@wecom/wecom-openclaw-plugin 2026.3.30 → 2026.4.1-beta.0

package/dist/cjs/src/dm-policy.js

@@ -0,0 +1,89 @@
+'use strict';
+
+var runtime = require('./runtime.js');
+var _const = require('./const.js');
+var messageSender = require('./message-sender.js');
+var groupPolicy = require('./group-policy.js');
+
+/**
+ * 企业微信 DM（私聊）访问控制模块
+ *
+ * 负责私聊策略检查、配对流程
+ */
+// ============================================================================
+// 公开 API
+// ============================================================================
+/**
+ * 检查 DM Policy 访问控制
+ * @returns 检查结果，包含是否允许继续处理
+ */
+async function checkDmPolicy(params) {
+    const { senderId, isGroup, account, wsClient, frame, runtime: runtime$1 } = params;
+    const core = runtime.getWeComRuntime();
+    // 群聊消息不检查 DM Policy
+    if (isGroup) {
+        return { allowed: true };
+    }
+    const dmPolicy = account.config.dmPolicy ?? "open";
+    const configAllowFrom = (account.config.allowFrom ?? []).map((v) => String(v));
+    // 如果 dmPolicy 是 disabled，直接拒绝
+    if (dmPolicy === "disabled") {
+        runtime$1.log?.(`[WeCom] Blocked DM from ${senderId} (dmPolicy=disabled)`);
+        return { allowed: false };
+    }
+    // 如果是 open 模式，允许所有人
+    if (dmPolicy === "open") {
+        return { allowed: true };
+    }
+    // OpenClaw <= 2026.2.19 signature: readAllowFromStore(channel, env?, accountId?)
+    const oldStoreAllowFrom = await core.channel.pairing.readAllowFromStore('wecom', undefined, account.accountId).catch(() => []);
+    // Compatibility fallback for newer OpenClaw implementations.
+    const newStoreAllowFrom = await core.channel.pairing
+        .readAllowFromStore({ channel: _const.CHANNEL_ID, accountId: account.accountId })
+        .catch(() => []);
+    // 检查发送者是否在允许列表中
+    const storeAllowFrom = [...oldStoreAllowFrom, ...newStoreAllowFrom];
+    const effectiveAllowFrom = [...configAllowFrom, ...storeAllowFrom];
+    const senderAllowedResult = groupPolicy.isSenderAllowed(senderId, effectiveAllowFrom);
+    if (senderAllowedResult) {
+        return { allowed: true };
+    }
+    // 处理未授权用户
+    if (dmPolicy === "pairing") {
+        const { code, created } = await core.channel.pairing.upsertPairingRequest({
+            channel: _const.CHANNEL_ID,
+            id: senderId,
+            accountId: account.accountId,
+            meta: { name: senderId },
+        });
+        if (created) {
+            runtime$1.log?.(`[WeCom] Pairing request created for sender=${senderId}`);
+            try {
+                await messageSender.sendWeComReply({
+                    wsClient,
+                    frame,
+                    text: core.channel.pairing.buildPairingReply({
+                        channel: _const.CHANNEL_ID,
+                        idLine: `您的企业微信用户ID: ${senderId}`,
+                        code,
+                    }),
+                    runtime: runtime$1,
+                    finish: true,
+                });
+            }
+            catch (err) {
+                runtime$1.error?.(`[WeCom] Failed to send pairing reply to ${senderId}: ${String(err)}`);
+            }
+        }
+        else {
+            runtime$1.log?.(`[WeCom] Pairing request already exists for sender=${senderId}`);
+        }
+        return { allowed: false, pairingSent: created };
+    }
+    // allowlist 模式：直接拒绝未授权用户
+    runtime$1.log?.(`[WeCom] Blocked unauthorized sender ${senderId} (dmPolicy=${dmPolicy})`);
+    return { allowed: false };
+}
+
+exports.checkDmPolicy = checkDmPolicy;
+//# sourceMappingURL=dm-policy.js.map

