@nanhara/hara 0.121.0 → 0.122.0

package/dist/fs-read.js

@@ -1,20 +1,92 @@
 // Bounded streaming line reader for files too large to load as one string. It stores only the requested
 // window and a capped prefix of each line, so huge logs/JSONL and minified one-line files stay safe.
-import { closeSync, createReadStream, fstatSync, openSync, readSync } from "node:fs";
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import { open } from "node:fs/promises";
 export class BinaryFileError extends Error {
     constructor(path) {
         super(`${path} appears to be binary (NUL byte detected)`);
         this.name = "BinaryFileError";
     }
 }
+export class NonRegularFileError extends Error {
+    code = "HARA_NOT_REGULAR_FILE";
+    constructor(path) {
+        super(`${path} is not a regular file`);
+        this.name = "NonRegularFileError";
+    }
+}
+export class FileReadLimitError extends Error {
+    limit;
+    code = "HARA_FILE_TOO_LARGE";
+    constructor(path, limit) {
+        super(`${path} exceeds the ${limit}-byte safe edit/read limit`);
+        this.limit = limit;
+        this.name = "FileReadLimitError";
+    }
+}
 const DEFAULT_LINE_CAP = 2000;
 const DEFAULT_MAX_SCAN = 64 * 1024 * 1024;
+const MAX_SLICE_LINES = 2_000;
+/** Editing tools materialize the old text for diff/CAS. Keep that allocation explicitly bounded. */
+export const MAX_EDIT_READ_BYTES = 64 * 1024 * 1024;
+const READ_CHUNK_BYTES = 64 * 1024;
+const MAX_PREFIX_CHARS = 1_000_000;
+/** Open without blocking on a FIFO, validate the SAME descriptor, then read at most maxBytes from it.
+ * Path-level stat→readFile is unsafe because the path can be exchanged for a pipe/device between calls. */
+async function readRegularFileSnapshotWithFlags(path, maxBytes, flags) {
+    const requested = Number.isFinite(maxBytes) ? Math.floor(maxBytes) : MAX_EDIT_READ_BYTES;
+    const limit = Math.min(MAX_EDIT_READ_BYTES, Math.max(1, requested));
+    const handle = await open(path, flags);
+    try {
+        const info = await handle.stat();
+        if (!info.isFile())
+            throw new NonRegularFileError(path);
+        if (info.size > limit)
+            throw new FileReadLimitError(path, limit);
+        const chunks = [];
+        let total = 0;
+        let position = 0;
+        // Read one byte past the limit so concurrent growth cannot bypass the pre-read size check.
+        while (total <= limit) {
+            const want = Math.min(READ_CHUNK_BYTES, limit + 1 - total);
+            const buffer = Buffer.allocUnsafe(want);
+            const { bytesRead } = await handle.read(buffer, 0, want, position);
+            if (bytesRead === 0)
+                break;
+            chunks.push(buffer.subarray(0, bytesRead));
+            total += bytesRead;
+            position += bytesRead;
+        }
+        if (total > limit)
+            throw new FileReadLimitError(path, limit);
+        return { text: Buffer.concat(chunks, total).toString("utf8"), dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
+    }
+    finally {
+        await handle.close().catch(() => { });
+    }
+}
+export async function readRegularFileSnapshot(path, maxBytes = MAX_EDIT_READ_BYTES) {
+    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | constants.O_NONBLOCK);
+}
+/** Quarantine/transaction reader: reject a symlink at open(2), then validate/read that same fd. */
+export async function readRegularFileSnapshotNoFollow(path, maxBytes = MAX_EDIT_READ_BYTES) {
+    const noFollow = typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0;
+    return readRegularFileSnapshotWithFlags(path, maxBytes, constants.O_RDONLY | constants.O_NONBLOCK | noFollow);
+}
+export async function readRegularFileText(path, maxBytes = MAX_EDIT_READ_BYTES) {
+    return (await readRegularFileSnapshot(path, maxBytes)).text;
+}
 /** Read only enough bytes to produce a bounded UTF-8 prefix (used by synchronous @file expansion). */
 export function readTextPrefixSync(path, maxChars) {
-    const chars = Math.max(0, Math.floor(maxChars));
-    const fd = openSync(path, "r");
+    const requested = Number.isFinite(maxChars) ? Math.floor(maxChars) : MAX_PREFIX_CHARS;
+    const chars = Math.min(MAX_PREFIX_CHARS, Math.max(0, requested));
+    // O_NONBLOCK makes opening a FIFO return immediately; fstat on this exact fd then rejects it before read.
