@nanhara/hara 0.121.1 → 0.122.1

package/dist/gateway/weixin.js

@@ -5,10 +5,10 @@
 // (iLink only uses crypto for media upload/download, which v1 doesn't do).
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
-import { basename } from "node:path";
+import { chmodSync, readFileSync, writeFileSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
 import { randomBytes, randomUUID, createHash, createCipheriv, createDecipheriv } from "node:crypto";
 import { chunkText } from "./telegram.js";
+import { INBOUND_MEDIA_MAX_BYTES, INBOUND_MEDIA_TIMEOUT_MS, InboundMediaBudget, cleanupTransientMedia, readResponseBytesLimited, savePrivateMediaBytes, } from "./media.js";
 const ILINK_BASE_URL = "https://ilinkai.weixin.qq.com";
 const CHANNEL_VERSION = "2.2.0";
 const ILINK_APP_ID = "bot";
@@ -44,7 +44,6 @@ const WEIXIN_CDN_ALLOWLIST = new Set([
     "mmbiz.qlogo.cn",
 ]);
 const IMAGE_EXTS = new Set(["jpg", "jpeg", "png", "gif", "webp", "bmp"]);
-const INBOUND_MEDIA_MAX = 128 * 1024 * 1024; // 128 MiB cap, per the reference
 const num = (v) => (typeof v === "number" ? v : 0);
 const str = (v) => (v == null ? "" : String(v));
 // ── pure protocol helpers (unit-tested) ──────────────────────────────────────
@@ -198,8 +197,16 @@ export function loadWeixinCreds() {
     }
 }
 function saveWeixinCreds(c) {
-    mkdirSync(weixinDir(), { recursive: true });
+    mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(weixinDir(), 0o700);
+    }
+    catch { /* best effort */ }
     writeFileSync(credsFile(), JSON.stringify(c, null, 2), { mode: 0o600 });
+    try {
+        chmodSync(credsFile(), 0o600);
+    }
+    catch { /* best effort */ }
 }
 // get_updates_buf cursor — persisted so a restart resumes the message stream where it left off.
 function loadCursor(accountId) {
@@ -213,8 +220,11 @@ function loadCursor(accountId) {
 }
 function saveCursor(accountId, buf) {
     try {
-        mkdirSync(weixinDir(), { recursive: true });
-        writeFileSync(join(weixinDir(), `${accountId}.cursor`), buf);
+        mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+        chmodSync(weixinDir(), 0o700);
+        const file = join(weixinDir(), `${accountId}.cursor`);
+        writeFileSync(file, buf, { mode: 0o600 });
+        chmodSync(file, 0o600);
     }
     catch {
         /* best-effort */
@@ -223,40 +233,74 @@ function saveCursor(accountId, buf) {
 // Per-peer context_token: every reply must echo the latest token iLink sent for that peer.