package/dist/cjs/src/dm-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-policy.js","sources":["../../../../../src/dm-policy.ts"],"sourcesContent":["/**\n * 企业微信 DM（私聊）访问控制模块\n *\n * 负责私聊策略检查、配对流程\n */\n\nimport type { RuntimeEnv } from \"openclaw/plugin-sdk/runtime-env\";\nimport type { WSClient, WsFrame } from \"@wecom/aibot-node-sdk\";\nimport { getWeComRuntime } from \"./runtime.js\";\nimport { CHANNEL_ID } from \"./const.js\";\nimport type { ResolvedWeComAccount } from \"./utils.js\";\nimport { sendWeComReply } from \"./message-sender.js\";\nimport { isSenderAllowed } from \"./group-policy.js\";\n\n// ============================================================================\n// 检查结果类型\n// ============================================================================\n\n/**\n * DM Policy 检查结果\n */\nexport interface DmPolicyCheckResult {\n  /** 是否允许继续处理消息 */\n  allowed: boolean;\n  /** 是否已发送配对消息（仅在 pairing 模式下） */\n  pairingSent?: boolean;\n}\n\n// ============================================================================\n// 公开 API\n// ============================================================================\n\n/**\n * 检查 DM Policy 访问控制\n * @returns 检查结果，包含是否允许继续处理\n */\nexport async function checkDmPolicy(params: {\n  senderId: string;\n  isGroup: boolean;\n  account: ResolvedWeComAccount;\n  wsClient: WSClient;\n  frame: WsFrame;\n  runtime: RuntimeEnv;\n}): Promise<DmPolicyCheckResult> {\n  const { senderId, isGroup, account, wsClient, frame, runtime } = params;\n  const core = getWeComRuntime();\n\n  // 群聊消息不检查 DM Policy\n  if (isGroup) {\n    return { allowed: true };\n  }\n\n  const dmPolicy = account.config.dmPolicy ?? \"open\";\n  const configAllowFrom = (account.config.allowFrom ?? []).map((v) => String(v));\n\n  // 如果 dmPolicy 是 disabled，直接拒绝\n  if (dmPolicy === \"disabled\") {\n    runtime.log?.(`[WeCom] Blocked DM from ${senderId} (dmPolicy=disabled)`);\n    return { allowed: false };\n  }\n\n  // 如果是 open 模式，允许所有人\n  if (dmPolicy === \"open\") {\n    return { allowed: true };\n  }\n\n  // OpenClaw <= 2026.2.19 signature: readAllowFromStore(channel, env?, accountId?)\n  const oldStoreAllowFrom = await core.channel.pairing.readAllowFromStore('wecom', undefined, account.accountId).catch(() => []);;\n  // Compatibility fallback for newer OpenClaw implementations.\n  const newStoreAllowFrom = await core.channel.pairing\n      .readAllowFromStore({ channel: CHANNEL_ID, accountId: account.accountId })\n      .catch(() => []);\n\n  // 检查发送者是否在允许列表中\n  const storeAllowFrom = [...oldStoreAllowFrom, ...newStoreAllowFrom];\n\n  const effectiveAllowFrom = [...configAllowFrom, ...storeAllowFrom];\n  const senderAllowedResult = isSenderAllowed(senderId, effectiveAllowFrom);\n\n  if (senderAllowedResult) {\n    return { allowed: true };\n  }\n\n  // 处理未授权用户\n  if (dmPolicy === \"pairing\") {\n    const { code, created } = await core.channel.pairing.upsertPairingRequest({\n      channel: CHANNEL_ID,\n      id: senderId,\n      accountId: account.accountId,\n      meta: { name: senderId },\n    });\n\n    if (created) {\n      runtime.log?.(`[WeCom] Pairing request created for sender=${senderId}`);\n      try {\n        await sendWeComReply({\n          wsClient,\n          frame,\n          text: core.channel.pairing.buildPairingReply({\n            channel: CHANNEL_ID,\n            idLine: `您的企业微信用户ID: ${senderId}`,\n            code,\n          }),\n          runtime,\n          finish: true,\n        });\n      } catch (err) {\n        runtime.error?.(`[WeCom] Failed to send pairing reply to ${senderId}: ${String(err)}`);\n      }\n    } else {\n      runtime.log?.(`[WeCom] Pairing request already exists for sender=${senderId}`);\n    }\n    return { allowed: false, pairingSent: created };\n  }\n\n  // allowlist 模式：直接拒绝未授权用户\n  runtime.log?.(`[WeCom] Blocked unauthorized sender ${senderId} (dmPolicy=${dmPolicy})`);\n  return { allowed: false };\n}\n"],"names":["runtime","getWeComRuntime","CHANNEL_ID","isSenderAllowed","sendWeComReply"],"mappings":";;;;;;;AAAA;;;;AAIG;AAwBH;AACA;AACA;AAEA;;;AAGG;AACI,eAAe,aAAa,CAAC,MAOnC,EAAA;AACC,IAAA,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAEA,SAAO,EAAE,GAAG,MAAM;AACvE,IAAA,MAAM,IAAI,GAAGC,uBAAe,EAAE;;IAG9B,IAAI,OAAO,EAAE;AACX,QAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1B;IAEA,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM;IAClD,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;;AAG9E,IAAA,IAAI,QAAQ,KAAK,UAAU,EAAE;QAC3BD,SAAO,CAAC,GAAG,GAAG,2BAA2B,QAAQ,CAAA,oBAAA,CAAsB,CAAC;AACxE,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;;AAGA,IAAA,IAAI,QAAQ,KAAK,MAAM,EAAE;AACvB,QAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1B;;IAGA,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;;AAE9H,IAAA,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;AACxC,SAAA,kBAAkB,CAAC,EAAE,OAAO,EAAEE,iBAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;AACxE,SAAA,KAAK,CAAC,MAAM,EAAE,CAAC;;IAGpB,MAAM,cAAc,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,iBAAiB,CAAC;IAEnE,MAAM,kBAAkB,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC;IAClE,MAAM,mBAAmB,GAAGC,2BAAe,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IAEzE,IAAI,mBAAmB,EAAE;AACvB,QAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1B;;AAGA,IAAA,IAAI,QAAQ,KAAK,SAAS,EAAE;AAC1B,QAAA,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;AACxE,YAAA,OAAO,EAAED,iBAAU;AACnB,YAAA,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