@turmind/halo 1.3.0 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@turmind/halo",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Halo — multi-agent collaborative workspace. CLI + TUI + HTTP/WS server in one package.",
   "type": "module",
   "license": "MIT",
@@ -20,7 +20,7 @@
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-sdk/client-bedrock-runtime": "^3.1030.0",
     "@aws-sdk/credential-provider-node": "^3.972.30",
-    "@hono/node-server": "^1.13.0",
+    "@hono/node-server": "^1.19.17",
     "@larksuiteoapi/node-sdk": "^1.65.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.222.0",
@@ -35,12 +35,12 @@
     "@opentelemetry/semantic-conventions": "^1.43.0",
     "@parcel/watcher": "^2.5.6",
     "@smithy/signature-v4": "^5.3.13",
+    "@wecom/aibot-node-sdk": "^1.0.7",
     "better-sqlite3": "^11.7.0",
-    "chokidar": "^5.0.0",
     "croner": "^10.0.1",
     "drizzle-orm": "^0.45.2",
     "grammy": "^1.42.0",
-    "hono": "^4.6.0",
+    "hono": "^4.13.8",
     "hyparquet": "^1.27.1",
     "hyparquet-compressors": "^1.1.1",
     "ink": "^7.0.3",
@@ -49,13 +49,13 @@
     "jszip": "^3.10.1",
     "marked": "^15.0.0",
     "marked-terminal": "^7.3.0",
-    "nanoid": "^5.0.9",
+    "nanoid": "^5.1.16",
     "node-pty": "1.2.0-beta.12",
     "qrcode": "^1.5.4",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
     "simple-git": "^3.27.0",
-    "ws": "^8.18.0",
+    "ws": "^8.21.3",
     "yaml": "^2.8.3"
   },
   "engines": {

package/templates/prompts/all/RUNTIME.md

@@ -4,7 +4,7 @@
 Each user message is prefixed `[<ISO-8601 UTC>]` — the server-stamped arrival time. Use it for "today" / "how long since the last message"; it is UTC, so convert to the user's timezone (from USER.md or context) before stating a date or time. Never echo the stamp in replies.
 
 ### Channel tag
-A `[channel: <type> | …]` tag right after the timestamp means the message arrived via an external channel (telegram / wechat / slack / feishu / web), not the admin UI. Don't echo the tag. IM replies are hard-split (telegram 4000 chars, wechat 3500, feishu 4500) and most IMs flatten markdown — prefer short paragraphs and `-` lists over tables and nested formatting; put long output in a file under `.halo/tmp/` and point to it. Use the `send-file` skill, if you have it, for attachments.
+A `[channel: <type> | …]` tag right after the timestamp means the message arrived via an external channel (telegram / wechat / slack / feishu / wecom / web), not the admin UI. Don't echo the tag. IM replies are hard-split (telegram 4000 chars, wechat 3500, feishu 4500, wecom 5000) and most IMs flatten markdown — prefer short paragraphs and `-` lists over tables and nested formatting; put long output in a file under `.halo/tmp/` and point to it. Use the `send-file` skill, if you have it, for attachments.
 
 ### Unattended runs
 If the conversation is a cron run, a goal-mode work order, or otherwise says nobody will answer, don't ask questions — deliver the result directly; if genuinely blocked, state what's blocked in one line and stop.

package/templates/skills/cron/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cron
-description: Manage scheduled cron jobs that run a halo agent on a schedule and optionally push the result to a chat channel (telegram / wechat / slack / feishu). Activate when the user asks to add / list / edit / pause / delete a recurring agent task.
+description: Manage scheduled cron jobs that run a halo agent on a schedule and optionally push the result to a chat channel (telegram / wechat / slack / feishu / wecom). Activate when the user asks to add / list / edit / pause / delete a recurring agent task.
 command: /cron
 requiresAccess: full
 verbs:
@@ -19,7 +19,7 @@ natural-language activation, infer it from the request. All verbs run through
 this body — map them onto the helper script's subcommands below.
 
 Halo runs a global cron daemon that executes user-defined agent prompts on a schedule and
-optionally pushes the resulting text to a chat (telegram / wechat / slack / feishu). Use the
+optionally pushes the resulting text to a chat (telegram / wechat / slack / feishu / wecom). Use the
 `manage-cron.py` helper script (sibling of this file) for every operation — it handles id
 generation, JSON encoding for `targets`, timestamps, and so on, so you don't end up
 handcrafting SQL.
@@ -97,11 +97,11 @@ shell_exec: python3 <skill-dir>/manage-cron.py channels
 
 Output is a JSON array `[{channelType, accountId, label, ready}, ...]`.
 
