@aspalagin/openclaw-max 0.7.2 → 0.8.0

package/dist/src/action-scope.js

@@ -0,0 +1,213 @@
+/**
+ * Scoping of message-tool actions to chats the channel policy admits. Core
+ * guards cross-conversation mutations only when tools.message.crossContext
+ * is tightened (both options default to allow), and never guards edit/delete
+ * addressed by messageId alone: without this check a prompt injection in one
+ * chat could post, edit, delete or pin in any other chat of the bot.
+ */
+import { ToolAuthorizationError } from 'openclaw/plugin-sdk/channel-actions';
+import { normalizeAccountId } from 'openclaw/plugin-sdk/core';
+import { admitMaxDmUser, admitMaxGroupMessage } from './access-policy.js';
+import { MaxApi, MaxApiError } from './api.js';
+import { isChatNotFound } from './send.js';
+/**
+ * Throws ToolAuthorizationError (a tool error the agent sees) when the action
+ * may not run in its chat under channels.max.actionScope. Only a call core
+ * marks senderIsOwner=true is not scoped (CLI `openclaw message`, an admin's
+ * Control UI chat, the owner's turn). Every other call, the flag missing
+ * included (heartbeat, subagents, scheduled runs without message authority),
+ * is held to the chats the inbound policy admits.
+ */
+export async function assertMaxActionInScope(ctx, account, target) {
+    const scope = account.config.actionScope ?? 'admitted';
+    if (scope === 'off' || ctx.senderIsOwner === true)
+        return;
+    const turnChatId = readCurrentMaxChatId(ctx);
+    const requesterId = ctx.requesterSenderId?.trim() || undefined;
+    // The turn's chat is current only for the account the turn came in on:
+    // another bot of the same group is held to its own policy.
+    const turnAccountId = ctx.requesterAccountId?.trim();
+    const currentChatId = !turnAccountId || normalizeAccountId(turnAccountId) === account.accountId
+        ? turnChatId
+        : undefined;
+    const api = new MaxApi({ token: account.token });
+    const { chat: located, authorId } = await failClosed(ctx.action, target, () => locateActionChat(api, target));
+    const replyTo = 'to' in target ? target.replyTo?.trim() || undefined : undefined;
+    if (isCurrentChat(located, currentChatId, requesterId)) {
+        if (replyTo)
+            await assertReplyInChat(ctx, api, replyTo, located, currentChatId);
+        return;
+    }
+    if (scope === 'current') {
+        deny(ctx.action, describeChat(located), 'actionScope="current" allows only the chat of the current turn');
+    }
+    const chat = await failClosed(ctx.action, target, () => classifyChat(api, located));
+    // A group admits the action only for a requester its sender allowlist admits.
+    const admission = chat.kind === 'group'
+        ? admitMaxGroupMessage(account, ctx.cfg, chat.chatId, requesterId)
+        : await admitMaxDmUser(account, chat.userId);
+    if (!admission.admitted)
+        deny(ctx.action, describeChat(chat), admission.reason);
+    // Outside the chat of the turn, edit and delete reach only the bot's own
+    // messages: what others wrote in an admitted chat is not the agent's to change.
+    if ('messageId' in target)
+        await assertBotMessage(ctx.action, api, target.messageId, authorId);
+    if (replyTo)
+        await assertReplyInChat(ctx, api, replyTo, chat);
+}
+/**
+ * A reply quotes its message in the chat it is sent to: that message must
+ * belong to the same chat, or the quote would carry another chat's text
+ * there. GET /messages/{mid} runs only for a reply; the message that started
+ * the turn needs no lookup in its own chat.
+ */
+async function assertReplyInChat(ctx, api, replyTo, target, currentChatId) {
+    const turnMessageId = ctx.toolContext?.currentMessageId;
+    if (currentChatId && turnMessageId != null && String(turnMessageId).trim() === replyTo)
+        return;
+    const refuse = (why) => {
+        throw new ToolAuthorizationError(`MAX ${ctx.action} refused: replyTo message ${replyTo} ${why}; a reply may quote only a message ` +
+            `of the chat it is sent to, here ${describeChat(target)} (channels.max.actionScope).`);
+    };
+    let replyChat;
+    try {
+        replyChat = chatOfMessage(await api.getMessageById(replyTo));
+    }
+    catch (err) {
+        return refuse(`cannot be resolved to a chat (${String(err)})`);
+    }
+    const targetChatId = target.chatId ?? (currentChatId != null ? Number(currentChatId) : undefined);
+    if (targetChatId != null && replyChat.chatId === targetChatId)
+        return;
+    // A dialog addressed by user id: the reply must sit in the dialog with that user.