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
     try {
-        const size = fstatSync(fd).size;
+        const info = fstatSync(fd);
+        if (!info.isFile())
+            throw new NonRegularFileError(path);
+        const size = info.size;
         // Four bytes per Unicode scalar plus a small boundary cushion guarantees enough decoded input for
         // `chars` without allocating the entire file. readSync can short-read, so fill in a loop.
         const byteLimit = Math.min(size, chars * 4 + 4);
@@ -41,11 +113,19 @@ export function readTextPrefixSync(path, maxChars) {
 }
 /** Render a line slice without retaining the entire file. Total line count is shown only when EOF is reached. */
 export async function streamFileSlice(path, offset = 1, limit = 300, options = {}) {
-    const start = Math.max(1, Math.floor(offset));
-    const want = Math.max(1, Math.floor(limit));
+    const requestedStart = Number.isFinite(offset) ? Math.floor(offset) : 1;
+    const requestedLines = Number.isFinite(limit) ? Math.floor(limit) : 300;
+    const start = Math.min(Number.MAX_SAFE_INTEGER, Math.max(1, requestedStart));
+    const want = Math.min(MAX_SLICE_LINES, Math.max(1, requestedLines));
     const requestedEnd = start + want - 1;
-    const lineCap = Math.max(1, Math.floor(options.lineCap ?? DEFAULT_LINE_CAP));
-    const maxScan = Math.max(lineCap, Math.floor(options.maxScanChars ?? DEFAULT_MAX_SCAN));
+    const requestedLineCap = Number.isFinite(options.lineCap)
+        ? Math.floor(options.lineCap)
+        : DEFAULT_LINE_CAP;
+    const lineCap = Math.min(DEFAULT_LINE_CAP, Math.max(1, requestedLineCap));
+    const requestedScan = Number.isFinite(options.maxScanChars)
+        ? Math.floor(options.maxScanChars)
+        : DEFAULT_MAX_SCAN;
+    const maxScan = Math.min(DEFAULT_MAX_SCAN, Math.max(lineCap, requestedScan));
     const rendered = [];
     let lineNo = 1;
     let linePrefix = "";
@@ -98,8 +178,17 @@ export async function streamFileSlice(path, offset = 1, limit = 300, options = {
         if (current > requestedEnd)
             hasMore = true;
     };
-    const stream = createReadStream(path, { encoding: "utf8", highWaterMark: 64 * 1024 });
+    // Keep validation and streaming on the same non-blocking descriptor. This closes the stat→open race
+    // where an attacker/local generator exchanges a regular path for a FIFO after validation.
+    const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    let stream;
     try {
+        const info = await handle.stat();
+        if (!info.isFile())
+            throw new NonRegularFileError(path);
+        // `end` is an inclusive byte offset. It makes the scan ceiling a true fd-level byte bound (not just
+        // a post-read character counter, which could overshoot badly on multi-byte text or a giant chunk).
+        stream = handle.createReadStream({ encoding: "utf8", highWaterMark: 64 * 1024, autoClose: false, end: maxScan - 1 });
         for await (const raw of stream) {
             const chunk = String(raw);
             if (chunk.length)
@@ -125,17 +214,22 @@ export async function streamFileSlice(path, offset = 1, limit = 300, options = {
                 stoppedEarly = true;
                 break;
             }
-            if (scanned >= maxScan) {
+        }
+        if (!stoppedEarly && stream.bytesRead >= maxScan) {
+            // Re-fstat the same open file description so concurrent growth is also detected. An exact-size file
+            // is genuine EOF and should still receive the normal total-line rendering.
