[Feature]: Add Feishu/Lark messaging channel #82

Request type

New feature

Problem

Operators whose teams use Feishu or Lark cannot reach AI Factory Operations Agent from their chat tool. The chart only provides native Slack messaging.

Two open pull requests implement the same Feishu/Lark channel: #74 and #81. They modify the same files, so only one can merge as is. They also differ in user-facing values and access behavior, and the value names become a public interface once either PR merges. Maintainers need to settle these choices before merging.

Proposed solution

Add an optional, default-off Feishu/Lark channel through OpenClaw's official @openclaw/feishu plugin, pinned to the chart's OpenClaw release. The plugin connects outbound over a persistent connection, so no ingress is required. Credentials come from an existing Secret. Direct messages are limited to allowlisted open_id values. A group message is admitted only when the chat is listed, the sender is allowlisted, and the message @mentions the bot. The plugin's workplace tools stay disabled.

Decisions to settle across #74 and #81:

• Group allowlist value name: allowedGroupIds in Add optional Feishu and Lark messaging #74, groupChatIds in Add optional native Feishu/Lark messaging #81.
• Group sessions: Add optional Feishu and Lark messaging #74 gives each sender in a group chat its own session (group_sender). Add optional native Feishu/Lark messaging #81 shares one session per group chat.
• View enforcement: Add optional Feishu and Lark messaging #74 relies on the conversation's default View policy. Add optional native Feishu/Lark messaging #81 forces View for every Feishu run, so a mode changed from the web UI cannot apply to Feishu messages.
• Plugin integrity: Add optional Feishu and Lark messaging #74 installs by version only. Add optional native Feishu/Lark messaging #81 also verifies npm's recorded integrity against a pinned value. Add optional native Feishu/Lark messaging #81 keeps the npm spec install because a path install loses OpenClaw's trusted-plugin status.
• Init container: Add optional Feishu and Lark messaging #74 hardens its security context, but it also passes the app credentials to the plugin install step. Add optional native Feishu/Lark messaging #81 passes no credentials to that step, but its security context is not hardened.
• Validation: Add optional Feishu and Lark messaging #74 rejects wildcard and blank group IDs. Add optional native Feishu/Lark messaging #81 rejects a Slack DM scope of main, which would merge all Feishu DMs into one shared session.
• Additional settings in Add optional native Feishu/Lark messaging #81:
  • a sender-name lookup switch, with documentation that lookups need contact:contact.base:readonly;
  • a streaming switch;
  • a scheduler opt-in, openclaw.cron.enabled, for delivering scheduled reports to Feishu. It has the same shape as in Fix Teams preinstallation, allowlists, and scheduled delivery #76;
  • documentation of the egress hosts and log-based troubleshooting.

Out of scope for both:

• Feishu Edit approvals. The plugin has no native approval client and does not dispatch card actions to plugin interactive handlers.
• A Feishu-specific queue mode. OpenClaw 2026.6.10 rejects plugin channels under messages.queue.byChannel.

Additional context

• Add optional Feishu and Lark messaging #74: Add optional Feishu and Lark messaging
• Add optional native Feishu/Lark messaging #81: Add optional native Feishu/Lark messaging, validated end to end against a live Feishu tenant
• Related:
  • Add optional native Microsoft Teams messaging #71 and Fix Teams preinstallation, allowlists, and scheduled delivery #76: Teams channel and scheduler opt-in
  • Add optional authenticated Alertmanager webhook receiver #78: Alertmanager webhook receiver
• OpenClaw Feishu channel documentation

Code of Conduct

• I agree to follow the AI Factory Operations Agent Code of Conduct.
• I searched open issues and found no duplicate.