;AAC5B,YAAA,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;AACzB,SAAA,CAAC;QAEF,IAAI,OAAO,EAAE;YACXF,SAAO,CAAC,GAAG,GAAG,8CAA8C,QAAQ,CAAA,CAAE,CAAC;AACvE,YAAA,IAAI;AACF,gBAAA,MAAMI,4BAAc,CAAC;oBACnB,QAAQ;oBACR,KAAK;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;AAC3C,wBAAA,OAAO,EAAEF,iBAAU;wBACnB,MAAM,EAAE,CAAA,YAAA,EAAe,QAAQ,CAAA,CAAE;wBACjC,IAAI;qBACL,CAAC;6BACFF,SAAO;AACP,oBAAA,MAAM,EAAE,IAAI;AACb,iBAAA,CAAC;YACJ;YAAE,OAAO,GAAG,EAAE;AACZ,gBAAAA,SAAO,CAAC,KAAK,GAAG,CAAA,wCAAA,EAA2C,QAAQ,CAAA,EAAA,EAAK,MAAM,CAAC,GAAG,CAAC,CAAA,CAAE,CAAC;YACxF;QACF;aAAO;YACLA,SAAO,CAAC,GAAG,GAAG,qDAAqD,QAAQ,CAAA,CAAE,CAAC;QAChF;QACA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE;IACjD;;IAGAA,SAAO,CAAC,GAAG,GAAG,CAAA,oCAAA,EAAuC,QAAQ,CAAA,WAAA,EAAc,QAAQ,CAAA,CAAA,CAAG,CAAC;AACvF,IAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;AAC3B;;;;"}

package/dist/cjs/src/group-policy.js

@@ -0,0 +1,133 @@
+'use strict';
+
+var _const = require('./const.js');
+
+/**
+ * 企业微信群组访问控制模块
+ *
+ * 负责群组策略检查（groupPolicy、群组白名单、群内发送者白名单）
+ */
+// ============================================================================
+// 内部辅助函数
+// ============================================================================
+/**
+ * 解析企业微信群组配置
+ */
+function resolveWeComGroupConfig(params) {
+    const groups = params.cfg?.groups ?? {};
+    const wildcard = groups["*"];
+    const groupId = params.groupId?.trim();
+    if (!groupId) {
+        return undefined;
+    }
+    const direct = groups[groupId];
+    if (direct) {
+        return direct;
+    }
+    const lowered = groupId.toLowerCase();
+    const matchKey = Object.keys(groups).find((key) => key.toLowerCase() === lowered);
+    if (matchKey) {
+        return groups[matchKey];
+    }
+    return wildcard;
+}
+/**
+ * 检查群组是否在允许列表中
+ */
+function isWeComGroupAllowed(params) {
+    const { groupPolicy } = params;
+    if (groupPolicy === "disabled") {
+        return false;
+    }
+    if (groupPolicy === "open") {
+        return true;
+    }
+    // allowlist 模式：检查群组是否在允许列表中
+    const normalizedAllowFrom = params.allowFrom.map((entry) => String(entry).replace(new RegExp(`^${_const.CHANNEL_ID}:`, "i"), "").trim());
+    if (normalizedAllowFrom.includes("*")) {
+        return true;
+    }
+    const normalizedGroupId = params.groupId.trim();
+    return normalizedAllowFrom.some((entry) => entry === normalizedGroupId || entry.toLowerCase() === normalizedGroupId.toLowerCase());
+}
+/**
+ * 检查群组内发送者是否在允许列表中
+ */
+function isGroupSenderAllowed(params) {
+    const { senderId, groupId, wecomConfig } = params;
+    const groupConfig = resolveWeComGroupConfig({
+        cfg: wecomConfig,
+        groupId,
+    });
+    const perGroupSenderAllowFrom = (groupConfig?.allowFrom ?? []).map((v) => String(v));
+    if (perGroupSenderAllowFrom.length === 0) {
+        return true;
+    }
+    if (perGroupSenderAllowFrom.includes("*")) {
+        return true;
+    }
+    return perGroupSenderAllowFrom.some((entry) => {
+        const normalized = entry.replace(new RegExp(`^${_const.CHANNEL_ID}:`, "i"), "").trim();
+        return normalized === senderId || normalized === `user:${senderId}`;
+    });
+}
+// ============================================================================
+// 公开 API
+// ============================================================================
+/**
+ * 检查群组策略访问控制
+ * @returns 检查结果，包含是否允许继续处理
+ */
+function checkGroupPolicy(params) {
+    const { chatId, senderId, account, config, runtime } = params;
+    const wecomConfig = (config.channels?.[_const.CHANNEL_ID] ?? {});
+    const defaultGroupPolicy = config.channels?.[_const.CHANNEL_ID]?.groupPolicy;
+    const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? "open";
+    // const { groupPolicy, providerMissingFallbackApplied } = resolveOpenProviderRuntimeGroupPolicy({
+    //   providerConfigPresent: config.channels?.[CHANNEL_ID] !== undefined,
+    //   groupPolicy: wecomConfig.groupPolicy,
+    //   defaultGroupPolicy,
+    // });
+    // warnMissingProviderGroupPolicyFallbackOnce({
+    //   providerMissingFallbackApplied,
+    //   providerKey: CHANNEL_ID,
+    //   accountId: account.accountId,
+    //   log: (msg) => runtime.log?.(msg),
+    // });
+    const groupAllowFrom = wecomConfig.groupAllowFrom ?? [];
+    const groupAllowed = isWeComGroupAllowed({
+        groupPolicy,
+        allowFrom: groupAllowFrom,
+        groupId: chatId,
+    });
+    if (!groupAllowed) {
+        runtime.log?.(`[WeCom] Group ${chatId} not allowed (groupPolicy=${groupPolicy})`);
+        return { allowed: false };
+    }
+    const senderAllowed = isGroupSenderAllowed({
+        senderId,
+        groupId: chatId,
+        wecomConfig,
+    });
+    if (!senderAllowed) {
+        runtime.log?.(`[WeCom] Sender ${senderId} not in group ${chatId} sender allowlist`);
+        return { allowed: false };
+    }
+    return { allowed: true };
+}
+/**
+ * 检查发送者是否在允许列表中（通用）
+ */
+function isSenderAllowed(senderId, allowFrom) {
+    if (allowFrom.includes("*")) {
+        return true;
+    }
+    return allowFrom.some((entry) => {
+        const normalized = entry.replace(new RegExp(`^${_const.CHANNEL_ID}:`, "i"), "").trim();
+        return normalized === senderId || normalized === `user:${senderId}`;
+    });
+}
+
+exports.checkGroupPolicy = checkGroupPolicy;
+exports.isSenderAllowed = isSenderAllowed;
+//# sourceMappingURL=group-policy.js.map

