@workclaw/openclaw-workchat 1.0.4 → 1.1.0

package/index.js

@@ -46,7 +46,8 @@ var init_types = __esm({
     DEFAULT_WS_URL = "wss://workbrain.cn/backend-api/open-apis/connect";
     WorkChatMsgType = {
       Text: "1",
-      Rich: "26"
+      Image: "2",
+      Audio: "110"
     };
     RequestDefaults = {
       TimeoutMs: 3e4
@@ -279,7 +280,8 @@ __export(accounts_exports, {
   listIndexedWorkChatAccountIds: () => listIndexedWorkChatAccountIds,
   listWorkChatAccountIds: () => listWorkChatAccountIds,
   loadWorkChatAccount: () => loadWorkChatAccount,
-  pruneStaleWorkChatAccounts: () => pruneStaleWorkChatAccounts,
+  migrateLegacyDefaultWorkChatAccount: () => migrateLegacyDefaultWorkChatAccount,
+  pruneOtherWorkChatAccounts: () => pruneOtherWorkChatAccounts,
   registerWorkChatAccountId: () => registerWorkChatAccountId,
   removeWorkChatAccountBinding: () => removeWorkChatAccountBinding,
   resolveWorkChatAccount: () => resolveWorkChatAccount,
@@ -296,6 +298,9 @@ function resolveAccountIndexPath() {
   return path4.join(resolveWorkChatStateDir(), "accounts.json");
 }
 function listIndexedWorkChatAccountIds() {
+  return readAccountIndex();
+}
+function readAccountIndex() {
   const filePath = resolveAccountIndexPath();
   try {
     if (!fs3.existsSync(filePath)) return [];
@@ -306,19 +311,23 @@ function listIndexedWorkChatAccountIds() {
     return [];
   }
 }
-function registerWorkChatAccountId(accountId) {
-  const dir = resolveWorkChatStateDir();
-  fs3.mkdirSync(dir, { recursive: true });
-  const existing = listIndexedWorkChatAccountIds();
-  if (existing.includes(accountId)) return;
-  fs3.writeFileSync(resolveAccountIndexPath(), JSON.stringify([...existing, accountId], null, 2), "utf-8");
+async function updateAccountIndex(mutator) {
+  const run = indexUpdateChain.then(() => {
+    const filePath = resolveAccountIndexPath();
+    fs3.mkdirSync(path4.dirname(filePath), { recursive: true });
+    const updated = mutator(readAccountIndex());
+    fs3.writeFileSync(filePath, JSON.stringify(updated, null, 2), "utf-8");
+  });
+  indexUpdateChain = run.then(() => void 0, () => void 0);
+  await run;
 }
-function unregisterWorkChatAccountId(accountId) {
-  const existing = listIndexedWorkChatAccountIds();
-  const updated = existing.filter((id) => id !== accountId);
-  if (updated.length !== existing.length) {
-    fs3.writeFileSync(resolveAccountIndexPath(), JSON.stringify(updated, null, 2), "utf-8");
-  }
+async function registerWorkChatAccountId(accountId) {
+  await updateAccountIndex(
+    (ids) => ids.includes(accountId) ? ids : [...ids, accountId]
+  );
+}
+async function unregisterWorkChatAccountId(accountId) {
+  await updateAccountIndex((ids) => ids.filter((id) => id !== accountId));
 }
 function resolveAccountsDir() {
   return path4.join(resolveWorkChatStateDir(), "accounts");
@@ -355,14 +364,14 @@ function saveWorkChatAccount(accountId, update) {
   } catch {
   }
 }
-function clearWorkChatAccount(accountId) {
+async function clearWorkChatAccount(accountId) {
   const filePath = resolveAccountPath(accountId);
   try {
     if (fs3.existsSync(filePath)) fs3.unlinkSync(filePath);
   } catch (err) {
     logger.warn(`clearWorkChatAccount: failed to remove ${filePath}: ${String(err)}`);
   }
-  unregisterWorkChatAccountId(accountId);
+  await unregisterWorkChatAccountId(accountId);
 }
 async function removeWorkChatAccountBinding(accountId) {
   clearWorkChatAccount(accountId);
@@ -378,21 +387,57 @@ async function removeWorkChatAccountBinding(accountId) {
     logger.warn(`removeWorkChatAccountBinding: channel reload trigger failed: ${String(err)}`);
   }
 }
-async function pruneStaleWorkChatAccounts(keepAgentId) {
+async function pruneOtherWorkChatAccounts(keepAccountId) {
+  const keep = keepAccountId.trim();
   const removed = [];
   for (const accountId of listIndexedWorkChatAccountIds()) {
-    const data = loadWorkChatAccount(accountId);
-    const storedAgentId = data?.agentId?.trim();
-    if (storedAgentId && storedAgentId !== keepAgentId) {
-      await removeWorkChatAccountBinding(accountId);
-      removed.push(accountId);
-      logger.info(
-        `pruneStaleWorkChatAccounts: removed account=${accountId} agent=${storedAgentId} (superseded by agent=${keepAgentId})`
-      );
-    }
+    if (accountId === keep) continue;
+    await removeWorkChatAccountBinding(accountId);
+    removed.push(accountId);
+    logger.info(
+      `pruneOtherWorkChatAccounts: removed account=${accountId} (superseded by ${keep})`
+    );
   }
   return removed;
 }
+async function migrateLegacyDefaultWorkChatAccount() {
+  const ids = listIndexedWorkChatAccountIds();
+  if (!ids.includes("default")) return false;
+  const data = loadWorkChatAccount("default");
+  const agentId = data?.agentId?.trim();
+  if (!agentId) return false;
+  const targetId = `agent-${agentId}`;
+  if (!ids.includes(targetId)) {
+    saveWorkChatAccount(targetId, { ...data });
+  }
+  try {
+    const { readFrameworkAllowFromList: readFrameworkAllowFromList2, registerUserInFrameworkStore: registerUserInFrameworkStore2 } = await Promise.resolve().then(() => (init_pairing(), pairing_exports));
+    for (const userId of readFrameworkAllowFromList2("default")) {
+      await registerUserInFrameworkStore2({ accountId: targetId, userId });
+    }
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom move failed: ${String(err)}`);
+  }
+  await updateAccountIndex((existing) => {
+    const next = existing.filter((id) => id !== "default" && id !== targetId);
+    next.push(targetId);
+    return next;
+  });
+  try {
+    fs3.rmSync(path4.join(resolveWorkChatStateDir(), "accounts", "default.json"), { force: true });
+  } catch {
+  }
+  try {
+    const { clearFrameworkAllowFromList: clearFrameworkAllowFromList2 } = await Promise.resolve().then(() => (init_pairing(), pairing_exports));
+    clearFrameworkAllowFromList2("default");
+  } catch (err) {
+    logger.warn(`migrateLegacyDefaultWorkChatAccount: allowFrom cleanup failed: ${String(err)}`);
+  }
+  logger.info(
+    `migrateLegacyDefaultWorkChatAccount: renamed default -> ${targetId} (agent=${agentId})`
+  );
+  return true;
+}
 function listWorkChatAccountIds(_cfg) {
   return listIndexedWorkChatAccountIds();
 }
@@ -442,12 +487,14 @@ async function triggerWorkChatChannelReload() {
     logger.warn(`triggerWorkChatChannelReload: failed to update config: ${String(err)}`);
   }
 }
+var indexUpdateChain;
 var init_accounts = __esm({
   "src/auth/accounts.ts"() {
     "use strict";
     init_types();
     init_state_dir();
     init_logger();
