13.1 企业飞书/Slack 群工作助手

本节通过一个完整的企业场景案例，演示如何从零开始构建一个多渠道工作助手，包括需求分析、架构设计、配置实现、核心代码、测试验证和部署上线的完整闭环。

13.1.1 需求分析与场景设定

背景故事

假设你在一家中等规模的互联网公司（500人左右）担任技术负责人。公司研发团队日常工作分散在飞书（内部）和 Slack（跨国团队）两个平台。现在需要部署一个 智能工作助手，帮助团队自动化以下日常工作：

1. 日报汇总：每天16:00 自动从研发群提取 @助手 的进度更新，聚合成结构化日报发至指定文档。

2. 代码评审辅助：当工程师在群里 @ 助手并贴上 GitHub PR 链接时，能自动拉取代码、总结改动、识别风险点，生成评审意见。

3. 故障诊断：接收故障告警，查询内部知识库和监控系统，协助定位根因并建议快速修复方案。

4. 工时追踪：从群聊消息中自动识别完成的任务，更新项目管理系统（Jira/飞书任务）。

技术约束与目标

维度	需求	实现影响
可用性	支持飞书和 Slack 同步工作	需要多渠道路由与消息映射
权限	不同团队有不同权限（研发可查源代码，HR不行）	需要实现基于用户角色的访问控制
一致性	跨平台操作保证一致	需要统一的任务状态机与补偿机制
延迟	日报聚合应在16:05分前完成	需要预加载与缓存策略
审计	所有操作必须有日志与确认	需要完整的执行堆栈与人工审核流

13.1.2 架构设计

整体架构图

核心模块设计

1. 智能体配置（Agent Profile）

工作助手需要具备的能力范围：

{
  "agents": {
    "work-assistant": {
      "name": "企业工作助手",
      "model": "claude-opus-4-6",
      "tools": [
        "github.pull_request.read",
        "github.pull_request.comment",
        "jira.issue.read",
        "jira.issue.update",
        "lark.document.append",
        "slack.message.send",
        "knowledge_base.search",
        "monitoring.query"
      ],
      "memory": {
        "strategy": "session_with_summary",
        "maxTokens": 8000,
        "compactAfterTurns": 20
      },
      "constraints": {
        "maxConcurrency": 3,
        "rateLimit": "10 req/min per user",
        "timeout": 45000
      }
    }
  }
}

2. 权限与策略（Policy Profile）

不同用户/角色享有不同的工具权限：

{
  "profiles": {
    "engineer": {
      "clearanceLevel": 3,
      "allowedTools": [
        "github.*",
        "jira.issue.read",
        "knowledge_base.search",
        "monitoring.query"
      ],
      "deniedTools": ["jira.issue.delete", "lark.document.delete"]
    },
    "manager": {
      "clearanceLevel": 2,
      "allowedTools": [
        "jira.*",
        "lark.document.*",
        "knowledge_base.search"
      ],
      "deniedTools": ["github.repository.delete"]
    },
    "guest": {
      "clearanceLevel": 1,
      "allowedTools": [
        "knowledge_base.search",
        "jira.issue.read"
      ]
    }
  }
}

3. 多渠道映射

{
  "channels": {
    "lark": {
      "enabled": true,
      "appId": "${LARK_APP_ID}",
      "appSecret": "${LARK_APP_SECRET}",
      "groups": {
        "research-team": {
          "enabled": true,
          "requireMention": true,
          "triggerKeywords": ["@工作助手", "#codereview", "#故障"],
          "defaultAgent": "work-assistant",
          "permissions": {
            "allowActions": ["query", "analyze"],
            "denyActions": ["delete", "execute"]
          }
        }
      }
    },
    "slack": {
      "enabled": true,
      "botToken": "${SLACK_BOT_TOKEN}",
      "appToken": "${SLACK_APP_TOKEN}",
      "channels": {
        "engineering": {
          "enabled": true,
          "requireMention": true,
          "defaultAgent": "work-assistant"
        }
      }
    }
  }
}

