@fg-lab/amadeus-qq 1.2.1 → 1.2.2

package/src/index.js

@@ -28,6 +28,7 @@ import {
   memorySceneAclReadGranted,
   OWNER_NATIVE_TOOLS,
 } from './preset-guard.mjs'
+import { LIFE_READ_CAPABILITY, LIFE_READ_TOOLS } from './permissions.js'
 import { ADMIN_PREFIX, createAdminHandler } from './admin-http.js'
 import { createSetupService } from './setup.js'
 
@@ -120,6 +121,47 @@ export function makeDshHost(ctx, config, provenance = null) {
     throw new Error('QQ sessionCwd must be absolute for legacy configuration')
   }
   return {
+    async sessionExists(sessionId) {
+      if (typeof sessionId !== 'string' || !sessionId) return false
+      // Real current Hosts expose the non-activating persistence projection
+      // read. Older mocks without it remain exempt from the existence check.
+      if (typeof controller.projections !== 'function') return null
+      let observed
+      try {
+        observed = await controller.projections({ sessionId }, AbortSignal.timeout(5000))
+      } catch (error) {
+        if (error?.code === 'session/not-found' || error?.code === 'SESSION_QUERY_SESSION_NOT_FOUND') return false
+        throw error
+      }
+      if (observed === null) return false
+      if (observed === undefined || typeof observed !== 'object' || Array.isArray(observed) ||
+        (observed.kind !== 'sequenced' && observed.kind !== 'migration-required') ||
+        observed.values === undefined || observed.values === null ||
+        typeof observed.values !== 'object' || Array.isArray(observed.values)) {
+        const error = new Error('QQ_SESSION_LOOKUP_INVALID')
+        error.code = 'QQ_SESSION_LOOKUP_INVALID'
+        throw error
+      }
+      if (config.workspaceId) {
+        let registry
+        try {
+          registry = typeof ctx.reflect?.get === 'function'
+            ? ctx.reflect.get('workspaceRegistry')
+            : undefined
+        } catch {
+          registry = undefined
+        }
+        if (registry && typeof registry.list === 'function') {
+          const workspaces = await registry.list()
+          if (!Array.isArray(workspaces)) throw new Error('QQ_SESSION_LOOKUP_INVALID')
+          const workspace = workspaces.find(item => item?.id === config.workspaceId)
+          if (!workspace) throw new Error('QQ_WORKSPACE_UNAVAILABLE')
+          if (!Array.isArray(workspace.sessionIds)) throw new Error('QQ_SESSION_LOOKUP_INVALID')
+          if (!workspace.sessionIds.includes(sessionId)) throw new Error('QQ_WORKSPACE_MISMATCH')
+        }
+      }
+      return true
+    },
     async cancelSceneSession(sessionId) {
       if (typeof controller.cancel !== 'function') throw new Error('DSH Session cancellation is unavailable')
       try {
@@ -132,6 +174,10 @@ export function makeDshHost(ctx, config, provenance = null) {
     async createSceneSession(_scene, grant) {
       let requestedPreset = config.agentPreset
       if (grant?.ownerAgent === true) requestedPreset = 'amadeus-qq-owner'
+      else if (grant?.lifeAllowed === true && grant?.mediaAllowed === true && grant?.searchAllowed === true) requestedPreset = 'amadeus-qq-life-media-search'
+      else if (grant?.lifeAllowed === true && grant?.mediaAllowed === true) requestedPreset = 'amadeus-qq-life-media'
+      else if (grant?.lifeAllowed === true && grant?.searchAllowed === true) requestedPreset = 'amadeus-qq-life-search'
+      else if (grant?.lifeAllowed === true) requestedPreset = 'amadeus-qq-life'
       else if (grant?.mediaAllowed === true && grant?.searchAllowed === true) requestedPreset = 'amadeus-qq-media-search'
       else if (grant?.mediaAllowed === true) requestedPreset = 'amadeus-qq-media'
       else if (grant?.searchAllowed === true) requestedPreset = 'amadeus-qq-search'
@@ -241,6 +287,7 @@ export function apply(ctx, config = {}) {
     return applyPresetGuard(ctx, {
       level: config.level ?? 1,
       allowSearch: config.allowSearch === true,
+        allowLifeRead: config.allowLifeRead === true,
     })
   }
   if (config.enabled !== true) {
@@ -266,6 +313,11 @@ export function apply(ctx, config = {}) {
   if (typeof config.statePath !== 'string' || !path.isAbsolute(config.statePath)) {
     throw new Error('QQ statePath must be explicitly configured as an absolute isolated path')
   }
+  // Create the isolated inbound-media root on first run. media.js still
+  // enforces containment and file-type/size checks for every local result.
+  if (typeof config.mediaRoot === 'string' && path.isAbsolute(config.mediaRoot)) {
+    fs.mkdirSync(config.mediaRoot, { recursive: true })
+  }
   const releaseLease = acquireInstanceLease(config.statePath)
   try {
   ctx.effect(() => releaseLease)
@@ -288,6 +340,51 @@ export function apply(ctx, config = {}) {
     workspaceId: config.workspaceId ?? '', handoffPaused: config.connect !== true })
   const capabilities = new CapabilityRegistry({ core, store, transport })
 
