@nanhara/hara 0.121.0 → 0.122.0

package/dist/gateway/flows.js

@@ -6,17 +6,65 @@
 // Opt-in: config lives in the user's ~/.hara/flows.json — no file, no flows (zero behaviour change).
 // Platform-agnostic: matching only reads the generic InboundMsg fields each adapter populates (chatType,
 // mentions), so a flow works on whatever platform surfaces the data it asks for.
-import { readFileSync } from "node:fs";
+import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { deliverResult } from "../cron/deliver.js";
+import { deliverResult, parseDeliver } from "../cron/deliver.js";
+import { addPending } from "./flows-pending.js";
+import { redactSensitiveValue } from "../security/secrets.js";
 const asArray = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]);
+function isStrings(value) {
+    return typeof value === "string" || (Array.isArray(value) && value.every((item) => typeof item === "string"));
+}
+function validFlow(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const f = value;
+    if (typeof f.name !== "string" || !f.name.trim() || typeof f.do !== "string" || !f.do.trim())
+        return false;
+    if (f.enabled !== undefined && typeof f.enabled !== "boolean")
+        return false;
+    if (f.guard !== undefined && typeof f.guard !== "string")
+        return false;
+    if (f.cwd !== undefined && typeof f.cwd !== "string")
+        return false;
+    if (f.schema !== undefined && (!f.schema || typeof f.schema !== "object" || Array.isArray(f.schema)))
+        return false;
+    if (f.deliver !== undefined && !isStrings(f.deliver))
+        return false;
+    if (f.notifyOn !== undefined && (!Array.isArray(f.notifyOn) || !f.notifyOn.every((item) => typeof item === "string")))
+        return false;
+    if (f.replyOn !== undefined && (!Array.isArray(f.replyOn) || !f.replyOn.every((item) => typeof item === "string")))
+        return false;
+    if (f.log !== undefined && typeof f.log !== "boolean")
+        return false;
+    if (f.reply !== undefined && typeof f.reply !== "boolean")
+        return false;
+    if (f.on !== undefined) {
+        if (!f.on || typeof f.on !== "object" || Array.isArray(f.on))
+            return false;
+        const on = f.on;
+        if (on.platform !== undefined && typeof on.platform !== "string")
+            return false;
+        if (on.chat !== undefined && !isStrings(on.chat))
+            return false;
+        if (on.chatType !== undefined && !["p2p", "group", "any"].includes(String(on.chatType)))
+            return false;
+        if (on.mention !== undefined && !isStrings(on.mention))
+            return false;
+        if (on.keyword !== undefined && !isStrings(on.keyword))
+            return false;
+        if (on.ignoreKeyword !== undefined && !isStrings(on.ignoreKeyword))
+            return false;
+    }
+    return true;
+}
 /** Load ~/.hara/flows.json — accepts a bare array or `{ "flows": [...] }`. Missing/malformed → [] (never throws). */
 export function loadFlows() {
     try {
         const parsed = JSON.parse(readFileSync(join(homedir(), ".hara", "flows.json"), "utf8"));
         const flows = Array.isArray(parsed) ? parsed : parsed?.flows;
-        return Array.isArray(flows) ? flows.filter((f) => f && f.enabled !== false && f.name && f.do) : [];
+        return Array.isArray(flows) ? flows.filter((f) => validFlow(f) && f.enabled !== false).slice(0, 64) : [];
     }
     catch {
         return [];
@@ -49,40 +97,367 @@ export function matchFlow(r, m, platform) {
     const kws = asArray(on.keyword);
     if (kws.length && !kws.some((k) => (m.text ?? "").includes(k)))