+    indexUpdateChain = Promise.resolve();
   }
 });
 
@@ -1559,14 +1606,14 @@ var require_util = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path6 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path8 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path6 && path6[0] !== "/") {
-          path6 = `/${path6}`;
+        if (path8 && path8[0] !== "/") {
+          path8 = `/${path8}`;
         }
-        return new URL(`${origin}${path6}`);
+        return new URL(`${origin}${path8}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -2387,9 +2434,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path6, origin }
+            request: { method, path: path8, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path6);
+          debugLog("sending request to %s %s%s", method, origin, path8);
         }
       );
     }
@@ -2407,14 +2454,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path6, origin },
+            request: { method, path: path8, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path6,
+            path8,
             statusCode
           );
         }
@@ -2423,23 +2470,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path6, origin }
+            request: { method, path: path8, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path6);
+          debugLog("trailers received from %s %s%s", method, origin, path8);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path6, origin },
+            request: { method, path: path8, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path6,
+            path8,
             error62.message
           );
         }
@@ -2554,7 +2601,7 @@ var require_request = __commonJS({
     var kHandler = Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path6,
+        path: path8,
         method,
         body,
         headers,
@@ -2571,11 +2618,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path6 !== "string") {
+        if (typeof path8 !== "string") {
           throw new InvalidArgumentError("path must be a string");
-        } else if (path6[0] !== "/" && !(path6.startsWith("http://") || path6.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path8[0] !== "/" && !(path8.startsWith("http://") || path8.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path6)) {
+        } else if (invalidPathRegex.test(path8)) {
           throw new InvalidArgumentError("invalid request path");
         }
         if (typeof method !== "string") {
@@ -2650,7 +2697,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path6, query) : path6;
+        this.path = query ? serializePathWithQuery(path8, query) : path8;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -6219,7 +6266,7 @@ var require_formdata = __commonJS({
     var { kEnumerableProperty } = require_util();
     var { webidl } = require_webidl();
     var nodeUtil = __require("util");
-    var FormData = class _FormData {
+    var FormData2 = class _FormData {
       #state = [];
       constructor(form = void 0) {
         webidl.util.markAsUncloneable(this);
@@ -6336,11 +6383,11 @@ var require_formdata = __commonJS({
         formData.#state = newState;
       }
     };
-    var { getFormDataState, setFormDataState } = FormData;
-    Reflect.deleteProperty(FormData, "getFormDataState");
-    Reflect.deleteProperty(FormData, "setFormDataState");
-    iteratorMixin("FormData", FormData, getFormDataState, "name", "value");
-    Object.defineProperties(FormData.prototype, {
+    var { getFormDataState, setFormDataState } = FormData2;
+    Reflect.deleteProperty(FormData2, "getFormDataState");
+    Reflect.deleteProperty(FormData2, "setFormDataState");
+    iteratorMixin("FormData", FormData2, getFormDataState, "name", "value");
+    Object.defineProperties(FormData2.prototype, {
       append: kEnumerableProperty,
       delete: kEnumerableProperty,
       get: kEnumerableProperty,
@@ -6368,8 +6415,8 @@ var require_formdata = __commonJS({
       }
       return { name, value };
     }
-    webidl.is.FormData = webidl.util.MakeTypeAssertion(FormData);
-    module.exports = { FormData, makeEntry, setFormDataState };
+    webidl.is.FormData = webidl.util.MakeTypeAssertion(FormData2);
+    module.exports = { FormData: FormData2, makeEntry, setFormDataState };
   }
 });
 
@@ -6733,7 +6780,7 @@ var require_body = __commonJS({
       fullyReadBody,
       extractMimeType
     } = require_util2();
-    var { FormData, setFormDataState } = require_formdata();
+    var { FormData: FormData2, setFormDataState } = require_formdata();
     var { webidl } = require_webidl();
     var assert2 = __require("assert");
     var { isErrored, isDisturbed } = __require("stream");
@@ -6926,13 +6973,13 @@ Content-Type: ${value.type || "application/octet-stream"}\r
               switch (mimeType.essence) {
                 case "multipart/form-data": {
                   const parsed = multipartFormDataParser(value, mimeType);
-                  const fd = new FormData();
+                  const fd = new FormData2();
                   setFormDataState(fd, parsed);
                   return fd;
                 }
                 case "application/x-www-form-urlencoded": {
                   const entries = new URLSearchParams(value.toString());
-                  const fd = new FormData();
+                  const fd = new FormData2();
                   for (const [name, value2] of entries) {
                     fd.append(name, value2);
                   }
@@ -7856,7 +7903,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request) {
-      const { method, path: path6, host, upgrade, blocking, reset } = request;
+      const { method, path: path8, host, upgrade, blocking, reset } = request;
       let { body, headers, contentLength } = request;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -7934,7 +7981,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request.typeOfService);
       }
-      let header = `${method} ${path6} HTTP/1.1\r
+      let header = `${method} ${path8} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -8613,7 +8660,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path6, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request;
+      const { method, path: path8, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request;
       let { body } = request;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request, new InvalidArgumentError(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -8682,7 +8729,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path6;
