@modelzen/feishu-codex-bridge 0.1.6 → 0.1.8

package/dist/cli.js

@@ -538,7 +538,7 @@ async function spawnExecProvider(pc, ref) {
   const timeoutMs = pc.noOutputTimeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS;
   const maxOutput = pc.maxOutputBytes ?? DEFAULT_EXEC_MAX_OUTPUT;
   const providerName = ref.provider ?? DEFAULT_PROVIDER;
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const env = {};
     if (pc.passEnv) for (const k of pc.passEnv) {
       const v = process.env[k];
@@ -583,7 +583,7 @@ async function spawnExecProvider(pc, ref) {
       try {
         const parsed = JSON.parse(stdout);
         const value = parsed.values?.[ref.id];
-        if (typeof value === "string") return resolve5(value);
+        if (typeof value === "string") return resolve6(value);
         const err = parsed.errors?.[ref.id]?.message;
         reject(new Error(`exec provider did not return secret for ${ref.id}${err ? `: ${err}` : ""}`));
       } catch (err) {
@@ -680,6 +680,30 @@ var COMMENT_SCOPES = [
   "wiki:wiki:readonly"
 ];
 var GRANT_SCOPES = [...REQUIRED_SCOPES, ...COMMENT_SCOPES];
+var SCOPE_LABELS = {
+  "im:message.group_at_msg:readonly": "\u63A5\u6536\u7FA4\u91CC @\u673A\u5668\u4EBA \u7684\u6D88\u606F",
+  "im:message.group_msg": "\u63A5\u6536\u7FA4\u5185\u6240\u6709\u6D88\u606F\uFF08\u514D@\uFF09",
+  "im:message.p2p_msg:readonly": "\u63A5\u6536\u79C1\u804A\u6D88\u606F\uFF08\u7BA1\u7406\u53F0\uFF09",
+  "im:message:send_as_bot": "\u53D1\u9001\u6D88\u606F / \u5361\u7247",
+  "im:message.pins:write_only": "\u7F6E\u9876\u6D88\u606F\u5230\u7FA4 Pin",
+  "im:message.reactions:write_only": "\u6D88\u606F\u8868\u60C5\u56DE\u590D\uFF08\u8FD0\u884C\u72B6\u6001\uFF09",
+  "im:resource": "\u56FE\u7247 / \u6587\u4EF6\u4E0A\u4F20\u4E0E\u4E0B\u8F7D",
+  "im:chat:create": "\u521B\u5EFA\u9879\u76EE\u7FA4",
+  "im:chat:update": "\u8F6C\u79FB\u7FA4\u4E3B\uFF08\u89E3\u7ED1\u65F6\uFF09",
+  "im:chat.managers:write_only": "\u8BBE\u7F6E\u7FA4\u7BA1\u7406\u5458",
+  "im:chat.announcement:read": "\u8BFB\u53D6\u7FA4\u516C\u544A",
+  "im:chat.announcement:write_only": "\u7F16\u8F91\u7FA4\u516C\u544A",
+  "im:chat.top_notice:write_only": "\u7F6E\u9876\u7FA4\u516C\u544A\u6A2A\u5E45",
+  "im:chat.tabs:write_only": "\u6DFB\u52A0\u7FA4\u6807\u7B7E\u9875",
+  "cardkit:card:write": "\u4EA4\u4E92\u6309\u94AE\u5361\u7247",
+  "docs:document.comment:read": "\u8BFB\u53D6\u6587\u6863\u8BC4\u8BBA",
+  "docs:document.comment:create": "\u53D1\u8868\u6587\u6863\u8BC4\u8BBA\u56DE\u590D",
+  "wiki:wiki:readonly": "\u8BFB\u53D6\u77E5\u8BC6\u5E93\u8282\u70B9"
+};
+function labelScope(scope) {
+  const label = SCOPE_LABELS[scope];
+  return label ? `${label}\uFF08${scope}\uFF09` : scope;
+}
 var HOSTS = {
   feishu: "open.feishu.cn",
   lark: "open.larksuite.com"
@@ -1112,7 +1136,7 @@ var AsyncQueue = class {
         continue;
       }
       if (this.closed) return;
-      const next = await new Promise((resolve5) => this.waiters.push(resolve5));
+      const next = await new Promise((resolve6) => this.waiters.push(resolve6));
       if (next.done) return;
       yield next.value;
     }
@@ -1163,8 +1187,8 @@ var AppServerClient = class {
     const id = ++this.nextId;
     const payload = `${JSON.stringify({ jsonrpc: "2.0", id, method, params: params ?? {} })}
 `;
-    return new Promise((resolve5, reject) => {
-      this.pending.set(id, { resolve: resolve5, reject });
+    return new Promise((resolve6, reject) => {
+      this.pending.set(id, { resolve: resolve6, reject });
       this.child.stdin.write(payload, (err) => {
         if (err) {
           this.pending.delete(id);
@@ -1188,14 +1212,14 @@ var AppServerClient = class {
     const child = this.child;
     if (!child || child.exitCode !== null) return;
     child.kill("SIGTERM");
-    await new Promise((resolve5) => {
+    await new Promise((resolve6) => {
       const t = setTimeout(() => {
         if (child.exitCode === null) child.kill("SIGKILL");
-        resolve5();
+        resolve6();
       }, graceMs);
       child.once("exit", () => {
         clearTimeout(t);
-        resolve5();
+        resolve6();
       });
     });
   }
@@ -1312,14 +1336,28 @@ function mapItemComplete(item) {