         return false;
+    const mutes = asArray(on.ignoreKeyword);
+    if (mutes.length && mutes.some((k) => (m.text ?? "").includes(k)))
+        return false;
     return true;
 }
+/** Append a run record to ~/.hara/flows-log.jsonl — the reviewable trail of everything the flow judged,
+ *  including runs the noise policy chose NOT to push (judged + logged ≠ delivered). */
+export function appendFlowLog(entry) {
+    try {
+        const dir = join(homedir(), ".hara");
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        chmodSync(dir, 0o700);
+        const file = join(dir, "flows-log.jsonl");
+        if (existsSync(file) && statSync(file).size >= 1_000_000) {
+            const rotated = `${file}.1`;
+            rmSync(rotated, { force: true });
+            renameSync(file, rotated);
+            chmodSync(rotated, 0o600);
+        }
+        const safe = redactSensitiveValue({ at: new Date().toISOString(), ...entry }).value;
+        appendFileSync(file, JSON.stringify(safe) + "\n", { encoding: "utf8", mode: 0o600 });
+        try {
+            chmodSync(file, 0o600);
+        }
+        catch {
+            /* best-effort on filesystems without POSIX modes */
+        }
+    }
+    catch {
+        /* logging is best-effort */
+    }
+}
+const senderFlowRate = new Map();
+const chatFlowRate = new Map();
+let globalFlowRate = [];
+let activeFlowRuns = 0;
+const MAX_ACTIVE_FLOW_RUNS = 4;
+const RATE_MINUTE_MS = 60_000;
+const RATE_HOUR_MS = 60 * RATE_MINUTE_MS;
+const MAX_SENDER_RUNS_PER_MINUTE = 5;
+const MAX_CHAT_RUNS_PER_MINUTE = 10;
+const MAX_CHAT_RUNS_PER_HOUR = 60;
+const MAX_GLOBAL_RUNS_PER_MINUTE = 20;
+const MAX_GLOBAL_RUNS_PER_HOUR = 120;
+const MAX_SENDER_RATE_BUCKETS = 1_024;
+const MAX_CHAT_RATE_BUCKETS = 1_024;
+const MAX_RATE_KEY_PART_CHARS = 160;
+const RATE_SWEEP_INTERVAL = 64;
+let claimsUntilRateSweep = RATE_SWEEP_INTERVAL;
+function boundedRateKey(...parts) {
+    return parts
+        .map((value) => {
+        const part = String(value ?? "").slice(0, MAX_RATE_KEY_PART_CHARS);
+        return `${part.length}:${part}`;
+    })
+        .join("");
+}
+function pruneRateTimes(times, now, windowMs, maxEntries) {
+    const live = [];
+    // Walk newest-first so even a bucket left by an older implementation cannot cause an unbounded copy.
+    for (let i = times.length - 1; i >= 0 && live.length < maxEntries; i--) {
+        const at = times[i];
+        // A backwards wall-clock adjustment must not reopen the limiter; future timestamps remain live.
+        if (Number.isFinite(at) && (at > now || now - at < windowMs))
+            live.push(at);
+    }
+    live.reverse();
+    return live;
+}
+function sweepRateMap(map, now, windowMs, maxEntriesPerBucket) {
+    for (const [key, times] of map) {
+        const live = pruneRateTimes(times, now, windowMs, maxEntriesPerBucket);
+        if (live.length)
+            map.set(key, live);
+        else
+            map.delete(key);
+    }
+}
+function prepareRateBucket(map, key, now, windowMs, maxBuckets, maxEntriesPerBucket) {
+    const current = map.get(key);
+    if (current) {
+        const live = pruneRateTimes(current, now, windowMs, maxEntriesPerBucket);
+        if (live.length)
+            map.set(key, live);
+        else
+            map.delete(key);
+        return live;
+    }
+    if (map.size >= maxBuckets) {
+        sweepRateMap(map, now, windowMs, maxEntriesPerBucket);
+        if (map.size >= maxBuckets)
+            return undefined;
+    }
+    return [];
+}
+function countRateTimes(times, now, windowMs) {
+    let count = 0;
