@sleep2agi/agent-network 2.3.0-preview.9 → 2.3.0-preview.91

package/dist/src/im/feishu/config.d.ts

@@ -8,6 +8,31 @@ export interface FeishuAccessList {
     /** Feishu chat_ids the bot is permitted to listen in. */
     allowChats: string[];
 }
+/**
+ * Outbound text-reply rendering mode (RFC-020 §16). Controls how
+ * `adapter.send` handles a text/markdown payload that doesn't already
+ * carry an `imagePath` / `files[]` (those upload routes are unaffected).
+ *
+ *  - "plain" (DEFAULT): always send `msg_type:text`. Bot replies are
+ *    fully copy-pasteable in Feishu; long replies are chunked into
+ *    multiple text messages instead of being PNG-rendered. This is the
+ *    correct default for issue/code/CLI bot replies where users want
+ *    to grab the text. Vincent 2026-06-30 explicit ask: "issue 发文字".
+ *
+ *  - "card": short markdown (bold, list, link, inline code) goes via
+ *    schema 1.0 interactive card with `markdown` element — text stays
+ *    copy-friendly + gets bolds/bullets styled. Heading/table/long
+ *    fall back to plain text (no PNG). Suited to operators who want
+ *    light formatting without losing copy.
+ *
+ *  - "auto": preserve the pre-2026-06-30 behavior — markdown with
+ *    headings / tables / >2000 chars is rendered to PNG via headless
+ *    chromium (#329 path), short markdown goes to schema 1.0 card,
+ *    plain text goes to msg_type:text. Highest fidelity at the cost
+ *    of copy-paste. Opt-in for operators who genuinely need rendered
+ *    tables / heading hierarchy in chat.
+ */
+export type OutboundRenderMode = "plain" | "card" | "auto";
 export interface FeishuChannelConfig {
     appId: string;
     appSecret: string;
@@ -20,6 +45,12 @@ export interface FeishuChannelConfig {
     auditRaw: boolean;
     /** Per-task timeout in ms; default 5 min (RFC-020 §4.5). */
     taskTimeoutMs: number;
+    /**
+     * RFC-020 §16 outbound rendering mode for text replies. Default `"plain"`.
+     * See `OutboundRenderMode` for per-mode semantics. Channels that omit
+     * the field get `"plain"` — Vincent's "issue 发文字" default.
+     */
+    outboundRender: OutboundRenderMode;
     /**
      * Absolute path to the channel directory. The adapter writes downloaded
      * inbound media to `<channelDir>/media/` (M5c). Populated by the loader so

