@marshulll/openclaw-wecom 0.1.28 → 0.1.30

package/README.en.md

@@ -86,9 +86,10 @@ Install guide: `docs/INSTALL.md`
 
 ## Media handling
 - App mode: downloads inbound media to local temp dir (`media.tempDir`)
+- Bot inbound media: if webhook provides a media URL, it will be decrypted with `encodingAESKey` and saved locally (no App creds needed)
 - Bot mode media bridge: if reply payload includes `mediaUrl + mediaType`,
   and App credentials are present, media will be uploaded and sent
-> Bot-only config cannot send/receive media (image/voice/video/file). Full media support requires App credentials.
+> Bot-only: inbound image/file works via URL decrypt, but outbound media still requires App credentials.
 
 ## Extra commands (App mode)
 - `/sendfile`: send files from server (multiple absolute paths)

package/README.md

@@ -88,9 +88,10 @@ openclaw gateway restart
 
 ## 媒体处理说明
 - App 模式：收到媒体会下载到本地临时目录（可配置 `media.tempDir`）
+- Bot 模式入站媒体：图片/文件若回调提供 URL，会用 `encodingAESKey` 解密并落盘（无需 App 凭据）
 - Bot 模式媒体桥接：当 reply payload 含 `mediaUrl + mediaType` 时，
   若已配置 App 凭据，会自动上传并发送媒体
-> 仅配置 Bot 时，媒体（图片/语音/视频/文件）无法收发；需补齐 App 凭据才能启用完整媒体能力。
+> 仅配置 Bot 时：可收图片/文件（URL 解密），但**出站媒体仍需 App 凭据**。
 
 ## 命令补充（App 模式）
 - `/sendfile`：发送服务器文件（支持多个绝对路径）

package/README.zh.md

@@ -88,9 +88,10 @@ openclaw gateway restart
 
 ## 媒体处理说明
 - App 模式：收到媒体会下载到本地临时目录（可配置 `media.tempDir`）
+- Bot 模式入站媒体：图片/文件若回调提供 URL，会用 `encodingAESKey` 解密并落盘（无需 App 凭据）
 - Bot 模式媒体桥接：当 reply payload 含 `mediaUrl + mediaType` 时，
   若已配置 App 凭据，会自动上传并发送媒体
-> 仅配置 Bot 时，媒体（图片/语音/视频/文件）无法收发；需补齐 App 凭据才能启用完整媒体能力。
+> 仅配置 Bot 时：可收图片/文件（URL 解密），但**出站媒体仍需 App 凭据**。
 
 ## 命令补充（App 模式）
 - `/sendfile`：发送服务器文件（支持多个绝对路径）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marshulll/openclaw-wecom",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "type": "module",
   "description": "OpenClaw WeCom channel plugin (intelligent bot + internal app)",
   "author": "OpenClaw",

package/wecom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marshulll/openclaw-wecom",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "type": "module",
   "description": "OpenClaw WeCom channel plugin (intelligent bot + internal app)",
   "author": "OpenClaw",

package/wecom/src/crypto.ts

@@ -107,6 +107,21 @@ export function decryptWecomEncrypted(params: {
   return msg;
 }
 
+export function decryptWecomMedia(params: {
+  encodingAESKey: string;
+  buffer: Buffer;
+}): Buffer {
+  const aesKey = decodeEncodingAESKey(params.encodingAESKey);
+  const iv = aesKey.subarray(0, 16);
+  const decipher = crypto.createDecipheriv("aes-256-cbc", aesKey, iv);
+  decipher.setAutoPadding(false);
+  const decryptedPadded = Buffer.concat([
+    decipher.update(params.buffer),
+    decipher.final(),
+  ]);
+  return pkcs7Unpad(decryptedPadded, WECOM_PKCS7_BLOCK_SIZE);
+}
+
 export function encryptWecomPlaintext(params: {
   encodingAESKey: string;
   receiveId?: string;

package/wecom/src/wecom-bot.ts

@@ -7,7 +7,13 @@ import type { PluginRuntime } from "openclaw/plugin-sdk";
 