 class TokenStore {
     accountId;
-    cache = {};
+    cache = new Map();
     constructor(accountId) {
         this.accountId = accountId;
         try {
-            if (existsSync(this.file()))
-                this.cache = JSON.parse(readFileSync(this.file(), "utf8"));
+            const exists = existsSync(this.file());
+            const parsed = exists ? JSON.parse(readFileSync(this.file(), "utf8")) : {};
+            if (exists)
+                chmodSync(this.file(), 0o600);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                for (const [peer, token] of Object.entries(parsed).slice(-1000)) {
+                    if (peer && typeof token === "string" && token)
+                        this.cache.set(peer, token);
+                }
+            }
         }
         catch {
-            this.cache = {};
+            this.cache.clear();
         }
     }
     file() {
         return join(weixinDir(), `${this.accountId}.context-tokens.json`);
     }
+    peerKey(peer) {
+        return String(peer ?? "").trim().slice(0, 256);
+    }
     persist() {
+        const temporary = `${this.file()}.${process.pid}.${randomUUID()}.tmp`;
         try {
-            mkdirSync(weixinDir(), { recursive: true });
-            writeFileSync(this.file(), JSON.stringify(this.cache));
+            mkdirSync(weixinDir(), { recursive: true, mode: 0o700 });
+            chmodSync(weixinDir(), 0o700);
+            writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.cache)), { mode: 0o600, flag: "wx" });
+            renameSync(temporary, this.file());
+            chmodSync(this.file(), 0o600);
         }
         catch {
             /* best-effort */
         }
+        finally {
+            try {
+                rmSync(temporary, { force: true });
+            }
+            catch {
+                /* best-effort */
+            }
+        }
     }
     get(peer) {
-        return this.cache[peer] || undefined;
+        const key = this.peerKey(peer);
+        const token = this.cache.get(key);
+        if (token) {
+            this.cache.delete(key);
+            this.cache.set(key, token);
+        }
+        return token;
     }
     set(peer, token) {
-        if (token) {
-            this.cache[peer] = token;
+        const key = this.peerKey(peer);
+        const boundedToken = String(token ?? "").slice(0, 4096);
+        if (key && boundedToken) {
+            this.cache.delete(key);
+            this.cache.set(key, boundedToken);
+            while (this.cache.size > 1000)
+                this.cache.delete(this.cache.keys().next().value);
             this.persist();
         }
     }
     del(peer) {
-        delete this.cache[peer];
+        this.cache.delete(this.peerKey(peer));
         this.persist();
     }
 }
@@ -333,14 +377,25 @@ async function sendChunk(creds, tokenStore, peer, text) {
     const clientId = `hara-weixin-${randomUUID().replace(/-/g, "")}`; // reused across the -14 retry for dedup
     const post = (ctx) => apiPost(creds.base_url, EP.sendMessage, buildSendBody(peer, text, ctx, clientId), creds.token, API_TIMEOUT_MS).catch((e) => ({ ret: 1, errmsg: String(e?.message ?? e) }));
     let resp = await post(tokenStore.get(peer));
+    // HARA_WX_DEBUG=1 → dump the raw send response (protocol exploration: does iLink return a message id we
+    // could use for a future recall/revoke?). Off by default; stderr only.
+    if (process.env.HARA_WX_DEBUG === "1")
+        console.error("weixin send resp:", JSON.stringify(resp).slice(0, 500));
     let [ret, errcode, errmsg] = [num(resp.ret), num(resp.errcode), str(resp.errmsg ?? resp.msg)];
     if (isSessionExpired(ret, errcode, errmsg)) {
         tokenStore.del(peer); // stale → drop it and retry once tokenless (iLink accepts that, degraded)
         resp = await post(undefined);
         [ret, errcode, errmsg] = [num(resp.ret), num(resp.errcode), str(resp.errmsg ?? resp.msg)];
     }
+    // Rate-limit (ret=-2, empty errmsg): iLink throttles cold/rapid proactive pushes. Back off and retry a few
+    // times instead of silently dropping the message — the reused clientId dedups so a retry can't double-send.