+    if (target.kind === 'dialog' && targetChatId == null && target.userId != null) {
+        let peer;
+        try {
+            peer = await classifyChat(api, replyChat);
+        }
+        catch (err) {
+            return refuse(`cannot be resolved to a chat (${String(err)})`);
+        }
+        if (peer.kind === 'dialog' && peer.chatId != null && peer.userId === target.userId)
+            return;
+    }
+    refuse(`belongs to another chat (${describeChat(replyChat)})`);
+}
+/** The author comes from the same GET /messages/{mid} as the chat; the bot id is remembered. */
+async function assertBotMessage(action, api, messageId, authorId) {
+    let botUserId;
+    try {
+        botUserId = await api.getBotUserId();
+    }
+    catch (err) {
+        throw new ToolAuthorizationError(`MAX ${action} refused: cannot resolve the bot's own user id to check the author of message ${messageId} (${String(err)})`);
+    }
+    if (authorId != null && authorId === botUserId)
+        return;
+    throw new ToolAuthorizationError(`MAX ${action} refused: message ${messageId} was not sent by this bot. Outside the chat of the current turn ` +
+        'only messages the bot sent itself may be edited or deleted (channels.max.actionScope).');
+}
+function deny(action, chat, reason) {
+    throw new ToolAuthorizationError(`MAX ${action} refused: ${chat} is outside the chats this conversation may act in (${reason}). ` +
+        'Allowed: the current chat, chats admitted by channels.max dmPolicy/allowFrom/pairing and ' +
+        'groupPolicy/groups/groupAllowFrom, or a request from the owner (channels.max.actionScope).');
+}
+/** Chat id of the current MAX turn (toolContext.currentChannelId is `max:<chatId>`). */
+function readCurrentMaxChatId(ctx) {
+    const tool = ctx.toolContext;
+    if (!tool)
+        return undefined;
+    if (tool.currentChannelProvider && tool.currentChannelProvider !== 'max')
+        return undefined;
+    const raw = tool.currentChannelId?.trim() || tool.currentMessagingTarget?.trim();
+    if (!raw)
+        return undefined;
+    const id = raw.replace(/^max:/, '');
+    return /^-?\d+$/.test(id) ? id : undefined;
+}
+/**
+ * The current chat itself, or — from a DM turn — the requester's own dialog
+ * addressed as user:<id>.
+ */
+function isCurrentChat(chat, currentChatId, requesterId) {
+    if (currentChatId && chat.chatId != null && String(chat.chatId) === currentChatId)
+        return true;
+    const currentIsDialog = currentChatId != null && !currentChatId.startsWith('-');
+    return (chat.kind === 'dialog' &&
+        currentIsDialog &&
+        chat.userId != null &&
+        requesterId === String(chat.userId));
+}
+function describeChat(chat) {
+    if (chat.kind === 'dialog') {
+        return chat.userId != null ? `the dialog with user ${chat.userId}` : `dialog ${chat.chatId}`;
+    }
+    return `chat ${chat.chatId}`;
+}
+/** Target resolution failures refuse the action (fail-closed). */
+async function failClosed(action, target, resolve) {
+    try {
+        return await resolve();
+    }
+    catch (err) {
+        const what = 'messageId' in target ? `message ${target.messageId}` : `target ${target.to}`;
+        throw new ToolAuthorizationError(`MAX ${action} refused: cannot resolve the chat of ${what} to check channels.max.actionScope (${String(err)})`);
+    }
+}
+/**
+ * Where the action lands, without an API call for explicit targets:
+ * user:<id> is a dialog, a negative id a group or channel, a positive id is
+ * classified later. An existing message is looked up (GET /messages/{mid}),
+ * which also tells its author.
