
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
opencode-chat-channel
Advanced tools
opencode plugin — multi-channel bot (Feishu/Lark, WeCom) with extensible ChatChannel interface
An opencode plugin that connects instant messaging bots to opencode AI via a unified multi-channel architecture.
Currently supported: Feishu (Lark) via WebSocket long connection — no public IP required.
Skeleton ready: WeCom (企业微信) — see src/channels/wecom/index.ts.
User sends message (Feishu / WeCom / ...)
↓ Channel adapter (WebSocket / HTTP callback / ...)
chat-channel plugin (this repo)
↓ client.session.prompt()
opencode AI (Sisyphus)
↓ text reply
User receives reply
open_id / user ID) gets their own persistent opencode sessionSince this is an opencode plugin, opencode handles installation automatically via npm. No scripts needed.
opencode.jsonEdit the opencode config file and add the plugin:
| Platform | Path |
|---|---|
| macOS / Linux | ~/.config/opencode/opencode.json |
| Windows | %APPDATA%\opencode\opencode.json |
{
"plugin": [
"opencode-chat-channel@latest"
]
}
opencode will pull and install the package automatically on next startup.
Add CHAT_CHANNELS to your opencode .env file to control which channels are active:
| Platform | Path |
|---|---|
| macOS / Linux | ~/.config/opencode/.env |
| Windows | %APPDATA%\opencode\.env |
# ~/.config/opencode/.env
# Enable Feishu only (recommended to start)
CHAT_CHANNELS=feishu
# Enable multiple channels at once
# CHAT_CHANNELS=feishu,wecom
# Leave unset or empty = auto mode: any channel with valid credentials starts automatically
# CHAT_CHANNELS=
Then configure credentials for each enabled channel (see sections below).
See the Feishu Configuration section below.
im:message (read/send messages)im:message.group_at_msg (receive group @ messages, optional)Receive Message v2.0 (im.message.receive_v1)App ID (non-sensitive, store in .env):
# macOS / Linux: ~/.config/opencode/.env
# Windows: %APPDATA%\opencode\.env
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
# Optional: custom opencode API URL (default: http://localhost:4321)
# OPENCODE_BASE_URL=http://localhost:4321
App Secret — choose the method for your platform:
| Platform | Method | Command / Location |
|---|---|---|
| macOS | Keychain (recommended) | security add-generic-password -a chat-channel -s opencode-chat-channel -w <secret> -U |
| Windows | .env file | Add FEISHU_APP_SECRET=<secret> to %APPDATA%\opencode\.env |
| Linux | .env file | Add FEISHU_APP_SECRET=<secret> to ~/.config/opencode/.env |
| All platforms | Environment variable | Set FEISHU_APP_SECRET=<secret> before launching opencode |
Priority: environment variable → macOS Keychain →
.envfile value (already loaded as env var). The plugin tries each in order and uses the first one found.
⚠️ If you store the secret in
.env, ensure the file has restricted permissions:
- macOS/Linux:
chmod 600 ~/.config/opencode/.env- Windows: right-click the file → Properties → Security → restrict to your user only
macOS Keychain (verify):
security find-generic-password -a chat-channel -s opencode-chat-channel -w
opencode
You should see in the logs:
[feishu] 飞书机器人已启动(长连接模式),appId=cli_xxx***
chat-channel 已启动,活跃渠道: feishu
The plugin uses a ChatChannel interface. To add a new channel:
src/channels/<name>/index.ts implementing ChatChannel and exporting a ChannelFactorysrc/index.ts → CHANNEL_FACTORIES array// src/channels/myapp/index.ts
import type { ChatChannel, ChannelFactory } from "../../types.js";
class MyAppChannel implements ChatChannel {
readonly name = "myapp";
async start(onMessage) { /* connect, call onMessage on each msg */ }
async send(target, text) { /* send reply */ }
}
export const myappChannelFactory: ChannelFactory = async (client) => {
// read credentials, return null if not configured
return new MyAppChannel(...);
};
// src/index.ts — add to CHANNEL_FACTORIES
import { myappChannelFactory } from "./channels/myapp/index.js";
const CHANNEL_FACTORIES: ChannelFactory[] = [
feishuChannelFactory,
myappChannelFactory, // ← add here
];
Q: Plugin starts but bot receives no messages
Q: Replies are slow
Q: How to reset conversation history
用户发消息(飞书 / 企业微信 / ...)