+    for (let attempt = 0; ret === RATE_LIMIT && errcode === 0 && attempt < 3; attempt++) {
+        await sleep(1500 * (attempt + 1));
+        resp = await post(tokenStore.get(peer));
+        [ret, errcode, errmsg] = [num(resp.ret), num(resp.errcode), str(resp.errmsg ?? resp.msg)];
+    }
     if (ret !== 0 || errcode !== 0)
-        console.error(`weixin send: ret=${ret} errcode=${errcode} errmsg=${errmsg}`);
+        throw new Error(`weixin send failed: ret=${ret} errcode=${errcode} errmsg=${errmsg || "unknown error"}`);
 }
 function aes128EcbEncrypt(plaintext, key) {
     const c = createCipheriv("aes-128-ecb", key, null); // PKCS7 auto-padding (Node default) matches iLink
@@ -397,8 +452,6 @@ export function inboundMediaRefs(itemList) {
     return out;
 }
 const cdnDownloadUrl = (param) => `${WEIXIN_CDN_BASE_URL}/download?encrypted_query_param=${encodeURIComponent(param)}`;
-const mediaDir = () => join(weixinDir(), "media");
-const sanitizeName = (name) => name.replace(/[^\w.\- ]+/g, "_").slice(-80) || "file.bin";
 function assertCdnHost(url) {
     let u;
     try {
@@ -413,7 +466,10 @@ function assertCdnHost(url) {
         throw new Error(`host ${u.hostname} not in WeChat CDN allowlist (SSRF guard)`);
 }
 /** Download (+ AES-decrypt if keyed) an inbound media item to a local file. Returns its path + mime, or null. */
-export async function downloadInboundMedia(ref) {
+export async function downloadInboundMedia(ref, options = {
+    maxBytes: INBOUND_MEDIA_MAX_BYTES,
+    signal: AbortSignal.timeout(INBOUND_MEDIA_TIMEOUT_MS),
+}) {
     try {
         let url;
         if (ref.encryptQueryParam)
@@ -424,22 +480,20 @@ export async function downloadInboundMedia(ref) {
         }
         else
             return null;
-        const res = await fetch(url, { signal: AbortSignal.timeout(60_000) });
+        const res = await fetch(url, { signal: options.signal });
         if (!res.ok)
             throw new Error(`media download HTTP ${res.status}`);
-        const ab = await res.arrayBuffer();
-        if (ab.byteLength > INBOUND_MEDIA_MAX)
-            throw new Error("media exceeds size cap");
-        let buf = Buffer.from(ab);
+        let buf = await readResponseBytesLimited(res, options.maxBytes, options.signal);
         if (ref.aesKeyB64)
             buf = aes128EcbDecrypt(buf, parseAesKey(ref.aesKeyB64));
         if (!buf.length)
             return null;
-        mkdirSync(mediaDir(), { recursive: true });
-        const tag = randomUUID().slice(0, 8);
-        const name = ref.kind === "image" ? `img_${tag}.jpg` : ref.kind === "voice" ? `audio_${tag}.silk` : `${tag}_${sanitizeName(ref.fileName || "document.bin")}`;
-        const path = join(mediaDir(), name);
-        writeFileSync(path, buf);
+        const filenameHint = ref.kind === "image" ? "image.jpg" : ref.kind === "voice" ? "audio.silk" : ref.fileName || "document.bin";
+        const path = await savePrivateMediaBytes(buf, {
+            platform: "weixin",
+            filenameHint,
+            ...options,
+        });
         return { path, mime: ref.kind === "image" ? "image/jpeg" : ref.kind === "voice" ? "audio/silk" : "application/octet-stream" };
     }
     catch (e) {
@@ -457,14 +511,14 @@ async function cdnUpload(uploadUrl, ciphertext) {
         throw new Error("CDN upload missing x-encrypted-param header");
     return ep;
 }
-/** Send a local file to a peer. Images go inline (image_item); everything else (audio/zip/pdf/doc/…) goes as a
+/** Send already-verified bytes to a peer. Images go inline (image_item); everything else (audio/zip/pdf/doc/…) goes as a
  *  file attachment (file_item) carrying the filename. Ported byte-exact from iLink's media protocol:
  *  getuploadurl → AES-128-ECB encrypt → CDN POST → sendmessage(item). */
-export async function sendMediaFile(creds, tokenStore, peer, filePath) {