+          headers[HTTP2_HEADER_PATH] = path8;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -8734,7 +8781,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path6;
+      headers[HTTP2_HEADER_PATH] = path8;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -10215,7 +10262,7 @@ var require_agent = __commonJS({
     function defaultFactory(origin, opts) {
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
-    var Agent4 = class extends DispatcherBase {
+    var Agent3 = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError("factory must be a function.");
@@ -10324,7 +10371,7 @@ var require_agent = __commonJS({
         return allClientStats;
       }
     };
-    module.exports = Agent4;
+    module.exports = Agent3;
   }
 });
 
@@ -11030,7 +11077,7 @@ var require_proxy_agent = __commonJS({
   "node_modules/undici/lib/dispatcher/proxy-agent.js"(exports, module) {
     "use strict";
     var { kProxy, kClose, kDestroy, kDispatch } = require_symbols();
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     var Pool = require_pool();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError, RequestAbortedError, SecureProxyConnectionError } = require_errors();
@@ -11086,10 +11133,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path6 = "/",
+          path: path8 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path6;
+        opts.path = origin + path8;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -11161,7 +11208,7 @@ var require_proxy_agent = __commonJS({
         } else {
           this[kClient] = clientFactory(url2, { connect });
         }
-        this[kAgent] = new Agent4({
+        this[kAgent] = new Agent3({
           ...opts,
           factory,
           connect: async (opts2, callback) => {
@@ -11289,7 +11336,7 @@ var require_env_http_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
     var ProxyAgent = require_proxy_agent();
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
       "https:": 443
@@ -11302,7 +11349,7 @@ var require_env_http_proxy_agent = __commonJS({
         super();
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
-        this[kNoProxyAgent] = new Agent4(agentOpts);
+        this[kNoProxyAgent] = new Agent3(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
           this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
@@ -13249,20 +13296,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path6) {
-      if (typeof path6 !== "string") {
-        return path6;
+    function safeUrl(path8) {
+      if (typeof path8 !== "string") {
+        return path8;
       }
-      const pathSegments = path6.split("?", 3);
+      const pathSegments = path8.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path6;
+        return path8;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path6, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path6);
+    function matchKey(mockDispatch2, { path: path8, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path8);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -13287,8 +13334,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path6, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path6)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path6), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path8, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path8)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path8), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -13327,19 +13374,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path6) {
-      while (path6.endsWith("/")) {
-        path6 = path6.slice(0, -1);
+    function removeTrailingSlash(path8) {
+      while (path8.endsWith("/")) {
+        path8 = path8.slice(0, -1);
       }
-      if (path6.length === 0) {
-        path6 = "/";
+      if (path8.length === 0) {
+        path8 = "/";
       }
-      return path6;
+      return path8;
     }
     function buildKey(opts) {
-      const { path: path6, method, body, headers, query } = opts;
+      const { path: path8, method, body, headers, query } = opts;
       return {
-        path: path6,
+        path: path8,
         method,
         body,
         headers,
@@ -14029,10 +14076,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path6, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path8, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path6,
+            Path: path8,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -14051,7 +14098,7 @@ var require_mock_agent = __commonJS({
   "node_modules/undici/lib/mock/mock-agent.js"(exports, module) {
     "use strict";
     var { kClients } = require_symbols();
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     var {
       kAgent,
       kMockAgentSet,
@@ -14089,7 +14136,7 @@ var require_mock_agent = __commonJS({
         if (opts?.agent && typeof opts.agent.dispatch !== "function") {
           throw new InvalidArgumentError("Argument opts.agent must implement Agent");
         }
-        const agent = opts?.agent ? opts.agent : new Agent4(opts);
+        const agent = opts?.agent ? opts.agent : new Agent3(opts);
         this[kAgent] = agent;
         this[kClients] = agent[kClients];
         this[kOptions] = mockOptions;
@@ -14114,9 +14161,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path6, searchParams] = dispatchOpts.path.split("?");
+          const [path8, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path6}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path8}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -14320,7 +14367,7 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile, readFile, mkdir } = __require("fs/promises");
+    var { writeFile: writeFile2, readFile, mkdir: mkdir2 } = __require("fs/promises");
     var { dirname, resolve } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -14517,12 +14564,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path6 = filePath || this.#snapshotPath;
-        if (!path6) {
+        const path8 = filePath || this.#snapshotPath;
+        if (!path8) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path6), "utf8");
+          const data = await readFile(resolve(path8), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -14536,7 +14583,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path6}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path8}`, { cause: error62 });
           }
         }
       }
@@ -14547,17 +14594,17 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path6 = filePath || this.#snapshotPath;
-        if (!path6) {
+        const path8 = filePath || this.#snapshotPath;