package/dist/src/im/feishu/hub-upload.d.ts

@@ -0,0 +1,88 @@
+/**
+ * RFC-020 §17 — feishu inbound bridge → hub `/api/upload` integration.
+ *
+ * Vincent 2026-06-30: cross-machine agents (e.g. TM门户运维@toodadev2)
+ * delegated by the feishu-local bot can't read inbound attachments
+ * because the only thing they get is a host-local path that doesn't
+ * exist on the receiver's filesystem. #351 already wired agent-node's
+ * receiver to prefer `file_id` and pull via `GET /api/files/<id>` when
+ * present. This module is the SENDER half: the feishu bridge uploads
+ * each downloaded inbound file to the hub via `POST /api/upload`,
+ * gets back a `file_id`, and propagates it alongside the local path.
+ *
+ * Failure mode (load-bearing): every failure path returns `null` and
+ * the caller falls back to path-only. The bridge MUST NOT crash because
+ * the hub is down / overloaded / refused a 12 MiB cap. Single-host
+ * `agent-node` Read still works on the local path; only cross-host
+ * delegation degrades, no regression vs the pre-fix baseline.
+ *
+ * Concurrency cap: a single feishu message can carry many images; bursts
+ * to /api/upload would hammer the hub rate limit (60/hour per token).
+ * `uploadFilesToHubConcurrent` caps in-flight requests at `concurrency`
+ * (default 4) so a 20-image message takes 5 sequential rounds instead
+ * of 20 simultaneous open sockets + a likely rate-limit denial.
+ */
+/**
+ * Hub upload limit, mirrors `server/src/uploads.ts:MAX_UPLOAD_BYTES`.
+ * Anything bigger is skipped at the bridge — the hub would 413 anyway.
+ */
+export declare const HUB_UPLOAD_LIMIT_BYTES: number;
+/** Default in-flight cap for `uploadFilesToHubConcurrent`. */
+export declare const DEFAULT_UPLOAD_CONCURRENCY = 4;
+/**
+ * One file uploaded to the hub. `mime` and `size` are from the local
+ * filesystem read; `file_id` and `path` come from the hub's response.
+ *
+ * `file_id` is the canonical cross-machine handle — receiving agent
+ * resolves to bytes via `GET /api/files/<file_id>`. `path` is the
+ * hub-machine-local absolute path the hub stored to; on the sender
+ * side it's purely informational (we already have the source file).
+ */
+export interface HubUploadResult {
+    file_id: string;
+    path?: string;
+    mime?: string;
+    size?: number;
+    name?: string;
+}
+export interface HubUploadOpts {
+    /** Hub base URL, no trailing slash. Defaults to env. */
+    hubUrl: string;
+    /** Bearer token (ntok_ / utok_ / atok_). Defaults to env. */
+    authToken: string;
+    /** Optional MIME hint; sniffed by filename ext otherwise. */
+    mime?: string;
+    /** Optional override filename (defaults to basename(path)). */
+    name?: string;
+    /** Injectable for tests. Defaults to global fetch. */
+    fetch?: typeof fetch;
+}
+/**
+ * Upload one local file to `${hubUrl}/api/upload`. Returns the file
+ * descriptor on success, or `null` on any failure (caller falls back
+ * to path-only).
+ *
+ *  - File must exist + be ≤ 12 MiB. Larger → skipped silently with
+ *    a stderr warn; caller gets `null` and ships path-only.
+ *  - Auth via `Authorization: Bearer <token>`.
+ *  - `Content-Length` header is set by `fetch` when given a Blob body;
+ *    the hub validates it before consuming bytes.
+ *  - Multipart body with a single `file` field. The hub server
+ *    reads `form.get("file")` and stores under a new file_id.
+ *  - Any network error / non-2xx / malformed JSON response → null.
+ */
+export declare function uploadToHub(filePath: string, opts: HubUploadOpts): Promise<HubUploadResult | null>;
+/**
+ * Upload many files to the hub with a bounded concurrency window.
+ * Returns one result per input path, preserving order. A failed
+ * upload appears as `null` at that slot — caller composes path-only
+ * descriptors for those.
+ *
+ * Why this matters: one feishu post can carry an arbitrary number of
+ * images. Naive `Promise.all(paths.map(uploadToHub))` would open N
+ * simultaneous HTTPS sockets to the hub AND blow past the 60/hour
+ * per-token rate limit on a single message with >60 images. A
+ * concurrency cap of 4 means N/4 sequential rounds, predictable
+ * load, no head-of-line blocking on the agent's reply.
+ */
+export declare function uploadFilesToHubConcurrent(filePaths: string[], opts: HubUploadOpts, concurrency?: number): Promise<(HubUploadResult | null)[]>;

