← Browse

@alexanys/feishu-bridge

B

Connect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning.

skillclaude

Install

agr install @alexanys/feishu-bridge --target claude

Writes 8 files into .claude/skills/, pinned to git-509b7a4b.

  • .claude/skills/feishu-bridge/.env.example
  • .claude/skills/feishu-bridge/.gitignore
  • .claude/skills/feishu-bridge/README.md
  • .claude/skills/feishu-bridge/SKILL.md
  • .claude/skills/feishu-bridge/bridge.mjs
  • .claude/skills/feishu-bridge/package-lock.json
  • .claude/skills/feishu-bridge/package.json
  • .claude/skills/feishu-bridge/setup-service.mjs

Document


name: feishu-bridge description: Connect a Feishu (Lark) bot to Clawdbot via WebSocket long-connection. No public server, domain, or ngrok required. Use when setting up Feishu/Lark as a messaging channel, troubleshooting the Feishu bridge, or managing the bridge service (start/stop/logs). Covers bot creation on Feishu Open Platform, credential setup, bridge startup, macOS launchd auto-restart, and group chat behavior tuning.

Feishu Bridge

Bridge Feishu bot messages to Clawdbot Gateway over local WebSocket.

Architecture

Feishu user → Feishu cloud ←WS→ bridge.mjs (local) ←WS→ Clawdbot Gateway → AI agent
  • Feishu SDK connects outbound (no inbound port / public IP needed)
  • Bridge authenticates to Gateway using the existing gateway token
  • Each Feishu chat maps to a Clawdbot session (feishu:<chatId>)

Setup

1. Create Feishu bot

  1. Go to open.feishu.cn/app → Create self-built app → Add Bot capability
  2. Enable permissions: im:message, im:message.group_at_msg, im:message.p2p_msg
  3. Events: add im.message.receive_v1, set delivery to WebSocket long-connection
  4. Publish the app (create version → request approval)
  5. Note the App ID and App Secret

2. Store secret

mkdir -p ~/.clawdbot/secrets
echo "YOUR_APP_SECRET" > ~/.clawdbot/secrets/feishu_app_secret
chmod 600 ~/.clawdbot/secrets/feishu_app_secret

3. Install & run

cd <skill-dir>/feishu-bridge
npm install
FEISHU_APP_ID=cli_xxx node bridge.mjs

4. Auto-start (macOS)

FEISHU_APP_ID=cli_xxx node setup-service.mjs
launchctl load ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist

Diagnostics

# Check service
launchctl list | grep feishu

# Logs
tail -f ~/.clawdbot/logs/feishu-bridge.err.log

# Stop
launchctl unload ~/Library/LaunchAgents/com.clawdbot.feishu-bridge.plist

Group chat behavior

Bridge replies only when: user @-mentions the bot, message ends with ?/, contains request verbs (帮/请/分析/总结…), or calls the bot by name. Customize the name list in bridge.mjsshouldRespondInGroup().

Environment variables

VariableRequiredDefault
FEISHU_APP_ID
FEISHU_APP_SECRET_PATH~/.clawdbot/secrets/feishu_app_secret
CLAWDBOT_CONFIG_PATH~/.clawdbot/clawdbot.json
CLAWDBOT_AGENT_IDmain
FEISHU_THINKING_THRESHOLD_MS2500

Trustgrade B

  • passBody integrity

    Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.

  • passType matchnot applicable to this artifact type

    Whether the artifact is really the kind of thing its metadata claims it is.

  • passFreshness

    How long since the source repository was last pushed to.

  • passPrompt injection

    Scans the artifact's own text for instructions aimed at your agent rather than at you.

  • warnLicenseno SPDX license detected

    Whether the source repository declares an SPDX license permissive enough to redistribute.

How the grade is calculated

Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:

  • Aevery check passed
  • Bone warning
  • Ctwo warnings
  • Dprompt injection or body integrity failed, or three warnings
  • Fone of those failed, and something else is wrong

These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.

Versions

  • git-509b7a4b41ad2026-07-31