+        if (!path8) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve(path6);
-        await mkdir(dirname(resolvedPath), { recursive: true });
+        const resolvedPath = resolve(path8);
+        await mkdir2(dirname(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
         }));
-        await writeFile(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile2(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -14696,7 +14743,7 @@ var require_snapshot_recorder = __commonJS({
 var require_snapshot_agent = __commonJS({
   "node_modules/undici/lib/mock/snapshot-agent.js"(exports, module) {
     "use strict";
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     var MockAgent = require_mock_agent();
     var { SnapshotRecorder } = require_snapshot_recorder();
     var WrapHandler = require_wrap_handler();
@@ -14747,7 +14794,7 @@ var require_snapshot_agent = __commonJS({
         });
         this[kSnapshotLoaded] = false;
         if (this[kSnapshotMode] === "record" || this[kSnapshotMode] === "update" || this[kSnapshotMode] === "playback" && opts.excludeUrls && opts.excludeUrls.length > 0) {
-          this[kRealAgent] = new Agent4(opts);
+          this[kRealAgent] = new Agent3(opts);
         }
         if ((this[kSnapshotMode] === "playback" || this[kSnapshotMode] === "update") && this[kSnapshotPath]) {
           this.loadSnapshots().catch(() => {
@@ -14986,9 +15033,9 @@ var require_global2 = __commonJS({
     var globalDispatcher = Symbol.for("undici.globalDispatcher.2");
     var legacyGlobalDispatcher = Symbol.for("undici.globalDispatcher.1");
     var { InvalidArgumentError } = require_errors();
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     if (getGlobalDispatcher() === void 0) {
-      setGlobalDispatcher(new Agent4());
+      setGlobalDispatcher(new Agent3());
     }
     function setGlobalDispatcher(agent) {
       if (!agent || typeof agent.dispatch !== "function") {
@@ -15183,15 +15230,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path6 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path6}`;
+        const path8 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path8}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path6;
+        this.opts.path = path8;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -16950,10 +16997,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path6) {
+    function deleteCachedUri(store, cacheKey, path8) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path6
+        path: path8
       });
       for (let i = 0; i < util.safeHTTPMethods.length; i++) {
         const method = util.safeHTTPMethods[i];
@@ -16961,7 +17008,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path6
+            path: path8
           });
         }
       }
@@ -16972,9 +17019,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue) ? headerValue : [headerValue];
       for (let i = 0; i < values.length; i++) {
-        const path6 = getSameOriginPath(cacheKey, values[i]);
-        if (path6 !== void 0) {
-          deleteCachedUri(store, cacheKey, path6);
+        const path8 = getSameOriginPath(cacheKey, values[i]);
+        if (path8 !== void 0) {
+          deleteCachedUri(store, cacheKey, path8);
         }
       }
     }
@@ -22121,11 +22168,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        const path6 = url2.pathname + url2.search;
+        const path8 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path6}?` : path6,
+            path: hasTrailingQuestionMark ? `${path8}?` : path8,
             origin: url2.origin,
             method: request.method,
             body: agent.isMockActive ? request.body && (request.body.source || request.body.stream) : body,
@@ -22675,8 +22722,8 @@ var require_cache3 = __commonJS({
        * @returns {requestResponseList}
        */
       #batchCacheOperations(operations) {
-        const cache = this.#relevantRequestResponseList;
-        const backupCache = [...cache];
+        const cache2 = this.#relevantRequestResponseList;
+        const backupCache = [...cache2];
         const addedItems = [];
         const resultList = [];
         try {
@@ -22703,9 +22750,9 @@ var require_cache3 = __commonJS({
                 return [];
               }
               for (const requestResponse of requestResponses) {
-                const idx = cache.indexOf(requestResponse);
+                const idx = cache2.indexOf(requestResponse);
                 assert2(idx !== -1);
-                cache.splice(idx, 1);
+                cache2.splice(idx, 1);
               }
             } else if (operation.type === "put") {
               if (operation.response == null) {
@@ -22735,11 +22782,11 @@ var require_cache3 = __commonJS({
               }
               requestResponses = this.#queryCache(operation.request);
               for (const requestResponse of requestResponses) {
-                const idx = cache.indexOf(requestResponse);
+                const idx = cache2.indexOf(requestResponse);
                 assert2(idx !== -1);
-                cache.splice(idx, 1);
+                cache2.splice(idx, 1);
               }
-              cache.push([operation.request, operation.response]);
+              cache2.push([operation.request, operation.response]);
               addedItems.push([operation.request, operation.response]);
             }
             resultList.push([operation.request, operation.response]);
@@ -22916,13 +22963,13 @@ var require_cachestorage = __commonJS({
         if (options.cacheName != null) {
           if (this.#caches.has(options.cacheName)) {
             const cacheList = this.#caches.get(options.cacheName);
-            const cache = new Cache(kConstruct, cacheList);
-            return await cache.match(request, options);
+            const cache2 = new Cache(kConstruct, cacheList);
+            return await cache2.match(request, options);
           }
         } else {
           for (const cacheList of this.#caches.values()) {
-            const cache = new Cache(kConstruct, cacheList);
-            const response = await cache.match(request, options);
+            const cache2 = new Cache(kConstruct, cacheList);
+            const response = await cache2.match(request, options);
             if (response !== void 0) {
               return response;
             }
@@ -22952,12 +22999,12 @@ var require_cachestorage = __commonJS({
         webidl.argumentLengthCheck(arguments, 1, prefix);
         cacheName = webidl.converters.DOMString(cacheName, prefix, "cacheName");
         if (this.#caches.has(cacheName)) {
