work-channel-binding

# Work Channel Binding Use this skill when the user/main agent wants to configure a work channel or when Main Agent recommends one. Workspace conventions: use the `## Tools` section of `AGENTS.md` for local paths, environment variable names and tool aliases; do not create `TOOLS.md`. Preserve existing workspace content. Users manually delete legacy `TOOLS.md` / `HEARTBEAT.md` after upgrading; channel setup does not migrate or clean them up. A subagent automatically receives only `AGENTS.md`; read `OFB_ENV.md` or other task-specific files explicitly when needed and authorized. Supported channels: - Feishu - WeCom ## Channel Plugin Prerequisites Before collecting account credentials, confirm the selected channel plugin is installed and enabled. - Feishu: follow `./skills/work-channel-binding/docs/feishu.md` and the current OpenClaw Feishu setup path. - WeCom: installs the plugin by running: ```bash WISEFLOW_CONFIRM_WECOM_INSTALL=confirmed ./skills/work-channel-binding/scripts/install-wecom-channel.sh ``` After installing a channel plugin, tell the user that Gateway may need a restart before binding verification succeeds. ## Required Flow 1. Ask the user to choose Feishu or WeCom. 2. Show the relevant tutorial: - `./skills/work-channel-binding/docs/feishu.md` - `./skills/work-channel-binding/docs/wecom.md` 3. Confirm channel plugin readiness. For WeCom, if the plugin is not installed yet, run `WISEFLOW_CONFIRM_WECOM_INSTALL=confirmed ./skills/work-channel-binding/scripts/install-wecom-channel.sh` from Main Agent after user confirmation; do not ask the user to run `npx` manually. 4. Collect account information: - account id; - account name; - app/bot id; - app/bot secret; - target agent for each account; - `dmPolicy` for private chats; - `groupPolicy` for group chats. If the user is unsure, default both policies to `open`. Explain that even when group chat policy is `open`, group chats only respond to messages that mention the bot. Do not repeat secrets back in summaries; scripts must redact them in output. 5. Run a binding check: - `python3 ./skills/work-channel-binding/scripts/check-work-channel-bindings.py` 6. Prepare a dry-run plan: - `python3 ./skills/work-channel-binding/scripts/prepare-work-channel-binding.py --channel <feishu|wecom> --plan-file <plan.json> --account-id <account> --account-name <name> --agent-id <agent> --app-id <id> --app-secret <secret> --dm-policy open --group-policy open` 7. Show a redacted summary and ask for user's confirmation. 8. Apply only after confirmation: - `python3 ./skills/work-channel-binding/scripts/apply-work-channel-binding.py --plan-file <plan.json>` 9. Ask for Gateway restart confirmation. 10. Before restarting, record followup: - `python3 ./skills/work-channel-binding/scripts/record-pending-followup.py --reason work-channel-binding` 11. Restart Gateway only after user confirmation: - `WISEFLOW_CONFIRM_GATEWAY_RESTART=confirmed ./skills/work-channel-binding/scripts/restart-gateway-confirmed.sh work-channel-binding` 12. On next session, complete followup: - `python3 ./skills/work-channel-binding/scripts/complete-pending-followup.py` ## Gateway Logs for Verification Resolve the installed CLI from `AGENTS.md` → `Tools` and `OFB_ENV.md`; `openclaw` below is shorthand, not a guarantee that the command is on the terminal PATH. The default macOS/Linux tarball entry is `~/xiaobei/bin/openclaw`; Windows PowerShell uses `& "$env:USERPROFILE\xiaobei\bin\openclaw.cmd"`. A source installation can use `node "<PROJECT_ROOT>/openclaw/dist/index.js"`; do not run `pnpm openclaw` against a production Gateway. - `openclaw logs --limit 20` reads the last 20 lines without following. Use `openclaw logs --limit 200 --plain` for a bounded diagnostic window and correlate channel/account, timestamps and errors with the binding being checked. - `openclaw logs --follow` is for explicitly requested interactive watching. Do not leave an automated check following indefinitely. - Read the actual `logging.file`; the product default is `<stateDir>/logs/gateway.log`, with warning/error records by default. Missing successful-connection or delivery info lines is not evidence of failure. - When the Gateway is unavailable, read its configured file directly. For Linux service startup failures, use `journalctl --user -u openclaw-gateway.service -n 100 --no-pager`; do not use journalctl on macOS, Windows or inside a container. - Reading logs does not authorize a config change, restart or test message. Redact credentials, customer identifiers and message content before reporting findings. ## First Work Channel Binding Reminder If this is the first work channel binding, check whether `it-engineer` and enabled/soon-to-be-enabled `hrbp` already have direct bindings. If not, ask whether the user wants to bind them together. ### 给 main agent 与 IT engineer 各绑一个 Work channel 账号 首次启用 Work channel 时，若 `openclaw.json` 里**没有为 main agent 和 IT engineer 绑定 Work channel**，**建议用户多申请几个 account，分别给 main agent 和 IT engineer 各绑一个**，再继续后续流程。 要点： - 飞书 / 企业微信的交互界面体验与功能丰富度都比微信强太多，main agent 与 IT engineer 走 Work channel 能显著提升日常协作与运维体验。 - main agent 与 IT engineer 应各用**独立的 account**（不要共用同一个），便于权限隔离与消息分流。 - 若用户已规划好账号则按其规划；若没有，主动建议其多申请两个 account 并分别绑定。 - 沿有这一步不阻塞当前绑定流程，但作为首次启用的强烈建议提出。 Never print secrets back to the user.