13.1.3 完整配置文件示例

文件路径：~/.openclaw/openclaw.json

{
  "gateway": {
    "port": 18789,
    "host": "0.0.0.0",
    "auth": {
      "requirePairing": true,
      "tokenTTL": 2592000,
      "maxFailedAttempts": 5,
      "cooldownSeconds": 300
    },
    "logging": {
      "level": "info",
      "file": "/var/log/openclaw/gateway.log",
      "maxSize": "100M",
      "maxAge": 30,
      "format": "json"
    }
  },

  "agents": {
    "work-assistant": {
      "name": "企业工作助手",
      "description": "协助团队自动化日报、代码评审、故障诊断和工时追踪",
      "model": "claude-opus-4-6",
      "modelProvider": "anthropic",
      "temperature": 0.7,
      "maxTokens": 2048,
      "tools": [
        "github_pr_analyzer",
        "jira_issue_manager",
        "knowledge_base_search",
        "monitoring_query",
        "document_writer"
      ],
      "memory": {
        "strategy": "session_with_summary",
        "maxContextTokens": 8000,
        "compactAfterTurns": 25,
        "pruneStrategy": "by_relevance"
      },
      "constraints": {
        "maxConcurrentRequests": 3,
        "requestTimeoutMs": 45000,
        "rateLimit": {
          "perUser": "10/min",
          "perTeam": "100/min",
          "perGlobal": "1000/min"
        }
      },
      "systemPrompt": "你是一个企业工作助手，帮助团队自动化日常工作。你能：\n1. 分析代码改动并给出评审意见\n2. 汇总日报进展\n3. 辅助故障诊断\n4. 更新项目任务\n\n在执行任何操作前，必须确认用户权限。对于写入操作，必须提前告知用户。"
    }
  },

  "profiles": {
    "engineer": {
      "clearanceLevel": 3,
      "allowedTools": [
        "github_pr_analyzer",
        "jira_issue_manager:read",
        "knowledge_base_search",
        "monitoring_query"
      ],
      "deniedTools": [
        "document_writer:write_to_admin_folder",
        "jira_issue_manager:delete"
      ],
      "rateLimit": "10/min"
    },
    "manager": {
      "clearanceLevel": 2,
      "allowedTools": [
        "jira_issue_manager",
        "document_writer",
        "knowledge_base_search"
      ],
      "deniedTools": [
        "github_pr_analyzer:admin_actions"
      ],
      "rateLimit": "20/min"
    },
    "guest": {
      "clearanceLevel": 1,
      "allowedTools": [
        "knowledge_base_search",
        "jira_issue_manager:read"
      ],
      "rateLimit": "5/min"
    }
  },

  "channels": {
    "lark": {
      "enabled": true,
      "type": "lark",
      "appId": "${LARK_APP_ID}",
      "appSecret": "${LARK_APP_SECRET}",
      "encryptionKey": "${LARK_ENCRYPTION_KEY}",
      "verificationToken": "${LARK_VERIFICATION_TOKEN}",
      "webhookPath": "/webhook/lark",
      "messageFormat": "lark_card",
      "groups": {
        "research-team": {
          "chatId": "${RESEARCH_TEAM_CHAT_ID}",
          "enabled": true,
          "requireMention": true,
          "mentionPatterns": ["@工作助手", "@work-bot"],
          "triggerKeywords": ["#codereview", "#故障", "#日报"],
          "defaultAgent": "work-assistant",
          "defaultProfile": "engineer",
          "permissions": {
            "allowActions": ["query", "analyze", "summarize"],
            "denyActions": ["delete", "execute_system_command"]
          },
          "routing": {
            "#codereview": {
              "tool": "github_pr_analyzer",
              "mode": "auto_reply"
            },
            "#故障": {
              "tool": "monitoring_query",
              "mode": "escalate_to_manager"
            }
          }
        }
      }
    },
    "slack": {
      "enabled": true,
      "type": "slack",
      "botToken": "${SLACK_BOT_TOKEN}",
      "appToken": "${SLACK_APP_TOKEN}",
      "signingSecret": "${SLACK_SIGNING_SECRET}",
      "webhookPath": "/webhook/slack",
      "channels": {
        "engineering": {
          "channelId": "${SLACK_ENGINEERING_CHANNEL_ID}",
          "enabled": true,
          "requireMention": true,
          "mentionPatterns": ["@work-assistant"],
          "defaultAgent": "work-assistant",
          "defaultProfile": "engineer"
        }
      }
    }
  },

