@soimy/dingtalk 3.4.0 → 3.4.1

package/index.ts

@@ -1,80 +1,85 @@
-import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
-import * as pluginSdk from "openclaw/plugin-sdk";
-import { emptyPluginConfigSchema } from "openclaw/plugin-sdk";
+import { defineChannelPluginEntry, type OpenClawPluginApi } from "openclaw/plugin-sdk/core";
+import { readStringParam } from "openclaw/plugin-sdk/param-readers";
 import { dingtalkPlugin } from "./src/channel";
 import { getConfig } from "./src/config";
 import { appendToDoc, createDoc, DocCreateAppendError, listDocs, searchDocs } from "./src/docs-service";
 import { setDingTalkRuntime } from "./src/runtime";
-import type { DingtalkPluginModule } from "./src/types";
 
 type GatewayMethodContext = Pick<
   Parameters<Parameters<OpenClawPluginApi["registerGatewayMethod"]>[1]>[0],
   "params" | "respond"
 >;
 
-const plugin: DingtalkPluginModule = {
+function registerDingTalkDocsGatewayMethods(api: OpenClawPluginApi): void {
+  api.registerGatewayMethod("dingtalk.docs.create", async ({ respond, params }: GatewayMethodContext) => {
+    const accountId = readStringParam(params, "accountId");
+    const spaceId = readStringParam(params, "spaceId", { required: true });
+    const title = readStringParam(params, "title", { required: true });
+    const content = readStringParam(params, "content", { allowEmpty: true });
+    const parentId = readStringParam(params, "parentId");
+    const config = getConfig(api.config, accountId ?? undefined);
+    try {
+      const doc = await createDoc(
+        config,
+        spaceId,
+        title,
+        content ?? undefined,
+        api.logger,
+        parentId ?? undefined,
+      );
+      return respond(true, doc);
+    } catch (error) {
+      if (error instanceof DocCreateAppendError) {
+        return respond(true, {
+          partialSuccess: true,
+          initContentAppended: false,
+          docId: error.doc.docId,
+          doc: error.doc,
+          appendError: error.message,
+        });
+      }
+      throw error;
+    }
+  });
+
+  api.registerGatewayMethod("dingtalk.docs.append", async ({ respond, params }: GatewayMethodContext) => {
+    const accountId = readStringParam(params, "accountId");
+    const docId = readStringParam(params, "docId", { required: true });
+    const content = readStringParam(params, "content", { required: true, allowEmpty: false });
+    const config = getConfig(api.config, accountId ?? undefined);
+    const result = await appendToDoc(config, docId, content, api.logger);
+    return respond(true, result);
+  });
+
+  api.registerGatewayMethod("dingtalk.docs.search", async ({ respond, params }: GatewayMethodContext) => {
+    const accountId = readStringParam(params, "accountId");
+    const keyword = readStringParam(params, "keyword", { required: true });
+    const spaceId = readStringParam(params, "spaceId");
+    const config = getConfig(api.config, accountId ?? undefined);
+    const docs = await searchDocs(config, keyword, spaceId, api.logger);
+    return respond(true, { docs });
+  });
+
+  api.registerGatewayMethod("dingtalk.docs.list", async ({ respond, params }: GatewayMethodContext) => {
+    const accountId = readStringParam(params, "accountId");
+    const spaceId = readStringParam(params, "spaceId", { required: true });
+    const parentId = readStringParam(params, "parentId");
+    const config = getConfig(api.config, accountId ?? undefined);
+    const docs = await listDocs(config, spaceId, parentId, api.logger);
+    return respond(true, { docs });
+  });
+}
+
+export { dingtalkPlugin } from "./src/channel";
+export { setDingTalkRuntime } from "./src/runtime";
+
+export default defineChannelPluginEntry({
   id: "dingtalk",
   name: "DingTalk Channel",
   description: "DingTalk (钉钉) messaging channel via Stream mode",
-  configSchema: emptyPluginConfigSchema(),
-  register(api: OpenClawPluginApi): void {
-    setDingTalkRuntime(api.runtime);
