@kafca/agentdock 0.1.55 → 0.1.56

package/dist-electron/services/local-ai-core/src/channel/weixin/local-core-weixin-gateway.js

@@ -9,10 +9,12 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_2 = require("node:crypto");
+const node_stream_1 = require("node:stream");
 const desktop_js_1 = require("../../../../../shared/desktop.js");
 const local_core_errors_js_1 = require("../../kernel/local-core-errors.js");
 const content_js_1 = require("../shared/content.js");
 const file_utils_js_1 = require("../shared/file-utils.js");
+const inbound_attachment_store_js_1 = require("../shared/inbound-attachment-store.js");
 const thread_routing_js_1 = require("../shared/thread-routing.js");
 const base_channel_gateway_js_1 = require("../shared/base-channel-gateway.js");
 const channel_keys_js_1 = require("../shared/channel-keys.js");
@@ -110,6 +112,7 @@ function createWeixinAttachmentContentPart(att) {
         return {
             type: 'image',
             data: att.data,
+            ...(att.uri ? { uri: att.uri } : {}),
             mimeType: att.mimeType,
             fileName: att.name,
         };
@@ -149,6 +152,7 @@ function renderBridgeContentForWeixin(event) {
 class LocalCoreWeixinGateway extends base_channel_gateway_js_1.BaseChannelGateway {
     processedInboundMessages = new Map();
     pollErrorLogWindows = new Map();
+    inboundAttachmentStore = new inbound_attachment_store_js_1.FileSystemInboundAttachmentStore();
     platform = 'weixin';
     constructor(options) {
         super(options);
@@ -722,7 +726,16 @@ class LocalCoreWeixinGateway extends base_channel_gateway_js_1.BaseChannelGatewa
                     const attachmentParts = [];
                     if (mediaItems.length > 0) {
                         const uploadsDir = node_path_1.default.join(binding.stateDir, 'weixin-uploads');
+                        const mayMaterializeAttachments = binding.allowFrom === '*'
+                            || Boolean(this.options.store.getAuthorizedUser(binding.workspaceId, conversationId, binding.platformKey));
                         for (const [idx, item] of mediaItems.entries()) {
+                            const itemData = item.image_item ?? item.file_item ?? null;
+                            const declaredName = String(itemData?.file_name ?? (item.type === transport_js_1.IMAGE_ITEM_TYPE ? 'image' : 'file'));
+                            if (!mayMaterializeAttachments) {
+                                attachmentText += attachmentText ? '\n' : '';
+                                attachmentText += item.type === transport_js_1.IMAGE_ITEM_TYPE ? '[Image]' : `[File: ${declaredName}]`;
+                                continue;
+                            }
                             try {
                                 const att = await this.downloadMediaItem(item, msgId, idx, uploadsDir, binding);
                                 if (att) {
@@ -887,37 +900,58 @@ class LocalCoreWeixinGateway extends base_channel_gateway_js_1.BaseChannelGatewa
             aesKey = decoded.length === 16 ? decoded : decoded.length === 32 ? Buffer.from(decoded.toString('ascii'), 'hex') : undefined;
         }
         const cdnUrl = `${binding.cdnBaseUrl}/download?encrypted_query_param=${encodeURIComponent(encryptQueryParam)}`;
-        const resp = await fetch(cdnUrl, { signal: AbortSignal.timeout(30_000) });
-        if (!resp.ok)
-            throw new Error(`CDN HTTP ${resp.status}`);
-        const rawBuf = Buffer.from(await resp.arrayBuffer());
-        if (rawBuf.length === 0)
-            throw new Error('CDN returned empty data');
-        let resultBuf;
-        if (aesKey) {