+            const latest = await handle.stat();
+            if (latest.size > stream.bytesRead) {
                 scanLimited = true;
                 stoppedEarly = true;
                 if (lineNo >= start && lineNo <= requestedEnd)
                     finishLine(true);
-                break;
             }
         }
     }
     finally {
-        stream.destroy();
+        stream?.destroy();
+        await handle.close().catch(() => { });
     }
     if (!stoppedEarly) {
         // A trailing newline creates no phantom line, matching String#split + trailing-empty removal.

package/dist/fs-write.js

@@ -1,7 +1,10 @@
 // Crash-safe UTF-8 writes for coding tools. Content is staged beside the destination, fsynced, then
 // renamed into place so a killed process never leaves a half-written source file.
-import { dirname, join } from "node:path";
-import { link, lstat, mkdir, open, readFile, realpath, rename, stat, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { basename, dirname, join } from "node:path";
+import { constants, linkSync, lstatSync, readlinkSync, renameSync, symlinkSync, unlinkSync } from "node:fs";
+import { link, lstat, mkdir, open, realpath, rename, rmdir, stat, unlink } from "node:fs/promises";
+import { NonRegularFileError, readRegularFileSnapshotNoFollow } from "./fs-read.js";
 export class FileChangedError extends Error {
     code = "HARA_FILE_CHANGED";
     constructor(path) {
@@ -24,12 +27,139 @@ async function writeTarget(path) {
     }
     return path;
 }
+/** mkdir -p with ownership accounting: only a mkdir call that actually succeeded is recorded. */
+async function ensureDirectory(path, created) {
+    try {
+        const info = await stat(path);
+        if (!info.isDirectory())
+            throw new Error(`${path} is not a directory`);
+        return;
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT")
+            throw error;
+    }
+    const parent = dirname(path);
+    if (parent === path)
+        throw new Error(`cannot create directory ${path}`);
+    await ensureDirectory(parent, created);
+    try {
+        await mkdir(path);
+        const info = await lstat(path);
+        if (!info.isDirectory())
+            throw new Error(`${path} changed while it was being created`);
+        // Store the canonical name now. Keeping a lexical path beneath a symlink would make undo look in a
+        // different tree after that parent link is retargeted, silently leaving directories we created behind.
+        const canonical = await realpath(path);
+        const canonicalInfo = await lstat(canonical);
+        if (!canonicalInfo.isDirectory() || canonicalInfo.dev !== info.dev || canonicalInfo.ino !== info.ino) {
+            throw new FileChangedError(path);
+        }
+        created.push({ path: canonical, dev: info.dev, ino: info.ino, mode: info.mode & 0o777 });
+    }
+    catch (error) {
+        if (error?.code !== "EEXIST")
+            throw error;
+        const info = await stat(path);
+        if (!info.isDirectory())
+            throw new Error(`${path} is not a directory`);
+    }
+}
+/** Remove only directories this process actually created and that still name the same empty inode. */
+export async function removeCreatedDirectories(created) {
+    for (let i = created.length - 1; i >= 0; i--) {
+        const expected = created[i];
+        let info;
+        try {
+            info = await lstat(expected.path);
+        }
+        catch (error) {
+            if (error?.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        if (!info.isDirectory() || info.dev !== expected.dev || info.ino !== expected.ino || (info.mode & 0o777) !== expected.mode) {
+            throw new FileChangedError(expected.path);
+        }
+        await rmdir(expected.path); // ENOTEMPTY is a safe refusal: concurrent content is never removed.
+    }
+}
+/**
+ * Delete a previously verified quarantine entry without reopening the long verify→unlink race.
+ *
+ * The caller has already verified content through a no-follow descriptor. We atomically claim the current
+ * directory entry under one more unpredictable name, then perform the final no-follow identity check and
+ * unlink synchronously in the same JS turn. A same-process watcher therefore cannot replace the entry in
+ * the long asynchronous content-read window and have an unrelated inode unlinked. On any mismatch/failure,
+ * the claimed entry is deliberately retained and its exact recovery path is included in the error.
