dsh-office-cli

Across the Chinese enterprise office landscape, WeCom, DingTalk, and Feishu/Lark each maintain their own CLI toolchain, yet a DeepSeek Harness agent had no secure, unified path to operate messages, documents, calendars, approvals, or mail on those platforms. dsh-office-cli fills that gap: it is not another chat-to-agent bridge but an outbound office-capability plugin that lets a DSH agent drive all three vendors through one native tool with shell-free argv execution, while each official CLI continues to own authentication, API discovery, and backward compatibility.

The design is safety-first. office_cli dispatches across wecom, dingtalk, and feishu in a single call surface; office_cli_doctor performs version-only availability checks without touching any credential; dsh-office provides terminal-side diagnostics and an interactive auth helper. A bundled DSH Skill enables progressive schema discovery and dry-run-first mutations. Sensitive commands such as auth, config, upgrade, and listener are blocked by default, as are credential-bearing arguments, raw API mode, and workspace-escaping paths. Writes, destructive operations, and any unrecognized command require a one-time DSH human approval before they proceed.

This plugin suits teams already running agents inside DeepSeek Harness whose daily workflows lean on WeCom, DingTalk, or Feishu. Administrators and security engineers no longer need to build a separate adapter per vendor or hand secrets to the model side. Once the official CLIs are locally authenticated, agents can collaborate across platforms in the same workspace, and high-security deployments can further tighten the blast radius via dedicated containers and least-privilege vendor applications.