-            const decipher = node_crypto_1.default.createDecipheriv('aes-128-ecb', aesKey, null);
-            decipher.setAutoPadding(true);
-            resultBuf = Buffer.concat([decipher.update(rawBuf), decipher.final()]);
-        }
-        else {
-            resultBuf = rawBuf;
-        }
-        const { ext, kind } = this.sniffExtAndKind(resultBuf);
         const declaredName = String(itemData?.file_name ?? (item.type === transport_js_1.IMAGE_ITEM_TYPE ? 'image' : 'file'));
-        const safeName = declaredName.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 64);
-        const safeMsgId = msgId.replace(/[^a-zA-Z0-9._-]/g, '_').slice(0, 48);
-        const fileName = `${safeMsgId}-${idx}-${safeName}${ext}`;
-        const filePath = node_path_1.default.join(uploadsDir, fileName);
-        node_fs_1.default.mkdirSync(uploadsDir, { recursive: true });
-        node_fs_1.default.writeFileSync(filePath, resultBuf);
+        const stored = await this.inboundAttachmentStore.save({
+            directory: uploadsDir,
+            storedFileName: `${msgId}-${idx}-${declaredName}`,
+            displayFileName: declaredName,
+            maxBytes: WEIXIN_MAX_UPLOAD_FILE_SIZE,
+            includeBase64: ({ prefix }) => this.sniffExtAndKind(prefix).kind === 'image',
+            finalizeStoredFileName: ({ storedFileName, prefix }) => `${storedFileName}${this.sniffExtAndKind(prefix).ext}`,
+            source: {
+                open: async () => {
+                    const resp = await fetch(cdnUrl, { signal: AbortSignal.timeout(30_000) });
+                    if (!resp.ok)
+                        throw new Error(`CDN HTTP ${resp.status}`);
+                    if (!resp.body)
+                        throw new Error('CDN returned no response body');
+                    const rawStream = node_stream_1.Readable.fromWeb(resp.body);
+                    if (!aesKey) {
+                        return { stream: rawStream };
+                    }
+                    const decipher = node_crypto_1.default.createDecipheriv('aes-128-ecb', aesKey, null);
+                    decipher.setAutoPadding(true);
+                    return { stream: rawStream.pipe(decipher) };
+                },
+            },
+        });
+        const { ext, kind } = this.sniffExtAndKind(stored.prefix);
+        const uri = await this.resolveInboundAttachmentUri(binding, stored.path);
         return {
-            path: filePath,
+            path: stored.path,
             kind,
             name: declaredName,
-            data: kind === 'image' ? resultBuf.toString('base64') : undefined,
+            data: stored.data,
             mimeType: kind === 'image' ? this.mimeTypeForImageExt(ext) : undefined,
+            ...(uri ? { uri } : {}),
         };
     }
+    async resolveInboundAttachmentUri(binding, filePath) {
+        const sandbox = binding.project?.agent?.options?.sandbox;
+        if (!sandbox?.enabled) {
+            return (0, inbound_attachment_store_js_1.resolveInboundAttachmentUri)({ filePath });
+        }
+        const workspace = await this.options.getWorkspaceRouter().getWorkspaceRegistryEntry(binding.workspaceId).catch(() => undefined);
+        if (!workspace) {
+            return undefined;
+        }
+        return (0, inbound_attachment_store_js_1.resolveInboundAttachmentUri)({
+            filePath,
+            workspacePath: workspace.path,
+            sandboxEnabled: true,
+            sandboxWorkspacePath: sandbox.workspace_mount_path,
+        });
+    }
     mimeTypeForImageExt(ext) {
         if (ext === '.jpg')
             return 'image/jpeg';