-          const cache2 = this.#caches.get(cacheName);
-          return new Cache(kConstruct, cache2);
+          const cache3 = this.#caches.get(cacheName);
+          return new Cache(kConstruct, cache3);
         }
-        const cache = [];
-        this.#caches.set(cacheName, cache);
-        return new Cache(kConstruct, cache);
+        const cache2 = [];
+        this.#caches.set(cacheName, cache2);
+        return new Cache(kConstruct, cache2);
       }
       /**
        * @see https://w3c.github.io/ServiceWorker/#cache-storage-delete
@@ -23072,9 +23119,9 @@ var require_util4 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path6) {
-      for (let i = 0; i < path6.length; ++i) {
-        const code = path6.charCodeAt(i);
+    function validateCookiePath(path8) {
+      for (let i = 0; i < path8.length; ++i) {
+        const code = path8.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -26355,7 +26402,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var RoundRobinPool = require_round_robin_pool();
-    var Agent4 = require_agent();
+    var Agent3 = require_agent();
     var ProxyAgent = require_proxy_agent();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
     var EnvHttpProxyAgent = require_env_http_proxy_agent();
@@ -26382,7 +26429,7 @@ var require_undici = __commonJS({
     module.exports.Pool = Pool;
     module.exports.BalancedPool = BalancedPool;
     module.exports.RoundRobinPool = RoundRobinPool;
-    module.exports.Agent = Agent4;
+    module.exports.Agent = Agent3;
     module.exports.ProxyAgent = ProxyAgent;
     module.exports.Socks5ProxyAgent = Socks5ProxyAgent;
     module.exports.EnvHttpProxyAgent = EnvHttpProxyAgent;
@@ -26428,11 +26475,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError("invalid opts.path");
           }
-          let path6 = opts.path;
+          let path8 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path6 = `/${path6}`;
+            path8 = `/${path8}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path6);
+          url2 = new URL(util.parseOrigin(url2).origin + path8);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -26576,8 +26623,7 @@ var init_redact = __esm({
 // src/api/api.ts
 async function fetchJson(params) {
   const { url: url2, init, timeoutMs, allowInsecureTls } = params;
-  const dispatcher = allowInsecureTls ? new import_undici.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
-  const fetcher = allowInsecureTls ? import_undici.fetch : globalThis.fetch;
+  const fetcher = globalThis.fetch;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
   let response;
@@ -26585,8 +26631,7 @@ async function fetchJson(params) {
   try {
     response = await fetcher(url2, {
       ...init,
-      signal: controller.signal,
-      ...dispatcher ? { dispatcher } : {}
+      signal: controller.signal
     });
     text = await response.text().catch(() => "");
   } finally {
@@ -26728,6 +26773,42 @@ async function sendWorkChatReplyMessage(params) {
   if (!data?.msgId) throw new Error("workchat: msgId missing in reply response");
   return { msgId: String(data.msgId) };
 }
+async function uploadWorkChatFile(params) {
+  const { opts, filePath, userId } = params;
+  const token = await getAccessToken(opts);
+  const { readFile } = await import("fs/promises");
+  const pathMod = await import("path");
+  const content = await readFile(filePath);
+  const fileName = pathMod.basename(filePath);
+  const ext = pathMod.extname(fileName).replace(/^\./, "").toLowerCase();
+  const mime = ext === "mp3" || ext === "m4a" ? "audio/mpeg" : ext === "wav" ? "audio/wav" : `image/${ext === "jpg" ? "jpeg" : ext || "png"}`;
+  const form = new FormData();
+  form.set("file", new Blob([new Uint8Array(content)], { type: mime }), fileName);
+  const ownerUserId = userId !== void 0 && String(userId).trim() !== "" ? String(userId) : "0";
+  form.set("userId", ownerUserId);
+  const resp = await fetchJson({
+    url: `${normalizeBaseUrl(opts.baseUrl)}/open-apis/v1/files/upload`,
+    timeoutMs: opts.timeoutMs ?? RequestDefaults.TimeoutMs,
+    allowInsecureTls: opts.allowInsecureTls,
+    init: {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "x-user-id": ownerUserId
+      },
+      body: form
+    }
+  });
+  const data = unwrapEnvelope(resp);
+  const url2 = typeof data?.url === "string" ? data.url.trim() : "";
+  if (!url2) throw new Error("workchat: url missing in file upload response");
+  return {
+    url: url2,
+    fileName: typeof data?.fileName === "string" ? data.fileName : void 0,
+    suffix: typeof data?.suffix === "string" ? data.suffix : void 0,
+    fileSize: typeof data?.fileSize === "number" ? data.fileSize : void 0
+  };
+}
 async function notifyAgentCreatedStatus(opts, agentId) {
   try {
     const token = await getAccessToken(opts);
@@ -26742,11 +26823,10 @@ async function notifyAgentCreatedStatus(opts, agentId) {
     logger.error(`agent-created/status failed: ${String(err)}`);
   }
 }
-var import_undici, tokenCache;
+var tokenCache;
 var init_api = __esm({
   "src/api/api.ts"() {
     "use strict";
-    import_undici = __toESM(require_undici(), 1);
     init_types();
     init_logger();
     init_redact();
@@ -26807,7 +26887,17 @@ function parseWorkChatFrame(data) {
   if (type === "CALLBACK" && String(envelope?.metadata?.topic || "").trim().toUpperCase() === "AGENT_MESSAGE") {
     const payload = parseMaybeJson(envelope?.data) ?? {};
     const message = payload?.message;
-    const text = typeof message === "string" ? message : typeof message?.content === "string" ? message.content : "";
+    const messageType = typeof message === "object" && message !== null ? String(message.type ?? "").trim().toLowerCase() : "";
+    const rawContent = typeof message === "string" ? message : typeof message?.content === "string" ? message.content : "";
+    let mediaUrl;
+    let text = rawContent;
+    if (messageType === "image" || messageType === "audio") {
+      mediaUrl = extractMediaUrl(rawContent) ?? firstFileUrl(payload);
+      text = messageType === "image" ? "[\u7528\u6237\u53D1\u9001\u4E86\u4E00\u5F20\u56FE\u7247]" : "[\u7528\u6237\u53D1\u9001\u4E86\u4E00\u6761\u8BED\u97F3]";
+    } else if (!text.trim()) {
+      mediaUrl = firstFileUrl(payload);
+      if (mediaUrl) text = "[\u7528\u6237\u53D1\u9001\u4E86\u4E00\u4E2A\u6587\u4EF6]";
+    }
     return {
       type: "agent_message",
       message: {
@@ -26815,12 +26905,26 @@ function parseWorkChatFrame(data) {
         userId: String(payload?.userId ?? ""),
         openConversationId: String(payload?.conversationId ?? ""),