 // src/agent/codex-appserver/backend.ts
 var APPROVAL_POLICY = "never";
 var SANDBOX = "danger-full-access";
+var BRIDGE_DEVELOPER_INSTRUCTIONS = [
+  "\u4F60\u73B0\u5728\u901A\u8FC7\u300C\u98DE\u4E66\u6865\u300D\u4E0E\u7528\u6237\u5BF9\u8BDD\uFF1A\u4F60\u7684\u56DE\u590D\u4F1A\u88AB\u6E32\u67D3\u6210\u98DE\u4E66\u6D88\u606F\u3002\u8BF7\u9075\u5B88\u4E24\u6761\u8F93\u51FA\u7EA6\u5B9A\u3002",
+  "",
+  "1) \u56FE\u7247\uFF1A\u8981\u914D\u56FE\u65F6\uFF0C\u7528\u6807\u51C6 Markdown \u56FE\u7247\u8BED\u6CD5 ![\u8BF4\u660E](\u8DEF\u5F84) \u5F15\u7528\u4E00\u4E2A\u3010\u771F\u5B9E\u5B58\u5728\u3011\u7684\u56FE\u7247\uFF0C",
+  "\u98DE\u4E66\u6865\u4F1A\u81EA\u52A8\u4E0A\u4F20\u5E76\u5728\u98DE\u4E66\u91CC\u6E32\u67D3\u3002\u8DEF\u5F84\u53EF\u4EE5\u662F\u76F8\u5BF9\u5F53\u524D\u5DE5\u4F5C\u76EE\u5F55\u7684\u76F8\u5BF9\u8DEF\u5F84\u3001\u5DE5\u4F5C\u76EE\u5F55\u5185\u7684\u7EDD\u5BF9\u8DEF\u5F84\uFF0C",
+  "\u6216\u4E00\u4E2A http(s) \u56FE\u7247 URL\u3002\u7EDD\u4E0D\u8981\u7F16\u9020\u4E0D\u5B58\u5728\u7684\u56FE\u7247\u5360\u4F4D\uFF08\u4F8B\u5982\u5199 ![\u7BA1\u7406\u53F0\u622A\u56FE] \u5374\u6CA1\u6709\u5BF9\u5E94\u6587\u4EF6\uFF09\u2014\u2014",
+  "\u6CA1\u6709\u771F\u5B9E\u56FE\u7247\u5C31\u4E0D\u8981\u5199\u56FE\u7247\u8BED\u6CD5\u3002",
+  "",
+  "2) \u5361\u7247\uFF1A\u4EC5\u5F53\u7528\u6237\u660E\u786E\u8981\u6C42\u300C\u7528\u5361\u7247\u56DE\u590D / \u505A\u6210\u98DE\u4E66\u5361\u7247 / \u5361\u7247\u5F62\u5F0F\u5C55\u793A / changelog \u5361\u7247\u300D\u4E4B\u7C7B\u65F6\uFF0C",
+  "\u628A\u8981\u5C55\u793A\u7684\u5185\u5BB9\u5305\u8FDB\u4E00\u4E2A ```feishu-card \u4EE3\u7801\u5757\uFF0C\u5757\u5185\u7528 Markdown \u4E66\u5199\uFF1A",
+  "\u9996\u884C\u7528 `# \u6807\u9898` \u4F5C\u4E3A\u5361\u7247\u6807\u9898\u680F\uFF1B\u7528 `---` \u4F5C\u5206\u9694\u7EBF\uFF1B\u7528 `> \u6587\u5B57` \u4F5C\u7070\u8272\u6CE8\u811A\uFF1B",
+  "`**\u7C97\u4F53**`\u3001\u5217\u8868\u3001\u94FE\u63A5\u7167\u5E38\u4F7F\u7528\uFF1B\u914D\u56FE\u540C\u6837\u7528 ![\u8BF4\u660E](\u771F\u5B9E\u8DEF\u5F84)\u3002",
+  "\u4E0D\u8981\u624B\u5199\u98DE\u4E66\u5361\u7247\u7684 JSON\u3002\u666E\u901A\u95EE\u7B54\u6B63\u5E38\u56DE\u590D\u5373\u53EF\uFF0C\u53EA\u6709\u7528\u6237\u8981\u5361\u7247\u65F6\u624D\u7528 ```feishu-card \u4EE3\u7801\u5757\u3002"
+].join("\n");
 var READ_HISTORY_TIMEOUT_MS = 2e4;
 function withDeadline(p, ms, label) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
     p.then(
       (v) => {
         clearTimeout(t);
-        resolve5(v);
+        resolve6(v);
       },
       (e) => {
         clearTimeout(t);
@@ -1359,11 +1397,11 @@ var CodexThread = class {
       if (self.model) params.model = self.model;
       if (self.effort) params.effort = self.effort;
       let startError;
-      const startFailed = new Promise((resolve5) => {
+      const startFailed = new Promise((resolve6) => {
         self.client.request("turn/start", params).then(void 0, (err) => {
           startError = err instanceof Error ? err : new Error(String(err));
           log.fail("agent", startError, { phase: "turn/start" });
-          resolve5("start-failed");
+          resolve6("start-failed");
         });
       });
       const stream2 = self.client.stream()[Symbol.asyncIterator]();
@@ -1487,6 +1525,7 @@ var CodexAppServerBackend = class {
       cwd: opts.cwd,
       approvalPolicy: APPROVAL_POLICY,
       sandbox: SANDBOX,
+      developerInstructions: BRIDGE_DEVELOPER_INSTRUCTIONS,
       ...opts.model ? { model: opts.model } : {}
     });
     return new CodexThread(client, res.thread.id, opts.model, opts.effort);
@@ -1498,6 +1537,7 @@ var CodexAppServerBackend = class {
       cwd: opts.cwd,
       approvalPolicy: APPROVAL_POLICY,
       sandbox: SANDBOX,
+      developerInstructions: BRIDGE_DEVELOPER_INSTRUCTIONS,
       ...opts.model ? { model: opts.model } : {}
     });
     return new CodexThread(client, res.thread.id, opts.model, opts.effort);
@@ -1928,6 +1968,15 @@ function card(elements, opts = {}) {
 function md(content) {
   return { tag: "markdown", content };
 }
+function image(imgKey, alt = "") {
+  return {
+    tag: "img",
+    img_key: imgKey,
+    alt: { tag: "plain_text", content: alt },
+    mode: "fit_horizontal",
+    preview: true
+  };