+ */
+export function discardClaimedPath(path, expected) {
+    const disposal = join(dirname(path), `.hara-discard-${process.pid}-${randomUUID()}.tmp`);
+    renameSync(path, disposal);
+    try {
+        const info = lstatSync(disposal);
+        const isLink = expected.linkTarget !== undefined;
+        const same = info.dev === expected.dev &&
+            info.ino === expected.ino &&
+            (info.mode & 0o777) === expected.mode &&
+            info.nlink === expected.nlink &&
+            info.isSymbolicLink() === isLink &&
+            (!isLink || readlinkSync(disposal) === expected.linkTarget);
+        if (!same)
+            throw new FileChangedError(path);
+        unlinkSync(disposal);
+    }
+    catch (error) {
+        throw new Error(`${error instanceof Error ? error.message : String(error)}; claimed entry is preserved at ${disposal}`, { cause: error });
+    }
+}
+function sameClaimedPath(path, expected) {
+    const info = lstatSync(path);
+    const isLink = expected.linkTarget !== undefined;
+    return (info.dev === expected.dev &&
+        info.ino === expected.ino &&
+        (info.mode & 0o777) === expected.mode &&
+        info.nlink === expected.nlink &&
+        info.isSymbolicLink() === isLink &&
+        (!isLink || readlinkSync(path) === expected.linkTarget));
+}
+/** Restore a move-claimed entry without overwriting a path that appeared concurrently. */
+function restoreClaimedPath(claimed, target, expected) {
+    if (!sameClaimedPath(claimed, expected)) {
+        throw new Error(`${new FileChangedError(target).message}; claimed entry is preserved at ${claimed}`);
+    }
+    const info = lstatSync(claimed);
+    if (info.isDirectory()) {
+        // POSIX has no portable rename-no-replace for directories. Retaining is safer than overwriting a new target.
+        throw new Error(`cannot safely restore a concurrently claimed directory; it is preserved at ${claimed}`);
+    }
+    try {
+        if (expected.linkTarget !== undefined)
+            symlinkSync(expected.linkTarget, target);
+        else
+            linkSync(claimed, target);
+    }
+    catch (error) {
+        if (error?.code === "EEXIST") {
+            throw new Error(`another entry appeared at ${target}; the claimed entry is preserved at ${claimed}`);
+        }
+        throw error;
+    }
+    discardClaimedPath(claimed, {
+        ...expected,
+        nlink: expected.nlink + (expected.linkTarget === undefined ? 1 : 0),
+    });
+}
 async function syncDirectory(path) {
     // Directory fsync makes the rename durable across a power loss on POSIX. Some filesystems/platforms
     // reject opening directories, so durability degrades gracefully after the file itself was synced.
     try {
-        const handle = await open(path, "r");
+        // The directory name can be exchanged after rename. O_NONBLOCK plus fstat on this exact descriptor
+        // keeps best-effort durability from hanging forever on a replacement FIFO/device.
+        const handle = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
         try {
+            if (!(await handle.stat()).isDirectory())
+                return;
             await handle.sync();
         }
         finally {
@@ -42,12 +172,27 @@ async function syncDirectory(path) {
 }
 /** Atomically replace/create a UTF-8 file, optionally refusing to overwrite a newer disk version. */
 export async function atomicWriteText(path, content, options = {}) {
-    const target = await writeTarget(path);
-    const dir = dirname(target);
-    await mkdir(dir, { recursive: true });
-    let mode = 0o666;
+    let target = await writeTarget(path);
+    let dir = dirname(target);
+    const createdDirs = [];
+    await ensureDirectory(dir, createdDirs);
+    // Canonicalize the parent too, not just a final-component symlink. A workspace may sit beneath a linked
+    // directory; returning/rolling back the canonical target prevents a concurrent parent retarget from sending
+    // later transaction steps to a different tree.
+    dir = await realpath(dir);
+    target = join(dir, basename(target));
+    // A caller-provided preflight identity is authoritative. Reading mode from a path before the move-claim
+    // would let a temporary same-path replacement influence the mode even when the expected inode is restored
+    // before claim verification.