-    api.registerChannel({ plugin: dingtalkPlugin });
-    api.registerGatewayMethod("dingtalk.docs.create", async ({ respond, params }: GatewayMethodContext) => {
-      const accountId = pluginSdk.readStringParam(params, "accountId");
-      const spaceId = pluginSdk.readStringParam(params, "spaceId", { required: true });
-      const title = pluginSdk.readStringParam(params, "title", { required: true });
-      const content = pluginSdk.readStringParam(params, "content", { allowEmpty: true });
-      const parentId = pluginSdk.readStringParam(params, "parentId");
-      const config = getConfig(api.config, accountId ?? undefined);
-      try {
-        const doc = await createDoc(
-          config,
-          spaceId,
-          title,
-          content ?? undefined,
-          api.logger,
-          parentId ?? undefined,
-        );
-        return respond(true, doc);
-      } catch (error) {
-        if (error instanceof DocCreateAppendError) {
-          return respond(true, {
-            partialSuccess: true,
-            initContentAppended: false,
-            docId: error.doc.docId,
-            doc: error.doc,
-            appendError: error.message,
-          });
-        }
-        throw error;
-      }
-    });
-    api.registerGatewayMethod("dingtalk.docs.append", async ({ respond, params }: GatewayMethodContext) => {
-      const accountId = pluginSdk.readStringParam(params, "accountId");
-      const docId = pluginSdk.readStringParam(params, "docId", { required: true });
-      const content = pluginSdk.readStringParam(params, "content", { required: true, allowEmpty: false });
-      const config = getConfig(api.config, accountId ?? undefined);
-      const result = await appendToDoc(config, docId, content, api.logger);
-      return respond(true, result);
-    });
-    api.registerGatewayMethod("dingtalk.docs.search", async ({ respond, params }: GatewayMethodContext) => {
-      const accountId = pluginSdk.readStringParam(params, "accountId");
-      const keyword = pluginSdk.readStringParam(params, "keyword", { required: true });
-      const spaceId = pluginSdk.readStringParam(params, "spaceId");
-      const config = getConfig(api.config, accountId ?? undefined);
-      const docs = await searchDocs(config, keyword, spaceId, api.logger);
-      return respond(true, { docs });
-    });
-    api.registerGatewayMethod("dingtalk.docs.list", async ({ respond, params }: GatewayMethodContext) => {
-      const accountId = pluginSdk.readStringParam(params, "accountId");
-      const spaceId = pluginSdk.readStringParam(params, "spaceId", { required: true });
-      const parentId = pluginSdk.readStringParam(params, "parentId");
-      const config = getConfig(api.config, accountId ?? undefined);
-      const docs = await listDocs(config, spaceId, parentId, api.logger);
-      return respond(true, { docs });
-    });
+  plugin: dingtalkPlugin,
+  setRuntime: setDingTalkRuntime,
+  registerFull(api) {
+    registerDingTalkDocsGatewayMethods(api);
   },
-};
-
-export default plugin;
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soimy/dingtalk",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "DingTalk (钉钉) channel plugin for OpenClaw",
   "keywords": [
     "bot",
@@ -51,6 +51,7 @@
   "devDependencies": {
     "@types/node": "^25.2.0",
     "@vitest/coverage-v8": "^3.2.4",
+    "openclaw": "2026.3.22",
     "oxfmt": "0.34.0",
     "oxlint": "^1.49.0",
     "oxlint-tsgolint": "^0.15.0",
@@ -58,7 +59,7 @@
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.2.13"
+    "openclaw": ">=2026.3.14"
   },
   "openclaw": {
     "extensions": [
@@ -72,8 +73,8 @@
       "id": "dingtalk",
       "label": "DingTalk",
       "selectionLabel": "DingTalk (钉钉)",
-      "docsPath": "/channels/dingtalk",
-      "docsLabel": "dingtalk",
+      "docsPath": "https://github.com/soimy/openclaw-channel-dingtalk",
+      "docsLabel": "plugin docs",
       "blurb": "钉钉企业内部机器人，使用 Stream 模式，无需公网 IP。",
       "order": 70,
       "aliases": [