  "tools": {
    "github_pr_analyzer": {
      "enabled": true,
      "type": "github",
      "token": "${GITHUB_TOKEN}",
      "timeout": 30000,
      "maxAttempts": 3,
      "cache": {
        "enabled": true,
        "ttl": 3600
      },
      "policy": {
        "minClearance": 3,
        "maxSize": 1000,
        "allowedActions": ["read", "comment"]
      }
    },
    "jira_issue_manager": {
      "enabled": true,
      "type": "jira",
      "url": "${JIRA_URL}",
      "username": "${JIRA_USERNAME}",
      "apiToken": "${JIRA_API_TOKEN}",
      "timeout": 20000,
      "maxAttempts": 3,
      "policy": {
        "minClearance": 2,
        "allowedActions": ["read", "update", "comment"],
        "deniedActions": ["delete"]
      }
    },
    "knowledge_base_search": {
      "enabled": true,
      "type": "custom",
      "endpoint": "http://kb-service:9000/search",
      "timeout": 15000,
      "policy": {
        "minClearance": 1
      }
    },
    "monitoring_query": {
      "enabled": true,
      "type": "custom",
      "endpoint": "http://prometheus:9090",
      "timeout": 20000,
      "policy": {
        "minClearance": 2
      }
    },
    "document_writer": {
      "enabled": true,
      "type": "lark_docs",
      "folderPath": "/团队工作区/日报汇总",
      "timeout": 25000,
      "policy": {
        "minClearance": 2,
        "allowedFolders": ["/团队工作区/日报汇总", "/项目管理/进度"],
        "deniedFolders": ["/admin", "/财务"]
      }
    }
  },

  "hooks": {
    "onMessageReceived": {
      "enabled": true,
      "script": "hooks/on_message_received.js"
    },
    "beforeToolExecution": {
      "enabled": true,
      "script": "hooks/before_tool_execution.js"
    },
    "afterToolExecution": {
      "enabled": true,
      "script": "hooks/after_tool_execution.js"
    }
  },

  "cron": {
    "daily_report_aggregation": {
      "schedule": "0 16 * * *",
      "agent": "work-assistant",
      "task": "aggregate_daily_reports",
      "timeout": 60000,
      "enabled": true
    }
  },

  "security": {
    "enableAudit": true,
    "auditLog": "/var/log/openclaw/audit.log",
    "enableEncryption": true,
    "tlsCert": "/etc/openclaw/tls/cert.pem",
    "tlsKey": "/etc/openclaw/tls/key.pem",
    "allowedIPs": ["10.0.0.0/8", "192.168.0.0/16"],
    "requireMTLS": false
  }
}

环境变量文件 ~/.openclaw/.env：

# Lark Configuration
LARK_APP_ID=cli_xxxxxxxxxxxx
LARK_APP_SECRET=xxxxxxxxxxxxxx
LARK_ENCRYPTION_KEY=xxxxxxxxxxxxxx
LARK_VERIFICATION_TOKEN=xxxxxxxxxxxxxx
RESEARCH_TEAM_CHAT_ID=oc_xxxxxxxxxxxx

# Slack Configuration
SLACK_BOT_TOKEN=xoxb-xxxxxxxxxxxx
SLACK_APP_TOKEN=xapp-xxxxxxxxxxxx
SLACK_SIGNING_SECRET=xxxxxxxxxxxxxx
SLACK_ENGINEERING_CHANNEL_ID=C0xxxxxxxxxxxx