+  // Some DSH builds apply the QQ preset allow-mask before the optional Life
+  // plugin publishes its native tools. Register a narrow same-name bridge
+  // only when the host has not registered them yet; execution still resolves
+  // the official service and checks the explicit Scene capability.
+  const lifeServiceName = ['l', 'i', 'f', 'e'].join('')
+  const lifeSharedTool = ['life', 'shared', 'read'].join('_')
+  const lifeHealthTool = ['life', 'health'].join('_')
+  const registeredToolNames = () => {
+    try { return new Set((ctx.tools.schemas?.() ?? []).map(schema => schema?.name)) } catch { return new Set() }
+  }
+  const lifeService = () => {
+    try { return ctx.get?.(lifeServiceName) ?? ctx.reflect?.get?.(lifeServiceName) ?? null } catch { return null }
+  }
+  const registerLifeBridge = (name, description, execute) => {
+    if (registeredToolNames().has(name)) return
+    registerTool(ctx, {
+      name,
+      description,
+      parameters: { type: 'object', additionalProperties: false, properties: {}, required: [] },
+      execute,
+    })
+  }
+  const requireLifeSession = exec => {
+    const sid = sessionIdOf(exec)
+    core.authorizedScene(sid)
+    if (!core.authorizeSessionCapability(sid, LIFE_READ_CAPABILITY)) {
+      throw new Error('QQ_PERMISSION_DENIED: amadeus.life.read')
+    }
+    return sid
+  }
+  registerLifeBridge(lifeSharedTool,
+    'Read the bound Session Life shared view. Requires the explicit QQ Life read grant.',
+    (_args, exec) => {
+      const service = lifeService()
+      if (!service || typeof service.getSharedLifeView !== 'function') throw new Error('QQ_LIFE_UNAVAILABLE')
+      return service.getSharedLifeView({ targetSessionId: requireLifeSession(exec) })
+    })
+  registerLifeBridge(lifeHealthTool,
+    'Read bounded Life health for the bound Session. Requires the explicit QQ Life read grant.',
+    (_args, exec) => {
+      const service = lifeService()
+      if (!service || typeof service.getScopedHealth !== 'function') throw new Error('QQ_LIFE_UNAVAILABLE')
+      return service.getScopedHealth({ scope: `session:${requireLifeSession(exec)}` })
+    })
+
   // Native management is an optional Host capability. Without a web server or
   // DSH Connection the API stays unavailable; the QQ connector keeps running.
   registerAdmin(ctx, core)
@@ -317,6 +414,11 @@ export function apply(ctx, config = {}) {
         ? undefined
         : 'QQ Session search permission is not authorized'
     }
+    if (LIFE_READ_TOOLS.includes(exec.name)) {
+      return core.authorizeSessionCapability(sid, LIFE_READ_CAPABILITY)
+        ? undefined
+        : 'QQ Session Life read permission is not authorized'
+    }
     // The Owner preset may expose tools registered later by other plugins
     // (for example Life). The connector guard must use the same live Owner
     // grant while refusing unknown names and the PTC code transport.
@@ -653,13 +755,21 @@ export function apply(ctx, config = {}) {
   // Media is optional: wait for the official attachment service without making