+    let mode = options.mode === undefined ? (options.expectedIdentity?.mode ?? 0o666) : options.mode & 0o777;
+    let preserveExactMode = options.mode !== undefined || options.expectedIdentity !== undefined;
     try {
-        mode = (await stat(target)).mode & 0o777;
+        const info = await stat(target);
+        if (!info.isFile())
+            throw new NonRegularFileError(path);
+        if (options.mode === undefined && !options.expectedIdentity)
+            mode = info.mode & 0o777;
+        preserveExactMode = true;
     }
     catch (error) {
         if (error?.code !== "ENOENT")
@@ -57,12 +202,21 @@ export async function atomicWriteText(path, content, options = {}) {
     // perfectly valid near-NAME_MAX file impossible to edit because the temporary name becomes longer.
     const temp = join(dir, `.hara-${process.pid}-${Date.now().toString(36)}-${tempSequence++}.tmp`);
     let staged = false;
+    let writtenIdentity;
+    const warnings = [];
+    let succeeded = false;
     try {
         const handle = await open(temp, "wx", mode);
         staged = true;
         try {
             await handle.writeFile(content, "utf8");
+            // open(2) applies the process umask even when replacing an existing file. Restore that existing (or
+            // explicit rollback) mode on the staged fd; brand-new ordinary files still honor the user's umask.
+            if (preserveExactMode)
+                await handle.chmod(mode);
             await handle.sync();
+            const info = await handle.stat();
+            writtenIdentity = { dev: info.dev, ino: info.ino, mode: info.mode & 0o777, nlink: info.nlink };
         }
         finally {
             await handle.close();
@@ -81,25 +235,97 @@ export async function atomicWriteText(path, content, options = {}) {
             await unlink(temp);
             staged = false;
         }
-        else {
-            if (typeof options.expected === "string") {
-                let current;
+        else if (typeof options.expected === "string") {
+            // Claim the directory entry BEFORE verification. Reading the old fd and then rename-overwriting the
+            // path leaves a verify→commit race; a concurrent replacement can otherwise be silently destroyed.
+            const claimed = join(dir, `.hara-claim-${process.pid}-${randomUUID()}.tmp`);
+            try {
+                await rename(target, claimed);
+            }
+            catch (error) {
+                if (error?.code === "ENOENT")
+                    throw new FileChangedError(path);
+                throw error;
+            }
+            let claimedIdentity;
+            try {
+                const pathInfo = await lstat(claimed);
+                claimedIdentity = {
+                    dev: pathInfo.dev,
+                    ino: pathInfo.ino,
+                    mode: pathInfo.mode & 0o777,
+                    nlink: pathInfo.nlink,
+                    linkTarget: pathInfo.isSymbolicLink() ? readlinkSync(claimed) : undefined,
+                };
+                const current = await readRegularFileSnapshotNoFollow(claimed);
+                const expectedIdentity = options.expectedIdentity;
+                const identityMatches = !expectedIdentity ||
+                    (current.dev === expectedIdentity.dev &&
+                        current.ino === expectedIdentity.ino &&
+                        current.mode === expectedIdentity.mode &&
+                        current.nlink === expectedIdentity.nlink);
+                if (!identityMatches || current.text !== options.expected)
+                    throw new FileChangedError(path);
+            }
+            catch (error) {
                 try {
-                    current = await readFile(target, "utf8");
+                    if (!claimedIdentity) {
+                        const info = lstatSync(claimed);
+                        claimedIdentity = {
+                            dev: info.dev,
+                            ino: info.ino,
+                            mode: info.mode & 0o777,
+                            nlink: info.nlink,
+                            linkTarget: info.isSymbolicLink() ? readlinkSync(claimed) : undefined,
+                        };
+                    }
+                    restoreClaimedPath(claimed, target, claimedIdentity);
                 }
-                catch {
-                    throw new FileChangedError(path);
+                catch (restoreError) {
+                    throw new Error(`${error instanceof Error ? error.message : String(error)}; safe restore was incomplete: ${restoreError?.message ?? String(restoreError)}`, { cause: error });
                 }
-                if (current !== options.expected)
-                    throw new FileChangedError(path);
+                throw error;
             }
+            if (!claimedIdentity)
+                throw new Error(`Failed to identify claimed file for ${path}`);
+            try {
+                await link(temp, target); // atomic create-if-absent: never overwrites an entry created after claim.