+    for (const at of times)
+        if (at > now || now - at < windowMs)
+            count++;
+    return count;
+}
+/** @internal Clears process-local flow quotas between isolated tests. Never call while flow runs are active. */
+export function resetFlowRateStateForTests() {
+    senderFlowRate.clear();
+    chatFlowRate.clear();
+    globalFlowRate = [];
+    activeFlowRuns = 0;
+    claimsUntilRateSweep = RATE_SWEEP_INTERVAL;
+}
+function claimFlowRun(rule, m, platform) {
+    const now = Date.now();
+    if (--claimsUntilRateSweep <= 0) {
+        sweepRateMap(senderFlowRate, now, RATE_MINUTE_MS, MAX_SENDER_RUNS_PER_MINUTE);
+        sweepRateMap(chatFlowRate, now, RATE_HOUR_MS, MAX_CHAT_RUNS_PER_HOUR);
+        claimsUntilRateSweep = RATE_SWEEP_INTERVAL;
+    }
+    globalFlowRate = pruneRateTimes(globalFlowRate, now, RATE_HOUR_MS, MAX_GLOBAL_RUNS_PER_HOUR);
+    if (activeFlowRuns >= MAX_ACTIVE_FLOW_RUNS)
+        return false;
+    const senderKey = boundedRateKey(rule.name, platform, m.chatId, m.userId);
+    const chatKey = boundedRateKey(rule.name, platform, m.chatId);
+    const senderMinute = prepareRateBucket(senderFlowRate, senderKey, now, RATE_MINUTE_MS, MAX_SENDER_RATE_BUCKETS, MAX_SENDER_RUNS_PER_MINUTE);
+    const chatHour = prepareRateBucket(chatFlowRate, chatKey, now, RATE_HOUR_MS, MAX_CHAT_RATE_BUCKETS, MAX_CHAT_RUNS_PER_HOUR);
+    // A full identity table is itself an abuse signal. Reject new identities instead of evicting a live
+    // bucket and letting an attacker cycle through unbounded sender/chat ids.
+    if (!senderMinute || !chatHour)
+        return false;
+    if (senderMinute.length >= MAX_SENDER_RUNS_PER_MINUTE ||
+        countRateTimes(chatHour, now, RATE_MINUTE_MS) >= MAX_CHAT_RUNS_PER_MINUTE ||
+        chatHour.length >= MAX_CHAT_RUNS_PER_HOUR ||
+        countRateTimes(globalFlowRate, now, RATE_MINUTE_MS) >= MAX_GLOBAL_RUNS_PER_MINUTE ||
+        globalFlowRate.length >= MAX_GLOBAL_RUNS_PER_HOUR) {
+        return false;
+    }
+    senderMinute.push(now);
+    chatHour.push(now);
+    globalFlowRate.push(now);
+    senderFlowRate.set(senderKey, senderMinute);
+    chatFlowRate.set(chatKey, chatHour);
+    activeFlowRuns++;
+    return true;
+}
+/** Extract the flow agent's structured result — {disposition,briefing,draft,dispatch?} — from its text
+ *  output. Tolerant of surrounding prose/fences; null if there's no parseable object (caller falls back). */
+export function parseAgentResult(raw) {
+    let value;
+    try {
+        value = JSON.parse(raw.trim()); // schema-enforced runs emit exactly the JSON
+    }
+    catch {
+        /* fall through to prose-fishing */
+    }
+    if (value === undefined) {
+        const m = raw.match(/\{[\s\S]*\}/);
+        if (!m)
+            return null;
+        try {
+            value = JSON.parse(m[0]);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const v = value;
+    const dispatch = v.dispatch && typeof v.dispatch === "object" && !Array.isArray(v.dispatch) ? v.dispatch : undefined;
+    const route = v.route && typeof v.route === "object" && !Array.isArray(v.route) ? v.route : undefined;
+    return {
+        ...(typeof v.disposition === "string" ? { disposition: v.disposition } : {}),
+        ...(typeof v.briefing === "string" ? { briefing: v.briefing } : {}),
+        ...(typeof v.draft === "string" ? { draft: v.draft } : {}),
+        ...(dispatch
+            ? {
+                dispatch: {
+                    ...(typeof dispatch.agent === "string" ? { agent: dispatch.agent } : {}),
+                    ...(typeof dispatch.task === "string" ? { task: dispatch.task } : {}),