+ */
+async function locateActionChat(api, target) {
+    if ('messageId' in target) {
+        const message = await api.getMessageById(target.messageId);
+        return { chat: chatOfMessage(message), authorId: message.sender?.user_id };
+    }
+    const to = target.to.trim().replace(/^max:/, '');
+    if (to.startsWith('user:')) {
+        const userId = Number(to.slice(5));
+        if (!Number.isFinite(userId))
+            throw new Error(`invalid MAX target: ${target.to}`);
+        return { chat: { kind: 'dialog', userId } };
+    }
+    const chatId = Number(to);
+    if (!to || !Number.isFinite(chatId))
+        throw new Error(`invalid MAX target: ${target.to}`);
+    return { chat: chatId < 0 ? { kind: 'group', chatId } : { kind: 'unknown', chatId } };
+}
+function chatOfMessage(message) {
+    const chatId = message.recipient?.chat_id;
+    if (chatId == null)
+        throw new Error('the message has no recipient chat');
+    const chatType = message.recipient?.chat_type;
+    if (chatType === 'chat' || chatType === 'channel')
+        return { kind: 'group', chatId };
+    if (chatType === 'dialog')
+        return { kind: 'dialog', chatId };
+    return chatId < 0 ? { kind: 'group', chatId } : { kind: 'unknown', chatId };
+}
+/**
+ * Settle a positive id (GET /chats: dialog or group; chat.not.found means a
+ * user id, which the send path retries as user_id) and a dialog's peer.
+ */
+async function classifyChat(api, chat) {
+    if (chat.kind === 'group')
+        return chat;
+    if (chat.kind === 'dialog' && (chat.userId != null || chat.chatId == null))
+        return chat;
+    const chatId = chat.chatId;
+    try {
+        const info = await api.getChat(chatId);
+        if (info.type !== 'dialog')
+            return { kind: 'group', chatId };
+        return { kind: 'dialog', chatId, userId: info.dialog_with_user?.user_id };
+    }
+    catch (err) {
+        if (chat.kind === 'unknown' && err instanceof MaxApiError && isChatNotFound(err)) {
+            return { kind: 'dialog', userId: chatId };
+        }
+        throw err;
+    }
+}

package/dist/src/actions.js

@@ -1,16 +1,76 @@
 /**
  * MAX channel message actions adapter — implements message tool actions
  */
+import { createActionGate } from 'openclaw/plugin-sdk/channel-actions';
 import { normalizeMessagePresentation } from 'openclaw/plugin-sdk/interactive-runtime';
+import { getAgentScopedMediaLocalRoots } from 'openclaw/plugin-sdk/media-local-roots';
 import { readStringParam } from 'openclaw/plugin-sdk/param-readers';
 import { jsonResult } from 'openclaw/plugin-sdk/tool-results';
 import { listMaxAccountIds, resolveMaxAccount } from './accounts.js';
-import { materializeMaxPresentation, MAX_TEXT_LIMIT, readMaxDeliveryPin } from './presentation.js';
+import { assertMaxActionInScope } from './action-scope.js';
+import { sanitizeMaxFileName } from './media-temp.js';
+import { materializeMaxPresentation, readMaxDeliveryPin, resolveMaxTextChunkLimit, } from './presentation.js';
 import { getMaxRuntime } from './runtime.js';
-import { deleteMaxMessage, editMaxMessage, pinMaxMessage, readMaxChannelButtons, readMaxSendButtons, sendMaxContact, sendMaxLocation, sendMaxMediaGroup, sendMaxMediaMessage, sendMaxMessage, sendMaxSticker, unpinMaxMessage, } from './send.js';
+import { deleteMaxMessage, describeMaxMediaSource, editMaxMessage, pinMaxMessage, readMaxChannelButtons, readMaxSendButtons, resolveMaxSendFlags, sendMaxContact, sendMaxLocation, sendMaxMediaGroup, sendMaxMediaMessage, sendMaxMessage, sendMaxSticker, unpinMaxMessage, } from './send.js';
 import { getLastStickerCode } from './sticker-cache.js';
 const providerId = 'max';
 const mediaSourceKeys = ['media', 'filePath', 'path', 'fileUrl', 'url', 'buffer', 'image'];
+/**
+ * Params that carry a media path or URL, per action: core normalizes them for
+ * the sandbox and scopes outbound media access to them. `buffer` is base64
+ * content for core, not a path, so it is not declared.
+ */
+const mediaSourceParams = mediaSourceKeys.filter((key) => key !== 'buffer');
+/** `data:<type>;base64,<data>` — a data URL in `buffer`. */
+const DATA_URL_RE = /^data:([^;,]*)(?:;[^,]*)?;base64,/i;
+/**
+ * Inline content from `buffer` (base64 or a base64 data URL) with `filename`
+ * and `contentType` (aliases fileName, mimeType) of the same object. The size
+ * limit is checked before decoding, so an oversized payload is refused
+ * without allocating it.
