🤖 WeComServer OpenClaw Plugin

WeComServer (企业微信私有部署) channel plugin for OpenClaw — by the Tencent WeCom team.

A bot plugin powered by WeCom Server AI Bot WebSocket persistent connections. Supports direct messages & group chats, streaming replies, and proactive messaging. Designed for WeCom private deployment environments.

✨ Features

• 🔗 WebSocket persistent connection for stable communication
• 💬 Supports both direct messages (DM) and group chat
• 📤 Proactive messaging to specific users or groups
• 🖼️ Receives and processes image and file messages with automatic downloading
• ⏳ Streaming replies with "thinking" placeholder messages
• 📝 Markdown formatting support for replies
• 🔒 Built-in access control: DM Policy (pairing / open / allowlist / disabled) and Group Policy (open / allowlist / disabled)
• ⚡ Auto heartbeat keep-alive and reconnection (up to 100 reconnect attempts)
• 🧙 Interactive CLI setup wizard
• 🔐 Custom CA certificate support for private deployment TLS verification
• 🌐 Configurable WebSocket endpoint for private deployment environments

🚀 Getting Started

Requirements

• OpenClaw >= 2026.3.24

Quick Install

Use the CLI tool to automatically install the plugin and complete bot configuration in one step:

# Automatically install the channel plugin and quickly complete configuration; also works for updates
npx -y @wecom/wecomserver-openclaw-cli install

More Options

# If installation fails, try force install
npx -y @wecom/wecomserver-openclaw-cli install --force

# Use --help to learn more about the tool
npx -y @wecom/wecomserver-openclaw-cli --help

Manual Install

openclaw plugins install @wecom/wecomserver-openclaw-plugin

Configuration

Option 1: Interactive Setup

openclaw channels add

Follow the prompts to enter your WeCom Server bot's Bot ID, Secret, WebSocket URL (optional), and CA Certificate filename (optional, the certificate file should be placed in ~/.openclaw/certs/ directory).

Option 2: CLI Quick Setup

openclaw config set channels.wecomserver.botId <YOUR_BOT_ID>
openclaw config set channels.wecomserver.secret <YOUR_BOT_SECRET>
openclaw config set channels.wecomserver.websocketUrl <YOUR_WEBSOCKET_URL>
openclaw config set channels.wecomserver.caCert <CA_CERT_FILENAME>
openclaw config set channels.wecomserver.enabled true
openclaw gateway restart

Configuration Reference

| Config Path | Description | Options | Default | |---|---|---|---| | channels.wecomserver.botId | WeCom Server bot ID | — | — | | channels.wecomserver.secret | WeCom Server bot secret | — | — | | channels.wecomserver.enabled | Enable the channel | true / false | false | | channels.wecomserver.websocketUrl | WebSocket endpoint (private deployment) | — | — | | channels.wecomserver.caCert | CA certificate filename (placed in ~/.openclaw/certs/) for self-signed TLS | — | — | | channels.wecomserver.dmPolicy | DM access policy | pairing / open / allowlist / disabled | open | | channels.wecomserver.allowFrom | DM allowlist (user IDs) | — | [] | | channels.wecomserver.groupPolicy | Group chat access policy | open / allowlist / disabled | open | | channels.wecomserver.groupAllowFrom | Group allowlist (group IDs) | — | [] | | channels.wecomserver.sendThinkingMessage | Send "thinking" placeholder | true / false | true |

Private Deployment Configuration

For private deployment environments, you typically need to configure:

1. websocketUrl: The WebSocket endpoint of your private WeCom Server instance.

2. caCert: The filename of the CA certificate (PEM format) for self-signed TLS certificates. The certificate file should be placed in the ~/.openclaw/certs/ directory (e.g., ca.pem). This is required when your private deployment uses self-signed certificates. If not specified, the system default certificate chain is used.

   How it works: The CA certificate is injected into Node.js global TLS layer at runtime via tls.createSecureContext interception. This covers all network exits: WebSocket connections (ws library), HTTP file downloads (axios), and fallback downloads (fetch). This approach bypasses the limitation that NODE_EXTRA_CA_CERTS only takes effect at process startup.

Example configuration for private deployment:

{
  "channels": {
    "wecomserver": {
      "botId": "your-bot-id",
      "secret": "your-bot-secret",
      "websocketUrl": "wss://your-private-wecom-server.example.com",
      "caCert": "ca.pem",
      "enabled": true
    }
  }
}

🔒 Access Control

DM (Direct Message) Access

Default: dmPolicy: "open" — all users can send direct messages without approval.

Approve Pairing

openclaw pairing list wecomserver            # View pending pairing requests
openclaw pairing approve wecomserver <CODE>  # Approve a pairing request

Allowlist Mode

Configure allowed user IDs via channels.wecomserver.allowFrom:

{
  "channels": {
    "wecomserver": {
      "dmPolicy": "allowlist",
      "allowFrom": ["user_id_1", "user_id_2"]
    }
  }
}

Open Mode

Set dmPolicy: "open" to allow all users to send direct messages without approval.

Disabled Mode

Set dmPolicy: "disabled" to completely block all direct messages.

Group Access

Group Policy (channels.wecomserver.groupPolicy)

• "open" — Allow messages from all groups (default)
• "allowlist" — Only allow groups listed in groupAllowFrom
• "disabled" — Disable all group messages

Group Configuration Examples

Allow All Groups (Default Behavior)

{
  "channels": {
    "wecomserver": {
      "groupPolicy": "open"
    }
  }
}

Allow Only Specific Groups

{
  "channels": {
    "wecomserver": {
      "groupPolicy": "allowlist",
      "groupAllowFrom": ["group_id_1", "group_id_2"]
    }
  }
}

Allow Only Specific Senders Within a Group (Sender Allowlist)

In addition to the group allowlist, you can restrict which members within a group are allowed to interact with the bot. Only messages from users listed in groups.<chatId>.allowFrom will be processed; messages from other members will be silently ignored. This is a sender-level allowlist that applies to all messages.

{
  "channels": {
    "wecomserver": {
      "groupPolicy": "allowlist",
      "groupAllowFrom": ["group_id_1"],
      "groups": {
        "group_id_1": {
          "allowFrom": ["user_id_1", "user_id_2"]
        }
      }
    }
  }
}

📦 Update

openclaw plugins update wecomserver-openclaw-plugin

📄 License

MIT