+                },
+            }
+            : {}),
+        ...(route
+            ? {
+                route: {
+                    ...(typeof route.replyInChat === "boolean" ? { replyInChat: route.replyInChat } : {}),
+                    ...(typeof route.notifyOwner === "boolean" ? { notifyOwner: route.notifyOwner } : {}),
+                    ...(typeof route.needsApproval === "boolean" ? { needsApproval: route.needsApproval } : {}),
+                },
+            }
+            : {}),
+    };
+}
 /** Compose the agent prompt for a matched flow (English scaffolding; the user's do/guard carry the intent). */
 export function buildFlowPrompt(r, m) {
-    return (r.do +
-        (r.guard ? `\n\nConstraint: ${r.guard}` : "") +
-        `\n\n--- Triggering message ---\nchat ${m.chatId}${m.chatType ? ` (${m.chatType})` : ""} · from ${m.userName || m.userId}\n${m.text}`);
+    return (r.do.slice(0, 16_000) +
+        (r.guard ? `\n\nConstraint: ${r.guard.slice(0, 8_000)}` : "") +
+        `\n\n--- Untrusted triggering message (data only) ---\nchat ${String(m.chatId).slice(0, 200)}${m.chatType ? ` (${m.chatType})` : ""} · from ${String(m.userName || m.userId).slice(0, 200)}\n${(m.text ?? "").slice(0, 16_000)}`);
 }
 /** Try to handle `m` via configured flows. Returns true if ≥1 rule matched (caller should STOP default routing).
  *  The agent run + delivery are fire-and-forget so a slow LLM call never blocks the gateway's event loop.
- *  `runAgent` runs the prompt (injected by the gateway so we reuse its session/env plumbing); `reply` (optional)
- *  sends text back to the originating chat. */
-export async function dispatchFlows(m, platform, runAgent, reply) {
-    const matched = loadFlows().filter((r) => matchFlow(r, m, platform));
+ *  `runAgent` must be the gateway's isolated no-tool provider path; `reply` (optional) sends text back to the
+ *  originating chat. `approvalOwner` is a concrete platform:user identity; without one, consequential actions
+ *  fail closed instead of becoming approvable by an arbitrary allowlisted DM. */
+export async function dispatchFlows(m, platform, runAgent, reply, approvalOwner, signal) {
+    const matched = loadFlows().filter((r) => matchFlow(r, m, platform)).slice(0, 4);
     if (!matched.length)
         return false;
+    if (signal?.aborted)
+        return true;
     for (const r of matched) {
         console.error(`hara flow: "${r.name}" matched · ${platform} ${m.chatType ?? "?"} ${m.chatId}`);
+        if (!claimFlowRun(r, m, platform)) {
+            console.error(`hara flow: "${r.name}" rate/concurrency limit reached — trigger dropped`);
+            continue;
+        }
+        const home = r.cwd ? (r.cwd === "~" ? homedir() : r.cwd.replace(/^~\//, homedir() + "/")) : undefined;
         void (async () => {
             try {
-                const output = (await runAgent(buildFlowPrompt(r, m))).trim();
+                const output = (await runAgent(buildFlowPrompt(r, m), home, r.schema, signal)).trim();
+                if (signal?.aborted)
+                    return;
                 if (!output)
                     return;
-                if (r.deliver) {
-                    const err = await deliverResult(r.deliver, output);
+                const parsed = parseAgentResult(output);
+                const dispo = parsed?.disposition;
+                // Draft sanitation: leaked tool-call/XML markup is model plumbing, not a human-readable message —
+                // never park or post it (a real incident sent "<tool_call>dispatch…" to a group). Drop such drafts.