+export async function sendMediaFile(creds, tokenStore, peer, file) {
     try {
-        const plaintext = readFileSync(filePath);
+        const plaintext = file.bytes;
         const rawsize = plaintext.length;
-        const isImage = IMAGE_EXTS.has((filePath.split(".").pop() || "").toLowerCase());
+        const isImage = IMAGE_EXTS.has((file.safeName.split(".").pop() || "").toLowerCase());
         const rawfilemd5 = createHash("md5").update(plaintext).digest("hex");
         const filekey = randomBytes(16).toString("hex");
         const key = randomBytes(16);
@@ -480,7 +534,7 @@ export async function sendMediaFile(creds, tokenStore, peer, filePath) {
         const encryptedParam = await cdnUpload(uploadUrl, ciphertext);
         const item = isImage
             ? imageInlineItem(encryptedParam, apiAesKey(keyHex), ciphertext.length)
-            : audioFileItem(encryptedParam, apiAesKey(keyHex), rawsize, basename(filePath));
+            : audioFileItem(encryptedParam, apiAesKey(keyHex), rawsize, file.safeName);
         const clientId = `hara-weixin-${randomUUID().replace(/-/g, "")}`; // reused across the -14 retry for dedup
         const send = (ctx) => {
             const msg = { from_user_id: "", to_user_id: peer, client_id: clientId, message_type: MSG_TYPE_BOT, message_state: MSG_STATE_FINISH, item_list: [item] };
@@ -510,34 +564,67 @@ export function weixinAdapter(creds) {
     const tokenStore = new TokenStore(creds.account_id);
     // Reuse parseWeixinMessage for text/voice-transcription, then download any image/file/voice media and append
     // a `[kind: localpath]` reference so hara can read the file. Handles media-only messages (no text) too.
-    const buildInbound = async (msg) => {
+    const buildInbound = async (msg, signal, shouldDownload) => {
         const parsed = parseWeixinMessage(msg, creds.account_id);
         const from = str(msg?.from_user_id).trim();
         if (!from || from === creds.account_id)
             return null;
-        if (guessChatType(msg, creds.account_id).kind !== "dm")
+        const chat = guessChatType(msg, creds.account_id);
+        const refs = inboundMediaRefs(msg?.item_list);
+        let text = parsed?.inbound.text ?? extractText(msg?.item_list);
+        const base = {
+            chatId: chat.id,
+            userId: from,
+            userName: from,
+            text: text || (refs.some((ref) => ref.kind === "image") ? "[图片]" : refs.length ? "[附件]" : ""),
+            chatType: chat.kind === "dm" ? "p2p" : "group",
+        };
+        if (!base.text)
             return null;
-        let text = parsed?.inbound.text ?? "";
+        const downloadAllowed = base.chatType === "p2p" && shouldDownload?.(base) === true;
+        // Persist context only for an authenticated DM, before any download. Rejected senders cannot grow state.
+        if (downloadAllowed)
+            tokenStore.set(from, parsed?.contextToken || str(msg?.context_token).trim());
         const images = [];
-        for (const ref of inboundMediaRefs(msg?.item_list)) {
-            const dl = await downloadInboundMedia(ref);
-            if (!dl)
-                continue;
-            if (ref.kind === "image") {
-                // images go through as real attachments (seen/described downstream); leave only a light marker in text
-                images.push(dl.path);
-                text += `${text ? "\n" : ""}[图片]`;
-            }
-            else {
-                const label = ref.kind === "voice" ? "语音" : `文件 ${ref.fileName ?? ""}`.trim();
-                text += `${text ? "\n" : ""}[${label}: ${dl.path}]`;
+        const transientFiles = [];
+        let handedOff = false;
+        try {
+            if (downloadAllowed) {
+                const budget = new InboundMediaBudget("weixin", signal);