package/dist/cjs/src/group-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-policy.js","sources":["../../../../../src/group-policy.ts"],"sourcesContent":["/**\n * 企业微信群组访问控制模块\n *\n * 负责群组策略检查（groupPolicy、群组白名单、群内发送者白名单）\n */\n\nimport type { OpenClawConfig } from \"openclaw/plugin-sdk/core\";\nimport type { RuntimeEnv } from \"openclaw/plugin-sdk/runtime-env\";\nimport { CHANNEL_ID } from \"./const.js\";\nimport type { ResolvedWeComAccount, WeComConfig, WeComGroupConfig } from \"./utils.js\";\n\n// ============================================================================\n// 检查结果类型\n// ============================================================================\n\n/**\n * 群组策略检查结果\n */\nexport interface GroupPolicyCheckResult {\n  /** 是否允许继续处理消息 */\n  allowed: boolean;\n}\n\n// ============================================================================\n// 内部辅助函数\n// ============================================================================\n\n/**\n * 解析企业微信群组配置\n */\nfunction resolveWeComGroupConfig(params: {\n  cfg?: WeComConfig;\n  groupId?: string | null;\n}): WeComGroupConfig | undefined {\n  const groups = params.cfg?.groups ?? {};\n  const wildcard = groups[\"*\"];\n  const groupId = params.groupId?.trim();\n  if (!groupId) {\n    return undefined;\n  }\n\n  const direct = groups[groupId];\n  if (direct) {\n    return direct;\n  }\n\n  const lowered = groupId.toLowerCase();\n  const matchKey = Object.keys(groups).find((key) => key.toLowerCase() === lowered);\n  if (matchKey) {\n    return groups[matchKey];\n  }\n  return wildcard;\n}\n\n/**\n * 检查群组是否在允许列表中\n */\nfunction isWeComGroupAllowed(params: {\n  groupPolicy: \"open\" | \"allowlist\" | \"disabled\";\n  allowFrom: Array<string | number>;\n  groupId: string;\n}): boolean {\n  const { groupPolicy } = params;\n  if (groupPolicy === \"disabled\") {\n    return false;\n  }\n  if (groupPolicy === \"open\") {\n    return true;\n  }\n  // allowlist 模式：检查群组是否在允许列表中\n  const normalizedAllowFrom = params.allowFrom.map((entry) =>\n    String(entry).replace(new RegExp(`^${CHANNEL_ID}:`, \"i\"), \"\").trim()\n  );\n  if (normalizedAllowFrom.includes(\"*\")) {\n    return true;\n  }\n  const normalizedGroupId = params.groupId.trim();\n  return normalizedAllowFrom.some(\n    (entry) => entry === normalizedGroupId || entry.toLowerCase() === normalizedGroupId.toLowerCase()\n  );\n}\n\n/**\n * 检查群组内发送者是否在允许列表中\n */\nfunction isGroupSenderAllowed(params: {\n  senderId: string;\n  groupId: string;\n  wecomConfig: WeComConfig;\n}): boolean {\n  const { senderId, groupId, wecomConfig } = params;\n\n  const groupConfig = resolveWeComGroupConfig({\n    cfg: wecomConfig,\n    groupId,\n  });\n\n  const perGroupSenderAllowFrom = (groupConfig?.allowFrom ?? []).map((v) => String(v));\n\n  if (perGroupSenderAllowFrom.length === 0) {\n    return true;\n  }\n\n  if (perGroupSenderAllowFrom.includes(\"*\")) {\n    return true;\n  }\n\n  return perGroupSenderAllowFrom.some((entry) => {\n    const normalized = entry.replace(new RegExp(`^${CHANNEL_ID}:`, \"i\"), \"\").trim();\n    return normalized === senderId || normalized === `user:${senderId}`;\n  });\n}\n\n// ============================================================================\n// 公开 API\n// ============================================================================\n\n/**\n * 检查群组策略访问控制\n * @returns 检查结果，包含是否允许继续处理\n */\nexport function checkGroupPolicy(params: {\n  chatId: string;\n  senderId: string;\n  account: ResolvedWeComAccount;\n  config: OpenClawConfig;\n  runtime: RuntimeEnv;\n}): GroupPolicyCheckResult {\n  const { chatId, senderId, account, config, runtime } = params;\n  const wecomConfig = (config.channels?.[CHANNEL_ID] ?? {}) as WeComConfig;\n\n  const defaultGroupPolicy = config.channels?.[CHANNEL_ID]?.groupPolicy;\n  const groupPolicy = account.config.groupPolicy ?? defaultGroupPolicy ?? \"open\"\n  // const { groupPolicy, providerMissingFallbackApplied } = resolveOpenProviderRuntimeGroupPolicy({\n  //   providerConfigPresent: config.channels?.[CHANNEL_ID] !== undefined,\n  //   groupPolicy: wecomConfig.groupPolicy,\n  //   defaultGroupPolicy,\n  // });\n\n  // warnMissingProviderGroupPolicyFallbackOnce({\n  //   providerMissingFallbackApplied,\n  //   providerKey: CHANNEL_ID,\n  //   accountId: account.accountId,\n  //   log: (msg) => runtime.log?.(msg),\n  // });\n\n  const groupAllowFrom = wecomConfig.groupAllowFrom ?? [];\n  const groupAllowed = isWeComGroupAllowed({\n    groupPolicy,\n    allowFrom: groupAllowFrom,\n    groupId: chatId,\n  });\n\n  if (!groupAllowed) {\n    runtime.log?.(\n      `[WeCom] Group ${chatId} not allowed (groupPolicy=${groupPolicy})`,\n    );\n    return { allowed: false };\n  }\n\n  const senderAllowed = isGroupSenderAllowed({\n    senderId,\n    groupId: chatId,\n    wecomConfig,\n  });\n\n  if (!senderAllowed) {\n    runtime.log?.(\n      `[WeCom] Sender ${senderId} not in group ${chatId} sender allowlist`,\n    );\n    return { allowed: false };\n  }\n\n  return { allowed: true };\n}\n\n/**\n * 检查发送者是否在允许列表中（通用）\n */\nexport function isSenderAllowed(senderId: string, allowFrom: string[]): boolean {\n  if (allowFrom.includes(\"*\")) {\n    return true;\n  }\n  return allowFrom.some((entry) => {\n    const normalized = entry.replace(new RegExp(`^${CHANNEL_ID}:`, \"i\"), \"\").trim();\n    return normalized === senderId || normalized === `user:${senderId}`;\n  });\n}\n"],"names":["CHANNEL_ID"],"mappings":";;;;AAAA;;;;AAIG;AAmBH;AACA;AACA;AAEA;;AAEG;AACH,SAAS,uBAAuB,CAAC,MAGhC,EAAA;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE;AACvC,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE;IACtC,IAAI,CAAC,OAAO,EAAE;AACZ,QAAA,OAAO,SAAS;IAClB;AAEA,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,EAAE;AACV,QAAA,OAAO,MAAM;IACf;AAEA,IAAA,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;IACjF,IAAI,QAAQ,EAAE;AACZ,QAAA,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB;AACA,IAAA,OAAO,QAAQ;AACjB;AAEA;;AAEG;AACH,SAAS,mBAAmB,CAAC,MAI5B,EAAA;AACC,IAAA,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM;AAC9B,IAAA,IAAI,WAAW,KAAK,UAAU,EAAE;AAC9B,QAAA,OAAO,KAAK;IACd;AACA,IAAA,IAAI,WAAW,KAAK,MAAM,EAAE;AAC1B,QAAA,OAAO,IAAI;IACb;;AAEA,IAAA,MAAM,mBAAmB,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,KACrD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAA,CAAA,EAAIA,iBAAU,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CACrE;AACD,IAAA,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACrC,QAAA,OAAO,IAAI;IACb;IACA,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAC7B,CAAC,KAAK,KAAK,KAAK,KAAK,iBAAiB,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,iBAAiB,CAAC,WAAW,EAAE,CAClG;AACH;AAEA;;AAEG;AACH,SAAS,oBAAoB,CAAC,MAI7B,EAAA;IACC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM;IAEjD,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC1C,QAAA,GAAG,EAAE,WAAW;QAChB,OAAO;AACR,KAAA,CAAC;IAEF,MAAM,uBAAuB,GAAG,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;AAEpF,IAAA,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE;AACxC,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,IAAI,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AACzC,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,KAAK,KAAI;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAA,CAAA,EAAIA,iBAAU,CAAA,CAAA,CAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/E,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAE;AACrE,IAAA,CAAC,CAAC;AACJ;AAEA;AACA;AACA;AAEA;;;AAGG;AACG,SAAU,gBAAgB,CAAC,MAMhC,EAAA;AACC,IAAA,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM;AAC7D,IAAA,MAAM,WAAW,IAAI,MAAM,CAAC,QAAQ,GAAGA,iBAAU,CAAC,IAAI,EAAE,CAAgB;IAExE,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,GAAGA,iBAAU,CAAC,EAAE,WAAW;IACrE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,IAAI,kBAAkB,IAAI,MAAM;;;;;;;;;;;;AAc9E,IAAA,MAAM,cAAc,GAAG,WAAW,CAAC,cAAc,IAAI,EAAE;IACvD,MAAM,YAAY,GAAG,mBAAmB,CAAC;QACvC,WAAW;AACX,QAAA,SAAS,EAAE,cAAc;AACzB,QAAA,OAAO,EAAE,MAAM;AAChB,KAAA,CAAC;IAEF,IAAI,CAAC,YAAY,EAAE;QACjB,OAAO,CAAC,GAAG,GACT,CAAA,cAAA,EAAiB,MAAM,CAAA,0BAAA,EAA6B,WAAW,CAAA,CAAA,CAAG,CACnE;AACD,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;IAEA,MAAM,aAAa,GAAG,oBAAoB,CAAC;QACzC,QAAQ;AACR,QAAA,OAAO,EAAE,MAAM;QACf,WAAW;AACZ,KAAA,CAAC;IAEF,IAAI,CAAC,aAAa,EAAE;QAClB,OAAO,CAAC,GAAG,GACT,CAAA,eAAA,EAAkB,QAAQ,CAAA,cAAA,EAAiB,MAAM,CAAA,iBAAA,CAAmB,CACrE;AACD,QAAA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3B;AAEA,IAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;AAC1B;AAEA;;AAEG;AACG,SAAU,eAAe,CAAC,QAAgB,EAAE,SAAmB,EAAA;AACnE,IAAA,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;AAC3B,QAAA,OAAO,IAAI;IACb;AACA,IAAA,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,KAAI;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAA,CAAA,EAAIA,iBAAU,CAAA,CAAA,CAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;QAC/E,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,CAAA,KAAA,EAAQ,QAAQ,CAAA,CAAE;AACrE,IAAA,CAAC,CAAC;AACJ;;;;;"}