-#### Pinning the chatId — REQUIRED for telegram / slack / feishu
+#### Pinning the chatId — REQUIRED for telegram / slack / feishu / wecom
 
 The cron dispatcher used to fall back to "whoever last messaged the bot"
 when no chatId was given, but in practice that always pushed to a stranger.
-**As of the current build, telegram / slack / feishu cron pushes require
+**As of the current build, telegram / slack / feishu / wecom cron pushes require
 an explicit chatId.** WeChat is the exception — it has a QR-bound owner
 that's a stable single recipient.
 
@@ -117,6 +117,7 @@ Format per channel:
 | telegram | `telegram:<accountId>:<chatId>`                 | numeric (Telegram private-chat id)      |
 | slack    | `slack:<accountId>:<chatId>`                    | `D…` (DM), `C…` (channel top), `C…:<thread_ts>` (thread) |
 | feishu   | `feishu:<accountId>:<chatId>`                   | `oc_…` chat_id                          |
+| wecom    | `wecom:<accountId>:<chatId>`                    | `<userid>` (bot DM) or `<chatid>` (group) |
 
 Comma-separated for multiple targets:
 
@@ -125,7 +126,7 @@ Comma-separated for multiple targets:
 ```
 
 **Pinning to the current chat (the common case).** When the user inside
-telegram/slack/feishu/wechat asks "remind me at X" / "send me a daily
+telegram/slack/feishu/wecom/wechat asks "remind me at X" / "send me a daily
 digest", construct the target with `{{channel.chat_id}}`:
 
 ```
@@ -215,7 +216,7 @@ picks it up within ~10s. Example:
 
 ## Patterns that go sideways
 
-- **telegram / slack / feishu target without a chatId** — every fire errors with
+- **telegram / slack / feishu / wecom target without a chatId** — every fire errors with
   `… cron target requires an explicit chatId …`. From inside a chat, use the
   `{{channel.chat_id}}` template; from the admin UI, ask the user for the chatId
   (or accept that the cron will run silently with no push target).

package/templates/skills/cron/manage-cron.py

@@ -164,7 +164,7 @@ def cmd_list(args):
     # in-channel "delete my cron" / "list my crons" flow, where the
     # agent only knows the current chatId and needs to find which
     # cron_jobs reference it. chatId formats don't collide across
-    # channels (telegram numeric, slack D…/C…, feishu oc_…, wechat o…)
+    # channels (telegram numeric, slack D…/C…, feishu oc_…, wecom userid/chatid, wechat o…)
     # so a single chatId match is unambiguous.
     if args.chat_id:
         jobs = [

package/templates/skills/send-file/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: send-file
 requiresAccess: workspace
-description: Send images, videos, or files as attachments to the current user. Works on all channels (Web, WeChat, Telegram, Slack, Feishu). Use when the user asks to send a file, or when an attachment (screenshot, PDF, chart, generated artifact) is more useful than inline text.
+description: Send images, videos, or files as attachments to the current user. Works on all channels (Web, WeChat, Telegram, Slack, Feishu, WeCom). Use when the user asks to send a file, or when an attachment (screenshot, PDF, chart, generated artifact) is more useful than inline text.
 ---
 # Send File
 

package/templates/skills/send-file/wecom.md

@@ -0,0 +1,15 @@
+# WeCom Channel — File Delivery
+
+The bot uploads the file as a temporary media asset over the same long-connect socket, then replies with the matching message type. Type is inferred from extension, and WeCom is stricter than Feishu about which formats render inline:
+
+- `.png/.jpg/.jpeg/.gif` → image (renders inline)
+- `.mp4`                 → video (renders as a player)
+- anything else          → generic file (download card) — this includes `.webp/.bmp`, `.mov/.webm`, PDFs, audio, archives
+
+There is no voice-bubble path: WeCom voice requires `amr`, which the agent never produces, so audio always goes as a file. Hard limit is 20 MB per file — larger files fail and the bot posts a short upload-failed note instead.
+
+If an image must render inline, convert to png/jpg first:
+
+```bash
+ffmpeg -i input.webp output.png -y
+```