+            }
+            catch (error) {
+                let recovery = "";
+                try {
+                    restoreClaimedPath(claimed, target, claimedIdentity);
+                }
+                catch (restoreError) {
+                    recovery = `; claimed old entry is retained: ${restoreError?.message ?? String(restoreError)}`;
+                }
+                if (error?.code === "EEXIST")
+                    throw new Error(`${new FileChangedError(path).message}${recovery}`);
+                throw new Error(`${error?.message ?? String(error)}${recovery}`, { cause: error });
+            }
+            await unlink(temp);
+            staged = false;
+            try {
+                discardClaimedPath(claimed, claimedIdentity);
+            }
+            catch (error) {
+                warnings.push(`old entry cleanup was refused: ${error?.message ?? String(error)}`);
+            }
+        }
+        else {
             await rename(temp, target);
             staged = false;
         }
         await syncDirectory(dir);
+        succeeded = true;
     }
     finally {
         if (staged)
             await unlink(temp).catch(() => { });
+        if (!succeeded)
+            await removeCreatedDirectories(createdDirs).catch(() => { });
     }
+    if (!writtenIdentity)
+        throw new Error(`Failed to identify staged file for ${path}`);
+    return { ...writtenIdentity, target, createdDirs, ...(warnings.length ? { warnings } : {}) };
 }

package/dist/gateway/dingtalk.js

@@ -38,7 +38,10 @@ export function parseDingtalkMessage(msg) {
         text = flattenRichText(msg.content?.richText).trim();
     if (!text)
         return null; // unsupported type (audio/file/etc.) or empty
-    return { msg: { chatId, userId, userName, text }, sessionWebhook };
+    // DingTalk documents conversationType=1 for a one-to-one bot chat and 2 for groups. Missing/novel values
+    // stay group-classified so protocol drift cannot expose the full-auto DM driver in a channel.
+    const chatType = String(msg.conversationType ?? "").trim() === "1" ? "p2p" : "group";
+    return { msg: { chatId, userId, userName, text, chatType }, sessionWebhook };
 }
 /** Flatten a DingTalk richText message (an array of {text}/{type} runs) into plain text (pure). */
 function flattenRichText(runs) {

package/dist/gateway/discord.js

@@ -4,9 +4,9 @@
 // the cross-platform gateway plumbing (send_file, in-chat system context, stuck-guard, image attach/describe)
 // works unchanged. NOTE: receiving message text needs the privileged "Message Content Intent" enabled for the
 // bot in the Discord developer portal.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, basename } from "node:path";
-import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+import { InboundMediaBudget, savePrivateResponse } from "./media.js";
 import { chunkText } from "./telegram.js";
 const REST = "https://discord.com/api/v10";
 const GATEWAY = "wss://gateway.discord.gg/?v=10&encoding=json";
@@ -20,16 +20,12 @@ const sleep = (ms, signal) => new Promise((r) => {
     signal?.addEventListener?.("abort", () => { clearTimeout(t); r(); }, { once: true });
 });
 const isImage = (name, mime) => (mime?.startsWith("image/") ?? false) || /\.(png|jpe?g|gif|webp)$/i.test(name);
-async function downloadDiscordAttachment(url, filename) {
+async function downloadDiscordAttachment(url, filename, options) {
     try {
-        const r = await fetch(url);
+        const r = await fetch(url, { signal: options.signal });
         if (!r.ok)
             return null;
-        const dir = join(homedir(), ".hara", "discord", "media");
-        mkdirSync(dir, { recursive: true });
-        const path = join(dir, `dc_${Date.now()}_${basename(filename) || "file.bin"}`);
-        writeFileSync(path, Buffer.from(await r.arrayBuffer()));
-        return path;
+        return await savePrivateResponse(r, { platform: "discord", filenameHint: filename, ...options });
     }
     catch {
         return null;
@@ -37,7 +33,13 @@ async function downloadDiscordAttachment(url, filename) {
 }
 /** Parse a Discord MESSAGE_CREATE payload → InboundMsg + its image attachment URLs (pure; download happens in
  *  start()). null = ignore (own message / another bot / empty). */
-export function parseDiscordMessage(d, selfId) {
+export function discordChatType(message, resolvedChannelType) {
+    if (message?.guild_id)
+        return "group";
+    // Discord channel type 1 is a one-to-one DM; type 3 is a group DM. Missing/failed REST metadata stays group.