+ */
+function readInlineMedia(source, maxBytes) {
+    const raw = typeof source.buffer === 'string' ? source.buffer : undefined;
+    if (!raw?.trim())
+        return undefined;
+    const dataUrl = DATA_URL_RE.exec(raw);
+    const base64 = (dataUrl ? raw.slice(dataUrl[0].length) : raw).replace(/\s+/g, '');
+    if (!/^[A-Za-z0-9+/_-]*={0,2}$/.test(base64)) {
+        throw new Error('buffer is not valid base64 content');
+    }
+    const decodedBytes = Math.floor((base64.replace(/=+$/, '').length * 3) / 4);
+    if (decodedBytes > maxBytes) {
+        throw new Error(`buffer is ${decodedBytes} bytes, over the ${maxBytes}-byte media limit (mediaMaxMb)`);
+    }
+    const buffer = Buffer.from(base64, base64.includes('-') || base64.includes('_') ? 'base64url' : 'base64');
+    if (buffer.byteLength === 0)
+        throw new Error('buffer is empty');
+    const pick = (...keys) => keys
+        .map((key) => source[key])
+        .find((value) => typeof value === 'string' && value.trim() !== '')
+        ?.trim();
+    const contentType = pick('contentType', 'mimeType') ?? (dataUrl?.[1] || undefined);
+    return {
+        buffer,
+        fileName: sanitizeMaxFileName(pick('filename', 'fileName'), contentType),
+        contentType,
+    };
+}
+/**
+ * Local media access for an action: the roots and host reader core passed
+ * with the action; without them (direct plugin dispatch) the agent-scoped
+ * default roots. Local files are read only through this policy.
+ */
+function resolveActionLocalMedia(ctx) {
+    if (ctx.mediaAccess || ctx.mediaLocalRoots?.length || ctx.mediaReadFile) {
+        return {
+            mediaAccess: ctx.mediaAccess,
+            mediaLocalRoots: ctx.mediaLocalRoots,
+            mediaReadFile: ctx.mediaReadFile,
+        };
+    }
+    return { mediaLocalRoots: getAgentScopedMediaLocalRoots(ctx.cfg, ctx.agentId ?? undefined) };
+}
 function listEnabledAccounts(cfg) {
     return listMaxAccountIds(cfg)
         .map((accountId) => resolveMaxAccount({ cfg, accountId }))
@@ -25,32 +85,30 @@ function readTargetParam(params, required = true) {
 /**
  * Media sources in order: the direct media field first, then every
  * structured `attachments[]` item (one source per item). Duplicates dropped.
+ * A path or URL wins over `buffer` (core may fill both; the path goes through
+ * the guarded loader); `buffer` alone is sent as inline content.
  */
-function readMediaSources(params) {
+function readMediaSources(params, maxBytes) {
     const sources = [];
     const add = (value) => {
         if (value && !sources.includes(value))
             sources.push(value);
     };
-    for (const key of mediaSourceKeys) {
-        const value = readStringParam(params, key, { trim: false });
-        if (value) {
-            add(value);
-            break;
+    const readPath = (source) => {
+        for (const key of mediaSourceParams) {
+            const value = readStringParam(source, key, { trim: false });
+            if (value)
+                return value;
         }
-    }
+        return undefined;
+    };
+    add(readPath(params) ?? readInlineMedia(params, maxBytes));
     if (Array.isArray(params.attachments)) {
         for (const item of params.attachments) {
             if (!item || typeof item !== 'object' || Array.isArray(item))
                 continue;
             const attachment = item;
-            for (const key of mediaSourceKeys) {
-                const value = typeof attachment[key] === 'string' ? attachment[key] : undefined;
-                if (value) {
-                    add(value);
-                    break;
-                }
-            }
+            add(readPath(attachment) ?? readInlineMedia(attachment, maxBytes));
         }
     }
     return sources;
@@ -77,7 +135,7 @@ async function sendMaxMediaSources(to, caption, sources, opts) {
         ...opts,
         onError: (err, failed) => {
             firstError ??= err;
-            errors.push(`${failed.join(', ')}: ${String(err)}`);
+            errors.push(`${failed.map(describeMaxMediaSource).join(', ')}: ${String(err)}`);
         },
     });
     if (messageIds.length === 0 && firstError !== undefined)