+}
 function note(content) {
   return { tag: "div", text: { tag: "lark_md", content, text_size: "notation", text_color: "grey" } };
 }
@@ -2337,6 +2386,92 @@ function truncateTail(s, n) {
   return t.length > n ? `\u2026${t.slice(t.length - n)}` : t;
 }
 
+// src/card/markdown-render.ts
+var NO_IMAGES = /* @__PURE__ */ new Map();
+var IMG_RE = /!\[([^\]]*)\]\(\s*(<[^>]+>|[^)\s]+)(?:\s+(?:"[^"]*"|'[^']*'))?\s*\)/g;
+var FENCE_RE = /```feishu-card[^\n]*\n([\s\S]*?)```/g;
+function cleanSrc(raw) {
+  let s = raw.trim();
+  if (s.startsWith("<") && s.endsWith(">")) s = s.slice(1, -1).trim();
+  return s;
+}
+function extractCardFences(text) {
+  const fences = [];
+  const re = new RegExp(FENCE_RE.source, "g");
+  const stripped = text.replace(re, (_full, inner) => {
+    fences.push(inner.trim());
+    return "";
+  });
+  return { fences, stripped };
+}
+function renderRichText(text, images = NO_IMAGES) {
+  const body = extractCardFences(text).stripped;
+  if (!body.includes("![")) {
+    const t = body.trim();
+    return t ? [md(t)] : [];
+  }
+  const els = [];
+  let buf = "";
+  const flush = () => {
+    const t = buf.trim();
+    if (t) els.push(md(t));
+    buf = "";
+  };
+  const re = new RegExp(IMG_RE.source, "g");
+  let last = 0;
+  let m;
+  while ((m = re.exec(body)) !== null) {
+    buf += body.slice(last, m.index);
+    const alt = m[1] ?? "";
+    const src = cleanSrc(m[2] ?? "");
+    const key = images.get(src);
+    if (key) {
+      flush();
+      els.push(image(key, alt));
+    } else {
+      buf += m[0];
+    }
+    last = m.index + m[0].length;
+  }
+  buf += body.slice(last);
+  flush();
+  return els;
+}
+function buildCleanCard(fenceMarkdown, images = NO_IMAGES, template = "blue") {
+  const lines = fenceMarkdown.split("\n");
+  let start = 0;
+  while (start < lines.length && lines[start]?.trim() === "") start++;
+  const headingMatch = lines[start]?.match(/^#{1,6}\s+(.+?)\s*$/);
+  const title = headingMatch ? headingMatch[1] : "";
+  if (headingMatch) start++;
+  const bodyMarkdown = lines.slice(start).join("\n").trim();
+  const elements = renderCleanBody(bodyMarkdown, images);
+  const body = elements.length > 0 ? elements : [md(title || "\xAD")];
+  return card(body, {
+    ...title ? { header: { title, template } } : {},
+    summary: title || "\u5361\u7247"
+  });
+}
+function renderCleanBody(bodyMarkdown, images) {
+  const out = [];
+  for (const raw of bodyMarkdown.split(/\n{2,}/)) {
+    const block = raw.trim();
+    if (!block) continue;
+    if (/^(-{3,}|\*{3,}|_{3,})$/.test(block)) {
+      out.push(hr());
+      continue;
+    }
+    const blockLines = block.split("\n");
+    if (blockLines.every((l) => l.trim() === "" || /^\s*>\s?/.test(l))) {
+      const noteText = blockLines.map((l) => l.replace(/^\s*>\s?/, "")).join("\n").trim();
+      if (noteText) out.push(note(noteText));
+      continue;
+    }
+    out.push(...renderRichText(block, images));
+  }
+  return out;
+}
+
 // src/card/tool-render.ts
 var HEADER_TITLE_MAX = 80;
 var OUTPUT_MAX = 1200;
@@ -2415,7 +2550,7 @@ function renderTerminal(state, rc) {
       })
     );
   }
-  if (answer) elements.push(md(answer));
+  if (answer) elements.push(...renderRichText(answer, rc.images));
   if (state.terminal === "interrupted") {
     elements.push(noteMd("_\u23F9 \u5DF2\u88AB\u4E2D\u65AD_"));
   } else if (state.terminal === "idle_timeout") {
@@ -2624,6 +2759,142 @@ var RunCardStream = class {
   }
 };
 
+// src/card/outbound-images.ts
+import { readFile as readFile5, stat as stat2 } from "fs/promises";
+import { extname, isAbsolute, resolve as resolve2, sep } from "path";
+var MAX_IMAGES = 9;
+var MAX_BYTES = 10 * 1024 * 1024;
+var DOWNLOAD_TIMEOUT_MS = 1e4;
+var ALLOWED_EXT = /* @__PURE__ */ new Set(["png", "jpg", "jpeg", "webp", "gif", "tif", "tiff", "bmp", "ico"]);
+var cache = /* @__PURE__ */ new Map();
+var IMG_RE2 = /!\[([^\]]*)\]\(\s*(<[^>]+>|[^)\s]+)(?:\s+(?:"[^"]*"|'[^']*'))?\s*\)/g;
+function cleanSrc2(raw) {
+  let s = raw.trim();
+  if (s.startsWith("<") && s.endsWith(">")) s = s.slice(1, -1).trim();
+  return s;
+}
+function imageSources(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const re = new RegExp(IMG_RE2.source, "g");