         messageId: String(payload?.msgId ?? ""),
-        ...payload?.agentId !== void 0 ? { agentId: String(payload.agentId) } : {}
+        ...payload?.agentId !== void 0 ? { agentId: String(payload.agentId) } : {},
+        ...mediaUrl ? { mediaUrl, mediaType: messageType || "file" } : {}
       }
     };
   }
   return { type: "ignored", ignoredKind: `${type}/${topicLower || "(no topic)"}` };
 }
+function extractMediaUrl(content) {
+  if (!content.trim()) return void 0;
+  try {
+    const parsed = JSON.parse(content);
+    return typeof parsed?.url === "string" && parsed.url.trim() ? parsed.url.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function firstFileUrl(payload) {
+  const url2 = Array.isArray(payload?.fileUrl) ? payload.fileUrl[0] : void 0;
+  return typeof url2 === "string" && url2.trim() ? url2.trim() : void 0;
+}
 function buildPongFrame(pongData) {
   return JSON.stringify({
     code: 200,
@@ -26834,8 +26938,10 @@ function generateMessageSid() {
 }
 function workChatMessageToMsgContext(message, accountId) {
   const fromUserId = message.userId ?? "";
+  const body = message.mediaUrl ? `${message.text ?? ""}
+[media] ${message.mediaUrl}` : message.text ?? "";
   const ctx = {
-    Body: message.text ?? "",
+    Body: body,
     From: fromUserId,
     To: fromUserId,
     AccountId: accountId,
@@ -26853,6 +26959,10 @@ function workChatMessageToMsgContext(message, accountId) {
   if (message.agentId) {
     ctx.AgentId = message.agentId;
   }
+  if (message.mediaUrl) {
+    ctx.MediaUrl = message.mediaUrl;
+    ctx.MediaType = message.mediaType ?? "file";
+  }
   return ctx;
 }
 var init_inbound = __esm({
@@ -27059,8 +27169,8 @@ function startBindingListener(sessionKey, opts, timeoutMs) {
         clearWorkChatTokenCache(opts.appKey || "default");
         const { endpoint, ticket } = await openConnection(opts);
         const url2 = `${endpoint}?ticket=${encodeURIComponent(ticket)}`;
-        const dispatcher = opts.allowInsecureTls ? new import_undici2.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
-        ws = new import_undici2.WebSocket(url2, dispatcher ? { dispatcher } : void 0);
+        const dispatcher = opts.allowInsecureTls ? new import_undici.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
+        ws = new import_undici.WebSocket(url2, dispatcher ? { dispatcher } : void 0);
         const entryNow = bindingListeners.get(sessionKey);
         if (!entryNow || entryNow.done) {
           try {
@@ -27127,28 +27237,27 @@ async function handleListenerFrame(sessionKey, data, ws) {
   if (result.type !== "init_agent") return;
   const eventData = result.eventData;
   if (!eventData) return;
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) return;
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
   const entry = bindingListeners.get(sessionKey);
   if (entry) entry.done = true;
-  const isRebind = listIndexedWorkChatAccountIds().length > 0;
+  const accountId = `agent-${agentId}`;
   try {
-    const { pruneStaleWorkChatAccounts: pruneStaleWorkChatAccounts2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
-    const removed = await pruneStaleWorkChatAccounts2(agentId);
+    const { pruneOtherWorkChatAccounts: pruneOtherWorkChatAccounts2 } = await Promise.resolve().then(() => (init_accounts(), accounts_exports));
+    const removed = await pruneOtherWorkChatAccounts2(accountId);
     if (removed.length > 0) {
-      logger.info(`binding listener: pruned stale account(s): ${removed.join(", ")}`);
+      logger.info(`binding listener: pruned previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`binding listener: rebind cleanup failed: ${String(err)}`);
   }
-  const accountId = isRebind ? `agent-${agentId}` : "default";
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...userId ? { userId } : {}
     });
-    registerWorkChatAccountId(accountId);
+    await registerWorkChatAccountId(accountId);
     const { bindAgentToAccountFromBinding: bindAgentToAccountFromBinding2 } = await Promise.resolve().then(() => (init_bind_agent(), bind_agent_exports));
     await bindAgentToAccountFromBinding2(accountId, agentId, userId);
     logger.info(`binding listener: account=${accountId} agent=${agentId} persisted`);
@@ -27187,12 +27296,12 @@ function completeWorkChatBinding(completion) {
   );
   return true;
 }
-var import_undici2, BIND_CMD, BIND_TYPE, BIND_NAME, ACTIVE_BINDING_TTL_MS, activeBindings, pendingWaiters, bindingListeners;
+var import_undici, BIND_CMD, BIND_TYPE, BIND_NAME, ACTIVE_BINDING_TTL_MS, activeBindings, pendingWaiters, bindingListeners;
 var init_login_qr = __esm({
   "src/auth/login-qr.ts"() {
     "use strict";
     init_logger();
-    import_undici2 = __toESM(require_undici(), 1);
+    import_undici = __toESM(require_undici(), 1);
     init_api();
     init_inbound();
     init_inbound();
@@ -27207,9 +27316,74 @@ var init_login_qr = __esm({
   }
 });
 
+// src/api/session-guard.ts
+function pauseSession(accountId) {
+  const until = Date.now() + SESSION_PAUSE_DURATION_MS;
+  pauseUntilMap.set(accountId, until);
+  logger.info(
+    `session-guard: paused accountId=${accountId} until=${new Date(until).toISOString()} (${SESSION_PAUSE_DURATION_MS / 1e3}s)`
+  );
+}
+function isSessionPaused(accountId) {
+  const until = pauseUntilMap.get(accountId);
+  if (until === void 0) return false;
+  if (Date.now() >= until) {
+    pauseUntilMap.delete(accountId);
+    return false;
+  }
+  return true;
+}
+function getRemainingPauseMs(accountId) {
+  const until = pauseUntilMap.get(accountId);
+  if (until === void 0) return 0;
+  const remaining = until - Date.now();
+  if (remaining <= 0) {
+    pauseUntilMap.delete(accountId);
+    return 0;
+  }
+  return remaining;
+}
+function assertSessionActive(accountId) {
+  if (isSessionPaused(accountId)) {
+    const remainingMin = Math.ceil(getRemainingPauseMs(accountId) / 6e4);
+    throw new Error(
+      `session paused for accountId=${accountId}, ${remainingMin} min remaining \u2014 the WorkChat binding is invalid, re-scan the QR code to fix`
+    );
+  }
+}
+function isPermanentBindingError(errMsg) {
+  return PERMANENT_ERROR_PATTERNS.some((p) => errMsg.includes(p));
+}
+function pauseOnPermanentError(accountId, errMsg) {
+  if (!isPermanentBindingError(errMsg)) return false;
+  if (!isSessionPaused(accountId)) {
+    pauseSession(accountId);
+    logger.warn(
+      `session-guard: permanent binding error, pausing accountId=${accountId} err="${errMsg.slice(0, 120)}" \u2014 re-scan required`
+    );
+  }
+  return true;
+}