@@ -119,6 +177,10 @@ function readLocationParams(params) {
         return undefined;
     return { latitude: lat, longitude: lng };
 }
+/** Voice delivery of audio: core's `asVoice` (or its `audioAsVoice` alias), boolean or "true". */
+function readAsVoiceParam(params) {
+    return [params.asVoice, params.audioAsVoice].some((value) => value === true || (typeof value === 'string' && value.trim() === 'true'));
+}
 /** Contact card fields: contactId (MAX user id) and vcfPhone/phone next to the given name. */
 function readContactParams(params, name) {
     const contactId = params.contactId != null ? Number(params.contactId) : undefined;
@@ -129,19 +191,45 @@ function readContactParams(params, name) {
         vcfPhone: vcfPhone ?? undefined,
     };
 }
+const MAX_MESSAGE_ACTIONS = [
+    'send',
+    'edit',
+    'delete',
+    'sticker',
+    'sendAttachment',
+    'pin',
+    'unpin',
+];
 export const maxMessageActions = {
-    describeMessageTool: ({ cfg }) => {
+    describeMessageTool: ({ cfg, accountId }) => {
         const accounts = listEnabledAccounts(cfg);
         if (accounts.length === 0) {
             return null;
         }
+        // channels.max.actions.<action>: false hides the action from the tool.
+        const gate = createActionGate(resolveMaxAccount({ cfg, accountId }).config.actions);
         return {
-            actions: ['send', 'edit', 'delete', 'sticker', 'sendAttachment', 'pin', 'unpin'],
+            actions: MAX_MESSAGE_ACTIONS.filter((name) => gate(name)),
             // presentation → inline keyboard + MAX markdown (presentation.ts);
             // delivery-pin → PUT /chats/{chatId}/pin on the sent message.
             capabilities: ['presentation', 'delivery-pin'],
+            mediaSourceParams: { send: mediaSourceParams, sendAttachment: mediaSourceParams },
         };
     },
+    // A send with a presentation is delivered by core itself (outbound adapter
+    // sendPayload), never reaching handleAction: the action gate and scope are
+    // checked here first, then core delivers the payload unchanged. Any other
+    // send declines (null) and keeps the handleAction path, which checks them.
+    prepareSendPayload: async ({ ctx, to, payload, replyToId }) => {
+        if (!payload.presentation)
+            return null;
+        const account = resolveMaxAccount({ cfg: ctx.cfg, accountId: ctx.accountId });
+        if (!createActionGate(account.config.actions)('send')) {
+            throw new Error('MAX action "send" is disabled by channels.max.actions');
+        }
+        await assertMaxActionInScope(ctx, account, { to, replyTo: replyToId });
+        return payload;
+    },
     extractToolSend: ({ args }) => {
         // Extract routing info for ALL actions (send, edit, delete, sticker)
         // Core uses extractToolSend for routing all message tool actions to plugin
@@ -162,13 +250,14 @@ export const maxMessageActions = {
         if (!to) {
             return null;
         }
-        // Strip provider prefix (e.g. "max:188862440" → "188862440")
+        // Strip provider prefix (e.g. "max:123456789" → "123456789")
         if (to.startsWith('max:'))
             to = to.slice(4);
         const accountId = typeof args.accountId === 'string' ? args.accountId.trim() : undefined;
         return { to, accountId };
     },
-    handleAction: async ({ action, params, cfg, accountId }) => {
+    handleAction: async (ctx) => {
+        const { action, params, cfg, accountId } = ctx;
         const account = resolveMaxAccount({
             cfg,
             accountId,
@@ -176,7 +265,15 @@ export const maxMessageActions = {
         if (!account.token) {
             throw new Error('MAX bot token not configured');
         }
-        // Strip provider prefix from target (e.g. "max:188862440" → "188862440")
+        if (!createActionGate(account.config.actions)(action)) {
+            throw new Error(`MAX action "${action}" is disabled by channels.max.actions`);
+        }
+        // Notification and link-preview options of sends: core's `silent` flag
+        // beats the account defaults (channels.max.notify / disableLinkPreview).