package/dist-electron/services/local-ai-core/src/kernel/local-core-errors.js

@@ -137,11 +137,12 @@ class LocalCoreError extends Error {
     info;
     constructor(code, message, input = {}) {
         const defaults = DEFAULTS[code];
-        super(message || defaults.userMessage);
+        const messageStr = coerceErrorMessage(message) || defaults.userMessage;
+        super(messageStr);
         this.name = 'LocalCoreError';
         this.info = {
             code,
-            message: message || defaults.userMessage,
+            message: messageStr,
             userMessage: input.userMessage || defaults.userMessage,
             severity: input.severity || defaults.severity,
             retryable: input.retryable ?? defaults.retryable,
@@ -158,9 +159,9 @@ function toLocalCoreErrorInfo(error, fallbackCode = 'internal_error', details =
     }
     const maybeInfo = error?.info;
     if (maybeInfo?.code && maybeInfo.message) {
-        return mergeDetails(maybeInfo, details);
+        return mergeDetails(ensureInfoMessageString(maybeInfo), details);
     }
-    const message = error instanceof Error ? error.message : String(error || '');
+    const message = coerceErrorMessage(error instanceof Error ? error.message : error);
     const classifiedCode = classifyErrorMessage(message, fallbackCode);
     return new LocalCoreError(classifiedCode, message || DEFAULTS[classifiedCode].userMessage, {
         details: Object.keys(details).length ? details : undefined,
@@ -171,7 +172,8 @@ function formatUserError(info) {
 }
 function formatLogError(info) {
     const suffix = info.cause ? ` cause=${info.cause}` : '';
-    return `${info.code}: ${info.message}${suffix}`;
+    const message = typeof info.message === 'string' ? info.message : safeStringify(info.message);
+    return `${info.code}: ${message}${suffix}`;
 }
 function errorInfoToHttpBody(info) {
     return {
@@ -253,3 +255,29 @@ function mergeDetails(info, details) {
         },
     };
 }
+function ensureInfoMessageString(info) {
+    if (typeof info.message === 'string') {
+        return info;
+    }
+    return { ...info, message: safeStringify(info.message) };
+}
+function coerceErrorMessage(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    if (value === null || value === undefined) {
+        return '';
+    }
+    return safeStringify(value);
+}
+function safeStringify(value) {
+    if (typeof value === 'string') {
+        return value;
+    }
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}

package/dist-electron/tests/integration/channel-inbound-attachment-store.test.js

@@ -0,0 +1,117 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_stream_1 = require("node:stream");
+const inbound_attachment_store_js_1 = require("../../services/local-ai-core/src/channel/shared/inbound-attachment-store.js");
+(0, node_test_1.default)('inbound attachment store streams a platform source into an atomic local file', async () => {
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'channel-inbound-store-'));
+    try {
+        const store = new inbound_attachment_store_js_1.FileSystemInboundAttachmentStore();
+        const stored = await store.save({
+            directory: tempDir,
+            storedFileName: 'message/one-report.pdf',
+            displayFileName: 'report.pdf',
+            source: {
+                open: async () => ({
+                    stream: node_stream_1.Readable.from([Buffer.from('hello '), Buffer.from('world')]),
+                    mimeType: 'application/pdf',
+                }),
+            },
+        });
+        strict_1.default.equal(stored.path, (0, node_path_1.join)(tempDir, 'message_one-report.pdf'));
+        strict_1.default.equal(stored.fileName, 'report.pdf');
+        strict_1.default.equal(stored.mimeType, 'application/pdf');
+        strict_1.default.equal(stored.size, 11);
+        strict_1.default.equal((0, node_fs_1.readFileSync)(stored.path, 'utf8'), 'hello world');
+        strict_1.default.deepEqual((0, node_fs_1.readdirSync)(tempDir), ['message_one-report.pdf']);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('inbound attachment store removes partial files when the size limit is exceeded', async () => {
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'channel-inbound-limit-'));
+    try {
+        const store = new inbound_attachment_store_js_1.FileSystemInboundAttachmentStore();
+        await strict_1.default.rejects(() => store.save({
+            directory: tempDir,
+            storedFileName: 'large.bin',
+            displayFileName: 'large.bin',
+            maxBytes: 4,
+            source: {
+                open: async () => ({ stream: node_stream_1.Readable.from([Buffer.from('12345')]) }),
+            },
+        }), /exceeds 4 bytes/);
+        strict_1.default.deepEqual((0, node_fs_1.readdirSync)(tempDir), []);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('inbound attachment store finalizes the filename before commit and can return base64', async () => {
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'channel-inbound-finalize-'));
+    try {
+        const store = new inbound_attachment_store_js_1.FileSystemInboundAttachmentStore();
+        const stored = await store.save({
+            directory: tempDir,
+            storedFileName: 'image-1',
+            displayFileName: 'image.png',
+            includeBase64: true,
+            finalizeStoredFileName: ({ storedFileName, prefix }) => {
+                strict_1.default.deepEqual(prefix.subarray(0, 4), Buffer.from([0x89, 0x50, 0x4e, 0x47]));
+                return `${storedFileName}.png`;
+            },
+            source: {
+                open: async () => ({ stream: node_stream_1.Readable.from([Buffer.from([0x89, 0x50, 0x4e, 0x47, 1, 2])]) }),
+            },
+        });
+        strict_1.default.equal(stored.path, (0, node_path_1.join)(tempDir, 'image-1.png'));
+        strict_1.default.equal(stored.data, 'iVBORwEC');
+        strict_1.default.deepEqual((0, node_fs_1.readdirSync)(tempDir), ['image-1.png']);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('inbound attachment store removes temporary data when filename finalization fails', async () => {
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'channel-inbound-finalize-error-'));
+    try {
+        const store = new inbound_attachment_store_js_1.FileSystemInboundAttachmentStore();
+        await strict_1.default.rejects(() => store.save({
+            directory: tempDir,
+            storedFileName: 'image-1',
+            displayFileName: 'image.png',
+            finalizeStoredFileName: () => {
+                throw new Error('cannot identify image');
+            },
+            source: {
+                open: async () => ({ stream: node_stream_1.Readable.from([Buffer.from('image')]) }),
+            },
+        }), /cannot identify image/);
+        strict_1.default.deepEqual((0, node_fs_1.readdirSync)(tempDir), []);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('inbound attachment URI maps workspace files into sandbox and hides external files', () => {
+    strict_1.default.equal((0, inbound_attachment_store_js_1.resolveInboundAttachmentUri)({
+        filePath: '/host/project/.agentdock/image.png',
+        workspacePath: '/host/project',
+        sandboxEnabled: true,
+        sandboxWorkspacePath: '/workspace',
+    }), 'file:///workspace/.agentdock/image.png');
+    strict_1.default.equal((0, inbound_attachment_store_js_1.resolveInboundAttachmentUri)({
+        filePath: '/host/state/image.png',
+        workspacePath: '/host/project',
+        sandboxEnabled: true,
+        sandboxWorkspacePath: '/workspace',
+    }), undefined);
+});