+var SESSION_PAUSE_DURATION_MS, PERMANENT_ERROR_PATTERNS, pauseUntilMap;
+var init_session_guard = __esm({
+  "src/api/session-guard.ts"() {
+    "use strict";
+    init_logger();
+    SESSION_PAUSE_DURATION_MS = 60 * 60 * 1e3;
+    PERMANENT_ERROR_PATTERNS = [
+      "\u667A\u80FD\u4F53\u4E0D\u80FD\u4E3A\u7A7A",
+      "\u667A\u80FD\u4F53\u4E0D\u662F\u63A5\u6536\u4EBA\u7684\u667A\u80FD\u4F53",
+      "\u8BBE\u5907\u94FE\u63A5\u5F02\u5E38",
+      "\u7533\u8BF7\u7ED1\u5B9A\u7684AppKey\u4E0D\u5B58\u5728"
+    ];
+    pauseUntilMap = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/messaging/send.ts
 var send_exports = {};
 __export(send_exports, {
+  buildApiOptions: () => buildApiOptions,
   pushWorkChatMessage: () => pushWorkChatMessage,
   replyWorkChatMessage: () => replyWorkChatMessage
 });
@@ -27255,6 +27429,7 @@ async function replyWorkChatMessage(params) {
     logger.info(`reply sent to=${to} messageId=${result.msgId}`);
     return { messageId: result.msgId };
   } catch (err) {
+    pauseOnPermanentError(account.accountId, err instanceof Error ? err.message : String(err));
     logger.error(`replyWorkChatMessage: failed to=${to} err=${String(err)}`);
     throw err;
   }
@@ -27280,6 +27455,7 @@ async function pushWorkChatMessage(params) {
     logger.info(`push sent to=${to} messageId=${result.msgId}`);
     return { messageId: result.msgId };
   } catch (err) {
+    pauseOnPermanentError(account.accountId, err instanceof Error ? err.message : String(err));
     logger.error(`pushWorkChatMessage: failed to=${to} err=${String(err)}`);
     throw err;
   }
@@ -27289,15 +27465,230 @@ var init_send = __esm({
     "use strict";
     init_types();
     init_api();
+    init_session_guard();
     init_logger();
   }
 });
 
+// src/messaging/send-media.ts
+var send_media_exports = {};
+__export(send_media_exports, {
+  downloadRemoteMediaToTemp: () => downloadRemoteMediaToTemp,
+  isLocalMediaSource: () => isLocalMediaSource,
+  resolveLocalMediaPath: () => resolveLocalMediaPath,
+  sendWorkChatMediaFile: () => sendWorkChatMediaFile
+});
+import { mkdir, writeFile } from "fs/promises";
+import os4 from "os";
+import path5 from "path";
+function isLocalMediaSource(mediaUrl) {
+  const trimmed = mediaUrl.trim();
+  if (trimmed.startsWith("http://") || trimmed.startsWith("https://")) return false;
+  return trimmed.startsWith("/") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("~") || trimmed.startsWith("file://") || path5.isAbsolute(trimmed);
+}
+function resolveLocalMediaPath(mediaUrl) {
+  if (mediaUrl.startsWith("file://")) {
+    const parsed = new URL(mediaUrl);
+    return process.platform === "win32" ? parsed.pathname.replace(/^\/([A-Za-z]:)/, "$1") : parsed.pathname;
+  }
+  if (mediaUrl.startsWith("~")) {
+    return path5.join(os4.homedir(), mediaUrl.slice(1));
+  }
+  return path5.resolve(mediaUrl);
+}
+function resolveMediaMsgType(filePath) {
+  const ext = path5.extname(filePath).replace(/^\./, "").toLowerCase();
+  return AUDIO_EXTENSIONS.has(ext) ? "audio" : "image";
+}
+function requireAgentId(account, agentId) {
+  const resolved = agentId ?? account.agentId;
+  if (!resolved) {
+    throw new Error("workchat: agentId is required \u2014 complete the binding QR flow first");
+  }
+  return resolved;
+}
+async function sendMediaRequest(params) {
+  const agentId = requireAgentId(params.account, params.agentId);
+  assertSessionActive(params.account.accountId);
+  const opts = buildApiOptions(params.account);
+  const body = {
+    agentId,
+    receiveId: params.account.userId ?? params.to,
+    msgType: params.msgType,
+    content: params.content,
+    ...params.conversationId ? { conversationId: params.conversationId } : {}
+  };
+  if (params.replyToMessageId) body.is_last = true;
+  try {
+    if (params.replyToMessageId) {
+      const result2 = await sendWorkChatReplyMessage({ opts, messageId: params.replyToMessageId, body });
+      logger.info(`reply media sent to=${params.to} messageId=${result2.msgId}`);
+      return { messageId: result2.msgId };
+    }
+    const result = await sendWorkChatMessage({ opts, body });
+    logger.info(`push media sent to=${params.to} messageId=${result.msgId}`);
+    return { messageId: result.msgId };
+  } catch (err) {
+    pauseOnPermanentError(params.account.accountId, err instanceof Error ? err.message : String(err));
+    throw err;
+  }
+}
+async function sendWorkChatMediaFile(params) {
+  const { account, to, filePath } = params;
+  const opts = buildApiOptions(account);
+  logger.info(`sendMedia: uploading filePath=${filePath} to=${to}`);
+  const uploaded = await uploadWorkChatFile({ opts, filePath, userId: account.userId ?? to });
+  logger.info(`sendMedia: upload done urlLen=${uploaded.url.length} suffix=${uploaded.suffix ?? "(none)"}`);
+  const caption = params.text?.trim() ?? "";
+  if (caption) {
+    await pushWorkChatMessage({
+      account,
+      to,
+      text: caption,
+      conversationId: params.conversationId,
+      agentId: params.agentId
+    });
+  }
+  const msgType = resolveMediaMsgType(filePath) === "audio" ? WorkChatMsgType.Audio : WorkChatMsgType.Image;
+  return sendMediaRequest({
+    account,
+    to,
+    msgType,
+    content: JSON.stringify({ url: uploaded.url }),
+    replyToMessageId: params.replyToMessageId,
+    conversationId: params.conversationId,
+    agentId: params.agentId
+  });
+}
+function tempMediaPath(ext) {
+  return path5.join(REMOTE_MEDIA_DIR, `${generateId("remote").replace(/:/g, "-")}${ext}`);
+}
+function extensionFromUrlOrContentType(contentType, url2) {
+  const fromUrl = path5.extname(new URL(url2).pathname).toLowerCase();
+  if (fromUrl) return fromUrl;
+  if (contentType?.startsWith("audio/mpeg")) return ".mp3";
+  if (contentType?.startsWith("audio/wav")) return ".wav";
+  if (contentType?.startsWith("audio/mp4")) return ".m4a";
+  if (contentType?.startsWith("image/")) return ".png";
+  return ".bin";
+}
+async function downloadRemoteMediaToTemp(url2) {
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), REMOTE_MEDIA_DOWNLOAD_TIMEOUT_MS);
+  let response;
+  try {
+    response = await globalThis.fetch(url2, { signal: controller.signal });
+  } finally {
+    clearTimeout(timeoutId);
+  }
+  if (!response.ok) {
+    throw new Error(
+      `remote media download failed: ${response.status} ${response.statusText} url=${url2.slice(0, 80)}`
+    );
+  }
+  const buf = Buffer.from(await response.arrayBuffer());
+  const ext = extensionFromUrlOrContentType(response.headers.get("content-type"), url2);
+  await mkdir(REMOTE_MEDIA_DIR, { recursive: true });