package/src/channel.ts

@@ -1,7 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { DWClient, TOPIC_CARD, TOPIC_ROBOT } from "dingtalk-stream";
-import type { ChannelMessageActionAdapter, OpenClawConfig } from "openclaw/plugin-sdk";
-import * as pluginSdk from "openclaw/plugin-sdk";
+import type { ChannelMessageActionAdapter } from "openclaw/plugin-sdk/channel-contract";
+import { buildChannelConfigSchema, type OpenClawConfig } from "openclaw/plugin-sdk/core";
+import { jsonResult } from "openclaw/plugin-sdk/telegram-core";
+import { readStringParam } from "openclaw/plugin-sdk/param-readers";
+import { extractToolSend } from "openclaw/plugin-sdk/tool-send";
 import { getAccessToken } from "./auth";
 import { analyzeCardCallback } from "./card-callback-service";
 import {
@@ -30,7 +33,7 @@ import {
 import { handleDingTalkMessage } from "./inbound-handler";
 import { getLogger } from "./logger-context";
 import { prepareMediaInput, resolveOutboundMediaType } from "./media-utils";
-import { dingtalkOnboardingAdapter } from "./onboarding.js";
+import { dingtalkSetupAdapter, dingtalkSetupWizard } from "./onboarding.js";
 import { resolveOriginalPeerId, preloadPeerIdsFromSessions } from "./peer-id-registry";
 import { getDingTalkRuntime } from "./runtime";
 import {
@@ -206,26 +209,46 @@ function readBooleanLikeParam(params: Record<string, unknown>, key: string): boo
   return undefined;
 }
 
+function describeDingTalkMessageTool(cfg: OpenClawConfig): {
+  actions: readonly ["send"] | readonly [];
+  capabilities: readonly ["cards"] | readonly [];
+  schema: null;
+} {
+  const config = getConfig(cfg);
+  const configured = Boolean(config.clientId && config.clientSecret);
+  if (!configured && !(config.accounts && Object.keys(config.accounts).length > 0)) {
+    return { actions: [], capabilities: [], schema: null };
+  }
+  const hasCardMode =
+    config.messageType === "card" ||
+    (config.accounts && Object.values(config.accounts).some((a) => a?.messageType === "card"));
+  return {
+    actions: ["send"] as const,
+    capabilities: hasCardMode ? (["cards"] as const) : [],
+    schema: null,
+  };
+}
+
 const dingtalkMessageActions: ChannelMessageActionAdapter = {
-  listActions: () => ["send"],
+  describeMessageTool: ({ cfg }) => describeDingTalkMessageTool(cfg),
   supportsAction: ({ action }) => action === "send",
-  extractToolSend: ({ args }) => pluginSdk.extractToolSend(args, "sendMessage"),
-  handleAction: async ({ action, params, cfg, accountId, dryRun }) => {
+  extractToolSend: ({ args }) => extractToolSend(args, "sendMessage"),
+  handleAction: async ({ action, params, cfg, accountId, dryRun, mediaLocalRoots }) => {
     if (action !== "send") {
       throw new Error(`Action ${action} is not supported for provider dingtalk.`);
     }
 
-    const to = pluginSdk.readStringParam(params, "to", { required: true });
+    const to = readStringParam(params, "to", { required: true });
     const mediaInput =
-      pluginSdk.readStringParam(params, "media", { trim: false }) ??
-      pluginSdk.readStringParam(params, "path", { trim: false }) ??
-      pluginSdk.readStringParam(params, "filePath", { trim: false }) ??
-      pluginSdk.readStringParam(params, "mediaUrl", { trim: false });
+      readStringParam(params, "media", { trim: false }) ??
+      readStringParam(params, "path", { trim: false }) ??
+      readStringParam(params, "filePath", { trim: false }) ??
+      readStringParam(params, "mediaUrl", { trim: false });
 
     const hasMedia = Boolean(mediaInput && mediaInput.trim());
-    const caption = pluginSdk.readStringParam(params, "caption", { allowEmpty: true }) ?? "";
+    const caption = readStringParam(params, "caption", { allowEmpty: true }) ?? "";
     let message =
-      pluginSdk.readStringParam(params, "message", {
+      readStringParam(params, "message", {
         required: !hasMedia,
         allowEmpty: true,
       }) ?? "";
@@ -235,12 +258,12 @@ const dingtalkMessageActions: ChannelMessageActionAdapter = {
     }
 
     const asVoice = readBooleanLikeParam(params, "asVoice") === true;
-    const requestedMediaType = pluginSdk.readStringParam(params, "mediaType");
+    const requestedMediaType = readStringParam(params, "mediaType");
 
     const target = resolveOriginalPeerId(stripTargetPrefix(to).targetId);
 
     if (dryRun) {
-      return pluginSdk.jsonResult({
+      return jsonResult({
         ok: true,
         dryRun: true,
         to: target,
@@ -267,13 +290,14 @@ const dingtalkMessageActions: ChannelMessageActionAdapter = {
         const result = await sendProactiveMedia(config, target, mediaPath, mediaType, {
           log,
           accountId: accountId ?? undefined,
+          mediaLocalRoots: mediaLocalRoots ? [...mediaLocalRoots] : undefined,
         });
 
         if (!result.ok) {
           throw new Error(result.error || "send media failed");
         }
 
-        return pluginSdk.jsonResult({
+        return jsonResult({
           ok: true,
           to: target,
           mediaType,
@@ -305,7 +329,7 @@ const dingtalkMessageActions: ChannelMessageActionAdapter = {
     }
 
     const data = result.data as any;
-    return pluginSdk.jsonResult({
+    return jsonResult({
       ok: true,
       to: target,
       messageId: data?.processQueryKey || data?.messageId || null,
@@ -322,12 +346,13 @@ export const dingtalkPlugin: DingTalkChannelPlugin = {
     id: "dingtalk",
     label: "DingTalk",
     selectionLabel: "DingTalk (钉钉)",
-    docsPath: "/channels/dingtalk",
+    docsPath: "https://github.com/soimy/openclaw-channel-dingtalk",
     blurb: "钉钉企业内部机器人，使用 Stream 模式，无需公网 IP。",
     aliases: ["dd", "ding"],
   },
-  configSchema: pluginSdk.buildChannelConfigSchema(DingTalkConfigSchema),
-  onboarding: dingtalkOnboardingAdapter,
+  configSchema: buildChannelConfigSchema(DingTalkConfigSchema),
+  setup: dingtalkSetupAdapter,
+  setupWizard: dingtalkSetupWizard,
   capabilities: {
     chatTypes: ["direct", "group"] as Array<"direct" | "group">,
     reactions: false,
@@ -479,6 +504,7 @@ export const dingtalkPlugin: DingTalkChannelPlugin = {
       mediaType: providedMediaType,
       asVoice,
       accountId,
+      mediaLocalRoots,
       log,
     }: any) => {
       const config = getConfig(cfg, accountId);
@@ -547,6 +573,7 @@ export const dingtalkPlugin: DingTalkChannelPlugin = {
             accountId,
             storePath,
             conversationId: to,
+            mediaLocalRoots,
           });
         } catch (err: any) {
           if (err?.response?.data !== undefined) {

package/src/config.ts

@@ -1,6 +1,6 @@
 import * as os from "node:os";
 import * as path from "node:path";
-import type { OpenClawConfig } from "openclaw/plugin-sdk";
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
 import type { DingTalkConfig } from "./types";
 
 const WINDOWS_ROOT_DIRECTORIES = new Set([

package/src/connection-manager.ts

@@ -112,6 +112,18 @@ export class ConnectionManager {
     }
   }
 
+  /**
+   * Resolve all pending waitForStop() callers without performing full stop().
+   * Called by stop() and terminal FAILED states where the manager will never
+   * reconnect again, so startAccount must be allowed to exit.
+   */
+  private resolveStopWaiters(): void {
+    for (const resolve of this.stopPromiseResolvers) {
+      resolve();
+    }
+    this.stopPromiseResolvers = [];
+  }
+
   private logRuntimeCounters(reason: string): void {
     const c = this.runtimeCounters;
     this.log?.info?.(
@@ -722,6 +734,7 @@ export class ConnectionManager {
           this.notifyStateChange(
             `Max consecutive deadline timeouts (${ConnectionManager.MAX_CONSECUTIVE_DEADLINE_TIMEOUTS}) reached`,
           );
+          this.resolveStopWaiters();
           return;
         }
 
@@ -755,6 +768,7 @@ export class ConnectionManager {
         this.consecutiveUnhealthyChecks = 0;
         this.reconnectDeadline = undefined;
         this.notifyStateChange(`Max runtime reconnect cycles (${maxCycles}) reached`);
+        this.resolveStopWaiters();
         return;
       }
 
@@ -822,10 +836,7 @@ export class ConnectionManager {
     this.log?.info?.(`[${this.accountId}] Connection manager stopped`);
 
     // Resolve all pending waitForStop() promises
-    for (const resolve of this.stopPromiseResolvers) {
-      resolve();
-    }
-    this.stopPromiseResolvers = [];
+    this.resolveStopWaiters();
   }
 
   /**
@@ -835,7 +846,7 @@ export class ConnectionManager {
    * Safe to call concurrently; all pending callers are resolved when stop() is called.
    */
   public waitForStop(): Promise<void> {
-    if (this.stopped) {
+    if (this.stopped || this.state === ConnectionStateEnum.FAILED) {
       return Promise.resolve();
     }
     return new Promise<void>((resolve) => {

package/src/media-utils.ts

@@ -5,7 +5,6 @@
  * Provides functions for media type detection and file upload to DingTalk media servers.
  */
 
-import * as fs from "node:fs";
 import { randomUUID } from "node:crypto";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -16,17 +15,35 @@ import axios from "axios";
 import FormData from "form-data";
 import type { DingTalkConfig, Logger } from "./types";
 import { formatDingTalkErrorPayloadLog, getProxyBypassOption } from "./utils";
+import { getDingTalkRuntime } from "./runtime";
+
+/**
+ * Extended PluginRuntime with media bridge support.
+ * The `media.loadWebMedia` method resolves sandbox/container paths
+ * through the runtime bridge when direct host filesystem access fails.
+ */
+interface PluginRuntimeWithMedia {
+  media?: {
+    loadWebMedia(
+      mediaPath: string,
+      options?: { mediaLocalRoots?: string[] },
+    ): Promise<{ buffer: Buffer | ArrayBuffer; fileName?: string; contentType?: string } | null>;
+  };
+  [key: string]: unknown;
+}
 
 /**
  * Calculate MP3 duration in seconds by parsing MPEG frame headers
  * Supports CBR and VBR MP3 files
- * @param filePath Path to the MP3 file
+ * @param filePathOrBuffer Path to the MP3 file, or a pre-read Buffer
  * @param log Optional logger
  * @returns Duration in seconds (0 if parsing fails)
  */
-export async function getMp3DurationSeconds(filePath: string, log?: Logger): Promise<number> {
+export async function getMp3DurationSeconds(filePathOrBuffer: string | Buffer, log?: Logger): Promise<number> {
   try {
-    const buffer = await fsPromises.readFile(filePath);
+    const buffer = typeof filePathOrBuffer === "string"
+      ? await fsPromises.readFile(filePathOrBuffer)
+      : filePathOrBuffer;
     let offset = 0;
 
     // Skip ID3v2 tag if present
@@ -181,7 +198,7 @@ export async function getMp3DurationSeconds(filePath: string, log?: Logger): Pro
       return Math.floor(duration);
     }
 
-    log?.warn?.(`[DingTalk] Could not parse MP3 duration from ${filePath} (found ${frameCount} frames)`);
+    log?.warn?.(`[DingTalk] Could not parse MP3 duration from ${typeof filePathOrBuffer === "string" ? filePathOrBuffer : "<buffer>"} (found ${frameCount} frames)`);
     return 0;
   } catch (err: unknown) {
     log?.error?.(`[DingTalk] Failed to get MP3 duration: ${err instanceof Error ? err.message : String(err)}`);
@@ -195,6 +212,7 @@ export async function getVoiceDurationMs(
   filePath: string,
   mediaType: DingTalkMediaType,
   log?: Logger,
+  options?: { mediaLocalRoots?: string[]; preReadBuffer?: Buffer },
 ): Promise<number> {
   if (mediaType !== "voice") {
     return DEFAULT_VOICE_DURATION_MS;
@@ -203,7 +221,15 @@ export async function getVoiceDurationMs(
   const ext = path.extname(filePath).toLowerCase();
 
   if (ext === ".mp3") {
-    const durationSec = await getMp3DurationSeconds(filePath, log);
+    let durationSec: number;
+    try {
+      // Reuse pre-read buffer from uploadMedia when available to avoid double read
+      const buffer = options?.preReadBuffer
+        ?? (await readMediaBuffer(filePath, options, log)).buffer;
+      durationSec = await getMp3DurationSeconds(buffer, log);
+    } catch {
+      durationSec = 0;
+    }
     if (durationSec > 0) {
       return Math.max(1, Math.round(durationSec * 1000));
     }
@@ -607,36 +633,80 @@ const FILE_SIZE_LIMITS: Record<DingTalkMediaType, number> = {
 };
 
 /**
- * Upload media file to DingTalk and get media_id
- * Uses DingTalk's media upload API: https://oapi.dingtalk.com/media/upload
+ * Read a media file, resolving sandbox/container paths via the runtime bridge
+ * when direct host filesystem access fails.
  *
- * Note: Media files are stored temporarily by DingTalk (not in permanent storage).
- * The media_id can be used in subsequent message sends.
- *
- * @param config DingTalk configuration
- * @param mediaPath Local path to the media file
- * @param mediaType Type of media: 'image' | 'voice' | 'video' | 'file'
- * @param getAccessToken Function to get DingTalk access token
- * @param log Optional logger
- * @returns media_id on success, null on failure
+ * Precedence:
+ *   1. Direct fs.readFile (works for host-local paths)
+ *   2. rt.media.loadWebMedia (resolves sandbox workspace paths via bridge)
  */
+async function readMediaBuffer(
+  mediaPath: string,
+  options?: { mediaLocalRoots?: string[] },
+  log?: Logger,
+): Promise<{ buffer: Buffer; size: number }> {
+  // Try direct host filesystem first
+  try {
+    const buffer = await fsPromises.readFile(mediaPath);
+    return { buffer, size: buffer.length };
+  } catch (err: unknown) {
+    const errno = err as NodeJS.ErrnoException;
+    if (errno.code !== "ENOENT") {
+      throw err; // Permission errors etc. should propagate immediately
+    }
+  }
+
+  // File not found on host — try runtime media bridge (sandbox/container paths)
+  log?.debug?.(`[DingTalk] File not found on host, trying runtime media bridge: ${mediaPath}`);
+  const rt = getDingTalkRuntime() as PluginRuntimeWithMedia;
+  if (!rt.media?.loadWebMedia) {
+    throw Object.assign(
+      new Error(`File not found and runtime media bridge unavailable: ${mediaPath}`),
+      { code: "ENOENT" },
+    );
+  }
+
+  const media = await rt.media.loadWebMedia(mediaPath, {
+    mediaLocalRoots: options?.mediaLocalRoots,
+  });
+
+  if (!media || !media.buffer) {
+    throw Object.assign(
+      new Error(`Runtime media bridge returned no data for: ${mediaPath}`),
+      { code: "ENOENT" },
+    );
+  }
+
+  const buffer = Buffer.isBuffer(media.buffer)
+    ? media.buffer
+    : Buffer.from(media.buffer);
+  return { buffer, size: buffer.length };
+}
+
+export interface UploadMediaResult {
+  mediaId: string;
+  /** The file buffer read during upload, reusable for voice duration parsing etc. */
+  buffer: Buffer;
+}
+
 export async function uploadMedia(
   config: DingTalkConfig,
   mediaPath: string,
   mediaType: DingTalkMediaType,
   getAccessToken: (config: DingTalkConfig, log?: Logger) => Promise<string>,
   log?: Logger,
-): Promise<string | null> {
-  let fileStream: fs.ReadStream | null = null;
-
+  options?: { mediaLocalRoots?: string[] },
+): Promise<UploadMediaResult | null> {
   try {
     const token = await getAccessToken(config, log);
 