# GitHub Configuration
GITHUB_TOKEN=ghp_xxxxxxxxxxxx

# Jira Configuration
JIRA_URL=https://jira.company.com
JIRA_USERNAME=[e-mail]
JIRA_API_TOKEN=ATATT3xxxxxxxxxxx

# OpenClaw Gateway Token
OPENCLAW_GATEWAY_TOKEN=ocgw_xxxxxxxxxxxx

13.1.4 核心代码实现

工作流Hook脚本

文件路径：hooks/on_message_received.js

/**
 * 消息接收Hook：在消息进入Agent前的前置处理
 * 职责：权限检查、消息分类、缓存策略判断
 */

const CLEARANCE_LEVELS = {
  'engineer': 3,
  'manager': 2,
  'guest': 1
};

const TRIGGER_KEYWORDS = {
  'codereview': { tool: 'github_pr_analyzer', priority: 'high' },
  '故障': { tool: 'monitoring_query', priority: 'urgent' },
  '日报': { tool: 'document_writer', priority: 'normal' }
};

module.exports = {
  name: 'on_message_received',
  version: '1.0.0',

  async execute(context) {
    const { message, channel, sender, logger } = context;

    logger.info(`[Hook] Received message from ${sender.userId} in ${channel}`, {
      messageId: message.id,
      content: message.text.substring(0, 100)
    });

    // 1. 权限检查
    const userRole = await getUserRole(sender.userId);
    const clearanceLevel = CLEARANCE_LEVELS[userRole] || 1;

    if (clearanceLevel < 1) {
      logger.warn(`[Hook] User ${sender.userId} has insufficient clearance`, {
        requiredLevel: 1,
        actualLevel: clearanceLevel
      });
      return {
        allow: false,
        reason: 'insufficient_clearance',
        response: '抱歉，您没有权限使用此功能'
      };
    }

    // 2. 消息分类与优先级判断
    let triggerType = null;
    let priority = 'normal';
    for (const [keyword, config] of Object.entries(TRIGGER_KEYWORDS)) {
      if (message.text.includes(keyword)) {
        triggerType = config.tool;
        priority = config.priority;
        break;
      }
    }

    // 3. 缓存决策
    const shouldCache = {
      'github_pr_analyzer': true,
      'knowledge_base_search': true,
      'monitoring_query': false // 监控数据实时性要求高，不缓存
    }[triggerType] || false;

    logger.info(`[Hook] Message classification`, {
      triggerType,
      priority,
      shouldCache
    });

    return {
      allow: true,
      metadata: {
        userRole,
        clearanceLevel,
        triggerType,
        priority,
        shouldCache,
        receivedAt: Date.now()
      }
    };
  }
};

async function getUserRole(userId) {
  // 从内部目录服务查询用户角色
  // 实际场景可调用企业LDAP或组织管理系统
  const roleMap = {
    'user123': 'engineer',
    'manager456': 'manager',
    'guest789': 'guest'
  };
  return roleMap[userId] || 'guest';
}

文件路径：hooks/before_tool_execution.js

/**
 * 工具执行前Hook：检查工具权限、超时、速率限制
 */

module.exports = {
  name: 'before_tool_execution',
  version: '1.0.0',

  async execute(context) {
    const { tool, args, message, metadata, logger } = context;
    const { clearanceLevel, userRole } = metadata;

    logger.info(`[Hook] Before tool execution`, {
      tool: tool.name,
      user: userRole,
      clearanceLevel
    });

    // 1. 权限检查
    const toolPolicy = await getToolPolicy(tool.name);
    if (toolPolicy.minClearance && clearanceLevel < toolPolicy.minClearance) {
      logger.error(`[Hook] Tool execution denied: insufficient clearance`, {
        tool: tool.name,
        required: toolPolicy.minClearance,
        actual: clearanceLevel
      });
      return {
        allow: false,
        reason: 'insufficient_clearance',
        errorMessage: `执行 ${tool.name} 需要权限等级 ${toolPolicy.minClearance}，您的等级是 ${clearanceLevel}`
      };
    }

    // 2. 参数安全检查（防止注入）
    const sanitizedArgs = sanitizeToolArgs(tool.name, args);

