret
3. Install & run
cd <skill-dir>/feishu-bridge
npm install
FEISHU_APP_ID=cli_xxx node bridge.mjs
4. Auto-start (macOS)
FEISHU_APP_ID=cli_xxx node setup-service.mjs
launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist
Diagnostics
# Check service
launchctl list | grep feishu
# Logs
tail -f ~/.clawdbot/logs/feishu-bridge.err.log
# Stop
launchctl unload ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist
Group chat behavior
Bridge replies only when: user @-mentions the bot, message ends with ?/?, contains request verbs (帮/请/分析/总结…), or calls the bot by name. Customize the name list in bridge.mjs → shouldRespondInGroup().
Environment variables
| Variable | Required | Default |
|---|---|---|
FEISHU_APP_ID | ✅ | — |
FEISHU_APP_SECRET_PATH | — | ~/.clawdbot/secrets/feishu_app_secret |
CLAWDBOT_CONFIG_PATH | — | ~/.clawdbot/clawdbot.json |
CLAWDBOT_AGENT_ID | — | main |
FEISHU_THINKING_THRESHOLD_MS | — | 2500 |
Trustgrade B
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- passType matchnot applicable to this artifact type
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- warnLicenseno SPDX license detected
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-509b7a4b41ad2026-07-31