dsh-office-cli: Securely expose official WeCom, DingTalk, and Feishu office CLIs using a DSH tool.

Introduction¶

If you have built agents on DeepSeek Harness (DSH), you have likely encountered requirements such as having the agent send a WeCom message, check a Feishu document, or create a DingTalk approval. While the official CLIs possess these capabilities, allowing the model to execute commands directly via a shell implies that authentication commands, credential parameters, and arbitrary paths are exposed to the model, making permission boundaries difficult to control.

Below is an introduction to dsh-office-cli, a plugin that securely exposes the three official office CLIs for WeCom, DingTalk, and Feishu/Lark through a single native DSH tool.

What is it¶

dsh-office-cli is maintained by meliwanx and licensed under MIT, with the current version being 0.1.0. It is an outbound (outgoing) office capability plugin, not just another chat-to-agent bridge: it allows DSH agents to operate on messages, contacts, documents, spreadsheets, calendars, meetings, tasks, approvals, emails, and other vendor-supported office services, while authentication, API discovery, and compatibility remain the responsibility of the official CLIs.

Please note that the README states the current target is DeepSeek Harness 0.1.0-rc.7, and it is still in the Developer Preview stage.

Core Features¶

The plugin consists of the following components:

1. office_cli: Performs argv-level execution of the three official CLIs (wecom, dingtalk, feishu) without a shell, enabling the model to call subcommands without needing shell access.

2. office_cli_doctor: Performs version availability checks only and does not read credentials.

3. dsh-office: Terminal-side doctor and interactive authentication assistant.

4. Built-in DSH Skill: Supports progressive schema discovery and dry-run-first change operations.

Regarding security mechanisms, the plugin defaults to intercepting authentication, configuration, upgrade, and listening commands, as well as intercepting credential parameters, raw API modes, and paths that attempt to escape the workspace. Write operations, destructive operations, and unknown commands require one-time approval from DSH. Credentials are retained in the respective vendor CLI’s own keychain or encrypted storage, and the tools exposed to the model do not accept authentication commands or flags containing keys.

The official CLIs and authentication entry points for the three platforms are as follows:

Installation and Usage¶

Requirements are Node.js >=22.19 and DeepSeek Harness. The installation is divided into two steps:

dsh plugin --profile web add github:meliwanx/dsh-office-cli
dsh plugin --profile web exec dsh-office install

The first command installs the plugin itself. Since the plugin package does not contain an installation script, the second explicit command installs a specific version of the official CLI to $DSH_HOME/office-cli, shared by all DSH profiles and isolated from global npm.

If you only need a single platform:

dsh plugin --profile web exec dsh-office install wecom
dsh plugin --profile web exec dsh-office install dingtalk
dsh plugin --profile web exec dsh-office install feishu

You can also skip the installation assistant and install the official CLI in PATH or as a dependency of a neighboring profile. The CLI resolution order is: explicit plugin configuration → $DSH_OFFICE_HOME / $DSH_HOME/office-cli → adjacent npm packages → PATH.

After installation, perform diagnostics first, then start DSH:

dsh plugin --profile web exec dsh-office doctor
dsh --profile web --dump-config
dsh --profile web

Authentication and Configuration¶

Authentication is handled via the terminal-side assistant, and credentials remain in the storage of the respective vendor CLIs:

dsh plugin --profile web exec dsh-office auth wecom
dsh plugin --profile web exec dsh-office auth dingtalk
dsh plugin --profile web exec dsh-office auth feishu

When you need to adjust the default configuration, rewrite the bundle line with id: dsh-office-cli in the profile’s cordis.patch.yml and fully specify its configuration:

- id: dsh-office-cli
  config:
    approval: writes       # writes | all | off
    timeoutMs: 120000
    killGraceMs: 2000
    maxOutputBytes: 262144
    maxArgs: 128
    maxArgLength: 65536
    allowRawApi: false
    workspaceFilesOnly: true
    # wecomCommand: /opt/bin/wecom-cli
    # dingtalkCommand: /opt/bin/dws
    # feishuCommand: /opt/bin/lark-cli

approval controls which operations require approval, with a default of writes; allowRawApi is disabled by default; workspaceFilesOnly is enabled by default. If the official CLI is not in the default location, you can use wecomCommand, dingtalkCommand, or feishuCommand to explicitly specify the path.

Use Cases and Notes¶

Version 0.1 focuses on the direction of DSH → Office Platform. Inbound chat channels require long connections, persistent chat/session mapping, replay protection, remote approval, and media streaming. The README explicitly states that these belong to the scope of future independent channel-* plugins and are not implemented in this set of foreground CLI tools. If you are looking for “integrating an IM into an agent as an entry point,” this plugin does not solve that problem; however, if you want “letting the agent actively operate on the office platform,” this is the right tool for you.

There are two points regarding security that must be clear:

1. workspaceFilesOnly is just a parameter-level defense, not an OS sandbox. For high-security deployments, it is recommended to use dedicated containers/accounts and vendor apps with minimal permissions. See the project’s SECURITY.md for details.

2. The plugin runs with the permissions of the current DSH process. The official CLI is installed in a shared directory and isolated from global npm, but it can still access resources that the current user can access. Before installation, it is recommended to check the source code and license: the plugin itself is MIT, while the various official CLIs pulled by the installation assistant are independent software with their own licenses. See THIRD_PARTY_NOTICES.md in the project for details.

Local development process:

npm install
npm run check
dsh plugin --profile web add .

Conclusion¶

The philosophy of dsh-office-cli is quite restrained: it does not reimplement vendor APIs but only provides an argv-level exposure with default interception and approval mechanisms. Authentication and compatibility are left to the official CLIs, and the security boundary is entrusted to DSH’s approval process. If you are looking to let DSH agents securely use WeCom, DingTalk, or Feishu, you might want to take a look.

• Directory Page: https://www.skillhub.cn/plugins/meliwanx/dsh-office-cli
• GitHub: https://github.com/meliwanx/dsh-office-cli