package/dist/src/im/feishu/outbound-marker.d.ts

@@ -76,17 +76,7 @@ export declare function normalizeMarkerPath(raw: string): string;
  * around stripped markers is collapsed (no double blank lines).
  */
 export declare function parseOutboundMarkers(reply: string | null | undefined): MarkerParseResult;
-/**
- * The single allowed outbound root for files the agent wants to send.
- * Each conversation gets its own subdirectory under this root; the
- * agent's Write permission on this tree is granted by Layer B (config
- * paths like `access.json` / `config.json` are denied, attachments
- * dir is allowed).
- *
- * `<conv>` is the open_chat_id (group) or open_id (DM). Bridge fills
- * the placeholder per-event when validating.
- */
-export declare const OUTBOUND_ROOT = "/work/feishu-attachments";
+export { OUTBOUND_ROOT, feishuConvKey, feishuOutboundDir } from "./outbound-paths.js";
 /**
  * Validate a normalized absolute path against the per-conversation
  * whitelist + size + existence checks. Returns null on success or a
@@ -95,22 +85,37 @@ export declare const OUTBOUND_ROOT = "/work/feishu-attachments";
  *
  * Filesystem-touching — bridge calls this AFTER `parseOutboundMarkers`.
  *
+ * Two API shapes accepted (overload):
+ *
+ *   1. **Preferred**: caller passes `expectedDir` — the precomputed
+ *      `/work/feishu-attachments/<connectionName>/<convKey>/` value
+ *      from `feishuOutboundDir`. This guarantees what the agent was
+ *      TOLD to use (via cli.ts prompt injection) matches what we
+ *      ACCEPT here — no second algorithm.
+ *
+ *   2. **Legacy**: caller passes `connectionName` + `convKey`. We
+ *      compute the prefix here via the same helper. Kept for the
+ *      single-arg unit-test ergonomics + backwards-compat (the old
+ *      bridge wire-up shape).
+ *
  * Params:
  *   - p: normalized absolute path candidate
- *   - convKey: per-conversation directory name (open_chat_id / open_id)
+ *   - expectedDir: precomputed whitelist directory (trailing `/`)
+ *     OR
+ *   - convKey + connectionName: legacy two-piece form
  *   - statFn: optional override for tests (defaults to fs.statSync)
  *   - realpathFn: optional override for tests (defaults to fs.realpathSync)
  *
- * Note: `convKey` may include characters Feishu accepts but are unusual
- * for file paths (open_id starts with `ou_`, open_chat_id with `oc_`).
- * The whitelist check uses the literal substring + path.posix.dirname
- * walk so symlink redirects don't bypass it — the realpath form must
- * also fall under `OUTBOUND_ROOT/<connection>/<convKey>/`.
+ * The whitelist check uses literal `.startsWith(expectedDir)` — the
+ * trailing slash on `expectedDir` ensures `oc_abc/` doesn't accept
+ * paths under `oc_abc_evil/`.
  */
 export interface ValidateOpts {
     p: string;
-    convKey: string;
-    connectionName: string;
+    /** Precomputed prefix (with trailing `/`). Preferred over convKey+connectionName. */
+    expectedDir?: string;
+    convKey?: string;
+    connectionName?: string;
     statFn?: (p: string) => {
         size: number;
     };

package/dist/src/im/feishu/outbound-paths.d.ts

@@ -0,0 +1,50 @@
+/**
+ * RFC-020 §15.1 — feishu outbound/attachment path helpers (SHARED).
+ *
+ * Single source of truth for `/work/feishu-attachments/<conn>/<convKey>/`
+ * naming. Used by:
+ *
+ *   - `adapter.ts` inbound `downloadImage` (subdir for received images),
+ *   - `bridge.ts` outbound marker whitelist (where the agent may write),
+ *   - `worker.ts` outbound envelope (the concrete path injected into the
+ *     agent's prompt, so what we tell the agent matches what we accept).
+ *
+ * 2026-06-29 Vincent UAT: prior to this module, the inbound downloader
+ * used `conversationId.replace(/[^a-zA-Z0-9_-]/g, "_")` and the outbound
+ * bridge whitelist used `sender.id` for DMs / `chatId` for groups. The
+ * two algorithms diverged — agent learned the inbound oc_<chat>/ layout
+ * from incoming attachments, then wrote outbound files to the same
+ * oc_<chat>/ subdir, but the bridge required ou_<userid>/. Every PDF
+ * generated by the bot was rejected. This module unifies on
+ * `conversationId` (the open_chat_id assigned by Feishu — present for
+ * DMs and groups equally).
+ */
+/**
+ * Sanitize a raw Feishu conversation id (`oc_<hex>` / occasionally
+ * `om_<id>` for DMs) into a filesystem-safe segment. Identical to the
+ * adapter.ts inbound download path policy — DO NOT CHANGE without also
+ * migrating any on-disk attachments under the old key.
+ *
+ * The regex strips anything outside `[A-Za-z0-9_-]`, replacing with `_`.
+ * Falsy / non-string input returns the empty string; caller is
+ * responsible for substituting a fallback (the empty key would resolve
+ * to `/work/feishu-attachments/<conn>//` which the path-prefix
+ * whitelist rejects cleanly).
+ */
+export declare function feishuConvKey(rawId: string | undefined | null): string;
+/**
+ * Compute the canonical per-conversation directory for outbound file
+ * dispatch + inbound attachment downloads. Trailing slash included so
+ * `.startsWith(...)` whitelist checks are unambiguous about the
+ * conversation boundary (no `oc_abc` matching `oc_abc_x`).
+ *
+ * Example:
+ *   feishuOutboundDir("feishu-local", "oc_9a7eedbba275a87999f7ee2cfb10f4cb")
+ *   → "/work/feishu-attachments/feishu-local/oc_9a7eedbba275a87999f7ee2cfb10f4cb/"
+ */
+export declare function feishuOutboundDir(connectionName: string, rawConvId: string | undefined | null): string;
+/**
+ * The fixed prefix root used as a sanity check by the marker validator.
+ * Useful for tests + for `validateOutboundPath` defense-in-depth.
+ */
+export declare const OUTBOUND_ROOT = "/work/feishu-attachments";