+                if (parsed?.draft && /<\/?(tool_call|arg_key|arg_value|invoke|function)/i.test(parsed.draft)) {
+                    console.error(`hara flow "${r.name}": draft contained tool-call markup — dropped`);
+                    parsed.draft = "";
+                }
+                let briefing = parsed?.briefing?.trim() || output;
+                const park = (action) => {
+                    if (!approvalOwner) {
+                        console.error(`hara flow "${r.name}": approval required but no unique owner is configured — action dropped`);
+                        briefing += "\n\n⚠ 需要审批，但网关未配置唯一主人；动作已安全丢弃。设置 HARA_GATEWAY_OWNER 后重试。";
+                        return undefined;
+                    }
+                    const executionTarget = action.kind === "org" ? action.origin : action.target;
+                    if (executionTarget) {
+                        const deliverable = parseDeliver(executionTarget);
+                        if ("error" in deliverable) {
+                            console.error(`hara flow "${r.name}": approval target cannot be delivered later — ${deliverable.error}`);
+                            briefing += `\n\n⚠ 当前平台只支持即时回复，暂不支持离线审批后回发；动作已安全丢弃。`;
+                            return undefined;
+                        }
+                    }
+                    return addPending({ ...action, owner: approvalOwner });
+                };
+                // Every judged run lands in the log — the reviewable trail even when the noise policy stays silent.
+                if (r.log !== false) {
+                    appendFlowLog({
+                        flow: r.name,
+                        chat: String(m.chatId),
+                        from: String(m.userName || m.userId),
+                        text: (m.text ?? "").slice(0, 300),
+                        disposition: dispo ?? null,
+                        briefing: briefing.slice(0, 500),
+                        ...(parsed?.draft ? { draft: parsed.draft.slice(0, 500) } : {}),
+                        ...(parsed?.dispatch ? { dispatch: parsed.dispatch } : {}),
+                    });
+                }
+                // AI-decided routing (preferred): the agent judged reply/notify/approval per the rule's natural-
+                // language policy — code below only EXECUTES that judgment. The enum gates (replyOn/notifyOn) further
+                // down remain as legacy fallback for rules whose agents don't emit a route.
+                if (parsed?.route) {
+                    const route = parsed.route;
+                    const wantsDispatch = !!(parsed.dispatch?.agent && parsed.dispatch.task);
+                    const draft = parsed.draft?.trim();
+                    // A model may recommend replyInChat, but it cannot grant itself send authority. Auto-reply is an
+                    // explicit config capability (`replyOn` + matching disposition); every other drafted send is parked.
+                    const canAutoReply = !!(draft && dispo && r.replyOn?.includes(dispo));
+                    if (wantsDispatch) {
+                        // Delegation stays owner-gated regardless of the route — an authorization boundary, not a judgment.
+                        const pendingDispatch = park({
+                            kind: "org",
+                            target: parsed.dispatch.agent,
+                            draft: parsed.dispatch.task,
+                            context: `派单 ${parsed.dispatch.agent}: ${parsed.dispatch.task.slice(0, 30)}`,
+                            notify: r.deliver,
+                            origin: `${platform}:${m.chatId}`,
+                        });
+                        if (pendingDispatch)
+                            briefing += `\n\n[${pendingDispatch.id}] 拟派单：${parsed.dispatch.agent} ← ${parsed.dispatch.task}\n—— /approve ${pendingDispatch.id} 派出 · /reject ${pendingDispatch.id} 取消`;
+                    }
+                    if (draft && (route.needsApproval || route.replyInChat) && (!canAutoReply || route.needsApproval || wantsDispatch)) {
+                        const pendingSend = park({ kind: "send", target: `${platform}:${m.chatId}`, draft, context: (parsed.briefing || parsed.draft).slice(0, 40), notify: r.deliver });
+                        if (pendingSend) {
+                            briefing += `\n\n[${pendingSend.id}] 拟发到群：${draft}\n—— /approve ${pendingSend.id} 发出 · /edit ${pendingSend.id} <内容> · /reject ${pendingSend.id}`;
+                        }
+                    }
+                    else if (route.replyInChat && canAutoReply && reply) {
+                        if (!signal?.aborted)
+                            await reply(draft).catch(() => { });
+                        console.error(`hara flow "${r.name}": answered in-chat (route)`);
+                    }
+                    if (route.notifyOwner || route.needsApproval || wantsDispatch || (route.replyInChat && !canAutoReply)) {
+                        for (const d of asArray(r.deliver)) {
+                            if (signal?.aborted)
+                                return;
+                            const err = await deliverResult(d, briefing);
+                            if (err)
+                                console.error(`hara flow "${r.name}": deliver(${d}) failed — ${err}`);
+                        }
+                    }
+                    else
+                        console.error(`hara flow "${r.name}": routed silently (no owner notify)`);
+                    return;
+                }
+                // Auto-answer lane (replyOn): safe Q&A goes straight back to the origin chat — no owner round-trip.