package/dist-electron/tests/integration/lark-gateway.test.js

@@ -9,6 +9,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const node_stream_1 = require("node:stream");
+const node_url_1 = require("node:url");
 const local_core_lark_gateway_js_1 = require("../../services/local-ai-core/src/channel/lark/local-core-lark-gateway.js");
 const runtime_state_js_1 = require("../../services/local-ai-core/src/channel/lark/runtime-state.js");
 function extractLarkCreatedMessage(request) {
@@ -1174,6 +1175,7 @@ function findLarkPostMdText(content) {
 });
 (0, node_test_1.default)('lark image messages are downloaded and forwarded as generic channel image parts', async () => {
     const sentMessages = [];
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lark-image-receive-'));
     const pngBytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
     const client = {
         im: {
@@ -1230,6 +1232,7 @@ function findLarkPostMdText(content) {
                 }],
         }),
         getWorkspaceRouter: () => ({
+            getWorkspaceRegistryEntry: async () => ({ path: tempDir }),
             getThreadSessionKey: (threadId) => `session:${threadId}`,
             sendThreadMessage: async (threadId, content) => {
                 sentMessages.push({ threadId, content });
@@ -1266,6 +1269,10 @@ function findLarkPostMdText(content) {
     strict_1.default.deepEqual(sentMessages[0]?.content?.contentParts?.map((part) => part.type), ['text', 'image']);
     strict_1.default.equal(sentMessages[0]?.content?.contentParts?.[1]?.mimeType, 'image/png');
     strict_1.default.equal(sentMessages[0]?.content?.contentParts?.[1]?.data, pngBytes.toString('base64'));
+    const imagePath = (0, node_path_1.join)(tempDir, '.agentdock', 'channel-uploads', 'lark', 'default', 'msg-image-1-img-key-1.png');
+    strict_1.default.equal(sentMessages[0]?.content?.contentParts?.[1]?.uri, (0, node_url_1.pathToFileURL)(imagePath).href);
+    strict_1.default.deepEqual((0, node_fs_1.readFileSync)(imagePath), pngBytes);
+    (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
 });
 (0, node_test_1.default)('lark file messages are downloaded and forwarded as generic channel file parts', async () => {
     const sentMessages = [];
@@ -1368,6 +1375,53 @@ function findLarkPostMdText(content) {
     strict_1.default.deepEqual((0, node_fs_1.readFileSync)(sentMessages[0]?.content?.contentParts?.[1]?.path), fileBytes);
     (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
 });
+(0, node_test_1.default)('lark file messages are not downloaded before the sender is authorized', async () => {
+    let resourceDownloads = 0;
+    let inboundMessage;
+    const gateway = new local_core_lark_gateway_js_1.LocalCoreLarkGateway({
+        store: {
+            getAuthorizedUser: () => undefined,
+        },
+        readConfig: async () => null,
+        getWorkspaceRouter: () => ({}),
+        eventBus: { emit: () => { }, on: () => () => { } },
+    });
+    const internals = gateway;
+    internals.runtime.set('default', {
+        workspaceId: 'default',
+        enabled: true,
+        status: 'running',
+        connected: true,
+        autoApprove: false,
+        client: {
+            im: {
+                messageResource: {
+                    get: async () => {
+                        resourceDownloads += 1;
+                        throw new Error('should not download');
+                    },
+                },
+            },
+        },
+    });
+    internals.handleInboundMessage = async (message) => {
+        inboundMessage = message;
+    };
+    await internals.handleMessageEvent('default', {
+        event: {
+            sender: { sender_id: { user_id: 'user-1' } },
+            message: {
+                message_id: 'msg-file-unauthorized',
+                message_type: 'file',
+                chat_id: 'chat-1',
+                content: JSON.stringify({ file_key: 'file-key-1', file_name: 'private.pdf' }),
+            },
+        },
+    });
+    strict_1.default.equal(resourceDownloads, 0);
+    strict_1.default.equal(inboundMessage.text, '[File: private.pdf]');
+    strict_1.default.deepEqual(inboundMessage.contentParts, [{ type: 'text', text: '[File: private.pdf]' }]);
+});
 (0, node_test_1.default)('lark group text messages strip the bot mention before dispatching', async () => {
     const sentMessages = [];
     const gateway = new local_core_lark_gateway_js_1.LocalCoreLarkGateway({