package/dist/cjs/src/mcp/interceptors/biz-error.js

@@ -0,0 +1,70 @@
+'use strict';
+
+var transport = require('../transport.js');
+
+/**
+ * 业务错误码检查拦截器
+ *
+ * 检查 tools/call 返回结果中是否包含需要清理缓存的业务错误码。
+ * MCP Server 可能在正常的 JSON-RPC 响应中返回业务层错误，
+ * 这些错误被包裹在 result.content[].text 中，需要解析后判断。
+ *
+ * 此拦截器对所有 call 调用生效。
+ */
+// ============================================================================
+// 常量
+// ============================================================================
+/**
+ * 需要触发缓存清理的业务错误码集合
+ *
+ * 这些错误码出现在 MCP 工具调用返回的 content 文本中（业务层面），
+ * 与 JSON-RPC 层面的错误码不同，需要在此处额外检测。
+ *
+ * - 850002: 机器人未被授权使用对应能力，需清理缓存以便下次重新拉取配置
+ */
+const BIZ_CACHE_CLEAR_ERROR_CODES = new Set([850002]);
+// ============================================================================
+// 拦截器实现
+// ============================================================================
+const bizErrorInterceptor = {
+    name: "biz-error",
+    /** 对所有 call 调用生效 */
+    match: () => true,
+    /** 检查返回结果中的业务错误码，必要时清理缓存 */
+    afterCall(ctx, result) {
+        checkBizErrorAndClearCache(result, ctx.category);
+        // 不修改 result，透传给下一个拦截器
+        return result;
+    },
+};
+// ============================================================================
+// 内部实现
+// ============================================================================
+/**
+ * 检查 tools/call 的返回结果中是否包含需要清理缓存的业务错误码
+ */
+function checkBizErrorAndClearCache(result, category) {
+    if (!result || typeof result !== "object")
+        return;
+    const { content } = result;
+    if (!Array.isArray(content))
+        return;
+    for (const item of content) {
+        if (item.type !== "text" || !item.text)
+            continue;
+        try {
+            const parsed = JSON.parse(item.text);
+            if (typeof parsed.errcode === "number" && BIZ_CACHE_CLEAR_ERROR_CODES.has(parsed.errcode)) {
+                console.log(`[mcp] 检测到业务错误码 ${parsed.errcode} (category="${category}")，清理缓存`);
+                transport.clearCategoryCache(category);
+                return;
+            }
+        }
+        catch {
+            // text 不是 JSON 格式，跳过
+        }
+    }
+}
+
+exports.bizErrorInterceptor = bizErrorInterceptor;
+//# sourceMappingURL=biz-error.js.map

