DeepSeek Harness (DSH) uses a plugin-based architecture. Developers often need to interact with agents through WeCom. Existing solutions typically require configuring a public URL, message encryption/decryption, or trusted IP whitelists. dsh-plugin-wecom-bot focuses on solving these issues by establishing a long-lived connection and implementing simple message routing.

Core Features

The plugin sends and receives messages over the WeCom “Intelligent Bot” long-lived connection. It treats text sent to the bot as a task, dispatches it to the DSH agent for execution, and returns the result to WeCom.

Key capabilities include:

  • WebSocket long-lived connection mode: Establishes connections based on the official protocol and supports streaming replies.
  • No public network dependency: The long-lived connection is initiated outbound by the plugin, eliminating the need to configure a public URL, message encryption/decryption, or trusted IP whitelists.
  • Session modes: Supports per-user (one session per member) and per-message (a new agent for each message).
  • Workspace and session management: Supports switching the working directory in chat and managing multiple named sessions.
  • Approval forwarding: Forwards privilege-operation requests such as sandbox elevation to WeCom, where approvals can be completed by replying with commands.
  • Protocol compatibility: Handles ALPN handshake issues using the ws library, resolving compatibility between Node.js’s default WebSocket client and the WeCom gateway.

Installation and Activation

Run the following commands in the plugin source directory.

  1. Install dependencies (the plugin depends on the ws library):
    pnpm install
  1. Add it to the web profile:
    dsh plugin --profile web add .

After installation, restart dsh web for the changes to take effect.

Configuration

Set the environment variables before starting dsh web to enable it. You need to provide the BotID and Secret obtained from the WeCom admin console.

export WECOM_BOT_ID="wwxxxxxxxxxxxxxx"
export WECOM_BOT_SECRET="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
dsh web

Usage

Startup and Verification

After startup, the logs should show a successful connection:

wecom-bot: connecting
wecom-bot: subscribed
wecom-bot: connected

Send a command to the bot through a direct chat in WeCom, for example:

帮我总结一下这个目录下 README.md 的主要内容

Workspace Switching

In per-user mode, you can switch the agent’s working directory. Each WeCom member’s directory is remembered independently.

  • Show workspace: #ws or 查看工作区
  • Switch workspace: #ws <名称或路径>
  • Show current directory: #cwd

Example:

#ws productv4-web

Session Management

In per-user mode, you can create and manage multiple named sessions.

  • List sessions: #sessions or 会话列表
  • Create session: #new <名称>
  • Switch session: #use <名称>
  • Delete session: #rm <名称>

Permission Approval

When the agent needs to perform an operation that requires privilege escalation (such as sandbox elevation), it initiates an approval. The approval request is forwarded to WeCom, and you can respond directly in the chat.

Example:

🔐 需要审批 #1
回复「同意 #1」批准，或「拒绝 #1」拒绝

Supported reply commands include:
* Approve: 同意, 批准, 允许, 是, ok, y, optionally with an ID #1.
* Reject: 拒绝, 不同意, 否, no, n, optionally with an ID #1.

Configuration Options

Configuration key Default Description
botId Environment variable WECOM_BOT_ID Intelligent Bot BotID
botSecret Environment variable WECOM_BOT_SECRET Intelligent Bot Secret
sessionMode per-user per-user: one agent session per member; per-message: a new agent for each message
cwd Process cwd The agent’s working directory
maxReplyChars 6000 Maximum number of characters in the final reply; excess is truncated
forwardAllApprovalsToWecom true Whether to forward approval requests from any session to WeCom for handling
approvalTimeoutMs 0 Approval timeout (milliseconds); 0 = no timeout

Known Limitations

  • Long-lived connection limit: A single bot allows only one long-lived connection at a time. If another connection is established elsewhere, this connection receives a disconnected_event and is disconnected.
  • Message rate: Limited by WeCom to approximately 30 messages/minute.
  • File support: Voice messages are processed as transcribed text; image/file messages are not processed yet (they will be ignored).
  • ALPN handshake: The WeCom long-lived connection gateway requires the TLS ClientHello to include ALPN http/1.1. This plugin uses the ws library to address the issue; if using another client, note this limitation.
  • Reply truncation: Final replies exceeding maxReplyChars are truncated.

References