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const src = cleanSrc2(m[2] ?? "");
+    if (src && !seen.has(src)) {
+      seen.add(src);
+      out.push(src);
+    }
+  }
+  return out;
+}
+async function uploadOutboundImages(channel, sources, cwd) {
+  const picked = sources.slice(0, MAX_IMAGES);
+  if (sources.length > picked.length) {
+    log.warn("outbound", "image-cap", { skipped: sources.length - picked.length });
+  }
+  const results = await Promise.all(
+    picked.map(async (src) => {
+      try {
+        return [src, await resolveAndUpload(channel, src, cwd)];
+      } catch (err) {
+        log.warn("outbound", "image-failed", { src: src.slice(0, 80), err: String(err) });
+        return [src, void 0];
+      }
+    })
+  );
+  const out = /* @__PURE__ */ new Map();
+  for (const [src, key] of results) if (key) out.set(src, key);
+  if (out.size > 0) log.info("outbound", "images", { want: sources.length, uploaded: out.size });
+  return out;
+}
+async function resolveAndUpload(channel, src, cwd) {
+  const { buffer, cacheKey } = await loadSource(src, cwd);
+  if (!buffer) return void 0;
+  const hit = cache.get(cacheKey);
+  if (hit) return hit;
+  const key = await uploadBuffer(channel, buffer);
+  if (key) cache.set(cacheKey, key);
+  return key;
+}
+async function loadSource(src, cwd) {
+  if (/^https?:\/\//i.test(src)) return loadRemote(src);
+  return loadLocal(src, cwd);
+}
+async function loadLocal(src, cwd) {
+  const cwdAbs = resolve2(cwd);
+  const abs = isAbsolute(src) ? resolve2(src) : resolve2(cwdAbs, src);
+  if (abs !== cwdAbs && !abs.startsWith(cwdAbs + sep)) {
+    log.warn("outbound", "image-outside-cwd", { src: src.slice(0, 80) });
+    return { cacheKey: `local:${abs}` };
+  }
+  const ext = extname(abs).slice(1).toLowerCase();
+  if (!ALLOWED_EXT.has(ext)) {
+    log.warn("outbound", "image-ext", { ext, src: src.slice(0, 80) });
+    return { cacheKey: `local:${abs}` };
+  }
+  let size;
+  let mtimeMs;
+  try {
+    const st = await stat2(abs);
+    if (!st.isFile()) throw new Error("not a file");
+    size = st.size;
+    mtimeMs = st.mtimeMs;
+  } catch {
+    log.warn("outbound", "image-missing", { src: src.slice(0, 80) });
+    return { cacheKey: `local:${abs}` };
+  }
+  if (size === 0 || size > MAX_BYTES) {
+    log.warn("outbound", "image-size", { size, src: src.slice(0, 80) });
+    return { cacheKey: `local:${abs}:${size}` };
+  }
+  const buffer = await readFile5(abs);
+  return { buffer, cacheKey: `local:${abs}:${mtimeMs}:${size}` };
+}
+async function loadRemote(url) {
+  const cacheKey = `url:${url}`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), DOWNLOAD_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { signal: ctrl.signal, redirect: "follow" });
+    if (!res.ok) {
+      log.warn("outbound", "image-http", { url: url.slice(0, 80), status: res.status });
+      return { cacheKey };
+    }
+    const ct = (res.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase();
+    if (ct && !ct.startsWith("image/")) {
+      log.warn("outbound", "image-ctype", { ct, url: url.slice(0, 80) });
+      return { cacheKey };
+    }
+    const declared = Number(res.headers.get("content-length") ?? 0);
+    if (declared > MAX_BYTES) {
+      log.warn("outbound", "image-size", { declared, url: url.slice(0, 80) });
+      return { cacheKey };
+    }
+    const ab = await res.arrayBuffer();
+    if (ab.byteLength === 0 || ab.byteLength > MAX_BYTES) {
+      log.warn("outbound", "image-size", { size: ab.byteLength, url: url.slice(0, 80) });
+      return { cacheKey };
+    }
+    return { buffer: Buffer.from(ab), cacheKey };
+  } catch (err) {
+    log.warn("outbound", "image-fetch", { url: url.slice(0, 80), err: String(err) });
+    return { cacheKey };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function uploadBuffer(channel, buffer) {
+  const res = await channel.rawClient.im.v1.image.create({
+    data: { image_type: "message", image: buffer }
+  });
+  const key = res?.image_key ?? res?.data?.image_key;
+  if (!key) {
+    log.warn("outbound", "image-no-key", { res: JSON.stringify(res).slice(0, 120) });
+    return void 0;
+  }
+  return key;
+}
+
 // src/card/dm-cards.ts