package/dist-electron/tests/integration/local-core-errors.test.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const local_core_errors_js_1 = require("../../services/local-ai-core/src/kernel/local-core-errors.js");
+(0, node_test_1.default)('LocalCoreError coerces non-string message into a string', () => {
+    const err = new local_core_errors_js_1.LocalCoreError('internal_error', { weird: 'shape' });
+    strict_1.default.equal(typeof err.info.message, 'string');
+    strict_1.default.equal(err.message, err.info.message);
+    strict_1.default.ok(err.info.message.includes('"weird"'));
+    const line = (0, local_core_errors_js_1.formatLogError)(err.info);
+    strict_1.default.ok(!line.includes('[object Object]'), `log line leaked [object Object]: ${line}`);
+});
+(0, node_test_1.default)('toLocalCoreErrorInfo stringifies Error whose message is an object', () => {
+    const raw = new Error('');
+    raw.message = { nested: 'value' };
+    const info = (0, local_core_errors_js_1.toLocalCoreErrorInfo)(raw);
+    strict_1.default.equal(typeof info.message, 'string');
+    const line = (0, local_core_errors_js_1.formatLogError)(info);
+    strict_1.default.ok(!line.includes('[object Object]'), `log line leaked [object Object]: ${line}`);
+});
+(0, node_test_1.default)('toLocalCoreErrorInfo preserves runtime_protocol_timeout classification for timeout string', () => {
+    const info = (0, local_core_errors_js_1.toLocalCoreErrorInfo)(new Error('Timed out waiting for ACP session/prompt after 900000ms'));
+    strict_1.default.equal(info.code, 'runtime_protocol_timeout');
+    strict_1.default.equal(typeof info.message, 'string');
+});
+(0, node_test_1.default)('formatLogError renders cause suffix when present', () => {
+    const err = new local_core_errors_js_1.LocalCoreError('runtime_exited', 'child crashed', { cause: 'SIGTERM' });
+    const line = (0, local_core_errors_js_1.formatLogError)(err.info);
+    strict_1.default.equal(line, 'runtime_exited: child crashed cause=SIGTERM');
+});
+(0, node_test_1.default)('toLocalCoreErrorInfo carries details through LocalCoreError instances', () => {
+    const base = new local_core_errors_js_1.LocalCoreError('runtime_protocol_timeout', 'Timed out waiting for ACP session/prompt after 100ms');
+    const info = (0, local_core_errors_js_1.toLocalCoreErrorInfo)(base, 'internal_error', { threadId: 'thread-x', runtimeId: 'hermes' });
+    strict_1.default.equal(info.code, 'runtime_protocol_timeout');
+    strict_1.default.equal(info.details?.threadId, 'thread-x');
+    strict_1.default.equal(info.details?.runtimeId, 'hermes');
+});

