Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Feature]: Per-account media inbound directory for multi-account Feishu [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60154•Fetched 2026-04-08 02:35:38
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
yangericjieyangericjie
Participants
yangericjieyangericjie
Timeline (top)
labeled ×1

Per-account media inbound directory for multi-account Feishu

Root Cause

Per-account media inbound directory for multi-account Feishu

Fix Action

Fix / Workaround

Current workaround:
There is no per-account inbound directory option. Workarounds are:

  1. Don't grant external Agents access to global inbound
  2. Manually copy files to the Agent's workspace
  3. Use Feishu cloud drive links instead of attachments

Code Example

~/.openclaw/media/inbound/

---

"accounts": {                                                                                                                                                                                                                                                              
     "rita": {                                                                                                                                                                                                                                                                
       "appId": "cli_xxx",                                                                                                                                                                                                                                                    
       "appSecret": "xxx",                                                                                                                                                                                                                                                    
       "inboundDir": "/path/to/rita/inbound/"                                                                                                                                                                                                                                 
     }                                                                                                                                                                                                                                                                        
   }

---

~/.openclaw/media/inbound/
RAW_BUFFERClick to expand / collapse

Summary

Per-account media inbound directory for multi-account Feishu

Problem to solve

When multiple Feishu accounts are configured in OpenClaw (e.g. Gauss + Rita as separate enterprise apps), all downloaded media files go to the same global directory:

  ~/.openclaw/media/inbound/

This creates a security issue — if a low-trust external Agent like Rita has mediaLocalRoots pointing to that global directory, she can read files received by other accounts (like Gauss), including sensitive content.

Proposed solution

Add an optional inboundDir config under channels.feishu.accounts.<id>:

  "accounts": {                                                                                                                                                                                                                                                              
    "rita": {                                                                                                                                                                                                                                                                
      "appId": "cli_xxx",                                                                                                                                                                                                                                                    
      "appSecret": "xxx",                                                                                                                                                                                                                                                    
      "inboundDir": "/path/to/rita/inbound/"                                                                                                                                                                                                                                 
    }                                                                                                                                                                                                                                                                        
  }

When configured, that account's media downloads go to its dedicated directory instead of the global inbound, ensuring file isolation between accounts.

Alternatives considered

Current workaround:
There is no per-account inbound directory option. Workarounds are:

  1. Don't grant external Agents access to global inbound
  2. Manually copy files to the Agent's workspace
  3. Use Feishu cloud drive links instead of attachments

Impact

When multiple Feishu accounts are configured in OpenClaw (e.g. Gauss + Rita as separate enterprise apps), all downloaded media files go to the same global directory:

  ~/.openclaw/media/inbound/

This creates a security issue — if a low-trust external Agent like Rita has mediaLocalRoots pointing to that global directory, she can read files received by other accounts (like Gauss), including sensitive content.

Evidence/examples

No response

Additional information

No response

extent analysis

TL;DR

Configure an optional inboundDir under channels.feishu.accounts.<id> to isolate media downloads for each Feishu account.

Guidance

  • Add an inboundDir configuration for each Feishu account to specify a dedicated directory for media downloads, ensuring file isolation between accounts.
  • Verify the configuration by checking the media download directory for each account after implementing the change.
  • Consider the proposed solution as a more scalable and secure alternative to current workarounds, such as manually copying files or using Feishu cloud drive links.
  • Review the security implications of granting external Agents access to the global inbound directory and adjust configurations accordingly.

Example

"accounts": {
  "rita": {
    "appId": "cli_xxx",
    "appSecret": "xxx",
    "inboundDir": "/path/to/rita/inbound/"
  }
}

Notes

The effectiveness of this solution relies on correctly configuring the inboundDir for each Feishu account and ensuring that external Agents do not have access to the global inbound directory.

Recommendation

Apply the proposed solution by configuring the inboundDir for each Feishu account, as it provides a more secure and scalable way to isolate media downloads between accounts.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#integration issue#index setup#retrieval issue#search optimization#API routing

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING