@sunnoy/wecom 1.9.0 → 2.0.1

package/wecom/runtime-telemetry.js

@@ -0,0 +1,330 @@
+const DAY_MS = 24 * 60 * 60 * 1000;
+const ACTIVE_SEND_LIMIT = 10;
+const ACTIVE_SEND_WARN_THRESHOLD = 8;
+const REPLY_LIMIT = 30;
+const REPLY_WARN_THRESHOLD = 24;
+const MAX_TRACKED_CHATS_PER_ACCOUNT = 500;
+
+const accountStates = new Map();
+
+function currentDayKey(at) {
+  return new Date(at).toISOString().slice(0, 10);
+}
+
+function ensureAccountState(accountId) {
+  if (!accountStates.has(accountId)) {
+    accountStates.set(accountId, {
+      lastInboundAt: null,
+      lastOutboundAt: null,
+      displaced: false,
+      lastDisplacedAt: null,
+      lastDisplacedReason: null,
+      chats: new Map(),
+    });
+  }
+  return accountStates.get(accountId);
+}
+
+function ensureChatState(accountState, chatId) {
+  const normalizedChatId = String(chatId ?? "").trim();
+  if (!normalizedChatId) {
+    return null;
+  }
+  if (!accountState.chats.has(normalizedChatId)) {
+    accountState.chats.set(normalizedChatId, {
+      chatId: normalizedChatId,
+      lastInboundAt: null,
+      lastOutboundAt: null,
+      lastTouchedAt: 0,
+      replyCount24h: 0,
+      activeSendDay: currentDayKey(Date.now()),
+      activeSendCountToday: 0,
+    });
+  }
+  return accountState.chats.get(normalizedChatId);
+}
+
+function touchChatState(chatState, at) {
+  chatState.lastTouchedAt = Math.max(chatState.lastTouchedAt ?? 0, at);
+}
+
+function pruneChatState(chatState, at) {
+  const dayKey = currentDayKey(at);
+  if (chatState.activeSendDay !== dayKey) {
+    chatState.activeSendDay = dayKey;
+    chatState.activeSendCountToday = 0;
+  }
+
+  if (!chatState.lastInboundAt || at - chatState.lastInboundAt >= DAY_MS) {
+    chatState.replyCount24h = 0;
+  }
+}
+
+function pruneAccountState(accountState, at) {
+  for (const [chatId, chatState] of accountState.chats.entries()) {
+    pruneChatState(chatState, at);
+
+    const lastRelevantAt = Math.max(
+      chatState.lastTouchedAt ?? 0,
+      chatState.lastInboundAt ?? 0,
+      chatState.lastOutboundAt ?? 0,
+    );
+    const hasReplyWindow = chatState.lastInboundAt && at - chatState.lastInboundAt < DAY_MS;
+    const hasDailyQuotaState = chatState.activeSendCountToday > 0;
+    if (!hasReplyWindow && !hasDailyQuotaState && lastRelevantAt > 0 && at - lastRelevantAt >= DAY_MS) {
+      accountState.chats.delete(chatId);
+    }
+  }
+
+  if (accountState.chats.size <= MAX_TRACKED_CHATS_PER_ACCOUNT) {
+    return;
+  }
+
+  const oldestFirst = [...accountState.chats.entries()].sort((left, right) => {
+    const leftTouched = left[1].lastTouchedAt ?? 0;
+    const rightTouched = right[1].lastTouchedAt ?? 0;
+    return leftTouched - rightTouched;
+  });
+  const excess = accountState.chats.size - MAX_TRACKED_CHATS_PER_ACCOUNT;
+  for (const [chatId] of oldestFirst.slice(0, excess)) {
+    accountState.chats.delete(chatId);
+  }
+}
+
+function describeReplyQuota(chatState, at) {
+  pruneChatState(chatState, at);
+  const windowActive = Boolean(chatState.lastInboundAt && at - chatState.lastInboundAt < DAY_MS);
+  const used = windowActive ? chatState.replyCount24h : 0;
+  const remaining = windowActive ? Math.max(0, REPLY_LIMIT - used) : REPLY_LIMIT;
+  return {
+    bucket: "reply24h",
+    limit: REPLY_LIMIT,
+    windowActive,
+    used,
+    remaining,
+    exhausted: windowActive && used >= REPLY_LIMIT,
+    nearLimit: windowActive && used >= REPLY_WARN_THRESHOLD,
+  };
+}
+
+function describeActiveQuota(chatState, at) {
+  pruneChatState(chatState, at);
+  const used = chatState.activeSendCountToday;
+  return {
+    bucket: "activeDaily",
+    limit: ACTIVE_SEND_LIMIT,
+    used,
+    remaining: Math.max(0, ACTIVE_SEND_LIMIT - used),
+    exhausted: used >= ACTIVE_SEND_LIMIT,
+    nearLimit: used >= ACTIVE_SEND_WARN_THRESHOLD,
+  };
+}
+
+export function forecastReplyQuota({ accountId, chatId, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  const chatState = ensureChatState(accountState, chatId);
+  if (!chatState) {
+    return {
+      bucket: "reply24h",
+      limit: REPLY_LIMIT,
+      windowActive: false,
+      used: 0,
+      remaining: REPLY_LIMIT,
+      exhausted: false,
+      nearLimit: false,
+    };
+  }
+  return describeReplyQuota(chatState, at);
+}
+
+export function forecastActiveSendQuota({ accountId, chatId, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  const chatState = ensureChatState(accountState, chatId);
+  if (!chatState) {
+    return {
+      bucket: "activeDaily",
+      limit: ACTIVE_SEND_LIMIT,
+      windowActive: false,
+      used: 0,
+      remaining: ACTIVE_SEND_LIMIT,
+      exhausted: false,
+      nearLimit: false,
+    };
+  }
+
+  const replyQuota = describeReplyQuota(chatState, at);
+  if (replyQuota.windowActive && !replyQuota.exhausted) {
+    return replyQuota;
+  }
+  return describeActiveQuota(chatState, at);
+}
+
+export function recordInboundMessage({ accountId, chatId, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  accountState.lastInboundAt = at;
+
+  const chatState = ensureChatState(accountState, chatId);
+  if (!chatState) {
+    return;
+  }
+
+  chatState.lastInboundAt = at;
+  chatState.replyCount24h = 0;
+  touchChatState(chatState, at);
+  pruneAccountState(accountState, at);
+}
+
+export function recordPassiveReply({ accountId, chatId, at = Date.now(), countQuota = true } = {}) {
+  const accountState = ensureAccountState(accountId);
+  accountState.lastOutboundAt = at;
+
+  const chatState = ensureChatState(accountState, chatId);
+  if (!chatState) {
+    return {
+      bucket: "reply24h",
+      used: 0,
+      limit: REPLY_LIMIT,
+      remaining: REPLY_LIMIT,
+      windowActive: false,
+      exhausted: false,
+      nearLimit: false,
+    };
+  }
+
+  chatState.lastOutboundAt = at;
+  touchChatState(chatState, at);
+  const quota = describeReplyQuota(chatState, at);
+  if (countQuota && quota.windowActive) {
+    chatState.replyCount24h += 1;
+  }
+  pruneAccountState(accountState, at);
+  return describeReplyQuota(chatState, at);
+}
+
+export function recordActiveSend({ accountId, chatId, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  accountState.lastOutboundAt = at;
+
+  const chatState = ensureChatState(accountState, chatId);
+  if (!chatState) {
+    return {
+      bucket: "activeDaily",
+      used: 0,
+      limit: ACTIVE_SEND_LIMIT,
+      remaining: ACTIVE_SEND_LIMIT,
+      windowActive: false,
+      exhausted: false,
+      nearLimit: false,
+    };
+  }
+
+  chatState.lastOutboundAt = at;
+  touchChatState(chatState, at);
+  const quota = forecastActiveSendQuota({ accountId, chatId, at });
+  if (quota.bucket === "reply24h" && quota.windowActive) {
+    chatState.replyCount24h += 1;
+  } else {
+    pruneChatState(chatState, at);
+    chatState.activeSendCountToday += 1;
+  }
+  pruneAccountState(accountState, at);
+  return forecastActiveSendQuota({ accountId, chatId, at });
+}
+
+export function recordOutboundActivity({ accountId, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  accountState.lastOutboundAt = at;
+}
+
+export function markAccountDisplaced({ accountId, reason = null, at = Date.now() }) {
+  const accountState = ensureAccountState(accountId);
+  accountState.displaced = true;
+  accountState.lastDisplacedAt = at;
+  accountState.lastDisplacedReason = reason ? String(reason) : null;
+}
+
+export function clearAccountDisplaced(accountId) {
+  const accountState = ensureAccountState(accountId);
+  accountState.displaced = false;
+}
+
+export function getAccountTelemetry(accountId, { now = Date.now() } = {}) {
+  const accountState = accountStates.get(accountId);
+  if (!accountState) {
+    return {
+      lastInboundAt: null,
+      lastOutboundAt: null,
+      connection: {
+        displaced: false,
+        lastDisplacedAt: null,
+        lastDisplacedReason: null,
+      },
+      quotas: {
+        trackedChats: 0,
+        replyWindowChats: 0,
+        totalReplyCount24h: 0,
+        nearLimitReplyChats: 0,
+        exhaustedReplyChats: 0,
+        activeDailyChats: 0,
+        totalActiveSendCountToday: 0,
+        nearLimitActiveChats: 0,
+        exhaustedActiveChats: 0,
+      },
+    };
+  }
+
+  pruneAccountState(accountState, now);
+
+  const summary = {
+    trackedChats: 0,
+    replyWindowChats: 0,
+    totalReplyCount24h: 0,
+    nearLimitReplyChats: 0,
+    exhaustedReplyChats: 0,
+    activeDailyChats: 0,
+    totalActiveSendCountToday: 0,
+    nearLimitActiveChats: 0,
+    exhaustedActiveChats: 0,
+  };
+
+  for (const chatState of accountState.chats.values()) {
+    summary.trackedChats += 1;
+
+    const replyQuota = describeReplyQuota(chatState, now);
+    if (replyQuota.windowActive) {
+      summary.replyWindowChats += 1;
+      summary.totalReplyCount24h += replyQuota.used;
+      if (replyQuota.exhausted) {
+        summary.exhaustedReplyChats += 1;
+      } else if (replyQuota.nearLimit) {
+        summary.nearLimitReplyChats += 1;
+      }
+    }
+
+    const activeQuota = describeActiveQuota(chatState, now);
+    if (activeQuota.used > 0) {
+      summary.activeDailyChats += 1;
+      summary.totalActiveSendCountToday += activeQuota.used;
+      if (activeQuota.exhausted) {
+        summary.exhaustedActiveChats += 1;
+      } else if (activeQuota.nearLimit) {
+        summary.nearLimitActiveChats += 1;
+      }
+    }
+  }
+
+  return {
+    lastInboundAt: accountState.lastInboundAt,
+    lastOutboundAt: accountState.lastOutboundAt,
+    connection: {
+      displaced: accountState.displaced,
+      lastDisplacedAt: accountState.lastDisplacedAt,
+      lastDisplacedReason: accountState.lastDisplacedReason,
+    },
+    quotas: summary,
+  };
+}
+
+export function resetRuntimeTelemetryForTesting() {
+  accountStates.clear();
+}

package/wecom/sandbox.js

@@ -0,0 +1,60 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+
+/**
+ * Resolve the allowed sandbox roots for outbound file access.
+ *
+ * @param {object} params
+ * @param {Function} params.resolveAgentWorkspaceDir - (config, agentId) => string
+ * @param {Function} params.resolveDefaultAgentId - (config) => string
+ * @param {Function} params.resolveStateDir - () => string
+ * @param {object} params.config - OpenClaw configuration
+ * @param {string} [params.agentId] - Agent identifier
+ * @returns {string[]} Deduplicated list of resolved absolute root paths.
+ */
+export function resolveSandboxRoots({ resolveAgentWorkspaceDir, resolveDefaultAgentId, resolveStateDir, config, agentId }) {
+  const effectiveAgentId = agentId || resolveDefaultAgentId(config);
+  const workspaceDir = resolveAgentWorkspaceDir(config, effectiveAgentId);
+  const stateDir = resolveStateDir();
+  const mediaCacheDir = path.join(stateDir, "media");
+  const browserMediaDir = path.join(stateDir, "media", "browser");
+
+  return [...new Set([workspaceDir, mediaCacheDir, browserMediaDir].map((p) => path.resolve(p)))];
+}
+
+/**
+ * Validate that a file path falls within one of the allowed sandbox roots.
+ *
+ * Uses `fs.realpath` to resolve symlinks before checking, preventing
+ * symlink-based escapes. Falls back to `path.resolve` if `realpath` fails
+ * (e.g. file does not exist yet), which still catches `..` traversal.
+ *
+ * @param {string} filePath - The absolute file path to validate.
+ * @param {string[]} allowedRoots - List of allowed root directories.
+ * @throws {Error} If the path escapes all sandbox roots.
+ */
+export async function assertPathInsideSandbox(filePath, allowedRoots) {
+  if (!filePath || typeof filePath !== "string") {
+    throw new Error("Sandbox violation: empty file path");
+  }
+
+  const resolved = path.resolve(filePath);
+
+  // Resolve symlinks when possible; fall back to lexical resolve.
+  let real;
+  try {
+    real = await realpath(resolved);
+  } catch {
+    real = resolved;
+  }
+
+  for (const root of allowedRoots) {
+    const resolvedRoot = path.resolve(root);
+    // Ensure trailing separator so "/workspace-x" doesn't match "/workspace-xyz".
+    if (real === resolvedRoot || real.startsWith(resolvedRoot + path.sep)) {
+      return;
+    }
+  }
+
+  throw new Error(`Sandbox violation: path "${filePath}" escapes allowed roots`);
+}

package/wecom/state.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getWebhookBotSendUrl } from "./constants.js";
-import { resolveAgentConfigForAccount, resolveAccount } from "./accounts.js";
+import { resolveAgentConfigForAccount, resolveDefaultAccountId, resolveAccount } from "./accounts.js";
 
 const runtimeState = {
   runtime: null,
@@ -10,13 +10,6 @@ const runtimeState = {
 };
 
 export const dispatchLocks = new Map();
-export const messageBuffers = new Map();
-export const webhookTargets = new Map();
-export const activeStreams = new Map();
-export const activeStreamHistory = new Map();
-export const lastStreamByKey = new Map();
-export const streamMeta = new Map();
-export const responseUrls = new Map();
 export const streamContext = new AsyncLocalStorage();
 
 export function setRuntime(runtime) {
@@ -50,36 +43,41 @@ export function setEnsureDynamicAgentWriteQueue(queuePromise) {
   runtimeState.ensureDynamicAgentWriteQueue = queuePromise;
 }
 
-/**
- * Extract Agent API config from the runtime openclaw config.
- * Returns null when Agent mode is not configured.
- *
- * @param {string} [accountId] - Optional account ID. When omitted, first tries
- *   the streamContext async store, then falls back to the default account.
- */
+function resolveEffectiveAccountId(accountId) {
+  if (accountId) {
+    return accountId;
+  }
+  const contextual = streamContext.getStore()?.accountId;
+  if (contextual) {
+    return contextual;
+  }
+  return resolveDefaultAccountId(getOpenclawConfig());
+}
+
 export function resolveAgentConfig(accountId) {
-  const config = getOpenclawConfig();
-  // Determine effective accountId: explicit param > async context > default.
-  const effectiveId = accountId || streamContext.getStore()?.accountId || undefined;
-  return resolveAgentConfigForAccount(config, effectiveId);
+  return resolveAgentConfigForAccount(getOpenclawConfig(), resolveEffectiveAccountId(accountId));
+}
+
+export function resolveAccountConfig(accountId) {
+  return resolveAccount(getOpenclawConfig(), resolveEffectiveAccountId(accountId));
 }
 
-/**
- * Resolve a webhook name to a full webhook URL.
- * Supports both full URLs and bare keys in config.
- * Returns null when the webhook name is not configured.
- *
- * @param {string} name - Webhook name from the `to` field (e.g. "ops-group")
- * @param {string} [accountId] - Optional account ID for multi-account lookup.
- * @returns {string|null}
- */
 export function resolveWebhookUrl(name, accountId) {
-  const config = getOpenclawConfig();
-  const effectiveId = accountId || streamContext.getStore()?.accountId || undefined;
-  const account = resolveAccount(config, effectiveId);
-  const webhooks = account?.config?.webhooks;
-  if (!webhooks || !webhooks[name]) return null;
-  const value = webhooks[name];
-  if (value.startsWith("http")) return value;
+  const account = resolveAccountConfig(accountId);
+  const value = account?.config?.webhooks?.[name];
+  if (!value) {
+    return null;
+  }
+  if (String(value).startsWith("http")) {
+    return String(value);
+  }
   return `${getWebhookBotSendUrl()}?key=${value}`;
 }
+
+export function resetStateForTesting() {
+  runtimeState.runtime = null;
+  runtimeState.openclawConfig = null;
+  runtimeState.ensuredDynamicAgentIds = new Set();
+  runtimeState.ensureDynamicAgentWriteQueue = Promise.resolve();
+  dispatchLocks.clear();
+}

package/wecom/workspace-template.js

@@ -1,4 +1,5 @@
-import { copyFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { logger } from "../logger.js";
 import { BOOTSTRAP_FILENAMES } from "./constants.js";
@@ -11,6 +12,40 @@ import {
   setOpenclawConfig,
 } from "./state.js";
 
+function expandTilde(p) {
+  if (!p || !p.startsWith("~")) return p;
+  return join(homedir(), p.slice(1));
+}
+
+// --- mtime caches for force-reseed ---
+const _templateMtimeCache = new Map();   // templateDir → { maxMtimeMs, checkedAt }
+const _agentSeedMtimeCache = new Map();  // `${templateDir}::${agentId}` → maxMtimeMs
+const TEMPLATE_MTIME_CACHE_TTL_MS = 60_000;
+
+function getTemplateMaxMtimeMs(templateDir) {
+  const now = Date.now();
+  const cached = _templateMtimeCache.get(templateDir);
+  if (cached && now - cached.checkedAt < TEMPLATE_MTIME_CACHE_TTL_MS) {
+    return cached.maxMtimeMs;
+  }
+
+  let maxMtimeMs = 0;
+  const files = readdirSync(templateDir);
+  for (const file of files) {
+    if (!BOOTSTRAP_FILENAMES.has(file)) continue;
+    const st = statSync(join(templateDir, file));
+    if (st.mtimeMs > maxMtimeMs) maxMtimeMs = st.mtimeMs;
+  }
+
+  _templateMtimeCache.set(templateDir, { maxMtimeMs, checkedAt: now });
+  return maxMtimeMs;
+}
+
+export function clearTemplateMtimeCache({ agentSeedCache = true } = {}) {
+  _templateMtimeCache.clear();
+  if (agentSeedCache) _agentSeedMtimeCache.clear();
+}
+
 /**
  * Resolve the agent workspace directory for a given agentId.
  * Mirrors openclaw core's resolveAgentWorkspaceDir logic for non-default agents:
@@ -42,7 +77,8 @@ export function getWorkspaceTemplateDir(config) {
  * @param {string} [overrideTemplateDir] - Optional per-account template directory
  */
 export function seedAgentWorkspace(agentId, config, overrideTemplateDir) {
-  const templateDir = overrideTemplateDir || getWorkspaceTemplateDir(config);
+  const rawTemplateDir = overrideTemplateDir || getWorkspaceTemplateDir(config);
+  const templateDir = expandTilde(rawTemplateDir);
   if (!templateDir) {
     return;
   }
@@ -55,6 +91,15 @@ export function seedAgentWorkspace(agentId, config, overrideTemplateDir) {
   const workspaceDir = resolveAgentWorkspaceDirLocal(agentId);
 
   try {
+    const templateMaxMtimeMs = getTemplateMaxMtimeMs(templateDir);
+    const cacheKey = `${templateDir}::${agentId}`;
+    const lastSyncedMtimeMs = _agentSeedMtimeCache.get(cacheKey) ?? 0;
+    const isFirstSeed = lastSyncedMtimeMs === 0;
+
+    if (templateMaxMtimeMs <= lastSyncedMtimeMs && existsSync(workspaceDir)) {
+      return;
+    }
+
     mkdirSync(workspaceDir, { recursive: true });
 
     const files = readdirSync(templateDir);
@@ -62,13 +107,25 @@ export function seedAgentWorkspace(agentId, config, overrideTemplateDir) {
       if (!BOOTSTRAP_FILENAMES.has(file)) {
         continue;
       }
+      const src = join(templateDir, file);
       const dest = join(workspaceDir, file);
       if (existsSync(dest)) {
-        continue;
+        if (!isFirstSeed) {
+          const srcMtimeMs = statSync(src).mtimeMs;
+          const destMtimeMs = statSync(dest).mtimeMs;
+          if (srcMtimeMs <= destMtimeMs) {
+            continue;
+          }
+        }
+        copyFileSync(src, dest);
+        logger.info("WeCom: re-seeded workspace file", { agentId, file, isFirstSeed });
+      } else {
+        copyFileSync(src, dest);
+        logger.info("WeCom: seeded workspace file", { agentId, file });
       }
-      copyFileSync(join(templateDir, file), dest);
-      logger.info("WeCom: seeded workspace file", { agentId, file });
     }
+
+    _agentSeedMtimeCache.set(cacheKey, templateMaxMtimeMs);
   } catch (err) {
     logger.warn("WeCom: failed to seed agent workspace", {
       agentId,
@@ -100,8 +157,10 @@ export function upsertAgentIdOnlyEntry(cfg, agentId) {
   const nextList = [...currentList];
 
   // Keep "main" as the explicit default when creating agents.list for the first time.
+  // Include heartbeat: {} so main inherits agents.defaults.heartbeat even when
+  // dynamic agents also have explicit heartbeat entries (hasExplicitHeartbeatAgents).
   if (nextList.length === 0) {
-    nextList.push({ id: "main" });
+    nextList.push({ id: "main", heartbeat: {} });
     existingIds.add("main");
     changed = true;
   }
@@ -128,7 +187,7 @@ export async function ensureDynamicAgentListed(agentId, templateDir) {
 
   const runtime = getRuntime();
   const configRuntime = runtime?.config;
-  if (!configRuntime?.loadConfig || !configRuntime?.writeConfigFile) {
+  if (!configRuntime?.writeConfigFile) {
     return;
   }
 
@@ -139,10 +198,26 @@ export async function ensureDynamicAgentListed(agentId, templateDir) {
         return;
       }
 
-      // Upsert into memory only. Writing to config file is dangerous and can wipe user settings.
+      // Upsert into in-memory config so the running gateway sees it immediately.
       const changed = upsertAgentIdOnlyEntry(openclawConfig, normalizedId);
       if (changed) {
         logger.info("WeCom: dynamic agent added to in-memory agents.list", { agentId: normalizedId });
+
+        // Persist to disk so `openclaw agents list` (separate process) can see
+        // the dynamic agent and it survives gateway restarts.
+        // Write the mutated in-memory config directly (same pattern as logoutAccount).
+        // NOTE: loadConfig() returns runtimeConfigSnapshot in gateway mode — the same
+        // object we already mutated above — so a read-modify-write pattern silently
+        // skips the write (diskChanged=false). Writing directly avoids this.
+        try {
+          await configRuntime.writeConfigFile(openclawConfig);
+          logger.info("WeCom: dynamic agent persisted to config file", { agentId: normalizedId });
+        } catch (writeErr) {
+          logger.warn("WeCom: failed to persist dynamic agent to config file", {
+            agentId: normalizedId,
+            error: writeErr?.message || String(writeErr),
+          });
+        }
       }
       
       // Always attempt seeding so recreated/cleaned dynamic agents can recover