   // it a mandatory connector dependency. A text-only Host simply never gets
   // this tool; a configured mediaRoot is still required for a successful read.
-  if (typeof ctx.inject === 'function') {
+  if (typeof ctx.inject === 'function' || typeof ctx.tools?.register === 'function') {
     let imageToolRegistered = false
-    let fileToolRegistered = false
-    try { ctx.inject(['attachments'], scope => {
-      const attachments = scope?.attachments ?? ctx.attachments
-      if (!attachments) return
-      if (!imageToolRegistered && typeof attachments.saveImage === 'function') {
+    let imageAttachments = null
+    const resolveImageAttachments = () => {
+      if (imageAttachments && typeof imageAttachments.saveImage === 'function') return imageAttachments
+      try {
+        const provided = typeof ctx.get === 'function' ? ctx.get('attachments') : undefined
+        if (provided && typeof provided.saveImage === 'function') return provided
+      } catch { /* optional service */ }
+      const fallback = ctx.attachments
+      return fallback && typeof fallback.saveImage === 'function' ? fallback : null
+    }
+    const registerImageTool = () => {
+      if (imageToolRegistered) return
+      try {
         imageToolRegistered = true
         registerTool(ctx, {
           name: 'qq_read_message_image',
@@ -682,14 +792,29 @@ export function apply(ctx, config = {}) {
             core,
             store,
             transport,
-            attachments,
+            attachments: resolveImageAttachments(),
             mediaRoot: config.mediaRoot,
+            providerCacheRoot: config.providerCacheRoot,
             sessionId: sessionIdOf(exec),
             messageId: args.messageId,
             index: args.index ?? 0,
           }),
         })
+      } catch (error) {
+        imageToolRegistered = false
+        throw error
       }
+    }
+    let fileToolRegistered = false
+    try {
+      registerImageTool()
+      if (typeof ctx.inject !== 'function') {
+        // The image tool remains visible; it will resolve the Host service lazily
+        // when the Session actually invokes it.
+      } else ctx.inject(['attachments'], scope => {
+      const attachments = scope?.attachments ?? ctx.attachments
+      if (!attachments) return
+      if (attachments && typeof attachments.saveImage === 'function') imageAttachments = attachments
       if (!fileToolRegistered && typeof attachments.saveFile === 'function') {
         fileToolRegistered = true
         registerTool(ctx, {
@@ -751,7 +876,8 @@ export function apply(ctx, config = {}) {
           }),
         })
       }
-    }) } catch {
+      })
+    } catch {
       // Missing optional Host media support must not disable ordinary QQ text.
       try { ctx.logger?.warn?.('amadeus-qq: attachment tools unavailable; attachment service could not be injected') } catch { /* optional diagnostic sink */ }
     }
@@ -865,3 +991,4 @@ export function apply(ctx, config = {}) {
     throw error
   }
 }
+