 function openChatUrl(chatId) {
   return `https://applink.feishu.cn/client/chat/open?openChatId=${encodeURIComponent(chatId)}`;
@@ -2780,8 +3051,9 @@ function scopeDiagnosis(i) {
     return [md("- \u98DE\u4E66\u6743\u9650\uFF1A\u2705 \u5FC5\u9700\u6743\u9650\u5DF2\u5168\u90E8\u5F00\u901A")];
   }
   return [
-    md(`- \u98DE\u4E66\u6743\u9650\uFF1A\u274C \u7F3A ${i.missingScopes.length} \u9879 \u2014\u2014 \u5F00\u901A\u524D\u76F8\u5173\u529F\u80FD\uFF08\u6536\u53D1\u6D88\u606F / \u5361\u7247 / \u5EFA\u7FA4\u7B49\uFF09\u4E0D\u53EF\u7528`),
-    note(`\u5F85\u5F00\u901A\uFF1A${i.missingScopes.join("\u3000")}`),
+    md(`- \u98DE\u4E66\u6743\u9650\uFF1A\u274C \u7F3A ${i.missingScopes.length} \u9879 \u2014\u2014 \u5F00\u901A\u524D\u76F8\u5173\u529F\u80FD\uFF08\u6536\u53D1\u6D88\u606F / \u5361\u7247 / \u56FE\u7247 / \u5EFA\u7FA4\u7B49\uFF09\u4E0D\u53EF\u7528`),
+    note(`\u5F85\u5F00\u901A\uFF1A
+${i.missingScopes.map((s) => `\xB7 ${labelScope(s)}`).join("\n")}`),
     actions([linkButton("\u{1F511} \u4E00\u952E\u53BB\u5F00\u901A\u8FD9\u4E9B\u6743\u9650", i.scopeGrantUrl)])
   ];
 }
@@ -2977,7 +3249,7 @@ function buildGroupSettingsCard(project) {
 // src/service/update.ts
 import { execFile, spawn as spawn5 } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve3 } from "path";
+import { dirname as dirname6, join as join8, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { promisify } from "util";
 
@@ -2986,7 +3258,7 @@ import { spawn as spawn4, spawnSync } from "child_process";
 import { existsSync as existsSync4 } from "fs";
 import { appendFile, mkdir as mkdir4, rm as rm2, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir3, userInfo as userInfo2 } from "os";
-import { dirname as dirname5, join as join7, resolve as resolve2 } from "path";
+import { dirname as dirname5, join as join7, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var LAUNCHD_LABEL = "ai.feishu-codex-bridge.bot";
 function launchAgentPlistPath() {
@@ -3000,7 +3272,7 @@ function serviceStderrPath() {
 }
 function resolveCliBinPath() {
   const distDir = dirname5(fileURLToPath2(import.meta.url));
-  return resolve2(distDir, "..", "bin", "feishu-codex-bridge.mjs");
+  return resolve3(distDir, "..", "bin", "feishu-codex-bridge.mjs");
 }
 function escapeXml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
@@ -3166,7 +3438,7 @@ function getServiceAdapter() {
 var execFileP = promisify(execFile);
 var NPM = process.platform === "win32" ? "npm.cmd" : "npm";
 function pkgRoot() {
-  return resolve3(dirname6(fileURLToPath3(import.meta.url)), "..");
+  return resolve4(dirname6(fileURLToPath3(import.meta.url)), "..");
 }
 function pkgJson() {
   try {
@@ -3232,12 +3504,12 @@ async function restartDaemon() {
 }
 
 // src/project/registry.ts
-import { mkdir as mkdir5, readFile as readFile5, rename as rename4, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile6, rename as rename4, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname7 } from "path";
 var FILE_VERSION2 = 1;
 async function read() {
   try {
-    const text = await readFile5(paths.projectsFile, "utf8");
+    const text = await readFile6(paths.projectsFile, "utf8");
     const parsed = JSON.parse(text);
     return Array.isArray(parsed.projects) ? parsed.projects : [];
   } catch (err) {
@@ -3292,7 +3564,7 @@ async function removeProject(name) {
 // src/project/lifecycle.ts
 import { mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync6 } from "fs";
-import { isAbsolute, join as join9, resolve as resolve4 } from "path";
+import { isAbsolute as isAbsolute2, join as join9, resolve as resolve5 } from "path";
 
 // src/project/git-info.ts
 import { execFile as execFile2 } from "child_process";
@@ -3430,7 +3702,7 @@ async function createProject(channel, input2) {
   let cwd;
   let blank;
   if (input2.existingPath) {
-    cwd = isAbsolute(input2.existingPath) ? input2.existingPath : resolve4(input2.existingPath);
+    cwd = isAbsolute2(input2.existingPath) ? input2.existingPath : resolve5(input2.existingPath);
     if (!existsSync6(cwd)) throw new Error(`\u6587\u4EF6\u5939\u4E0D\u5B58\u5728\uFF1A${cwd}`);
     blank = false;
   } else {
@@ -3468,12 +3740,12 @@ async function transferOwnership(channel, chatId, toOpenId) {