+                // Runs BEFORE the noise gate so an answered question needs no WeChat push at all.
+                if (r.replyOn?.length && dispo && r.replyOn.includes(dispo) && parsed?.draft?.trim() && reply) {
+                    if (!signal?.aborted)
+                        await reply(parsed.draft.trim()).catch(() => { });
+                    console.error(`hara flow "${r.name}": ${dispo} — answered in-chat (replyOn)`);
+                    if (!r.notifyOn?.length || !r.notifyOn.includes(dispo))
+                        return; // answered; only ALSO brief the owner if asked to
+                }
+                // Noise policy (updatable config, hot-reloaded per message): only dispositions in notifyOn interrupt
+                // the owner. The AGENT judges the disposition; the CONFIG decides which judgments are push-worthy.
+                if (r.notifyOn?.length && (!dispo || !r.notifyOn.includes(dispo))) {
+                    console.error(`hara flow "${r.name}": ${dispo ?? "missing disposition"} — logged, not delivered (notifyOn=${r.notifyOn.join(",")})`);
+                    return;
+                }
+                // Drafted reply → park for approval; approved = posted back to the ORIGIN chat.
+                if (parsed?.draft?.trim() && (dispo === "reply" || dispo === "handle")) {
+                    const pendingSend = park({ kind: "send", target: `${platform}:${m.chatId}`, draft: parsed.draft.trim(), context: (parsed.briefing || parsed.draft).slice(0, 40), notify: r.deliver });
+                    if (pendingSend) {
+                        briefing += `\n\n[${pendingSend.id}] 拟发到群：${parsed.draft.trim()}\n—— /approve ${pendingSend.id} 发出 · /edit ${pendingSend.id} <内容> · /reject ${pendingSend.id}`;
+                    }
+                }
+                // Agent-proposed delegation → park an org dispatch; approved = that agent runs AT ITS HOME (global
+                // index resolution). Delegation is still human-gated: proposing is free, executing needs the owner.
+                if (parsed?.dispatch?.agent && parsed.dispatch.task) {
+                    const pendingDispatch = park({
+                        kind: "org",
+                        target: parsed.dispatch.agent,
+                        draft: parsed.dispatch.task,
+                        context: `派单 ${parsed.dispatch.agent}: ${parsed.dispatch.task.slice(0, 30)}`,
+                        notify: r.deliver,
+                        origin: `${platform}:${m.chatId}`, // the asker's chat — an approved task's result goes back here
+                    });
+                    if (pendingDispatch)
+                        briefing += `\n\n[${pendingDispatch.id}] 拟派单：${parsed.dispatch.agent} ← ${parsed.dispatch.task}\n—— /approve ${pendingDispatch.id} 派出 · /reject ${pendingDispatch.id} 取消`;
+                }
+                for (const d of asArray(r.deliver)) {
+                    if (signal?.aborted)
+                        return;
+                    const err = await deliverResult(d, briefing);
                     if (err)
-                        console.error(`hara flow "${r.name}": deliver failed — ${err}`);
+                        console.error(`hara flow "${r.name}": deliver(${d}) failed — ${err}`);
                 }
-                if (r.reply && reply)
-                    await reply(output).catch(() => { });
+                if (r.reply && reply && !signal?.aborted)
+                    await reply(briefing).catch(() => { });
             }
             catch (e) {
                 console.error(`hara flow "${r.name}": ${e instanceof Error ? e.message : String(e)}`);
             }
+            finally {
+                activeFlowRuns = Math.max(0, activeFlowRuns - 1);
+            }
         })();
     }
     return true;

package/dist/gateway/matrix.js

@@ -7,9 +7,9 @@
 // LIMITATION (v1): NO end-to-end encryption. Encrypted rooms (m.room.encrypted events) are skipped — only
 // plaintext rooms work. E2EE would need libolm + a crypto store (see hermes' matrix-nio adapter), which breaks
 // the zero-dep constraint. Invite this bot into UNENCRYPTED rooms only.