package/dist/cjs/src/mcp/interceptors/biz-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biz-error.js","sources":["../../../../../../../src/mcp/interceptors/biz-error.ts"],"sourcesContent":["/**\n * 业务错误码检查拦截器\n *\n * 检查 tools/call 返回结果中是否包含需要清理缓存的业务错误码。\n * MCP Server 可能在正常的 JSON-RPC 响应中返回业务层错误，\n * 这些错误被包裹在 result.content[].text 中，需要解析后判断。\n *\n * 此拦截器对所有 call 调用生效。\n */\n\nimport { clearCategoryCache } from \"../transport.js\";\nimport type { CallInterceptor, CallContext } from \"./types.js\";\n\n// ============================================================================\n// 常量\n// ============================================================================\n\n/**\n * 需要触发缓存清理的业务错误码集合\n *\n * 这些错误码出现在 MCP 工具调用返回的 content 文本中（业务层面），\n * 与 JSON-RPC 层面的错误码不同，需要在此处额外检测。\n *\n * - 850002: 机器人未被授权使用对应能力，需清理缓存以便下次重新拉取配置\n */\nconst BIZ_CACHE_CLEAR_ERROR_CODES = new Set([850002]);\n\n// ============================================================================\n// 拦截器实现\n// ============================================================================\n\nexport const bizErrorInterceptor: CallInterceptor = {\n  name: \"biz-error\",\n\n  /** 对所有 call 调用生效 */\n  match: () => true,\n\n  /** 检查返回结果中的业务错误码，必要时清理缓存 */\n  afterCall(ctx: CallContext, result: unknown): unknown {\n    checkBizErrorAndClearCache(result, ctx.category);\n    // 不修改 result，透传给下一个拦截器\n    return result;\n  },\n};\n\n// ============================================================================\n// 内部实现\n// ============================================================================\n\n/**\n * 检查 tools/call 的返回结果中是否包含需要清理缓存的业务错误码\n */\nfunction checkBizErrorAndClearCache(result: unknown, category: string): void {\n  if (!result || typeof result !== \"object\") return;\n\n  const { content } = result as { content?: Array<{ type: string; text?: string }> };\n  if (!Array.isArray(content)) return;\n\n  for (const item of content) {\n    if (item.type !== \"text\" || !item.text) continue;\n    try {\n      const parsed = JSON.parse(item.text) as Record<string, unknown>;\n      if (typeof parsed.errcode === \"number\" && BIZ_CACHE_CLEAR_ERROR_CODES.has(parsed.errcode)) {\n        console.log(`[mcp] 检测到业务错误码 ${parsed.errcode} (category=\"${category}\")，清理缓存`);\n        clearCategoryCache(category);\n        return;\n      }\n    } catch {\n      // text 不是 JSON 格式，跳过\n    }\n  }\n}\n"],"names":["clearCategoryCache"],"mappings":";;;;AAAA;;;;;;;;AAQG;AAKH;AACA;AACA;AAEA;;;;;;;AAOG;AACH,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD;AACA;AACA;AAEO,MAAM,mBAAmB,GAAoB;AAClD,IAAA,IAAI,EAAE,WAAW;;AAGjB,IAAA,KAAK,EAAE,MAAM,IAAI;;IAGjB,SAAS,CAAC,GAAgB,EAAE,MAAe,EAAA;AACzC,QAAA,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;;AAEhD,QAAA,OAAO,MAAM;IACf,CAAC;;AAGH;AACA;AACA;AAEA;;AAEG;AACH,SAAS,0BAA0B,CAAC,MAAe,EAAE,QAAgB,EAAA;AACnE,IAAA,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE;AAE3C,IAAA,MAAM,EAAE,OAAO,EAAE,GAAG,MAA8D;AAClF,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE;AAE7B,IAAA,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE;AACxC,QAAA,IAAI;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAA4B;AAC/D,YAAA,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;gBACzF,OAAO,CAAC,GAAG,CAAC,CAAA,eAAA,EAAkB,MAAM,CAAC,OAAO,CAAA,YAAA,EAAe,QAAQ,CAAA,OAAA,CAAS,CAAC;gBAC7EA,4BAAkB,CAAC,QAAQ,CAAC;gBAC5B;YACF;QACF;AAAE,QAAA,MAAM;;QAER;IACF;AACF;;;;"}

package/dist/cjs/src/mcp/interceptors/index.js

@@ -0,0 +1,73 @@
+'use strict';
+
+var bizError = require('./biz-error.js');
+var msgMedia = require('./msg-media.js');
+var smartpageCreate = require('./smartpage-create.js');
+var smartpageExport = require('./smartpage-export.js');
+
+/**
+ * MCP call 拦截器注册表与调度入口
+ *
+ * 所有 call 拦截器在此注册，按注册顺序执行。
+ * 新增拦截器只需：
+ *   1. 在 interceptors/ 目录下新建文件，实现 CallInterceptor 接口
+ *   2. 在下方 interceptors 数组中注册
+ *
+ * tool.ts 的 handleCall 无需任何改动。
+ */
+// ============================================================================
+// 拦截器注册表（按注册顺序执行）
+// ============================================================================
+const interceptors = [
+    bizError.bizErrorInterceptor, // 业务错误码检查（所有 call 生效）
+    msgMedia.mediaInterceptor, // get_msg_media base64 拦截
+    smartpageCreate.smartpageCreateInterceptor, // smartpage_create 本地文件读取
+    smartpageExport.smartpageExportInterceptor, // smartpage_get_export_result content → 本地文件
+];
+/**
+ * 收集匹配的 beforeCall 配置，合并后返回
+ *
+ * 合并策略：
+ * - timeoutMs: 取所有拦截器返回值中的最大值
+ * - args: 后注册的拦截器覆盖前者（一般同一调用只有一个拦截器会返回 args）
+ */
+async function resolveBeforeCall(ctx) {
+    let mergedTimeoutMs;
+    let mergedArgs;
+    for (const interceptor of interceptors) {
+        if (!interceptor.match(ctx) || !interceptor.beforeCall)
+            continue;
+        const opts = await interceptor.beforeCall(ctx);
+        if (opts?.timeoutMs !== undefined) {
+            mergedTimeoutMs = mergedTimeoutMs === undefined
+                ? opts.timeoutMs
+                : Math.max(mergedTimeoutMs, opts.timeoutMs);
+        }
+        if (opts?.args !== undefined) {
+            mergedArgs = opts.args;
+        }
+    }
+    return {
+        options: mergedTimeoutMs !== undefined ? { timeoutMs: mergedTimeoutMs } : undefined,
+        args: mergedArgs,
+    };
+}
+/**
+ * 依次执行匹配的 afterCall 拦截器，管道式传递 result
+ *
+ * 前一个拦截器的返回值作为下一个拦截器的输入。
+ * 拦截器若不需要修改 result，应原样返回。
+ */
+async function runAfterCall(ctx, result) {
+    let current = result;
+    for (const interceptor of interceptors) {
+        if (!interceptor.match(ctx) || !interceptor.afterCall)
+            continue;
+        current = await interceptor.afterCall(ctx, current);
+    }
+    return current;
+}
+
+exports.resolveBeforeCall = resolveBeforeCall;
+exports.runAfterCall = runAfterCall;
+//# sourceMappingURL=index.js.map