 }
 
 // src/bot/session-store.ts
-import { mkdir as mkdir7, readFile as readFile6, rename as rename5, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile7, rename as rename5, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname8 } from "path";
 var FILE_VERSION3 = 1;
 async function read2() {
   try {
-    const text = await readFile6(paths.sessionsFile, "utf8");
+    const text = await readFile7(paths.sessionsFile, "utf8");
     const parsed = JSON.parse(text);
     return Array.isArray(parsed.sessions) ? parsed.sessions : [];
   } catch (err) {
@@ -3528,6 +3800,156 @@ async function handleDmConsole(channel, cfg, msg) {
   });
 }
 
+// src/bot/media.ts
+import { mkdir as mkdir8, readdir as readdir2, rm as rm3, stat as stat3 } from "fs/promises";
+import { join as join10 } from "path";
+var MAX_IMAGES2 = 9;
+var MEDIA_TTL_MS = 60 * 6e4;
+var EXT_BY_CONTENT_TYPE = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/jpg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/bmp": "bmp",
+  "image/heic": "heic",
+  "image/heif": "heif",
+  "image/tiff": "tiff"
+};
+function messageHasImages(msg) {
+  if ((msg.resources ?? []).some((r) => r.type === "image")) return true;
+  return msg.rawContentType === "merge_forward";
+}
+async function collectInboundImages(channel, msg) {
+  let refs;
+  try {
+    refs = await gatherRefs(channel, msg);
+  } catch (err) {
+    log.warn("intake", "image-gather-failed", { err: String(err) });
+    return [];
+  }
+  if (refs.length === 0) return [];
+  await pruneOldMedia();
+  try {
+    await mkdir8(paths.mediaDir, { recursive: true });
+  } catch {
+  }
+  const out = [];
+  let index = 0;
+  for (const ref of refs.slice(0, MAX_IMAGES2)) {
+    const path = await downloadOne(channel, ref, index++);
+    if (path) out.push(path);
+  }
+  log.info("intake", "images", { found: refs.length, downloaded: out.length });
+  return out;
+}
+async function gatherRefs(channel, msg) {
+  const refs = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (messageId, fileKey) => {
+    if (!fileKey || seen.has(fileKey)) return;
+    seen.add(fileKey);
+    refs.push({ messageId, fileKey });
+  };
+  for (const r of msg.resources ?? []) {
+    if (r.type === "image") add(msg.messageId, r.fileKey);
+  }
+  if (msg.rawContentType === "merge_forward") {
+    const items = await fetchSubMessages(channel, msg.messageId);
+    for (const sub of items) {
+      if (!sub.message_id || sub.message_id === msg.messageId) continue;
+      for (const key of imageKeysFromContent(sub.msg_type, sub.body?.content)) {
+        add(sub.message_id, key);
+      }
+    }
+  }
+  return refs;
+}
+async function fetchSubMessages(channel, messageId) {
+  try {
+    const res = await channel.rawClient.im.v1.message.get({ path: { message_id: messageId } });
+    return res.data?.items ?? [];
+  } catch (err) {
+    log.warn("intake", "submessages-failed", { messageId, err: String(err) });
+    return [];
+  }
+}
+function imageKeysFromContent(msgType, content) {
+  if (!content) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(content);
+  } catch {
+    return [];
+  }
+  if (msgType === "image") {
+    const key = parsed?.image_key;
+    return key ? [key] : [];
+  }
+  const keys = [];
+  walkForImageKeys(parsed, keys);
+  return keys;
+}
+function walkForImageKeys(node, out) {
+  if (!node || typeof node !== "object") return;
+  if (Array.isArray(node)) {
+    for (const child of node) walkForImageKeys(child, out);
+    return;
+  }
+  const obj = node;
+  if (obj.tag === "img" && typeof obj.image_key === "string") out.push(obj.image_key);
+  for (const k of Object.keys(obj)) walkForImageKeys(obj[k], out);
+}
+async function downloadOne(channel, ref, index) {
+  try {
+    const res = await channel.rawClient.im.v1.messageResource.get({
+      path: { message_id: ref.messageId, file_key: ref.fileKey },
+      params: { type: "image" }
+    });
+    const ext = extFromHeaders(res.headers);
+    const file = join10(paths.mediaDir, `${safeName(ref.fileKey)}-${index}.${ext}`);
+    await res.writeFile(file);
+    return file;
+  } catch (err) {
+    log.warn("intake", "image-download-failed", { fileKey: ref.fileKey.slice(0, 24), err: String(err) });