    // 3. 速率限制检查
    const rateLimitKey = `${userRole}:${tool.name}`;
    const isAllowed = await checkRateLimit(rateLimitKey);
    if (!isAllowed) {
      logger.warn(`[Hook] Rate limit exceeded`, { rateLimitKey });
      return {
        allow: false,
        reason: 'rate_limit_exceeded',
        errorMessage: '操作过于频繁，请稍候再试'
      };
    }

    // 4. 审计记录
    await logAuditEvent({
      action: 'TOOL_EXECUTION_REQUESTED',
      tool: tool.name,
      user: userRole,
      timestamp: Date.now(),
      args: JSON.stringify(sanitizedArgs),
      status: 'PENDING_APPROVAL'
    });

    return {
      allow: true,
      sanitizedArgs,
      timeout: toolPolicy.timeout || 30000
    };
  }
};

async function getToolPolicy(toolName) {
  // 返回工具策略（实际应从配置加载）
  const policies = {
    'github_pr_analyzer': { minClearance: 2, timeout: 30000 },
    'jira_issue_manager': { minClearance: 2, timeout: 20000 },
    'knowledge_base_search': { minClearance: 1, timeout: 15000 },
    'monitoring_query': { minClearance: 2, timeout: 20000 },
    'document_writer': { minClearance: 2, timeout: 25000 }
  };
  return policies[toolName] || {};
}

function sanitizeToolArgs(toolName, args) {
  // 根据工具类型清理参数
  if (toolName === 'github_pr_analyzer') {
    // 确保只能访问公开或授权的仓库
    if (args.repo) {
      args.repo = args.repo.replace(/[^a-zA-Z0-9-]/g, '');
    }
  }
  if (toolName === 'document_writer') {
    // 路径必须在允许的文件夹内
    const allowedPaths = ['/团队工作区/日报汇总', '/项目管理/进度'];
    if (!allowedPaths.some(p => args.path.startsWith(p))) {
      throw new Error(`Access denied to path: ${args.path}`);
    }
  }
  return args;
}

async function checkRateLimit(key) {
  // 使用Redis实现速率限制（伪代码）
  const redis = require('redis');
  const client = redis.createClient();
  const current = await client.incr(`ratelimit:${key}`);
  if (current === 1) {
    await client.expire(`ratelimit:${key}`, 60);
  }
  return current <= 10;
}

async function logAuditEvent(event) {
  // 写入审计日志
  const fs = require('fs').promises;
  await fs.appendFile(
    '/var/log/openclaw/audit.log',
    JSON.stringify(event) + '\n'
  );
}

13.1.5 测试验证

单元测试

文件路径：tests/work_assistant.test.js

const { describe, it, expect, beforeEach, afterEach } = require('@jest/globals');
const WorkAssistant = require('../lib/work_assistant');
const { MockGithubClient } = require('./mocks/github');
const { MockJiraClient } = require('./mocks/jira');

describe('WorkAssistant', () => {
  let assistant;
  let mockGithub;
  let mockJira;

  beforeEach(() => {
    mockGithub = new MockGithubClient();
    mockJira = new MockJiraClient();
    assistant = new WorkAssistant({
      github: mockGithub,
      jira: mockJira
    });
  });

  describe('代码评审功能', () => {
    it('应该从PR链接提取并分析改动', async () => {
      mockGithub.mockPullRequest({
        id: 12345,
        title: '修复登录超时问题',
        additions: 50,
        deletions: 20,
        files: [
          { name: 'auth.js', changes: 30 }
        ]
      });

      const message = '请帮我审查这个PR: https://github.com/company/repo/pull/12345';
      const result = await assistant.analyzePullRequest(message);

      expect(result).toHaveProperty('summary');
      expect(result).toHaveProperty('riskPoints');
      expect(result.summary).toContain('修复登录超时问题');
    });

    it('应该识别高风险改动', async () => {
      mockGithub.mockPullRequest({
        id: 12346,
        files: [
          { name: 'database.js', changes: 100 },
          { name: 'auth.js', changes: 80 }
        ]
      });

      const result = await assistant.analyzePullRequest(
        'https://github.com/company/repo/pull/12346'
      );