 import type { WecomWebhookTarget } from "./monitor.js";
 import type { ResolvedWecomAccount, WecomInboundMessage } from "./types.js";
-import { computeWecomMsgSignature, decryptWecomEncrypted, encryptWecomPlaintext, verifyWecomSignature } from "./crypto.js";
+import {
+  computeWecomMsgSignature,
+  decryptWecomEncrypted,
+  decryptWecomMedia,
+  encryptWecomPlaintext,
+  verifyWecomSignature,
+} from "./crypto.js";
 import {
   MEDIA_TOO_LARGE_ERROR,
   downloadWecomMedia,
@@ -49,6 +55,7 @@ const mediaCache = new Map<string, { entry: InboundMedia; createdAt: number; siz
 type StreamState = {
   streamId: string;
   msgid?: string;
+  responseUrl?: string;
   createdAt: number;
   updatedAt: number;
   started: boolean;
@@ -224,7 +231,7 @@ function buildStreamPlaceholderReply(streamId: string): { msgtype: "stream"; str
     stream: {
       id: streamId,
       finish: false,
-      content: "1",
+      content: "\ud83e\udd14\u601d\u8003\u4e2d...",
     },
   };
 }
@@ -420,9 +427,42 @@ async function startAgentForStream(params: {
           }
         }
 
-        const text = core.channel.text.convertMarkdownTables(payload.text ?? "", tableMode);
+        let text = payload.text ?? "";
         const current = streams.get(streamId);
         if (!current) return;
+
+        const trimmedText = text.trim();
+        if (trimmedText.startsWith("{") && trimmedText.includes("\"template_card\"")) {
+          try {
+            const parsed = JSON.parse(trimmedText) as { template_card?: Record<string, unknown> };
+            if (parsed.template_card) {
+              const isSingleChat = chatType !== "group";
+              const responseUrl = current.responseUrl;
+              if (isSingleChat && responseUrl) {
+                await fetch(responseUrl, {
+                  method: "POST",
+                  headers: { "Content-Type": "application/json" },
+                  body: JSON.stringify({ msgtype: "template_card", template_card: parsed.template_card }),
+                });
+                current.finished = true;
+                current.content = current.content || "[已发送交互卡片]";
+                current.updatedAt = Date.now();
+                target.statusSink?.({ lastOutboundAt: Date.now() });
+                return;
+              }
+              const cardTitle = (parsed.template_card as any)?.main_title?.title || "交互卡片";
+              const cardDesc = (parsed.template_card as any)?.main_title?.desc || "";
+              const buttons = Array.isArray((parsed.template_card as any)?.button_list)
+                ? (parsed.template_card as any).button_list.map((b: any) => b?.text).filter(Boolean).join(" / ")
+                : "";
+              text = `【交互卡片】${cardTitle}${cardDesc ? `\n${cardDesc}` : ""}${buttons ? `\n\n选项: ${buttons}` : ""}`;
+            }
+          } catch {
+            // ignore parse failure, treat as normal text
+          }
+        }
+
+        text = core.channel.text.convertMarkdownTables(text, tableMode);
         const nextText = current.content
           ? `${current.content}\n\n${text}`.trim()
           : text.trim();
@@ -638,8 +678,23 @@ async function buildBotMediaMessage(params: {
       }
     } else if (url) {
       const media = await fetchMediaFromUrl(url, target.account, maxBytes);
-      buffer = media.buffer;
-      contentType = media.contentType;
+      const aesKey = target.account.encodingAESKey || "";
+      if (aesKey) {
+        try {
+          buffer = decryptWecomMedia({ encodingAESKey: aesKey, buffer: media.buffer });
+          if (msgtype === "image") contentType = "image/jpeg";
+          else if (msgtype === "voice") contentType = "audio/amr";
+          else if (msgtype === "video") contentType = "video/mp4";
+          else contentType = "application/octet-stream";
+        } catch (err) {
+          target.runtime.error?.(`[${target.account.accountId}] wecom bot media decrypt failed: ${String(err)}`);
+          buffer = media.buffer;
+          contentType = media.contentType;
+        }
+      } else {
+        buffer = media.buffer;
+        contentType = media.contentType;
+      }
     } else if (mediaId && hasAppCreds) {
       const media = await downloadWecomMedia({ account: target.account, mediaId, maxBytes });
       buffer = media.buffer;
@@ -1210,7 +1265,7 @@ export async function handleWecomBotWebhook(params: {
     return true;
   }
 