+    return void 0;
+  }
+}
+function extFromHeaders(headers) {
+  const ct = readHeader(headers, "content-type");
+  if (ct) {
+    const base = ct.split(";")[0]?.trim().toLowerCase();
+    if (base && EXT_BY_CONTENT_TYPE[base]) return EXT_BY_CONTENT_TYPE[base];
+  }
+  return "png";
+}
+function readHeader(headers, name) {
+  if (!headers || typeof headers !== "object") return void 0;
+  const h = headers;
+  const raw = typeof h.get === "function" ? h.get(name) : h[name] ?? h[name.toLowerCase()];
+  return typeof raw === "string" ? raw : Array.isArray(raw) ? String(raw[0]) : void 0;
+}
+function safeName(fileKey) {
+  return fileKey.replace(/[^a-zA-Z0-9_-]/g, "").slice(-40) || "img";
+}
+async function pruneOldMedia() {
+  let entries;
+  try {
+    entries = await readdir2(paths.mediaDir);
+  } catch {
+    return;
+  }
+  const cutoff = Date.now() - MEDIA_TTL_MS;
+  for (const name of entries) {
+    const file = join10(paths.mediaDir, name);
+    try {
+      const st = await stat3(file);
+      if (st.mtimeMs < cutoff) await rm3(file, { force: true });
+    } catch {
+    }
+  }
+}
+
 // src/bot/comments.ts
 var SUPPORTED_FILE_TYPES = /* @__PURE__ */ new Set(["doc", "docx", "sheet", "file"]);
 var REPLY_MAX_CHARS = 2e3;
@@ -3922,19 +4344,34 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
   async function handleTurn(msg, text, sessionKey, flat, project) {
     const existing = active.get(sessionKey);
     if (existing) {
-      if (getPendingPolicy(cfg) === "steer" && existing.run && existing.thread) {
-        const tid = existing.run.turnId();
+      const images = messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0;
+      const cur = active.get(sessionKey);
+      if (!cur) {
+        startReservedRun(msg, text, sessionKey, flat, project, images);
+        return;
+      }
+      if (getPendingPolicy(cfg) === "steer" && cur.run && cur.thread) {
+        const tid = cur.run.turnId();
         if (tid) {
           try {
-            await existing.thread.steer({ text }, tid);
-            log.info("intake", "steer", { tid });
+            await cur.thread.steer({ text, images }, tid);
+            log.info("intake", "steer", { tid, images: images?.length ?? 0 });
             return;
           } catch (err) {
             log.warn("intake", "steer-failed", { err: String(err) });
           }
         }
       }
-      existing.queue.push(text);
+      cur.queue.push({ text, images });
+      log.info("intake", "queued", { depth: cur.queue.length });
+      return;
+    }
+    startReservedRun(msg, text, sessionKey, flat, project);
+  }
+  function startReservedRun(msg, text, sessionKey, flat, project, preloadedImages) {
+    const existing = active.get(sessionKey);
+    if (existing) {
+      existing.queue.push({ text, images: preloadedImages });
       log.info("intake", "queued", { depth: existing.queue.length });
       return;
     }
@@ -3943,6 +4380,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
     void withTrace({ chatId: msg.chatId, msgId: msg.messageId }, async () => {
       const reaction = runReaction(msg.messageId, !sema.hasFree());
       try {
+        const images = preloadedImages ?? (messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0);
         let thread = await resolveThread(sessionKey, msg.chatId);
         if (!thread) {
           const cwd = project?.cwd ?? fallbackCwd;
@@ -3967,6 +4405,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
             flat,
             thread,
             firstText: text,
+            images,
             knownThreadId: sessionKey,
             requesterOpenId: msg.senderId
           },
@@ -4019,7 +4458,8 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
         return;
       }
       const firstText = text || "\u4F60\u597D\uFF0C\u6211\u4EEC\u5F00\u59CB\u5427\u3002";
-      log.info("card", "start", { project: project?.name ?? "(unregistered)", model, effort });
+      const images = messageHasImages(msg) ? await collectInboundImages(channel, msg) : void 0;
+      log.info("card", "start", { project: project?.name ?? "(unregistered)", model, effort, images: images?.length ?? 0 });
       await launchRun(