      expect(result.riskPoints).toContainEqual(
        expect.objectContaining({
          level: 'high',
          reason: expect.stringMatching(/数据库|权限/)
        })
      );
    });

    it('应该尊重权限限制', async () => {
      const userWithLowClearance = { role: 'guest', clearanceLevel: 1 };

      const result = await assistant.analyzePullRequest(
        'https://github.com/company/internal-repo/pull/1',
        userWithLowClearance
      );

      expect(result.error).toBeTruthy();
      expect(result.error).toContain('权限不足');
    });
  });

  describe('日报聚合功能', () => {
    it('应该从群消息中提取日报内容', async () => {
      const messages = [
        '今天完成了用户认证模块的重构',
        '修复了3个高优先级bug',
        '进度：85%，明天继续'
      ];

      const dailyReport = await assistant.aggregateDailyReport(messages);

      expect(dailyReport.completedTasks).toHaveLength(2);
      expect(dailyReport.progress).toBe('85%');
    });

    it('应该格式化并写入文档', async () => {
      const messages = ['完成了前端开发', '明天开始测试'];
      mockJira.mockDocumentWrite();

      const result = await assistant.aggregateDailyReport(messages);
      await assistant.writeToDocument(result);

      expect(mockJira.writeWasCalled()).toBe(true);
    });
  });

  describe('权限与审计', () => {
    it('应该在执行危险操作前请求确认', async () => {
      const operation = {
        tool: 'jira_issue_manager',
        action: 'update_task_status',
        params: { taskId: 'PROJ-123', status: 'Done' }
      };

      const requiresConfirmation =
        await assistant.checkIfRequiresConfirmation(operation);

      expect(requiresConfirmation).toBe(true);
    });

    it('应该记录所有的工具执行操作', async () => {
      await assistant.executeTool('knowledge_base_search', { query: 'test' });

      const auditLog = await assistant.getAuditLog();
      expect(auditLog).toContainEqual(
        expect.objectContaining({
          action: 'TOOL_EXECUTION',
          tool: 'knowledge_base_search'
        })
      );
    });
  });
});

集成测试

#!/bin/bash

# tests/integration_test.sh

set -e

echo "=== OpenClaw 工作助手集成测试 ==="

# 1. 启动OpenClaw
echo "[1/5] 启动OpenClaw服务..."
openclaw gateway start --daemon --config ~/.openclaw/openclaw.json
sleep 3

# 2. 验证配置加载
echo "[2/5] 验证配置加载..."
openclaw status --deep | grep -q "Agent: work-assistant" || {
  echo "ERROR: Agent未正确加载"
  exit 1
}

# 3. 测试飞书渠道
echo "[3/5] 测试飞书渠道连接..."
curl -X POST http://localhost:18789/webhook/lark \
  -H "Content-Type: application/json" \
  -d '{
    "challenge": "test123",
    "token": "LARK_VERIFICATION_TOKEN"
  }' | grep -q "challenge" || {
  echo "ERROR: 飞书渠道测试失败"
  exit 1
}

# 4. 测试权限检查
echo "[4/5] 测试权限检查..."
RESULT=$(openclaw test-permission \
  --user "guest789" \
  --tool "github_pr_analyzer" 2>&1)
echo "$RESULT" | grep -q "insufficient_clearance" || {
  echo "ERROR: 权限检查失败，Guest不应该能访问github_pr_analyzer"
  exit 1
}

# 5. 端到端消息流测试
echo "[5/5] 端到端消息流测试..."
TEST_RESPONSE=$(curl -s -X POST http://localhost:18789/test/message \
  -d "sender=user123&channel=lark:research-team&text=请帮我审查PR: https://github.com/company/repo/pull/12345")

if echo "$TEST_RESPONSE" | grep -q "正在分析"; then
  echo "✓ 集成测试全部通过"
  exit 0
else
  echo "ERROR: 端到端测试失败"
  echo "响应: $TEST_RESPONSE"
  exit 1
fi