package/dist-electron/tests/integration/weixin-gateway.test.js

@@ -5,10 +5,44 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_test_1 = __importDefault(require("node:test"));
 const strict_1 = __importDefault(require("node:assert/strict"));
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
 const local_core_weixin_gateway_js_1 = require("../../services/local-ai-core/src/channel/weixin/local-core-weixin-gateway.js");
+(0, node_test_1.default)('weixin inbound attachment source streams AES-decrypted files into the shared store', async () => {
+    const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'weixin-file-receive-'));
+    const originalFetch = globalThis.fetch;
+    try {
+        const plaintext = Buffer.from('%PDF streamed file');
+        const aesKey = node_crypto_1.default.randomBytes(16);
+        const cipher = node_crypto_1.default.createCipheriv('aes-128-ecb', aesKey, null);
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        globalThis.fetch = (async () => new Response(encrypted));
+        const gateway = new local_core_weixin_gateway_js_1.LocalCoreWeixinGateway({
+            store: {},
+            readConfig: async () => null,
+            getWorkspaceRouter: () => ({}),
+            eventBus: { emit: () => { }, on: () => () => { } },
+        });
+        const downloaded = await gateway.downloadMediaItem({
+            type: 4,
+            file_item: {
+                file_name: 'report.pdf',
+                aeskey: aesKey.toString('hex'),
+                media: { encrypt_query_param: 'download-token' },
+            },
+        }, 'msg-1', 0, tempDir, { cdnBaseUrl: 'https://weixin.example' });
+        strict_1.default.equal(downloaded.kind, 'file');
+        strict_1.default.deepEqual((0, node_fs_1.readFileSync)(downloaded.path), plaintext);
+        strict_1.default.equal(downloaded.data, undefined);
+    }
+    finally {
+        globalThis.fetch = originalFetch;
+        (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
+    }
+});
 (0, node_test_1.default)('weixin channel can encrypt, upload, and send a local file', async () => {
     const tempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'weixin-file-send-'));
     const originalFetch = globalThis.fetch;
@@ -388,6 +422,7 @@ const local_core_weixin_gateway_js_1 = require("../../services/local-ai-core/src
 (0, node_test_1.default)('weixin downloaded image attachment keeps image data content part', () => {
     const part = (0, local_core_weixin_gateway_js_1.createWeixinAttachmentContentPart)({
         path: '/tmp/image.png',
+        uri: (0, node_url_1.pathToFileURL)('/tmp/image.png').href,
         kind: 'image',
         name: 'image.png',
         data: 'aW1n',
@@ -396,6 +431,7 @@ const local_core_weixin_gateway_js_1 = require("../../services/local-ai-core/src
     strict_1.default.deepEqual(part, {
         type: 'image',
         data: 'aW1n',
+        uri: (0, node_url_1.pathToFileURL)('/tmp/image.png').href,
         mimeType: 'image/png',
         fileName: 'image.png',
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kafca/agentdock",
-  "version": "0.1.55",
+  "version": "0.1.56",
   "license": "PolyForm-Noncommercial-1.0.0",
   "type": "module",
   "main": "dist-electron/electron/main.js",

package/dist/renderer/assets/projects-DB1FLZ3A.js

@@ -1 +0,0 @@
-import{D as t}from"./index-DJ8w4e0l.js";const e=()=>t.get("/projects"),r=o=>t.get(`/projects/${o}`);export{r as g,e as l};