         {
           chatId: msg.chatId,
@@ -4027,6 +4467,7 @@ function createOrchestrator(channel, cfg, fallbackCwd) {
           replyInThread: true,
           thread,
           firstText,
+          images,
           model,
           effort,
           cwd,
@@ -4432,14 +4873,14 @@ ${tail}` }, { replyTo: evt.messageId }).catch(() => void 0);
     };
     let curCardKey;
     try {
-      let turnText = opts.firstText;
+      let turnInput = { text: opts.firstText, images: opts.images };
       let replyTo = opts.replyTo;
       let replyInThread = opts.flat ? false : opts.replyInThread ?? Boolean(opts.knownThreadId);
       for (; ; ) {
         const rec = topicThreadId ? await getSession(topicThreadId) : void 0;
         const turnModel = rec?.model ?? opts.model;
         const turnEffort = rec?.effort ?? opts.effort;
-        const run = opts.thread.runStreamed({ text: turnText }, { model: turnModel, effort: turnEffort });
+        const run = opts.thread.runStreamed(turnInput, { model: turnModel, effort: turnEffort });
         state.run = run;
         const render = new RunRender();
         render.showTools = getShowToolCalls(cfg);
@@ -4517,16 +4958,29 @@ ${tail}` }, { replyTo: evt.messageId }).catch(() => void 0);
         const finalMsgId = cardMsgId;
         await adoptThreadId(finalMsgId);
         rc.cardKey = finalMsgId;
+        const answerText = finalMessageText(rc.rs);
+        const { fences } = extractCardFences(answerText);
+        const imgSources = imageSources(answerText);
+        if (imgSources.length > 0) {
+          rc.images = await uploadOutboundImages(channel, imgSources, opts.cwd ?? fallbackCwd);
+        }
         await stream2.updateCard(channel, buildRunCard(rc));
         runsByCard.delete(cardMsgId);
         promoteCard(finalMsgId, rc);
+        for (const fence of fences) {
+          try {
+            await sendManagedCard(channel, opts.chatId, buildCleanCard(fence, rc.images), finalMsgId, !opts.flat);
+          } catch (err) {
+            log.fail("card", err, { phase: "clean-card" });
+          }
+        }
         if (topicThreadId) await patchSession(topicThreadId, { updatedAt: Date.now() });
         replyTo = finalMsgId;
         replyInThread = !opts.flat;
         log.info("card", "final", { terminal: render.terminal() });
         if (killed) break;
         if (state.queue.length === 0) break;
-        turnText = state.queue.shift();
+        turnInput = state.queue.shift();
       }
     } catch (err) {
       log.fail("intake", err);
@@ -4890,7 +5344,7 @@ async function runUpdate(opts = {}) {
 }
 
 // src/cli/commands/bot.ts
-import { rm as rm3 } from "fs/promises";
+import { rm as rm4 } from "fs/promises";
 async function runBotInit(name) {
   if (!ensureCodex()) {
     process.exitCode = 1;
@@ -4944,7 +5398,7 @@ async function runBotRm(name) {
   }
   const after = await removeBot(bot2.appId);
   await removeSecret(secretKeyForApp(bot2.appId));
-  await rm3(botDir(bot2.appId), { recursive: true, force: true });
+  await rm4(botDir(bot2.appId), { recursive: true, force: true });
   console.log(`\u2713 \u5DF2\u79FB\u9664\u673A\u5668\u4EBA\u300C${bot2.name}\u300D(${bot2.appId})\uFF1A\u6CE8\u518C\u8868 + \u5BC6\u94A5 + \u72B6\u6001\u76EE\u5F55(projects/sessions)\u3002`);
   if (after.bots.length === 0) {
     console.log("  \u5DF2\u65E0\u4EFB\u4F55\u673A\u5668\u4EBA\uFF0C`bot init` \u91CD\u65B0\u521B\u5EFA\u3002");
@@ -5002,15 +5456,15 @@ async function secretsRemove(id) {
   console.log(ok ? `\u2713 \u5DF2\u5220\u9664: ${id}` : `\u672A\u627E\u5230: ${id}`);
 }
 function readStdin() {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     let data = "";
     if (process.stdin.isTTY) {
-      resolve5("");
+      resolve6("");
       return;
     }
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (c) => data += c);
-    process.stdin.on("end", () => resolve5(data));
+    process.stdin.on("end", () => resolve6(data));
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelzen/feishu-codex-bridge",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Bridge Feishu/Lark messenger with local Codex via app-server (project=group, thread=session)",
   "type": "module",
   "bin": {