13.1.6 部署上线

部署架构

Kubernetes部署配置

文件路径：deploy/k8s/openclaw-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-work-assistant
  namespace: ai-platform
  labels:
    app: openclaw
    component: work-assistant

spec:
  replicas: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

  selector:
    matchLabels:
      app: openclaw
      component: work-assistant

  template:
    metadata:
      labels:
        app: openclaw
        component: work-assistant
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"

    spec:
      serviceAccountName: openclaw

      initContainers:
      - name: config-validator
        image: openclaw:latest
        command: ["openclaw", "doctor"]
        volumeMounts:
        - name: config
          mountPath: /etc/openclaw

      containers:
      - name: openclaw
        image: openclaw:latest
        imagePullPolicy: IfNotPresent

        ports:
        - name: gateway
          containerPort: 18789
          protocol: TCP
        - name: metrics
          containerPort: 9090
          protocol: TCP

        env:
        - name: OPENCLAW_CONFIG
          value: /etc/openclaw/openclaw.json
        - name: OPENCLAW_LOG_LEVEL
          value: "info"
        - name: REDIS_URL
          valueFrom:
            secretKeyRef:
              name: openclaw-redis
              key: url
        - name: LARK_APP_ID
          valueFrom:
            secretKeyRef:
              name: openclaw-lark
              key: app-id
        - name: LARK_APP_SECRET
          valueFrom:
            secretKeyRef:
              name: openclaw-lark
              key: app-secret
        - name: SLACK_BOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: openclaw-slack
              key: bot-token
        - name: GITHUB_TOKEN
          valueFrom:
            secretKeyRef:
              name: openclaw-github
              key: token

        resources:
          requests:
            cpu: "500m"
            memory: "1Gi"
          limits:
            cpu: "2000m"
            memory: "4Gi"

        livenessProbe:
          httpGet:
            path: /health
            port: 18789
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

        readinessProbe:
          httpGet:
            path: /ready
            port: 18789
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 2

        volumeMounts:
        - name: config
          mountPath: /etc/openclaw
          readOnly: true
        - name: logs
          mountPath: /var/log/openclaw

      volumes:
      - name: config
        configMap:
          name: openclaw-config
      - name: logs
        emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: openclaw-gateway
  namespace: ai-platform
  labels:
    app: openclaw
    component: work-assistant

spec:
  type: LoadBalancer
  selector:
    app: openclaw
    component: work-assistant
  ports:
  - name: gateway
    port: 18789
    targetPort: 18789
    protocol: TCP

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: openclaw-config
  namespace: ai-platform

data:
  openclaw.json: |
    {
      "gateway": {
        "port": 18789,
        "host": "0.0.0.0",
        "logging": {
          "level": "info",
          "file": "/var/log/openclaw/gateway.log"
        }
      },
      "agents": {
        "work-assistant": {
          "model": "claude-opus-4-6",
          "tools": ["github_pr_analyzer", "jira_issue_manager", "knowledge_base_search", "monitoring_query", "document_writer"]
        }
      }
    }

部署脚本

#!/bin/bash

# deploy/deploy.sh

set -e

NAMESPACE="ai-platform"
RELEASE_NAME="openclaw-work-assistant"

echo "=== OpenClaw 工作助手部署流程 ==="

# 1. 验证前置条件
echo "[1/6] 验证部署前置条件..."
kubectl cluster-info >/dev/null 2>&1 || {
  echo "ERROR: 无法连接到Kubernetes集群"
  exit 1
}

kubectl get namespace $NAMESPACE >/dev/null 2>&1 || {
  echo "创建命名空间: $NAMESPACE"
  kubectl create namespace $NAMESPACE
}

# 2. 创建密钥
echo "[2/6] 注入敏感信息到Secret..."
kubectl create secret generic openclaw-lark \
  --from-literal=app-id=$LARK_APP_ID \
  --from-literal=app-secret=$LARK_APP_SECRET \
  --namespace=$NAMESPACE \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret generic openclaw-slack \
  --from-literal=bot-token=$SLACK_BOT_TOKEN \
  --from-literal=app-token=$SLACK_APP_TOKEN \
  --namespace=$NAMESPACE \
  --dry-run=client -o yaml | kubectl apply -f -