package/dist/cjs/src/mcp/interceptors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../../../../src/mcp/interceptors/index.ts"],"sourcesContent":["/**\n * MCP call 拦截器注册表与调度入口\n *\n * 所有 call 拦截器在此注册，按注册顺序执行。\n * 新增拦截器只需：\n *   1. 在 interceptors/ 目录下新建文件，实现 CallInterceptor 接口\n *   2. 在下方 interceptors 数组中注册\n *\n * tool.ts 的 handleCall 无需任何改动。\n */\n\nimport { bizErrorInterceptor } from \"./biz-error.js\";\nimport { mediaInterceptor } from \"./msg-media.js\";\nimport { smartpageCreateInterceptor } from \"./smartpage-create.js\";\nimport { smartpageExportInterceptor } from \"./smartpage-export.js\";\nimport type { CallContext, CallInterceptor, BeforeCallOptions } from \"./types.js\";\nimport type { SendJsonRpcOptions } from \"../transport.js\";\n\nexport type { CallContext, CallInterceptor, BeforeCallOptions } from \"./types.js\";\n\n// ============================================================================\n// 拦截器注册表（按注册顺序执行）\n// ============================================================================\n\nconst interceptors: CallInterceptor[] = [\n  bizErrorInterceptor,         // 业务错误码检查（所有 call 生效）\n  mediaInterceptor,            // get_msg_media base64 拦截\n  smartpageCreateInterceptor,  // smartpage_create 本地文件读取\n  smartpageExportInterceptor,  // smartpage_get_export_result content → 本地文件\n];\n\n// ============================================================================\n// 调度 API\n// ============================================================================\n\n/** resolveBeforeCall 的返回值 */\nexport interface ResolvedBeforeCall {\n  /** 合并后的 sendJsonRpc 选项（如超时时间） */\n  options?: SendJsonRpcOptions;\n  /** 替换后的 args（如从本地文件读取的请求体） */\n  args?: Record<string, unknown>;\n}\n\n/**\n * 收集匹配的 beforeCall 配置，合并后返回\n *\n * 合并策略：\n * - timeoutMs: 取所有拦截器返回值中的最大值\n * - args: 后注册的拦截器覆盖前者（一般同一调用只有一个拦截器会返回 args）\n */\nexport async function resolveBeforeCall(ctx: CallContext): Promise<ResolvedBeforeCall> {\n  let mergedTimeoutMs: number | undefined;\n  let mergedArgs: Record<string, unknown> | undefined;\n\n  for (const interceptor of interceptors) {\n    if (!interceptor.match(ctx) || !interceptor.beforeCall) continue;\n\n    const opts = await interceptor.beforeCall(ctx);\n    if (opts?.timeoutMs !== undefined) {\n      mergedTimeoutMs = mergedTimeoutMs === undefined\n        ? opts.timeoutMs\n        : Math.max(mergedTimeoutMs, opts.timeoutMs);\n    }\n    if (opts?.args !== undefined) {\n      mergedArgs = opts.args;\n    }\n  }\n\n  return {\n    options: mergedTimeoutMs !== undefined ? { timeoutMs: mergedTimeoutMs } : undefined,\n    args: mergedArgs,\n  };\n}\n\n/**\n * 依次执行匹配的 afterCall 拦截器，管道式传递 result\n *\n * 前一个拦截器的返回值作为下一个拦截器的输入。\n * 拦截器若不需要修改 result，应原样返回。\n */\nexport async function runAfterCall(ctx: CallContext, result: unknown): Promise<unknown> {\n  let current = result;\n\n  for (const interceptor of interceptors) {\n    if (!interceptor.match(ctx) || !interceptor.afterCall) continue;\n    current = await interceptor.afterCall(ctx, current);\n  }\n\n  return current;\n}\n"],"names":["bizErrorInterceptor","mediaInterceptor","smartpageCreateInterceptor","smartpageExportInterceptor"],"mappings":";;;;;;;AAAA;;;;;;;;;AASG;AAWH;AACA;AACA;AAEA,MAAM,YAAY,GAAsB;AACtC,IAAAA,4BAAmB;AACnB,IAAAC,yBAAgB;AAChB,IAAAC,0CAA0B;AAC1B,IAAAC,0CAA0B;CAC3B;AAcD;;;;;;AAMG;AACI,eAAe,iBAAiB,CAAC,GAAgB,EAAA;AACtD,IAAA,IAAI,eAAmC;AACvC,IAAA,IAAI,UAA+C;AAEnD,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU;YAAE;QAExD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;AAC9C,QAAA,IAAI,IAAI,EAAE,SAAS,KAAK,SAAS,EAAE;YACjC,eAAe,GAAG,eAAe,KAAK;kBAClC,IAAI,CAAC;kBACL,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC;QAC/C;AACA,QAAA,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE;AAC5B,YAAA,UAAU,GAAG,IAAI,CAAC,IAAI;QACxB;IACF;IAEA,OAAO;AACL,QAAA,OAAO,EAAE,eAAe,KAAK,SAAS,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,SAAS;AACnF,QAAA,IAAI,EAAE,UAAU;KACjB;AACH;AAEA;;;;;AAKG;AACI,eAAe,YAAY,CAAC,GAAgB,EAAE,MAAe,EAAA;IAClE,IAAI,OAAO,GAAG,MAAM;AAEpB,IAAA,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE;QACtC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS;YAAE;QACvD,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC;IACrD;AAEA,IAAA,OAAO,OAAO;AAChB;;;;;"}

package/dist/cjs/src/mcp/interceptors/msg-media.js

@@ -0,0 +1,159 @@
+'use strict';
+
+var fs = require('node:fs/promises');
+var path = require('node:path');
+var transport = require('../transport.js');
+var runtime = require('../../runtime.js');
+var openclawCompat = require('../../openclaw-compat.js');
+
+function _interopNamespaceDefault(e) {
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n.default = e;
+    return Object.freeze(n);
+}
+
+var fs__namespace = /*#__PURE__*/_interopNamespaceDefault(fs);
+var path__namespace = /*#__PURE__*/_interopNamespaceDefault(path);
+
+/**
+ * get_msg_media 响应拦截器
+ *
+ * 核心逻辑：
+ * 1. beforeCall: 设置延长的超时时间（120s），因为 base64 数据可达 ~27MB
+ * 2. afterCall: 从 MCP result 的 content[].text 中提取 base64_data，
+ *    解码为 Buffer 并通过 saveMediaBuffer 保存到本地媒体目录，
+ *    替换响应中的 base64_data 为 local_path，避免大模型被 base64 数据消耗 token
+ */
+// ============================================================================
+// 拦截器实现
+// ============================================================================
+const mediaInterceptor = {
+    name: "media",
+    /** 仅对 get_msg_media 方法生效 */
+    match: (ctx) => ctx.method === "get_msg_media",
+    /** 设置延长的超时时间 */
+    beforeCall() {
+        return { timeoutMs: transport.MEDIA_DOWNLOAD_TIMEOUT_MS };
+    },
+    /** 拦截响应：base64 → 本地文件 */
+    async afterCall(ctx, result) {
+        return interceptMediaResponse(result);
+    },
+};
+// ============================================================================
+// 内部实现
+// ============================================================================
+/**
+ * 拦截 get_msg_media 的 MCP 响应
+ *
+ * 1. 从 MCP result 的 content[].text 中提取业务 JSON
+ * 2. 提取 media_item.base64_data，解码为 Buffer
+ * 3. 通过 openclaw SDK 的 saveMediaBuffer 保存到本地媒体目录
+ * 4. 替换响应：移除 base64_data，加入 local_path
+ *
+ * 这样大模型只看到轻量的文件路径信息，不会被 base64 数据消耗 token。
+ */
+async function interceptMediaResponse(result) {
+    const t0 = performance.now();
+    // 1. 提取 MCP result 中的 content 数组
+    const content = result?.content;
+    if (!Array.isArray(content))
+        return result;
+    const textItem = content.find((c) => c.type === "text" && typeof c.text === "string");
+    if (!textItem)
+        return result;
+    // 2. 解析业务 JSON
+    let bizData;
+    try {
+        bizData = JSON.parse(textItem.text);
+    }
+    catch {
+        // 非 JSON 格式，原样返回
+        return result;
+    }
+    // 3. 校验业务响应：errcode !== 0 或无 media_item 时原样返回
+    if (bizData.errcode !== 0)
+        return result;
+    const mediaItem = bizData.media_item;
+    if (!mediaItem || typeof mediaItem.base64_data !== "string")
+        return result;
+    const base64Data = mediaItem.base64_data;
+    const mediaName = mediaItem.name;
+    const mediaType = mediaItem.type;
+    const mediaId = mediaItem.media_id;
+    const tParsed = performance.now();
+    // 4. 解码 base64 → Buffer
+    const buffer = Buffer.from(base64Data, "base64");
+    const tDecoded = performance.now();
+    // 5. 检测 contentType，并通过 saveMediaBuffer 保存到本地媒体目录
+    const contentType = await openclawCompat.detectMime({ buffer, filePath: mediaName }) ?? "application/octet-stream";
+    const tMimeDetected = performance.now();
+    // 企业微信聊天记录附件可达 20MB（文件消息上限），
+    // 而 saveMediaBuffer 默认 maxBytes 为 5MB（针对 outbound 场景），
+    // 此处显式放宽到 20MB 以支持大文件下载。
+    const INBOUND_MAX_BYTES = 20 * 1024 * 1024; // 20MB
+    const core = runtime.getWeComRuntime();
+    const saved = await core.channel.media.saveMediaBuffer(buffer, contentType, "inbound", INBOUND_MAX_BYTES, // maxBytes: 放宽到 20MB，匹配企业微信文件消息上限
+    mediaName);
+    // 5.1 补偿：核心库 EXT_BY_MIME 可能缺少某些格式映射（如 audio/amr），
+    //     导致保存的文件没有后缀。此处检测并修复。
+    const MIME_EXT_PATCH = {
+        "audio/amr": ".amr",
+    };
+    const patchExt = MIME_EXT_PATCH[contentType];
+    if (patchExt && !path__namespace.extname(saved.path)) {
+        const newPath = saved.path + patchExt;
+        try {
+            await fs__namespace.rename(saved.path, newPath);
+            saved.path = newPath;
+        }
+        catch {
+            // rename 失败不影响主流程，文件仍可用
+        }
+    }
+    const tSaved = performance.now();
+    // 6. 构造精简响应，移除 base64_data，加入本地路径
+    const newBizData = {
+        errcode: 0,
+        errmsg: "ok",
+        media_item: {
+            media_id: mediaId,
+            name: mediaName ?? saved.path.split("/").pop(),
+            type: mediaType,
+            local_path: saved.path,
+            size: buffer.length,
+            content_type: saved.contentType,
+        },
+    };
+    const tEnd = performance.now();
+    // 耗时日志：各环节耗时（ms）
+    console.log(`[mcp] get_msg_media 拦截成功: media_id=${mediaId ?? "unknown"}, ` +
+        `type=${mediaType ?? "unknown"}, size=${buffer.length}, saved=${saved.path}\n` +
+        `  ⏱ 耗时明细 (总 ${(tEnd - t0).toFixed(1)}ms):\n` +
+        `    解析响应 JSON:   ${(tParsed - t0).toFixed(1)}ms\n` +
+        `    base64 解码:     ${(tDecoded - tParsed).toFixed(1)}ms  (${(base64Data.length / 1024).toFixed(0)}KB base64 → ${(buffer.length / 1024).toFixed(0)}KB buffer)\n` +
+        `    MIME 检测:       ${(tMimeDetected - tDecoded).toFixed(1)}ms  (${contentType})\n` +
+        `    saveMediaBuffer: ${(tSaved - tMimeDetected).toFixed(1)}ms\n` +
+        `    构造响应:        ${(tEnd - tSaved).toFixed(1)}ms`);
+    // 7. 返回修改后的 MCP result 结构
+    return {
+        content: [{
+                type: "text",
+                text: JSON.stringify(newBizData),
+            }],
+    };
+}
+
+exports.mediaInterceptor = mediaInterceptor;
+//# sourceMappingURL=msg-media.js.map

