@sleep2agi/agent-network 2.3.0-preview.2 → 2.3.0-preview.21

package/dist/src/im/feishu/outbound-marker.d.ts

@@ -0,0 +1,140 @@
+/**
+ * RFC-020 §15 — agent→bridge outbound file protocol.
+ *
+ * 2026-06-29 Vincent UAT: agent generated a PDF via reportlab + wrote it
+ * to `/work/feishu-attachments/<conv>/x.pdf`, then in text asked Vincent
+ * "I'm not sure if the system will auto-attach this — try another way?"
+ * The bridge has `adapter.send({files})` since #329, but no protocol
+ * told the agent how to signal "dispatch this file to the user".
+ *
+ * Convention: in its final reply, the agent emits one
+ *
+ *     [[send-file:/abs/path]]
+ *
+ * marker per file (one per line, end of reply). The bridge:
+ *
+ *   1. extracts every `[[send-file:...]]` token,
+ *   2. strips them from the user-visible text,
+ *   3. validates each path against an allowed-outbound-root whitelist
+ *      (`/work/feishu-attachments/<conn>/<chat>/` — same per-conversation
+ *      directory the LLM has Write access to under Layer B),
+ *   4. checks the file exists, is non-empty, and ≤ 30 MB (Feishu file_v1
+ *      upper bound),
+ *   5. magic-byte sniffs to choose `image_key` vs `file_key` upload route,
+ *   6. dispatches each file via `adapter.send({files:[...]})`,
+ *   7. emits a friendly fallback if validation fails — never the raw error.
+ *
+ * Pure module — no I/O, no IM SDK calls. The parser returns the cleaned
+ * text + a structured list of file requests; bridge.ts is responsible
+ * for filesystem checks and dispatching.
+ */
+/**
+ * One outbound-file request parsed from an agent reply.
+ *
+ *  - `raw`: the bytes between `[[send-file:` and `]]`, before any
+ *    normalization. Kept for stderr forensic.
+ *  - `normalized`: lexical-normalized absolute path (quote-strip, `..`
+ *    collapse, `//` collapse, `./` resolution against cwd). The
+ *    `validatedAbsolute` field is set later by the bridge after the
+ *    realpath / whitelist / exists check.
+ */
+export interface OutboundFileRequest {
+    raw: string;
+    normalized: string;
+}
+export interface MarkerParseResult {
+    /** Reply text with all `[[send-file:...]]` markers removed + adjacent
+     *  whitespace collapsed. May be empty (file-only reply). */
+    cleanedText: string;
+    /** Files in source order. Caller-side validation happens after. */
+    files: OutboundFileRequest[];
+}
+/**
+ * Lexically normalize a path token from the marker. NOT a full
+ * symlink/realpath resolver — bridge does that after this returns.
+ *
+ *  - Trim leading / trailing whitespace.
+ *  - Strip one layer of matching quotes (`"/x"` / `'/x'` → `/x`).
+ *  - `.` and `..` segments collapse via `path.posix.normalize`.
+ *  - Repeated `/` collapse.
+ *
+ * Returns an absolute path or the empty string if the input cannot be
+ * interpreted as an absolute path token (caller drops empties).
+ */
+export declare function normalizeMarkerPath(raw: string): string;
+/**
+ * Parse an agent reply into cleaned text + outbound-file requests.
+ *
+ * Empty / null input returns `{cleanedText: "", files: []}` so callers
+ * can safely pipe through without defensive checks.
+ *
+ * Marker-only reply (no surrounding text) returns `cleanedText: ""` —
+ * caller should NOT send an empty text message in that case; they only
+ * dispatch the files.
+ *
+ * Multiple markers on one reply are all captured. Adjacent whitespace
+ * around stripped markers is collapsed (no double blank lines).
+ */
+export declare function parseOutboundMarkers(reply: string | null | undefined): MarkerParseResult;
+export { OUTBOUND_ROOT, feishuConvKey, feishuOutboundDir } from "./outbound-paths.js";
+/**
+ * Validate a normalized absolute path against the per-conversation
+ * whitelist + size + existence checks. Returns null on success or a
+ * Chinese user-friendly reason on failure (the same string can be
+ * surfaced as a fallback text reply when ALL files fail validation).
+ *
+ * Filesystem-touching — bridge calls this AFTER `parseOutboundMarkers`.
+ *
+ * Two API shapes accepted (overload):
+ *
+ *   1. **Preferred**: caller passes `expectedDir` — the precomputed
+ *      `/work/feishu-attachments/<connectionName>/<convKey>/` value
+ *      from `feishuOutboundDir`. This guarantees what the agent was
+ *      TOLD to use (via cli.ts prompt injection) matches what we
+ *      ACCEPT here — no second algorithm.
+ *
+ *   2. **Legacy**: caller passes `connectionName` + `convKey`. We
+ *      compute the prefix here via the same helper. Kept for the
+ *      single-arg unit-test ergonomics + backwards-compat (the old
+ *      bridge wire-up shape).
+ *
+ * Params:
+ *   - p: normalized absolute path candidate
+ *   - expectedDir: precomputed whitelist directory (trailing `/`)
+ *     OR
+ *   - convKey + connectionName: legacy two-piece form
+ *   - statFn: optional override for tests (defaults to fs.statSync)
+ *   - realpathFn: optional override for tests (defaults to fs.realpathSync)
+ *
+ * The whitelist check uses literal `.startsWith(expectedDir)` — the
+ * trailing slash on `expectedDir` ensures `oc_abc/` doesn't accept
+ * paths under `oc_abc_evil/`.
+ */
+export interface ValidateOpts {
+    p: string;
+    /** Precomputed prefix (with trailing `/`). Preferred over convKey+connectionName. */
+    expectedDir?: string;
+    convKey?: string;
+    connectionName?: string;
+    statFn?: (p: string) => {
+        size: number;
+    };
+    realpathFn?: (p: string) => string;
+}
+export declare function validateOutboundPath(opts: ValidateOpts): string | null;
+/**
+ * Magic-byte sniffer — picks `image` vs `file` upload route. Reads the
+ * first 16 bytes only; safe to call before commitment. Returns:
+ *
+ *   - "image" when the bytes are a PNG / JPG / GIF / WebP / BMP signature
+ *     (Feishu image_v1 supports these natively, with chat inline render).
+ *   - "file" otherwise (PDF, TXT, audio, video, archive, …).
+ *
+ * Caller supplies a Buffer (bridge reads via fs.openSync + readSync).
+ */
+export declare function sniffFileKind(buf: Buffer): "image" | "file";
+/**
+ * User-facing fallback message when ALL marker validations fail and the
+ * stripped text is empty (would leave the user with no reply at all).
+ */
+export declare const ALL_FILES_FAILED_FALLBACK = "[\u6587\u4EF6\u9644\u4EF6\u53D1\u9001\u5931\u8D25] \u6211\u51C6\u5907\u597D\u4E86\u6587\u4EF6\u4F46\u5206\u53D1\u65F6\u51FA\u4E86\u95EE\u9898\u2014\u2014\u7A0D\u540E\u518D\u8BD5\u6216\u6362\u79CD\u65B9\u5F0F\u3002";

