Feishu dynamic agents

Per-user agent isolation: give every Feishu DM sender their own workspace, bootstrap files, and conversation history.

Per-user agent isolation (Dynamic Agent Creation)

Enable dynamicAgentCreation to automatically create isolated agent instances for each DM user. Each user gets their own:

• Independent workspace directory
• Separate USER.md / SOUL.md / MEMORY.md
• Private conversation history
• Isolated skills and state

This is essential for public bots where you want each user to have their own private AI assistant experience.

Quick setup

{  channels: {    feishu: {      dmPolicy: "open",      allowFrom: ["*"],      dynamicAgentCreation: {        enabled: true,        workspaceTemplate: "~/.openclaw/workspace-{agentId}",        agentDirTemplate: "~/.openclaw/agents/{agentId}/agent",      },    },  },  session: {    // Critical: makes each user's DM their "main session"    // Automatically loads USER.md / SOUL.md / MEMORY.md    // For stronger isolation, use "per-channel-peer" instead    dmScope: "main",  },}

How it works

When a new user sends their first DM:

1. The channel generates a unique agentId: feishu-{user_open_id} for the default account, or a bounded account-prefixed identity digest for a named account
2. Creates a new workspace at workspaceTemplate path
3. Registers the agent and creates a binding for this user
4. The workspace helper ensures bootstrap files (AGENTS.md, SOUL.md, USER.md, etc.) on first access
5. Routes all future messages from this user to their dedicated agent

Configuration options

Template variables:

• {agentId} - the generated agent ID (e.g., feishu-ou_xxxxxx or feishu-support-<identity_digest>)
• {userId} - the sender's Feishu open_id (e.g., ou_xxxxxx)

Session scope

session.dmScope controls how direct messages are mapped to agent sessions. This is a global setting that affects all channels.

Tradeoff: Using "main" enables automatic bootstrap file loading (USER.md, SOUL.md, MEMORY.md), but means all DMs across all channels share the same session key pattern. For public multi-user bots where isolation matters more than bootstrap auto-loading, consider "per-channel-peer" and manage bootstrap files manually.

Typical multi-user deployment

{  channels: {    feishu: {      appId: "cli_xxx",      appSecret: "xxx",      dmPolicy: "open",      allowFrom: ["*"],      groupPolicy: "open",      requireMention: true,      dynamicAgentCreation: {        enabled: true,        workspaceTemplate: "~/.openclaw/workspace-{agentId}",        agentDirTemplate: "~/.openclaw/agents/{agentId}/agent",      },    },  },  session: {    // Choose dmScope based on your isolation needs:    // "main" for bootstrap auto-loading, "per-channel-peer" for stronger isolation    dmScope: "main",  },  bindings: [], // Empty - dynamic agents auto-bind}

Verification

Check gateway logs to confirm dynamic creation is working:

feishu: creating dynamic agent "feishu-ou_xxxxxx" for user ou_xxxxxx  workspace: /home/user/.openclaw/workspace-feishu-ou_xxxxxx  agentDir: /home/user/.openclaw/agents/feishu-ou_xxxxxx/agent

List all created workspaces:

ls -la ~/.openclaw/workspace-*

Notes

• Workspace isolation: Each user gets their own workspace directory and agent instance. Users cannot see each other's conversation history or files within the normal messaging flow.
• Security boundary: This is a messaging-context isolation mechanism, not a hostile co-tenant security boundary. The agent process and host environment are shared.
• Config writes must stay enabled: Dynamic agent creation writes agents and bindings into the config; it is skipped when channels.feishu.configWrites is false (default: enabled).
• bindings should be empty: Dynamic agents auto-register their own bindings
• Upgrade path: Existing manual bindings continue to work alongside dynamic agents
• session.dmScope is global: This affects all channels, not just Feishu