-  if (msgid && msgidToStreamId.has(msgid)) {
+  if (msgtype !== "event" && msgid && msgidToStreamId.has(msgid)) {
     const streamId = msgidToStreamId.get(msgid) ?? "";
     const reply = buildStreamPlaceholderReply(streamId);
     logVerbose(target, `bot stream placeholder reply streamId=${streamId || "unknown"}`);
@@ -1225,6 +1280,87 @@ export async function handleWecomBotWebhook(params: {
 
   if (msgtype === "event") {
     const eventtype = String((msg as any).event?.eventtype ?? "").toLowerCase();
+    if (eventtype === "template_card_event") {
+      if (msgid && msgidToStreamId.has(msgid)) {
+        jsonOk(res, buildEncryptedJsonReply({
+          account: target.account,
+          plaintextJson: {},
+          nonce,
+          timestamp,
+        }));
+        return true;
+      }
+
+      const cardEvent = (msg as any).event?.template_card_event;
+      let interactionDesc = `[卡片交互] 按钮: ${cardEvent?.event_key || "unknown"}`;
+      const selected = cardEvent?.selected_items?.selected_item;
+      if (Array.isArray(selected) && selected.length > 0) {
+        const selects = selected.map((item: any) => {
+          const key = item?.question_key || "unknown";
+          const options = Array.isArray(item?.option_ids?.option_id)
+            ? item.option_ids.option_id.join(",")
+            : "";
+          return `${key}=${options}`;
+        }).join("; ");
+        if (selects) interactionDesc += ` 选择: ${selects}`;
+      }
+      if (cardEvent?.task_id) interactionDesc += ` (任务ID: ${cardEvent.task_id})`;
+
+      jsonOk(res, buildEncryptedJsonReply({
+        account: target.account,
+        plaintextJson: {},
+        nonce,
+        timestamp,
+      }));
+
+      const streamId = createStreamId();
+      if (msgid) msgidToStreamId.set(msgid, streamId);
+      streams.set(streamId, {
+        streamId,
+        msgid,
+        responseUrl: typeof (msg as any).response_url === "string" ? String((msg as any).response_url).trim() : undefined,
+        createdAt: Date.now(),
+        updatedAt: Date.now(),
+        started: true,
+        finished: false,
+        content: "",
+      });
+      recentEncrypts.set(encryptHash, { ts: Date.now(), streamId });
+
+      let core: PluginRuntime | null = null;
+      try {
+        core = getWecomRuntime();
+      } catch (err) {
+        logVerbose(target, `runtime not ready, skipping agent processing: ${String(err)}`);
+      }
+      if (core) {
+        const enrichedTarget: WecomWebhookTarget = { ...target, core };
+        const eventMsg = {
+          ...msg,
+          msgtype: "text",
+          text: { content: interactionDesc },
+        } as WecomInboundMessage;
+        startAgentForStream({ target: enrichedTarget, accountId: target.account.accountId, msg: eventMsg, streamId })
+          .catch((err) => {
+            const state = streams.get(streamId);
+            if (state) {
+              state.error = err instanceof Error ? err.message : String(err);
+              state.content = state.content || `Error: ${state.error}`;
+              state.finished = true;
+              state.updatedAt = Date.now();
+            }
+            target.runtime.error?.(`[${target.account.accountId}] wecom agent failed: ${String(err)}`);
+          });
+      } else {
+        const state = streams.get(streamId);
+        if (state) {
+          state.finished = true;
+          state.updatedAt = Date.now();
+        }
+      }
+
+      return true;
+    }
     if (eventtype === "enter_chat") {
       const welcome = target.account.config.welcomeText?.trim();
       const reply = welcome
@@ -1255,6 +1391,7 @@ export async function handleWecomBotWebhook(params: {
   streams.set(streamId, {
     streamId,
     msgid,
+    responseUrl: typeof (msg as any).response_url === "string" ? String((msg as any).response_url).trim() : undefined,
     createdAt: Date.now(),
     updatedAt: Date.now(),
     started: false,