↓ 渠道适配器(WebSocket 长连接 / HTTP 回调 / ...)
chat-channel 插件(本仓库)
↓ client.session.prompt()
opencode AI (Sisyphus)
↓ 回复文本
用户收到回复
本项目是 opencode 插件,opencode 通过 npm 自动管理安装,无需额外脚本。
opencode.json编辑 opencode 配置文件,在 plugin 数组中添加:
| 平台 | 路径 |
|---|---|
| macOS / Linux | ~/.config/opencode/opencode.json |
| Windows | %APPDATA%\opencode\opencode.json |
{
"plugin": [
"opencode-chat-channel@latest"
]
}
下次启动 opencode 时会自动拉取并安装。
在 opencode 的 .env 文件中配置 CHAT_CHANNELS,指定要开启哪些渠道:
| 平台 | 路径 |
|---|---|
| macOS / Linux | ~/.config/opencode/.env |
| Windows | %APPDATA%\opencode\.env |
# ~/.config/opencode/.env
# 只开启飞书(初始推荐)
CHAT_CHANNELS=feishu
# 同时开启多个渠道
# CHAT_CHANNELS=feishu,wecom
# 留空或不配置 = 自动模式:凭证存在的渠道自动启用
# CHAT_CHANNELS=
然后配置对应渠道的凭证(见下方各渠道配置说明)。
参见下方各渠道的配置说明。
im:message(读取/发送消息)im:message.group_at_msg(接收群组 @ 消息,按需)接收消息 v2.0(即 im.message.receive_v1)App ID(非敏感,明文存 .env):
# macOS / Linux: ~/.config/opencode/.env
# Windows: %APPDATA%\opencode\.env
FEISHU_APP_ID=cli_xxxxxxxxxxxxxxxx
# 可选:自定义 opencode API 地址(默认:http://localhost:4321)
# OPENCODE_BASE_URL=http://localhost:4321
App Secret—按使用的平台选择存储方式:
| 平台 | 方式 | 命令 / 路径 |
|---|---|---|
| macOS | 钥匙串(推荐,不落盘明文) | security add-generic-password -a chat-channel -s opencode-chat-channel -w <secret> -U |
| Windows | 写入 .env 文件 | 在 %APPDATA%\opencode\.env 中添加 FEISHU_APP_SECRET=<secret> |
| Linux | 写入 .env 文件 | 在 ~/.config/opencode/.env 中添加 FEISHU_APP_SECRET=<secret> |
| 所有平台 | 环境变量 | 启动 opencode 前设置 FEISHU_APP_SECRET=<secret> |
读取优先级:环境变量 → macOS 钥匙串 →
.env文件(已在插件启动时自动读入环境变量)。 插件依次尝试,找到第一个有效值即停止。
⚠️ 如果将 Secret 写入
.env,建议限制文件权限:
- macOS/Linux:
chmod 600 ~/.config/opencode/.env- Windows:右键文件 → 属性 → 安全,限制为仅当前用户可读
macOS 钥匙串验证:
security find-generic-password -a chat-channel -s opencode-chat-channel -w
opencode
启动后日志中会看到:
[feishu] 飞书机器人已启动(长连接模式),appId=cli_xxx***
chat-channel 已启动,活跃渠道: feishu
插件基于 ChatChannel 接口设计,新增渠道步骤:
src/channels/<渠道名>/index.ts,实现 ChatChannel 接口并导出 ChannelFactorysrc/index.ts 的 CHANNEL_FACTORIES 数组中注册工厂函数参见 src/channels/wecom/index.ts — 企业微信骨架,含详细的实现 TODO 注释。
src/
├── index.ts # 插件入口,注册所有渠道
├── types.ts # ChatChannel 接口 & 公共类型
├── session-manager.ts # opencode session 管理 & 工具函数
└── channels/
├── feishu/
│ └── index.ts # 飞书渠道实现(已完成)
└── wecom/
└── index.ts # 企业微信渠道骨架(待实现)
Q: 插件启动后收不到消息
Q: 回复很慢
Q: 想重置对话历史
MIT
FAQs
opencode plugin — multi-channel bot (Feishu/Lark, WeCom) with extensible ChatChannel interface
The npm package opencode-chat-channel receives a total of 40 weekly downloads. As such, opencode-chat-channel popularity was classified as not popular.
We found that opencode-chat-channel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.