-    // Check file size (stat will throw if file doesn't exist)
-    const stats = await fsPromises.stat(mediaPath);
+    // Read file via sandbox-aware bridge (falls back to direct fs for host paths)
+    const { buffer, size } = await readMediaBuffer(mediaPath, options, log);
+
+    // Check file size
     const sizeLimit = FILE_SIZE_LIMITS[mediaType];
-    if (stats.size > sizeLimit) {
-      const sizeMB = (stats.size / (1024 * 1024)).toFixed(2);
+    if (size > sizeLimit) {
+      const sizeMB = (size / (1024 * 1024)).toFixed(2);
       const limitMB = (sizeLimit / (1024 * 1024)).toFixed(2);
       log?.error?.(
         `[DingTalk] Media file too large: ${sizeMB}MB exceeds ${limitMB}MB limit for ${mediaType}`,
@@ -644,17 +714,15 @@ export async function uploadMedia(
       return null;
     }
 
-    // Read file as a stream for better memory efficiency
-    fileStream = fs.createReadStream(mediaPath);
     const filename = path.basename(mediaPath);
 
     // Upload to DingTalk's media server using form-data
     const form = new FormData();
-    form.append("media", fileStream, { filename });
+    form.append("media", buffer, { filename });
 
     const uploadUrl = `https://oapi.dingtalk.com/media/upload?access_token=${token}&type=${mediaType}`;
 
-    log?.debug?.(`[DingTalk] Uploading media: ${filename} (${stats.size} bytes) as ${mediaType}`);
+    log?.debug?.(`[DingTalk] Uploading media: ${filename} (${size} bytes) as ${mediaType}`);
 
     const response = await axios.post(uploadUrl, form, {
       headers: form.getHeaders(),
@@ -665,9 +733,9 @@ export async function uploadMedia(
 
     if (response.data?.errcode === 0 && response.data?.media_id) {
       log?.debug?.(
-        `[DingTalk] Media uploaded successfully: ${response.data.media_id} (${stats.size} bytes)`,
+        `[DingTalk] Media uploaded successfully: ${response.data.media_id} (${size} bytes)`,
       );
-      return response.data.media_id;
+      return { mediaId: response.data.media_id, buffer };
     } else {
       log?.error?.(`[DingTalk] Media upload failed: ${JSON.stringify(response.data)}`);
       return null;
@@ -676,7 +744,7 @@ export async function uploadMedia(
     // Handle file system errors (e.g., file not found, permission denied)
     const errno = err as NodeJS.ErrnoException;
     if (errno.code === "ENOENT") {
-      log?.error?.(`[DingTalk] Media file not found: ${mediaPath}`);
+      log?.error?.(`[DingTalk] Media file not found (host and sandbox): ${mediaPath}`);
     } else if (errno.code === "EACCES") {
       log?.error?.(`[DingTalk] Permission denied accessing media file: ${mediaPath}`);
     } else {
@@ -690,10 +758,5 @@ export async function uploadMedia(
       }
     }
     return null;
-  } finally {
-    // Ensure file stream is closed even on error
-    if (fileStream) {
-      fileStream.destroy();
-    }
   }
 }