+                for (const ref of refs) {
+                    let downloaded = null;
+                    const path = await budget.download(async (options) => {
+                        downloaded = await downloadInboundMedia(ref, options);
+                        return downloaded?.path ?? null;
+                    });
+                    if (!path || !downloaded)
+                        continue;
+                    transientFiles.push(path);
+                    if (ref.kind === "image") {
+                        // images go through as real attachments (seen/described downstream); leave only a light marker in text
+                        images.push(path);
+                        if (text !== "[图片]")
+                            text += `${text ? "\n" : ""}[图片]`;
+                    }
+                    else {
+                        const label = ref.kind === "voice" ? "语音" : `文件 ${ref.fileName ?? ""}`.trim();
+                        text = text === "[附件]" ? `[${label}: ${path}]` : `${text}${text ? "\n" : ""}[${label}: ${path}]`;
+                    }
+                }
             }
+            const inbound = {
+                ...base,
+                text: text.trim() || base.text,
+                images: images.length ? images : undefined,
+                transientFiles: transientFiles.length ? transientFiles : undefined,
+            };
+            handedOff = true;
+            return inbound;
+        }
+        finally {
+            if (!handedOff && transientFiles.length)
+                await cleanupTransientMedia("weixin", transientFiles);
         }
-        text = text.trim();
-        if (!text && !images.length)
-            return null;
-        tokenStore.set(from, parsed?.contextToken || str(msg?.context_token).trim());
-        return { chatId: from, userId: from, userName: from, text: text || "[图片]", images: images.length ? images : undefined };
     };
     return {
         name: "weixin",
@@ -546,10 +633,11 @@ export function weixinAdapter(creds) {
             for (const part of chunkText(text || "(empty)"))
                 await sendChunk(creds, tokenStore, peer, part);
         },
-        async sendFile(chatId, filePath) {
-            await sendMediaFile(creds, tokenStore, String(chatId), filePath);
+        async sendFile(chatId, file) {
+            if (!(await sendMediaFile(creds, tokenStore, String(chatId), file)))
+                throw new Error(`weixin file delivery failed: ${file.safeName}`);
         },
-        async start(onMessage, signal) {
+        async start(onMessage, signal, shouldDownload) {
             let buf = loadCursor(creds.account_id);
             let pollMs = LONG_POLL_TIMEOUT_MS;
             while (!signal.aborted) {
@@ -578,7 +666,7 @@ export function weixinAdapter(creds) {
                 buf = str(resp.get_updates_buf) || buf;
                 saveCursor(creds.account_id, buf);
                 for (const msg of Array.isArray(resp.msgs) ? resp.msgs : []) {
-                    const inbound = await buildInbound(msg);
+                    const inbound = await buildInbound(msg, signal, shouldDownload);
                     if (inbound)
                         await onMessage(inbound).catch(() => { });
                 }

package/dist/hooks.js

@@ -1,24 +1,30 @@
 // Lifecycle hooks — run user/plugin shell commands around tool calls (codex/Claude-Code parity).
-// PreToolUse runs BEFORE a tool: a non-zero exit BLOCKS the call (its output becomes the denial message).
+// PreToolUse runs BEFORE a tool: non-zero, timeout, signal, or launch failure BLOCKS the call.
 // PostToolUse runs AFTER: observe-only (format, log, notify). Configured in config.json `hooks` + contributed
 // by plugins. The command receives {tool, payload} as JSON on stdin + HARA_TOOL_NAME in the env.