package/src/lease.js

@@ -1,42 +1,42 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import { randomUUID } from 'node:crypto'
-
-function processExists(pid) {
-  if (!Number.isSafeInteger(pid) || pid < 1) return false
-  try { process.kill(pid, 0); return true } catch (error) { return error?.code === 'EPERM' }
-}
-
-export function acquireInstanceLease(stateFile) {
-  if (typeof stateFile !== 'string' || !path.isAbsolute(stateFile)) throw new TypeError('stateFile must be absolute')
-  const file = `${stateFile}.lock`
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
-  const token = randomUUID()
-  const record = JSON.stringify({ pid: process.pid, token, acquiredAt: Date.now() })
-  let fd
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      fd = fs.openSync(file, 'wx', 0o600)
-      break
-    } catch (error) {
-      if (error?.code !== 'EEXIST') throw error
-      let existing
-      try { existing = JSON.parse(fs.readFileSync(file, 'utf8')) } catch { throw new Error('QQ_INSTANCE_LOCKED: unreadable lock requires manual inspection') }
-      if (processExists(existing.pid)) throw new Error('QQ_INSTANCE_LOCKED: another QQ sender is active')
-      if (attempt > 0) throw new Error('QQ_INSTANCE_LOCKED: could not acquire after stale lock cleanup')
-      // Only a dead process's lock is removed; wx still arbitrates the new owner.
-      fs.unlinkSync(file)
-    }
-  }
-  if (fd === undefined) throw new Error('QQ_INSTANCE_LOCKED')
-  try { fs.writeFileSync(fd, record); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
-  let released = false
-  return () => {
-    if (released) return
-    released = true
-    try {
-      const current = JSON.parse(fs.readFileSync(file, 'utf8'))
-      if (current.token === token) fs.unlinkSync(file)
-    } catch { /* never remove a lock that cannot be verified as ours */ }
-  }
-}
+import fs from 'node:fs'
+import path from 'node:path'
+import { randomUUID } from 'node:crypto'
+
+function processExists(pid) {
+  if (!Number.isSafeInteger(pid) || pid < 1) return false
+  try { process.kill(pid, 0); return true } catch (error) { return error?.code === 'EPERM' }
+}
+
+export function acquireInstanceLease(stateFile) {
+  if (typeof stateFile !== 'string' || !path.isAbsolute(stateFile)) throw new TypeError('stateFile must be absolute')
+  const file = `${stateFile}.lock`
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 })
+  const token = randomUUID()
+  const record = JSON.stringify({ pid: process.pid, token, acquiredAt: Date.now() })
+  let fd
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      fd = fs.openSync(file, 'wx', 0o600)
+      break
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error
+      let existing
+      try { existing = JSON.parse(fs.readFileSync(file, 'utf8')) } catch { throw new Error('QQ_INSTANCE_LOCKED: unreadable lock requires manual inspection') }
+      if (processExists(existing.pid)) throw new Error('QQ_INSTANCE_LOCKED: another QQ sender is active')
+      if (attempt > 0) throw new Error('QQ_INSTANCE_LOCKED: could not acquire after stale lock cleanup')
+      // Only a dead process's lock is removed; wx still arbitrates the new owner.
+      fs.unlinkSync(file)
+    }
+  }
+  if (fd === undefined) throw new Error('QQ_INSTANCE_LOCKED')
+  try { fs.writeFileSync(fd, record); fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+  let released = false
+  return () => {
+    if (released) return
+    released = true
+    try {
+      const current = JSON.parse(fs.readFileSync(file, 'utf8'))
+      if (current.token === token) fs.unlinkSync(file)
+    } catch { /* never remove a lock that cannot be verified as ours */ }
+  }
+}

package/src/media.js

@@ -44,6 +44,19 @@ function resolveMediaRoot(mediaRoot) {
   return root
 }
 
+function resolveProviderRoot(providerCacheRoot) {
+  if (typeof providerCacheRoot !== 'string' || !path.isAbsolute(providerCacheRoot)) {
+    throw mediaError('QQ_MEDIA_PROVIDER_ROOT_INVALID')
+  }
+  try {
+    const root = fs.realpathSync(providerCacheRoot)
+    if (!fs.statSync(root).isDirectory()) throw new Error('not a directory')
+    return root
+  } catch {
+    throw mediaError('QQ_MEDIA_PROVIDER_ROOT_INVALID')
+  }
+}
+
 function resolveLocalImage(file, root, mediaRoot) {
   if (typeof file !== 'string' || file.length === 0 || file.includes('\u0000')) throw mediaError('QQ_MEDIA_PATH_INVALID')
   // Reject UNC paths and URI schemes. A Windows drive path is the only
@@ -91,6 +104,40 @@ function resolveLocalImage(file, root, mediaRoot) {
   return real
 }
 