+        const sendFlags = resolveMaxSendFlags(account.config, {
+            silent: typeof params.silent === 'boolean' ? params.silent : undefined,
+        });
+        // Strip provider prefix from target (e.g. "max:123456789" → "123456789")
         const stripPrefix = (val) => {
             if (!val)
                 return val;
@@ -184,6 +281,10 @@ export const maxMessageActions = {
         };
         if (action === 'send') {
             const to = stripPrefix(readTargetParam(params));
+            await assertMaxActionInScope(ctx, account, {
+                to,
+                replyTo: readStringParam(params, 'replyTo'),
+            });
             const presentation = normalizeMessagePresentation(params.presentation);
             const pin = readMaxDeliveryPin(params.delivery, params.pin);
             const content = readStringParam(params, 'message', {
@@ -233,14 +334,16 @@ export const maxMessageActions = {
                 const rendered = await materializeMaxPresentation({ text: content, presentation });
                 const renderedButtons = readMaxChannelButtons(rendered.channelData);
                 const text = rendered.text ?? '';
-                const chunks = text.length > MAX_TEXT_LIMIT
-                    ? getMaxRuntime().channel.text.chunkMarkdownText(text, MAX_TEXT_LIMIT)
+                const chunkLimit = resolveMaxTextChunkLimit(cfg, account.accountId);
+                const chunks = text.length > chunkLimit
+                    ? getMaxRuntime().channel.text.chunkMarkdownText(text, chunkLimit)
                     : [text];
                 let firstMessageId = '';
                 let firstChatType;
                 for (let index = 0; index < chunks.length; index += 1) {
                     const sent = await sendMaxMessage(to, chunks[index], {
                         token: account.token,
+                        ...sendFlags,
                         replyToMessageId: index === 0 ? (readStringParam(params, 'replyTo') ?? undefined) : undefined,
                         format: 'markdown',
                         buttons: index === chunks.length - 1 ? renderedButtons : undefined,
@@ -267,6 +370,7 @@ export const maxMessageActions = {
                 if (firstCode) {
                     const result = await sendMaxSticker(to, firstCode, {
                         token: account.token,
+                        ...sendFlags,
                         replyToMessageId: replyTo ?? undefined,
                     });
                     return withPin(result.messageId, result.raw.message?.recipient?.chat_type);
@@ -277,6 +381,7 @@ export const maxMessageActions = {
             if (location) {
                 const result = await sendMaxLocation(to, location, content || undefined, {
                     token: account.token,
+                    ...sendFlags,
                     replyToMessageId: replyTo ?? undefined,
                     format: 'markdown',
                 });
@@ -287,25 +392,32 @@ export const maxMessageActions = {
             if (contactName) {
                 const result = await sendMaxContact(to, readContactParams(params, contactName), {
                     token: account.token,
+                    ...sendFlags,
                     replyToMessageId: replyTo ?? undefined,
                 });
                 return withPin(result.messageId, result.raw.message?.recipient?.chat_type);
             }
             // Media: direct media fields and every structured attachments[] item.
-            const mediaSources = readMediaSources(params);
+            const mediaMaxBytes = (account.config.mediaMaxMb ?? 20) * 1024 * 1024;
+            const mediaSources = readMediaSources(params, mediaMaxBytes);
             if (mediaSources.length) {
-                // Local path or URL: https image links go by URL, other remote media
-                // is downloaded to a temp file and uploaded.
+                // Local paths only under the allowed roots (resolveActionLocalMedia);
+                // public https image links go by URL, other remote media is
+                // downloaded through the SSRF-guarded fetcher and uploaded.