package/dist/cjs/src/mcp/interceptors/msg-media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msg-media.js","sources":["../../../../../../../src/mcp/interceptors/msg-media.ts"],"sourcesContent":["/**\n * get_msg_media 响应拦截器\n *\n * 核心逻辑：\n * 1. beforeCall: 设置延长的超时时间（120s），因为 base64 数据可达 ~27MB\n * 2. afterCall: 从 MCP result 的 content[].text 中提取 base64_data，\n *    解码为 Buffer 并通过 saveMediaBuffer 保存到本地媒体目录，\n *    替换响应中的 base64_data 为 local_path，避免大模型被 base64 数据消耗 token\n */\n\nimport * as fs from \"node:fs/promises\";\nimport * as path from \"node:path\";\nimport { MEDIA_DOWNLOAD_TIMEOUT_MS } from \"../transport.js\";\nimport { getWeComRuntime } from \"../../runtime.js\";\nimport { detectMime } from \"../../openclaw-compat.js\";\nimport type { CallInterceptor, CallContext } from \"./types.js\";\n\n// ============================================================================\n// 拦截器实现\n// ============================================================================\n\nexport const mediaInterceptor: CallInterceptor = {\n  name: \"media\",\n\n  /** 仅对 get_msg_media 方法生效 */\n  match: (ctx: CallContext) => ctx.method === \"get_msg_media\",\n\n  /** 设置延长的超时时间 */\n  beforeCall() {\n    return { timeoutMs: MEDIA_DOWNLOAD_TIMEOUT_MS };\n  },\n\n  /** 拦截响应：base64 → 本地文件 */\n  async afterCall(ctx: CallContext, result: unknown): Promise<unknown> {\n    return interceptMediaResponse(result);\n  },\n};\n\n// ============================================================================\n// 内部实现\n// ============================================================================\n\n/**\n * 拦截 get_msg_media 的 MCP 响应\n *\n * 1. 从 MCP result 的 content[].text 中提取业务 JSON\n * 2. 提取 media_item.base64_data，解码为 Buffer\n * 3. 通过 openclaw SDK 的 saveMediaBuffer 保存到本地媒体目录\n * 4. 替换响应：移除 base64_data，加入 local_path\n *\n * 这样大模型只看到轻量的文件路径信息，不会被 base64 数据消耗 token。\n */\nasync function interceptMediaResponse(result: unknown): Promise<unknown> {\n  const t0 = performance.now();\n\n  // 1. 提取 MCP result 中的 content 数组\n  const content = (result as Record<string, unknown>)?.content;\n  if (!Array.isArray(content)) return result;\n\n  const textItem = content.find(\n    (c: Record<string, unknown>) => c.type === \"text\" && typeof c.text === \"string\",\n  ) as { type: string; text: string } | undefined;\n  if (!textItem) return result;\n\n  // 2. 解析业务 JSON\n  let bizData: Record<string, unknown>;\n  try {\n    bizData = JSON.parse(textItem.text) as Record<string, unknown>;\n  } catch {\n    // 非 JSON 格式，原样返回\n    return result;\n  }\n\n  // 3. 校验业务响应：errcode !== 0 或无 media_item 时原样返回\n  if (bizData.errcode !== 0) return result;\n\n  const mediaItem = bizData.media_item as Record<string, unknown> | undefined;\n  if (!mediaItem || typeof mediaItem.base64_data !== \"string\") return result;\n\n  const base64Data = mediaItem.base64_data as string;\n  const mediaName = mediaItem.name as string | undefined;\n  const mediaType = mediaItem.type as string | undefined;\n  const mediaId = mediaItem.media_id as string | undefined;\n\n  const tParsed = performance.now();\n\n  // 4. 解码 base64 → Buffer\n  const buffer = Buffer.from(base64Data, \"base64\");\n  const tDecoded = performance.now();\n\n  // 5. 检测 contentType，并通过 saveMediaBuffer 保存到本地媒体目录\n  const contentType = await detectMime({ buffer, filePath: mediaName }) ?? \"application/octet-stream\";\n  const tMimeDetected = performance.now();\n\n  // 企业微信聊天记录附件可达 20MB（文件消息上限），\n  // 而 saveMediaBuffer 默认 maxBytes 为 5MB（针对 outbound 场景），\n  // 此处显式放宽到 20MB 以支持大文件下载。\n  const INBOUND_MAX_BYTES = 20 * 1024 * 1024; // 20MB\n\n  const core = getWeComRuntime();\n  const saved = await core.channel.media.saveMediaBuffer(\n    buffer,\n    contentType,\n    \"inbound\",\n    INBOUND_MAX_BYTES,   // maxBytes: 放宽到 20MB，匹配企业微信文件消息上限\n    mediaName,           // originalFilename: 保留原始文件名\n  );\n\n  // 5.1 补偿：核心库 EXT_BY_MIME 可能缺少某些格式映射（如 audio/amr），\n  //     导致保存的文件没有后缀。此处检测并修复。\n  const MIME_EXT_PATCH: Record<string, string> = {\n    \"audio/amr\": \".amr\",\n  };\n  const patchExt = MIME_EXT_PATCH[contentType];\n  if (patchExt && !path.extname(saved.path)) {\n    const newPath = saved.path + patchExt;\n    try {\n      await fs.rename(saved.path, newPath);\n      saved.path = newPath;\n    } catch {\n      // rename 失败不影响主流程，文件仍可用\n    }\n  }\n\n  const tSaved = performance.now();\n\n  // 6. 构造精简响应，移除 base64_data，加入本地路径\n  const newBizData = {\n    errcode: 0,\n    errmsg: \"ok\",\n    media_item: {\n      media_id: mediaId,\n      name: mediaName ?? saved.path.split(\"/\").pop(),\n      type: mediaType,\n      local_path: saved.path,\n      size: buffer.length,\n      content_type: saved.contentType,\n    },\n  };\n\n  const tEnd = performance.now();\n\n  // 耗时日志：各环节耗时（ms）\n  console.log(\n    `[mcp] get_msg_media 拦截成功: media_id=${mediaId ?? \"unknown\"}, ` +\n    `type=${mediaType ?? \"unknown\"}, size=${buffer.length}, saved=${saved.path}\\n` +\n    `  ⏱ 耗时明细 (总 ${(tEnd - t0).toFixed(1)}ms):\\n` +\n    `    解析响应 JSON:   ${(tParsed - t0).toFixed(1)}ms\\n` +\n    `    base64 解码:     ${(tDecoded - tParsed).toFixed(1)}ms  (${(base64Data.length / 1024).toFixed(0)}KB base64 → ${(buffer.length / 1024).toFixed(0)}KB buffer)\\n` +\n    `    MIME 检测:       ${(tMimeDetected - tDecoded).toFixed(1)}ms  (${contentType})\\n` +\n    `    saveMediaBuffer: ${(tSaved - tMimeDetected).toFixed(1)}ms\\n` +\n    `    构造响应:        ${(tEnd - tSaved).toFixed(1)}ms`,\n  );\n\n  // 7. 返回修改后的 MCP result 结构\n  return {\n    content: [{\n      type: \"text\" as const,\n      text: JSON.stringify(newBizData),\n    }],\n  };\n}\n"],"names":["MEDIA_DOWNLOAD_TIMEOUT_MS","detectMime","getWeComRuntime","path","fs"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;AAQG;AASH;AACA;AACA;AAEO,MAAM,gBAAgB,GAAoB;AAC/C,IAAA,IAAI,EAAE,OAAO;;IAGb,KAAK,EAAE,CAAC,GAAgB,KAAK,GAAG,CAAC,MAAM,KAAK,eAAe;;IAG3D,UAAU,GAAA;AACR,QAAA,OAAO,EAAE,SAAS,EAAEA,mCAAyB,EAAE;IACjD,CAAC;;AAGD,IAAA,MAAM,SAAS,CAAC,GAAgB,EAAE,MAAe,EAAA;AAC/C,QAAA,OAAO,sBAAsB,CAAC,MAAM,CAAC;IACvC,CAAC;;AAGH;AACA;AACA;AAEA;;;;;;;;;AASG;AACH,eAAe,sBAAsB,CAAC,MAAe,EAAA;AACnD,IAAA,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE;;AAG5B,IAAA,MAAM,OAAO,GAAI,MAAkC,EAAE,OAAO;AAC5D,IAAA,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;AAAE,QAAA,OAAO,MAAM;IAE1C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAC3B,CAAC,CAA0B,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAClC;AAC/C,IAAA,IAAI,CAAC,QAAQ;AAAE,QAAA,OAAO,MAAM;;AAG5B,IAAA,IAAI,OAAgC;AACpC,IAAA,IAAI;QACF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAA4B;IAChE;AAAE,IAAA,MAAM;;AAEN,QAAA,OAAO,MAAM;IACf;;AAGA,IAAA,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC;AAAE,QAAA,OAAO,MAAM;AAExC,IAAA,MAAM,SAAS,GAAG,OAAO,CAAC,UAAiD;IAC3E,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ;AAAE,QAAA,OAAO,MAAM;AAE1E,IAAA,MAAM,UAAU,GAAG,SAAS,CAAC,WAAqB;AAClD,IAAA,MAAM,SAAS,GAAG,SAAS,CAAC,IAA0B;AACtD,IAAA,MAAM,SAAS,GAAG,SAAS,CAAC,IAA0B;AACtD,IAAA,MAAM,OAAO,GAAG,SAAS,CAAC,QAA8B;AAExD,IAAA,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;;IAGjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;AAChD,IAAA,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;;AAGlC,IAAA,MAAM,WAAW,GAAG,MAAMC,yBAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,IAAI,0BAA0B;AACnG,IAAA,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;;;;IAKvC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,IAAA,MAAM,IAAI,GAAGC,uBAAe,EAAE;AAC9B,IAAA,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CACpD,MAAM,EACN,WAAW,EACX,SAAS,EACT,iBAAiB;AACjB,IAAA,SAAS,CACV;;;AAID,IAAA,MAAM,cAAc,GAA2B;AAC7C,QAAA,WAAW,EAAE,MAAM;KACpB;AACD,IAAA,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC;AAC5C,IAAA,IAAI,QAAQ,IAAI,CAACC,eAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;AACzC,QAAA,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,QAAQ;AACrC,QAAA,IAAI;YACF,MAAMC,aAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;AACpC,YAAA,KAAK,CAAC,IAAI,GAAG,OAAO;QACtB;AAAE,QAAA,MAAM;;QAER;IACF;AAEA,IAAA,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;;AAGhC,IAAA,MAAM,UAAU,GAAG;AACjB,QAAA,OAAO,EAAE,CAAC;AACV,QAAA,MAAM,EAAE,IAAI;AACZ,QAAA,UAAU,EAAE;AACV,YAAA,QAAQ,EAAE,OAAO;AACjB,YAAA,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;AAC9C,YAAA,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,YAAY,EAAE,KAAK,CAAC,WAAW;AAChC,SAAA;KACF;AAED,IAAA,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE;;AAG9B,IAAA,OAAO,CAAC,GAAG,CACT,sCAAsC,OAAO,IAAI,SAAS,CAAA,EAAA,CAAI;QAC9D,CAAA,KAAA,EAAQ,SAAS,IAAI,SAAS,CAAA,OAAA,EAAU,MAAM,CAAC,MAAM,CAAA,QAAA,EAAW,KAAK,CAAC,IAAI,CAAA,EAAA,CAAI;QAC9E,CAAA,YAAA,EAAe,CAAC,IAAI,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,MAAA,CAAQ;QAC7C,CAAA,iBAAA,EAAoB,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,IAAA,CAAM;AACnD,QAAA,CAAA,mBAAA,EAAsB,CAAC,QAAQ,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,YAAA,EAAe,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,YAAA,CAAc;AAChK,QAAA,CAAA,mBAAA,EAAsB,CAAC,aAAa,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,KAAA,EAAQ,WAAW,CAAA,GAAA,CAAK;QACnF,CAAA,qBAAA,EAAwB,CAAC,MAAM,GAAG,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,IAAA,CAAM;AACjE,QAAA,CAAA,iBAAA,EAAoB,CAAC,IAAI,GAAG,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA,EAAA,CAAI,CACnD;;IAGD,OAAO;AACL,QAAA,OAAO,EAAE,CAAC;AACR,gBAAA,IAAI,EAAE,MAAe;AACrB,gBAAA,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;aACjC,CAAC;KACH;AACH;;;;"}