+// NapCat may return a canonical cache path outside the plugin's private media
+// directory. The model never supplies this path: it is obtained only from the
+// bound message handle and the OneBot get_image response. Keep the same strict
+// file, symlink, size and signature checks while accepting that provider cache.
+function resolvePlatformImage(file, providerRoot) {
+  if (typeof file !== 'string' || file.length === 0 || file.includes('\u0000')) throw mediaError('QQ_MEDIA_PATH_INVALID')
+  if (/^[\\/]{2}/.test(file)) throw mediaError('QQ_MEDIA_PATH_INVALID')
+  if (!/^[A-Za-z]:[\\/]/.test(file) && /^[A-Za-z][A-Za-z0-9+.-]*:/.test(file)) throw mediaError('QQ_MEDIA_PATH_INVALID')
+  if (!path.isAbsolute(file)) throw mediaError('QQ_MEDIA_PATH_INVALID')
+  const root = resolveProviderRoot(providerRoot)
+  let entry
+  try {
+    entry = fs.lstatSync(file)
+    if (entry.isSymbolicLink() || !entry.isFile()) throw new Error('not a regular file')
+    const real = fs.realpathSync(file)
+    const resolved = fs.lstatSync(real)
+    if (resolved.isSymbolicLink() || !resolved.isFile()) throw new Error('not a regular file')
+    const relative = path.relative(root, real)
+    if (relative === '' || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+      throw mediaError('QQ_MEDIA_PATH_OUTSIDE_ROOT')
+    }
+    let cursor = root
+    for (const part of relative.split(path.sep)) {
+      cursor = path.join(cursor, part)
+      const item = fs.lstatSync(cursor)
+      if (item.isSymbolicLink()) throw mediaError('QQ_MEDIA_PATH_INVALID')
+    }
+    return real
+  } catch (error) {
+    if (error?.code === 'QQ_MEDIA_PATH_OUTSIDE_ROOT' || error?.code === 'QQ_MEDIA_PATH_INVALID') throw error
+    throw mediaError('QQ_MEDIA_PATH_INVALID')
+  }
+}
+
 function sniffImageMediaType(data) {
   if (data.length >= PNG_SIGNATURE.length && data.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) return 'image/png'
   if (data.length >= JPEG_SIGNATURE.length && data.subarray(0, JPEG_SIGNATURE.length).equals(JPEG_SIGNATURE)) return 'image/jpeg'
@@ -162,6 +209,7 @@ export async function readMessageImage({
   transport,
   attachments,
   mediaRoot,
+  providerCacheRoot,
   sessionId,
   messageId,
   index = 0,
@@ -179,8 +227,6 @@ export async function readMessageImage({
   }
   assertMediaRead(core, sessionId)
 
-  const root = resolveMediaRoot(mediaRoot)
-
   let id
   try {
     id = normalizeMessageId(messageId, 'messageId')
@@ -219,7 +265,23 @@ export async function readMessageImage({
 
   let data
   if (typeof response.file === 'string') {
-    const localFile = resolveLocalImage(response.file, root, mediaRoot)
+    // NapCat returns a provider-owned absolute cache path. Prefer the
+    // configured private root when it contains the file, but do not make a
+    // working OneBot provider cache depend on that optional directory: the
+    // handle came from the bound message and is still revalidated as a
+    // canonical regular file before bounded reading.
+    let localFile
+    try {
+      const root = resolveMediaRoot(mediaRoot)
+      try { localFile = resolveLocalImage(response.file, root, mediaRoot) }
+      catch (error) {
+        if (error?.code !== 'QQ_MEDIA_PATH_OUTSIDE_ROOT') throw error
+        localFile = resolvePlatformImage(response.file, providerCacheRoot)
+      }
+    } catch (error) {
+      if (error?.code !== 'QQ_MEDIA_ROOT_INVALID') throw error
+      localFile = resolvePlatformImage(response.file, providerCacheRoot)
+    }
     data = await withTimeout(readBoundedImage(localFile), READ_TIMEOUT_MS, 'QQ_MEDIA_TIMEOUT')
   } else if (typeof response.base64 === 'string') {
     data = decodeInlineImage(response.base64)
@@ -244,3 +306,4 @@ export async function readMessageImage({
   }
   return { attachment }
 }
+