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, basename } from "node:path";
-import { homedir } from "node:os";
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+import { InboundMediaBudget, savePrivateResponse } from "./media.js";
 import { chunkText } from "./telegram.js";
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const isImage = (name, mime) => (mime?.startsWith("image/") ?? false) || /\.(png|jpe?g|gif|webp)$/i.test(name);
@@ -35,10 +35,49 @@ export function parseMxc(mxc) {
         return null;
     return { server, mediaId };
 }
+/** Read the latest m.direct account-data event from a /sync response. null means the response carried no
+ * update, while an empty Set means it explicitly cleared the mapping. Values are bounded and room-id shaped. */
+export function matrixDirectRoomsFromSync(sync) {
+    const events = Array.isArray(sync?.account_data?.events) ? sync.account_data.events : [];
+    let found = false;
+    let content;
+    for (const event of events) {
+        if (event?.type !== "m.direct")
+            continue;
+        found = true;
+        content = event.content;
+    }
+    if (!found)
+        return null;
+    const rooms = new Set();
+    if (!content || typeof content !== "object" || Array.isArray(content))
+        return rooms;
+    for (const value of Object.values(content)) {
+        if (!Array.isArray(value))
+            continue;
+        for (const room of value) {
+            if (typeof room !== "string" || !room.startsWith("!") || room.length > 512)
+                continue;
+            rooms.add(room);
+            if (rooms.size >= 1000)
+                return rooms;
+        }
+    }
+    return rooms;
+}
+/** Matrix rooms have no intrinsic DM type. We accept p2p only when m.direct names the room AND the live
+ * joined-members response proves the room contains exactly this bot and this sender. Stale/shared mappings
+ * and malformed/unknown member shapes stay group-classified. */
+export function matrixChatType(roomId, selfUserId, sender, directRooms, joinedMembers) {
+    if (!directRooms.has(roomId) || !joinedMembers || typeof joinedMembers !== "object" || Array.isArray(joinedMembers))
+        return "group";
+    const members = Object.keys(joinedMembers);
+    return members.length === 2 && members.includes(selfUserId) && members.includes(sender) ? "p2p" : "group";
+}
 /** Extract an InboundMsg from a single Matrix timeline event (pure). Accepts m.room.message of msgtype m.text
  *  (and friends carrying a body) plus m.image (→ marker text + the mxc url to download in start()). Ignores our
  *  own messages and encrypted events. Returns the InboundMsg + the image's mxc url (null if none). null = skip. */
-export function parseMatrixEvent(event, selfUserId) {
+export function parseMatrixEvent(event, selfUserId, chatType = "group") {
     if (!event || event.type !== "m.room.message")
         return null; // encrypted (m.room.encrypted) / state events → skip
     const sender = typeof event.sender === "string" ? event.sender : "";
@@ -65,25 +104,39 @@ export function parseMatrixEvent(event, selfUserId) {
             userId: sender,
             userName: sender,
             text: text || "[图片]",
+            chatType,
         },
         imageMxc,
     };
 }
+async function resolveMatrixChatType(homeserver, token, roomId, selfUserId, sender, directRooms, signal) {
+    if (!directRooms.has(roomId))
+        return "group";
+    try {
+        const res = await fetch(`${homeserver}/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/joined_members`, {
+            headers: { Authorization: `Bearer ${token}` },
+            signal,
+        });
+        if (!res.ok)
+            return "group";
+        const body = (await res.json());
+        return matrixChatType(roomId, selfUserId, sender, directRooms, body?.joined);
+    }
+    catch {