package/dist/src/im/feishu/outbound-route.d.ts

@@ -0,0 +1,62 @@
+/**
+ * RFC-020 §16.1 — feishu outbound route decision (pure helper).
+ *
+ * Single source of truth for the `adapter.send` decision tree that
+ * picks among text / interactive card / image (rendered PNG) / file /
+ * imagePath outputs. Extracted into a pure module so the production
+ * call site AND the unit tests can bind the same function — previously
+ * the test mirrored the decision tree in a sibling `pickRoute` helper,
+ * which would drift silently if the production tree changed.
+ *
+ * Inputs are the minimal data the decision needs:
+ *
+ *   - `text` / `imagePath` / `files` — payload from `NormalizedIMMessage`
+ *   - `forceTextOnly` — caption-mode hint (RFC-020 §15.2)
+ *   - `mode` — channel-config `outboundRender` (`"plain"` / `"card"` /
+ *     `"auto"`, RFC-020 §16)
+ *
+ * Outputs the chosen `route` plus a short `reason` string for log /
+ * debug. The CALLER (adapter.send) actually performs the upload /
+ * render side-effects keyed on the route — this function does no I/O.
+ *
+ * Behavior contract (mirrors adapter.send line-for-line, locked by
+ * `feishu-outbound-render-mode.test.ts`):
+ *
+ *   1. `imagePath` set → `image_upload`
+ *   2. `files[0].path` set → `file_upload`
+ *   3. `forceTextOnly` true → `text`
+ *   4. mode "plain" → `text` (always)
+ *   5. mode "card" → `card_short_md` iff `looksLikeMarkdown(text)` AND
+ *      NOT `shouldRenderAsImage(text)`; else `text`
+ *   6. mode "auto" → `image_render` iff `shouldRenderAsImage(text)`;
+ *      else `card_short_md` iff `looksLikeMarkdown(text)`; else `text`
+ *   7. unknown mode (defensive default-default) → `text`
+ *
+ * The production switch in adapter.send may add the actual upload /
+ * render / lark API calls keyed on the route, but the route itself
+ * is decided HERE. To change the decision, change this file.
+ */
+export type OutboundRoute = "image_upload" | "file_upload" | "text" | "card_short_md" | "image_render";
+export interface RouteInput {
+    text?: string;
+    imagePath?: string;
+    files?: {
+        name: string;
+        path?: string;
+    }[];
+    forceTextOnly?: boolean;
+    /** `outboundRender` from the channel config. Defaults to "plain" when
+     *  absent so a caller that doesn't read the config still gets the
+     *  "Vincent default" behavior. */
+    mode?: "plain" | "card" | "auto";
+}
+export interface RouteDecision {
+    route: OutboundRoute;
+    reason: string;
+}
+/**
+ * Decide the outbound route for a `NormalizedIMMessage` (or a subset
+ * of its fields). Pure — no I/O, no SDK calls; safe to call from tests
+ * directly.
+ */
+export declare function resolveOutboundRoute(input: RouteInput): RouteDecision;

package/dist/src/im/feishu/worker-lifecycle.d.ts

@@ -0,0 +1,13 @@
+interface WorkerProcessBoundary {
+    stderr: {
+        write(message: string): unknown;
+    };
+    exit(code: number): unknown;
+}
+/**
+ * A terminal WS error means this worker no longer owns a live ingress path.
+ * Exit non-zero so the parent/supervisor cannot continue advertising it as
+ * healthy. Kept separate from worker.ts so the real exit contract is testable.
+ */
+export declare function exitFeishuWorker(error: Error, boundary?: WorkerProcessBoundary): void;
+export {};