                 const result = await sendMaxMediaSources(to, content, mediaSources, {
                     token: account.token,
+                    ...sendFlags,
                     replyToMessageId: replyTo ?? undefined,
                     format: 'markdown',
-                    mediaMaxBytes: (account.config.mediaMaxMb ?? 20) * 1024 * 1024,
+                    mediaMaxBytes,
+                    localMedia: resolveActionLocalMedia(ctx),
+                    asVoice: readAsVoiceParam(params),
                 });
                 return withPin(result.messageId, result.chatType, mediaResultExtra(result));
             }
             const result = await sendMaxMessage(to, content, {
                 token: account.token,
+                ...sendFlags,
                 replyToMessageId: replyTo ?? undefined,
                 format: 'markdown',
                 buttons,
@@ -314,6 +426,7 @@ export const maxMessageActions = {
         }
         if (action === 'edit') {
             const messageId = readStringParam(params, 'messageId', { required: true });
+            await assertMaxActionInScope(ctx, account, { messageId });
             const text = readStringParam(params, 'message', {
                 required: true,
                 allowEmpty: true,
@@ -326,6 +439,7 @@ export const maxMessageActions = {
         }
         if (action === 'delete') {
             const messageId = readStringParam(params, 'messageId', { required: true });
+            await assertMaxActionInScope(ctx, account, { messageId });
             await deleteMaxMessage(messageId, {
                 token: account.token,
             });
@@ -334,6 +448,7 @@ export const maxMessageActions = {
         if (action === 'pin') {
             const to = stripPrefix(readTargetParam(params));
             const messageId = readStringParam(params, 'messageId', { required: true });
+            await assertMaxActionInScope(ctx, account, { to });
             const notifyParam = params.notify;
             const pinned = await pinMaxMessage(to, messageId, {
                 token: account.token,
@@ -346,11 +461,16 @@ export const maxMessageActions = {
         }
         if (action === 'unpin') {
             const to = stripPrefix(readTargetParam(params));
+            await assertMaxActionInScope(ctx, account, { to });
             await unpinMaxMessage(to, { token: account.token });
             return jsonResult({ ok: true, to, pinned: false });
         }
         if (action === 'sticker') {
             const to = stripPrefix(readTargetParam(params));
+            await assertMaxActionInScope(ctx, account, {
+                to,
+                replyTo: readStringParam(params, 'replyTo'),
+            });
             // stickerId may come as string or string[] from message tool schema
             const rawStickerId = params.stickerId;
             let stickerCode = Array.isArray(rawStickerId)
@@ -366,6 +486,7 @@ export const maxMessageActions = {
             const replyTo = readStringParam(params, 'replyTo');
             const result = await sendMaxSticker(to, stickerCode, {
                 token: account.token,
+                ...sendFlags,
                 replyToMessageId: replyTo ?? undefined,
             });
             return jsonResult({ ok: true, to, messageId: result.messageId });
@@ -373,15 +494,20 @@ export const maxMessageActions = {
         if (action === 'sendAttachment') {
             const to = stripPrefix(readTargetParam(params));
             const replyTo = readStringParam(params, 'replyTo');
+            await assertMaxActionInScope(ctx, account, { to, replyTo });
             const caption = readStringParam(params, 'message') ?? readStringParam(params, 'caption') ?? '';
             const attachType = readStringParam(params, 'type') ?? readStringParam(params, 'attachmentType') ?? '';
-            const mediaSources = readMediaSources(params);
+            const mediaMaxBytes = (account.config.mediaMaxMb ?? 20) * 1024 * 1024;
+            const mediaSources = readMediaSources(params, mediaMaxBytes);
             if (mediaSources.length) {
                 const result = await sendMaxMediaSources(to, caption, mediaSources, {
                     token: account.token,
+                    ...sendFlags,
                     replyToMessageId: replyTo ?? undefined,
                     format: 'markdown',
-                    mediaMaxBytes: (account.config.mediaMaxMb ?? 20) * 1024 * 1024,
+                    mediaMaxBytes,
+                    localMedia: resolveActionLocalMedia(ctx),
+                    asVoice: readAsVoiceParam(params),
                 });
                 return jsonResult({
                     ok: true,
@@ -399,6 +525,7 @@ export const maxMessageActions = {
                 if (location) {
                     const result = await sendMaxLocation(to, location, caption || undefined, {
                         token: account.token,
+                        ...sendFlags,
                         replyToMessageId: replyTo ?? undefined,
                     });
                     return jsonResult({ ok: true, to, messageId: result.messageId });
@@ -410,11 +537,12 @@ export const maxMessageActions = {
                 const contactName = readStringParam(params, 'contactName') ?? readStringParam(params, 'name') ?? 'Unknown';
                 const result = await sendMaxContact(to, readContactParams(params, contactName), {
                     token: account.token,
+                    ...sendFlags,
                     replyToMessageId: replyTo ?? undefined,
                 });
                 return jsonResult({ ok: true, to, messageId: result.messageId });
             }
-            throw new Error("sendAttachment: unknown type. Use media/filePath for files, or type='location' / type='contact'");
+            throw new Error("sendAttachment: unknown type. Use media/filePath (or base64 buffer with filename) for files, or type='location' / type='contact'");
         }
         throw new Error(`Action ${action} is not supported for provider ${providerId}.`);
     },