package/dist/src/im/feishu/outbound-paths.d.ts

@@ -0,0 +1,50 @@
+/**
+ * RFC-020 §15.1 — feishu outbound/attachment path helpers (SHARED).
+ *
+ * Single source of truth for `/work/feishu-attachments/<conn>/<convKey>/`
+ * naming. Used by:
+ *
+ *   - `adapter.ts` inbound `downloadImage` (subdir for received images),
+ *   - `bridge.ts` outbound marker whitelist (where the agent may write),
+ *   - `worker.ts` outbound envelope (the concrete path injected into the
+ *     agent's prompt, so what we tell the agent matches what we accept).
+ *
+ * 2026-06-29 Vincent UAT: prior to this module, the inbound downloader
+ * used `conversationId.replace(/[^a-zA-Z0-9_-]/g, "_")` and the outbound
+ * bridge whitelist used `sender.id` for DMs / `chatId` for groups. The
+ * two algorithms diverged — agent learned the inbound oc_<chat>/ layout
+ * from incoming attachments, then wrote outbound files to the same
+ * oc_<chat>/ subdir, but the bridge required ou_<userid>/. Every PDF
+ * generated by the bot was rejected. This module unifies on
+ * `conversationId` (the open_chat_id assigned by Feishu — present for
+ * DMs and groups equally).
+ */
+/**
+ * Sanitize a raw Feishu conversation id (`oc_<hex>` / occasionally
+ * `om_<id>` for DMs) into a filesystem-safe segment. Identical to the
+ * adapter.ts inbound download path policy — DO NOT CHANGE without also
+ * migrating any on-disk attachments under the old key.
+ *
+ * The regex strips anything outside `[A-Za-z0-9_-]`, replacing with `_`.
+ * Falsy / non-string input returns the empty string; caller is
+ * responsible for substituting a fallback (the empty key would resolve
+ * to `/work/feishu-attachments/<conn>//` which the path-prefix
+ * whitelist rejects cleanly).
+ */
+export declare function feishuConvKey(rawId: string | undefined | null): string;
+/**
+ * Compute the canonical per-conversation directory for outbound file
+ * dispatch + inbound attachment downloads. Trailing slash included so
+ * `.startsWith(...)` whitelist checks are unambiguous about the
+ * conversation boundary (no `oc_abc` matching `oc_abc_x`).
+ *
+ * Example:
+ *   feishuOutboundDir("feishu-local", "oc_9a7eedbba275a87999f7ee2cfb10f4cb")
+ *   → "/work/feishu-attachments/feishu-local/oc_9a7eedbba275a87999f7ee2cfb10f4cb/"
+ */
+export declare function feishuOutboundDir(connectionName: string, rawConvId: string | undefined | null): string;
+/**
+ * The fixed prefix root used as a sanity check by the marker validator.
+ * Useful for tests + for `validateOutboundPath` defense-in-depth.
+ */
+export declare const OUTBOUND_ROOT = "/work/feishu-attachments";