# 3. 构建镜像
echo "[3/6] 构建Docker镜像..."
docker build -t openclaw:latest \
  -f Dockerfile \
  --build-arg VERSION=$(git describe --tags) \
  .

docker tag openclaw:latest $DOCKER_REGISTRY/openclaw:latest
docker push $DOCKER_REGISTRY/openclaw:latest

# 4. 部署应用
echo "[4/6] 部署到Kubernetes..."
kubectl apply -f deploy/k8s/openclaw-deployment.yaml

# 5. 等待就绪
echo "[5/6] 等待Pod就绪..."
kubectl rollout status deployment/openclaw-work-assistant \
  -n $NAMESPACE \
  --timeout=5m

# 6. 验证部署
echo "[6/6] 验证部署..."
GATEWAY_IP=$(kubectl get svc openclaw-gateway -n $NAMESPACE \
  -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

if [ -z "$GATEWAY_IP" ]; then
  echo "WARNING: LoadBalancer IP未分配，使用NodePort"
  GATEWAY_PORT=$(kubectl get svc openclaw-gateway -n $NAMESPACE \
    -o jsonpath='{.spec.ports[0].nodePort}')
  GATEWAY_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[0].address}')
  GATEWAY_URL="http://$GATEWAY_IP:$GATEWAY_PORT"
else
  GATEWAY_URL="http://$GATEWAY_IP:18789"
fi

echo ""
echo "✓ 部署成功!"
echo "Gateway URL: $GATEWAY_URL"
echo ""
echo "后续步骤:"
echo "1. 在飞书开放平台配置事件订阅，指向: $GATEWAY_URL/webhook/lark"
echo "2. 在Slack应用配置中设置事件URL: $GATEWAY_URL/webhook/slack"
echo "3. 验证连接: curl $GATEWAY_URL/health"

13.1.7 常见问题FAQ

Q1：部署后飞书消息无法接收，怎么办？

A：按以下顺序排查：

1. 确认Pod健康：kubectl logs -f deploy/openclaw-work-assistant -n ai-platform

2. 确认Gateway可访问：curl http://<gateway-ip>:18789/health

3. 确认飞书应用已发布：检查飞书开放平台应用状态

4. 确认事件订阅URL正确：在飞书平台检查“事件与回调”的URL是否与实际Gateway地址一致

5. 确认网络连接：尝试从飞书侧主动拉起连接测试

Q2：如何监控OpenClaw的性能？

A：使用以下方式：

# 查看实时日志
kubectl logs -f deploy/openclaw-work-assistant -n ai-platform --tail=100

# 查看Prometheus指标
kubectl port-forward svc/openclaw-gateway 9090:9090 -n ai-platform

# 访问 http://localhost:9090

# 查看审计日志
kubectl exec -it <pod-name> -n ai-platform -- tail -f /var/log/openclaw/audit.log

Q3：如何处理工具执行超时？

A：在配置中调整超时值：

{
  "tools": {
    "github_pr_analyzer": {
      "timeout": 45000,
      "maxAttempts": 3,
      "retryStrategy": "exponential_backoff"
    }
  }
}

Q4：如何安全地更新敏感信息（如Token）？

A：不需要重新部署，直接更新Secret：

kubectl patch secret openclaw-lark \
  -p '{"data":{"app-secret":"'$(echo -n $NEW_SECRET | base64)'"}}'  \
  -n ai-platform

OpenClaw会自动热加载Secret变更（无需重启）。

Q5：如何在本地环境测试？

A：使用开发模式启动：

openclaw gateway start --dev \
  --config ./openclaw.local.json \
  --port 18789

# 模拟飞书消息
curl -X POST http://localhost:18789/webhook/lark \
  -H "Content-Type: application/json" \
  -d @tests/fixtures/lark_message.json

本案例展示了一个完整的企业级工作助手从需求、架构、配置、代码、测试到部署的全闭环实现。核心要点是：确保权限边界清晰、审计完整、异常可复现、部署可自动化。