+        return "group";
+    }
+}
 /** Download a Matrix mxc:// media to a local path under ~/.hara/matrix/media (resolves via /_matrix/media/v3/download). */
-async function downloadMatrixMedia(homeserver, token, mxc) {
+async function downloadMatrixMedia(homeserver, token, mxc, options) {
     const parts = parseMxc(mxc);
     if (!parts)
         return null;
     try {
         const url = `${homeserver}/_matrix/media/v3/download/${encodeURIComponent(parts.server)}/${encodeURIComponent(parts.mediaId)}`;
-        const r = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+        const r = await fetch(url, { headers: { Authorization: `Bearer ${token}` }, signal: options.signal });
         if (!r.ok)
             return null;
-        const dir = join(homedir(), ".hara", "matrix", "media");
-        mkdirSync(dir, { recursive: true });
-        const path = join(dir, `mx_${Date.now()}_${parts.mediaId.slice(-12)}`);
-        writeFileSync(path, Buffer.from(await r.arrayBuffer()));
-        return path;
+        return await savePrivateResponse(r, { platform: "matrix", filenameHint: parts.mediaId, ...options });
     }
     catch {
         return null;
@@ -135,13 +188,20 @@ export function matrixAdapter(homeserver, token, selfUserId) {
                 /* upload/send failed — surfaced upstream as "no file delivered" */
             }
         },
-        async start(onMessage, signal) {
+        async start(onMessage, signal, shouldDownload) {
+            let directRooms = new Set();
+            const updateDirectRooms = (sync) => {
+                const next = matrixDirectRoomsFromSync(sync);
+                if (next)
+                    directRooms = next;
+            };
             // Prime the cursor: a since-less, timeout=0 sync skips backlog so we only see messages from now on.
             let since = "";
             try {
                 const r = await fetch(`${base}/_matrix/client/v3/sync?timeout=0`, { headers: auth, signal });
                 if (r.ok) {
                     const j = (await r.json());
+                    updateDirectRooms(j);
                     if (typeof j.next_batch === "string")
                         since = j.next_batch;
                 }
@@ -159,6 +219,7 @@ export function matrixAdapter(homeserver, token, selfUserId) {
                         continue;
                     }
                     const j = (await res.json());
+                    updateDirectRooms(j);
                     if (typeof j.next_batch === "string")
                         since = j.next_batch;
                     const join = j.rooms?.join ?? {};
@@ -168,10 +229,14 @@ export function matrixAdapter(homeserver, token, selfUserId) {
                             const parsed = parseMatrixEvent(event, selfUserId);
                             if (!parsed)
                                 continue;
-                            if (parsed.imageMxc) {
-                                const path = await downloadMatrixMedia(base, token, parsed.imageMxc);
-                                if (path)
+                            parsed.msg.chatType = await resolveMatrixChatType(base, token, roomId, selfUserId, String(parsed.msg.userId), directRooms, signal);
+                            if (parsed.imageMxc && shouldDownload?.(parsed.msg) === true) {
+                                const budget = new InboundMediaBudget("matrix", signal);
+                                const path = await budget.download((options) => downloadMatrixMedia(base, token, parsed.imageMxc, options));
+                                if (path) {
                                     parsed.msg.images = [path];
+                                    parsed.msg.transientFiles = [path];
+                                }
                             }
                             await onMessage(parsed.msg).catch(() => { });
                         }