package/dist/src/im/feishu/outbound-route.d.ts

@@ -0,0 +1,62 @@
+/**
+ * RFC-020 §16.1 — feishu outbound route decision (pure helper).
+ *
+ * Single source of truth for the `adapter.send` decision tree that
+ * picks among text / interactive card / image (rendered PNG) / file /
+ * imagePath outputs. Extracted into a pure module so the production
+ * call site AND the unit tests can bind the same function — previously
+ * the test mirrored the decision tree in a sibling `pickRoute` helper,
+ * which would drift silently if the production tree changed.
+ *
+ * Inputs are the minimal data the decision needs:
+ *
+ *   - `text` / `imagePath` / `files` — payload from `NormalizedIMMessage`
+ *   - `forceTextOnly` — caption-mode hint (RFC-020 §15.2)
+ *   - `mode` — channel-config `outboundRender` (`"plain"` / `"card"` /
+ *     `"auto"`, RFC-020 §16)
+ *
+ * Outputs the chosen `route` plus a short `reason` string for log /
+ * debug. The CALLER (adapter.send) actually performs the upload /
+ * render side-effects keyed on the route — this function does no I/O.
+ *
+ * Behavior contract (mirrors adapter.send line-for-line, locked by
+ * `feishu-outbound-render-mode.test.ts`):
+ *
+ *   1. `imagePath` set → `image_upload`
+ *   2. `files[0].path` set → `file_upload`
+ *   3. `forceTextOnly` true → `text`
+ *   4. mode "plain" → `text` (always)
+ *   5. mode "card" → `card_short_md` iff `looksLikeMarkdown(text)` AND
+ *      NOT `shouldRenderAsImage(text)`; else `text`
+ *   6. mode "auto" → `image_render` iff `shouldRenderAsImage(text)`;
+ *      else `card_short_md` iff `looksLikeMarkdown(text)`; else `text`
+ *   7. unknown mode (defensive default-default) → `text`
+ *
+ * The production switch in adapter.send may add the actual upload /
+ * render / lark API calls keyed on the route, but the route itself
+ * is decided HERE. To change the decision, change this file.
+ */
+export type OutboundRoute = "image_upload" | "file_upload" | "text" | "card_short_md" | "image_render";
+export interface RouteInput {
+    text?: string;
+    imagePath?: string;
+    files?: {
+        name: string;
+        path?: string;
+    }[];
+    forceTextOnly?: boolean;
+    /** `outboundRender` from the channel config. Defaults to "plain" when
+     *  absent so a caller that doesn't read the config still gets the
+     *  "Vincent default" behavior. */
+    mode?: "plain" | "card" | "auto";
+}
+export interface RouteDecision {
+    route: OutboundRoute;
+    reason: string;
+}
+/**
+ * Decide the outbound route for a `NormalizedIMMessage` (or a subset
+ * of its fields). Pure — no I/O, no SDK calls; safe to call from tests
+ * directly.
+ */
+export declare function resolveOutboundRoute(input: RouteInput): RouteDecision;