+    return Number(resolvedChannelType) === 1 ? "p2p" : "group";
+}
+export function parseDiscordMessage(d, selfId, resolvedChannelType) {
     if (!d?.channel_id || !d?.author?.id)
         return null;
     if (d.author.id === selfId || d.author.bot)
@@ -55,6 +57,7 @@ export function parseDiscordMessage(d, selfId) {
             userId: String(d.author.id),
             userName: d.author.global_name || d.author.username || String(d.author.id),
             text: text || "[图片]",
+            chatType: discordChatType(d, resolvedChannelType),
         },
         imageUrls,
     };
@@ -78,13 +81,13 @@ export function discordAdapter(token) {
             form.append("files[0]", new Blob([readFileSync(filePath)]), basename(filePath));
             await fetch(`${REST}/channels/${chatId}/messages`, { method: "POST", headers: auth, body: form }).catch(() => { });
         },
-        async start(onMessage, signal) {
+        async start(onMessage, signal, shouldDownload) {
             if (!WSImpl) {
                 console.error("hara gateway: Discord needs Node ≥ 22 (global WebSocket). Upgrade Node.");
                 return;
             }
             while (!signal.aborted) {
-                await connectOnce(token, onMessage, signal);
+                await connectOnce(token, onMessage, signal, shouldDownload);
                 if (!signal.aborted)
                     await sleep(3000, signal); // reconnect backoff
             }
@@ -93,9 +96,10 @@ export function discordAdapter(token) {
 }
 /** One gateway connection: HELLO→heartbeat, IDENTIFY, then dispatch MESSAGE_CREATE. Resolves on close/abort;
  *  the caller reconnects. v1 keeps it simple — fresh IDENTIFY each time, no RESUME. */
-function connectOnce(token, onMessage, signal) {
+function connectOnce(token, onMessage, signal, shouldDownload) {
     return new Promise((resolve) => {
         const ws = new WSImpl(GATEWAY);
+        const channelTypes = new Map();
         let hb = null;
         let seq = null;
         let selfId = "";
@@ -145,12 +149,43 @@ function connectOnce(token, onMessage, signal) {
                 if (p.t === "READY")
                     selfId = p.d?.user?.id ?? "";
                 else if (p.t === "MESSAGE_CREATE") {
+                    // Parse/filter first with the safe group default, then resolve non-guild channel metadata only for a
+                    // real user message. Channel type is immutable, so known results are safe to cache for this connection.
                     const parsed = parseDiscordMessage(p.d, selfId);
                     if (parsed) {
-                        for (const im of parsed.imageUrls) {
-                            const path = await downloadDiscordAttachment(im.url, im.name);
-                            if (path)
-                                (parsed.msg.images ??= []).push(path);
+                        if (!p.d?.guild_id) {
+                            const channelId = String(p.d?.channel_id ?? "");
+                            let channelType = channelTypes.get(channelId);
+                            if (channelType === undefined && channelId) {
+                                try {
+                                    const response = await fetch(`${REST}/channels/${encodeURIComponent(channelId)}`, {
+                                        headers: { Authorization: `Bot ${token}` },
+                                        signal,
+                                    });
+                                    const body = response.ok ? (await response.json()) : null;
+                                    const candidate = Number(body?.type);
+                                    if (Number.isSafeInteger(candidate)) {
+                                        channelType = candidate;
+                                        channelTypes.set(channelId, candidate);
+                                        if (channelTypes.size > 1000)
+                                            channelTypes.delete(channelTypes.keys().next().value);
+                                    }
+                                }
+                                catch {
+                                    /* cannot prove a DM → retain the safe group classification and retry on the next message */
+                                }
+                            }
+                            parsed.msg.chatType = discordChatType(p.d, channelType);
+                        }
+                        if (shouldDownload?.(parsed.msg) === true) {
+                            const budget = new InboundMediaBudget("discord", signal);
+                            for (const im of parsed.imageUrls) {
+                                const path = await budget.download((options) => downloadDiscordAttachment(im.url, im.name, options));
+                                if (path) {
+                                    (parsed.msg.images ??= []).push(path);
+                                    (parsed.msg.transientFiles ??= []).push(path);
+                                }
+                            }
                         }
                         await onMessage(parsed.msg).catch(() => { });
                     }