DSH DingTalk

文件接收与回传：支持机器人单聊接收不超过 20 MB 的附件，并通过会话专属 send_file / send_image 工具将工作区内的文件或图片回传原单聊或群聊。文件格式、权限、平台限制和使用方式见中文文件指南。

简体中文 | English

Connect local DeepSeek Harness (DSH) to DingTalk over a Stream connection, without a public inbound endpoint.

Node.js ^22.19.0 || >=24.0.0 is required. The bot works only while local dsh web is running and the computer is online; it does not keep running in the cloud after sleep, network loss, or process exit.

AI Native setup (recommended)

An AI agent can inspect the setup plan, execute explicitly approved non-secret steps, and resume from a checkpoint. QR URLs, Client Secrets, and plaintext /bind codes are excluded from machine JSON and checkpoints and are assigned to a separate terminal handoff that you operate yourself.

read-only inspection and plan
→ explicit dependency, plugin, and configuration approvals
→ AI execution with a non-secret checkpoint
→ private human QR/Secret/binding handoff
→ AI checkpoint resume
→ explicit dsh web start or restart
→ doctor plus one real-message acceptance check

You can give this prompt to an AI coding agent:

Install the DingTalk connector using the AI Native setup flow in this README. Run the read-only plan first and show me the plan and non-secret answers before apply. Never request, read, or record a Client ID, Client Secret, QR URL, Device Code, /bind code, or owner staff ID. At a private checkpoint, pause so I can continue in a separate local terminal, then validate with JSON resume and doctor --json. Never automatically start, stop, or restart dsh web. If JSON resume returns restart_required only because process inspection is unknown, for example because sandboxed ps is unavailable, do not restart or loop resume automatically. Keep the existing dsh web running, validate it with doctor --json and one real direct message, and record the process-inspection limitation. Ask me to restart only if validation fails or the process predates the applied configuration.

Resolve the stable release version first, then pin every step to that version:

npx @dingtalk-real-ai/dsh-dingtalk@latest --version

Record the output as <version>, then generate a strictly read-only plan. Use default for a new installation; select an account explicitly when several already exist.

npx @dingtalk-real-ai/dsh-dingtalk@<version> setup --plan --json --account default

The plan only reads local configuration and the process table, and runs dsh --version and pnpm --version. It never installs, writes files, creates binding codes, or controls processes. Its stable output includes planId, actions, required approvals, and an answerTemplate. Replace every null with an explicit choice and save the result as JSON:

{
  "schemaVersion": 1,
  "planId": "setup-plan-<from-plan>",
  "accountId": "default",
  "approvals": {
    "installDsh": false,
    "installPnpm": false,
    "installPlugin": true,
    "writeProfile": true
  },
  "features": {
    "dwsEnabled": false,
    "imageMode": "auto",
    "senderAccess": "owner",
    "allowedSenders": [],
    "groupAccess": "none",
    "groupAllowlist": []
  }
}

Keep DSH or pnpm installation approval false when the plan does not request that action. Set it to true only after explicit user approval; machine mode never assumes “yes.” Apply the plan with:

…