 import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
 import { loadConfig } from "./config.js";
 import { pluginHooks } from "./plugins/plugins.js";
-let cache = null;
+import { redactToolSubprocessOutput, toolSubprocessEnv } from "./security/subprocess-env.js";
+import { shellCommand } from "./sandbox.js";
+const cache = new Map();
 export function resetHooksCache() {
-    cache = null;
+    cache.clear();
 }
-function merged() {
-    if (cache)
-        return cache;
-    const cfg = loadConfig().hooks ?? {};
+function merged(cwd) {
+    const key = resolve(cwd);
+    const cached = cache.get(key);
+    if (cached)
+        return cached;
+    const cfg = loadConfig({ cwd: key }).hooks ?? {};
     const plg = pluginHooks();
-    cache = {
+    const value = {
         PreToolUse: [...(cfg.PreToolUse ?? []), ...(plg.PreToolUse ?? [])],
         PostToolUse: [...(cfg.PostToolUse ?? []), ...(plg.PostToolUse ?? [])],
     };
-    return cache;
+    cache.set(key, value);
+    return value;
 }
 const matches = (m, name) => {
     if (!m || m === "*")
@@ -31,33 +37,45 @@ const matches = (m, name) => {
     }
 };
 /** True if any hook is configured (lets the loop skip the work entirely in the common case). */
-export function hasHooks() {
-    const h = merged();
+export function hasHooks(cwd = process.cwd()) {
+    const h = merged(cwd);
     return !!(h.PreToolUse?.length || h.PostToolUse?.length);
 }
-/** Run hooks for an event matching `toolName`. PreToolUse: a non-zero exit BLOCKS (returns the message);
- *  PostToolUse: observe-only, never blocks. Sync (hooks are short, opt-in); 30s timeout each. */
-export function runHooks(event, toolName, payload, cwd) {
-    for (const h of merged()[event] ?? []) {
+/** Run hooks for an event matching `toolName`. Any abnormal PreToolUse termination fails closed;
+ *  PostToolUse remains observe-only. Sync (hooks are short, opt-in); 30s timeout each. */
+export function runHooks(event, toolName, payload, cwd, timeoutMs = 30_000) {
+    for (const h of merged(cwd)[event] ?? []) {
         if (!matches(h.matcher, toolName))
             continue;
         let r;
         try {
-            r = spawnSync(h.command, {
-                shell: true,
+            // Hooks are user/plugin-configured external code. Route them through the same command preflight and
+            // macOS protected-read mask as Bash, even though hooks remain observe-only after a tool has run.
+            const shell = shellCommand(h.command, cwd, "off");
+            r = spawnSync(shell.cmd, shell.args, {
                 cwd,
                 input: JSON.stringify({ tool: toolName, payload }),
                 encoding: "utf8",
-                timeout: 30_000,
-                env: { ...process.env, HARA_TOOL_NAME: toolName },
+                timeout: timeoutMs,
+                env: toolSubprocessEnv(process.env, { HARA_TOOL_NAME: toolName }),
             });
         }
-        catch {
+        catch (error) {
+            if (event === "PreToolUse") {
+                const detail = redactToolSubprocessOutput(error instanceof Error ? error.message : String(error));
+                return { block: true, message: `⛔ blocked because a PreToolUse hook could not start${detail ? `: ${detail}` : ""}` };
+            }
+            // PostToolUse is best-effort: a policy-blocked or broken observer must never rewrite the result of a
+            // tool that already completed. In particular, do not retry it through an unsandboxed fallback shell.
             continue;
         }
-        if (event === "PreToolUse" && r.status !== 0 && r.status !== null) {
-            const msg = (String(r.stdout ?? "") + String(r.stderr ?? "")).trim();
-            return { block: true, message: `⛔ blocked by a PreToolUse hook${msg ? `: ${msg}` : ` (exit ${r.status})`}` };
+        // A hook is allowed to ignore stdin. On Linux, a command that exits successfully before Node finishes
+        // writing `input` can report EPIPE in r.error *alongside status=0*. The wait status is authoritative in
+        // that case; true launch/write failures still have status=null, while timeouts/signals remain blocked.
+        if (event === "PreToolUse" && (r.status !== 0 || !!r.signal)) {
+            const output = redactToolSubprocessOutput((String(r.stdout ?? "") + String(r.stderr ?? "")).trim());
+            const failure = redactToolSubprocessOutput(r.error?.message || (r.signal ? `terminated by ${r.signal}` : `exit ${r.status ?? "unknown"}`));
+            return { block: true, message: `⛔ blocked by a PreToolUse hook${output ? `: ${output}` : ` (${failure})`}` };
         }
     }
     return { block: false, message: "" };