+  const filePath = tempMediaPath(ext);
+  await writeFile(filePath, buf);
+  logger.debug(`downloadRemoteMediaToTemp: saved ${buf.length} bytes to ${filePath}`);
+  return filePath;
+}
+var AUDIO_EXTENSIONS, REMOTE_MEDIA_DIR, REMOTE_MEDIA_DOWNLOAD_TIMEOUT_MS;
+var init_send_media = __esm({
+  "src/messaging/send-media.ts"() {
+    "use strict";
+    init_api();
+    init_session_guard();
+    init_types();
+    init_logger();
+    init_random();
+    init_send();
+    AUDIO_EXTENSIONS = /* @__PURE__ */ new Set(["wav", "m4a", "mp3"]);
+    REMOTE_MEDIA_DIR = path5.join(os4.tmpdir(), "openclaw", "workchat", "media");
+    REMOTE_MEDIA_DOWNLOAD_TIMEOUT_MS = 6e4;
+  }
+});
+
+// src/messaging/outbound-hooks.ts
+var outbound_hooks_exports = {};
+__export(outbound_hooks_exports, {
+  applyWorkChatMessageSendingHook: () => applyWorkChatMessageSendingHook,
+  emitWorkChatMessageSent: () => emitWorkChatMessageSent
+});
+import {
+  fireAndForgetHook,
+  buildCanonicalSentMessageHookContext,
+  toPluginMessageContext,
+  toPluginMessageSentEvent
+} from "openclaw/plugin-sdk/hook-runtime";
+import { getGlobalHookRunner } from "openclaw/plugin-sdk/plugin-runtime";
+async function applyWorkChatMessageSendingHook(params) {
+  const hookRunner = getGlobalHookRunner();
+  if (!hookRunner?.hasHooks("message_sending")) {
+    return { cancelled: false, text: params.text };
+  }
+  try {
+    const hookResult = await hookRunner.runMessageSending(
+      {
+        to: params.to,
+        content: params.text,
+        metadata: {
+          channel: CHANNEL_ID,
+          accountId: params.accountId,
+          ...params.mediaUrl ? { mediaUrls: [params.mediaUrl] } : {}
+        }
+      },
+      { channelId: CHANNEL_ID, accountId: params.accountId }
+    );
+    if (hookResult?.cancel) {
+      return { cancelled: true, text: params.text };
+    }
+    return {
+      cancelled: false,
+      text: hookResult?.content ?? params.text
+    };
+  } catch (err) {
+    logger.warn(`message_sending hook error, proceeding with send: ${String(err)}`);
+    return { cancelled: false, text: params.text };
+  }
+}
+function emitWorkChatMessageSent(params) {
+  const hookRunner = getGlobalHookRunner();
+  if (!hookRunner?.hasHooks("message_sent")) return;
+  const canonical = buildCanonicalSentMessageHookContext({
+    to: params.to,
+    content: params.content,
+    success: params.success,
+    error: params.error,
+    channelId: CHANNEL_ID,
+    accountId: params.accountId,
+    conversationId: params.to
+  });
+  fireAndForgetHook(
+    Promise.resolve(
+      hookRunner.runMessageSent(
+        toPluginMessageSentEvent(canonical),
+        toPluginMessageContext(canonical)
+      )
+    ),
+    "workchat: message_sent plugin hook failed"
+  );
+}
+var CHANNEL_ID;
+var init_outbound_hooks = __esm({
+  "src/messaging/outbound-hooks.ts"() {
+    "use strict";
+    init_logger();
+    CHANNEL_ID = "openclaw-workchat";
+  }
+});
+
 // src/messaging/debug-mode.ts
 import fs5 from "fs";
-import path5 from "path";
+import path6 from "path";
 function resolveDebugModePath() {
-  return path5.join(resolveStateDir(), "openclaw-workchat", "debug-mode.json");
+  return path6.join(resolveStateDir(), "openclaw-workchat", "debug-mode.json");
 }
 function loadState() {
   try {
@@ -27310,7 +27701,7 @@ function loadState() {
 }
 function saveState(state) {
   const filePath = resolveDebugModePath();
-  fs5.mkdirSync(path5.dirname(filePath), { recursive: true });
+  fs5.mkdirSync(path6.dirname(filePath), { recursive: true });
   fs5.writeFileSync(filePath, JSON.stringify(state, null, 2), "utf-8");
 }
 function toggleDebugMode(accountId) {
@@ -27420,77 +27811,73 @@ var init_slash_commands = __esm({
   }
 });
 
-// src/messaging/outbound-hooks.ts
-var outbound_hooks_exports = {};
-__export(outbound_hooks_exports, {
-  applyWorkChatMessageSendingHook: () => applyWorkChatMessageSendingHook,
-  emitWorkChatMessageSent: () => emitWorkChatMessageSent
-});
-import {
-  fireAndForgetHook,
-  buildCanonicalSentMessageHookContext,
-  toPluginMessageContext,
-  toPluginMessageSentEvent
-} from "openclaw/plugin-sdk/hook-runtime";
-import { getGlobalHookRunner } from "openclaw/plugin-sdk/plugin-runtime";
-async function applyWorkChatMessageSendingHook(params) {
-  const hookRunner = getGlobalHookRunner();
-  if (!hookRunner?.hasHooks("message_sending")) {
-    return { cancelled: false, text: params.text };
-  }
+// src/storage/seen-msgids.ts
+var seen_msgids_exports = {};
+__export(seen_msgids_exports, {
+  _resetSeenMsgIdsForTest: () => _resetSeenMsgIdsForTest,
+  isDuplicateMessage: () => isDuplicateMessage,
+  recordMessageProcessed: () => recordMessageProcessed
+});
+import fs6 from "fs";
+import path7 from "path";
+function resolveSeenFilePath(accountId) {
+  const safe = accountId.replace(/[^a-zA-Z0-9_-]/g, "_");
+  return path7.join(resolveStateDir(), "openclaw-workchat", "accounts", `${safe}.seen-msgids.json`);
+}
+function loadSeen(accountId) {
+  const cached2 = cache.get(accountId);
+  if (cached2) return cached2;
+  let ids = [];
   try {
-    const hookResult = await hookRunner.runMessageSending(
-      {
-        to: params.to,
-        content: params.text,
-        metadata: {
-          channel: CHANNEL_ID,
-          accountId: params.accountId,
-          ...params.mediaUrl ? { mediaUrls: [params.mediaUrl] } : {}
-        }
-      },
-      { channelId: CHANNEL_ID, accountId: params.accountId }
-    );
-    if (hookResult?.cancel) {
-      return { cancelled: true, text: params.text };
+    const raw = fs6.readFileSync(resolveSeenFilePath(accountId), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed.msgIds)) {
+      ids = parsed.msgIds.filter((x) => typeof x === "string" && x !== "");
     }
-    return {
-      cancelled: false,
-      text: hookResult?.content ?? params.text
-    };
+  } catch {
+  }
+  const entry = { ids, index: new Set(ids) };
+  cache.set(accountId, entry);
+  return entry;
+}
+function persistSeen(accountId, seen) {
+  try {
+    const filePath = resolveSeenFilePath(accountId);
+    fs6.mkdirSync(path7.dirname(filePath), { recursive: true });
+    fs6.writeFileSync(filePath, JSON.stringify({ msgIds: seen.ids }), "utf-8");
   } catch (err) {
-    logger.warn(`message_sending hook error, proceeding with send: ${String(err)}`);
-    return { cancelled: false, text: params.text };
+    logger.warn(`seen-msgids persist failed accountId=${accountId}: ${String(err)}`);
   }
 }
-function emitWorkChatMessageSent(params) {
-  const hookRunner = getGlobalHookRunner();
-  if (!hookRunner?.hasHooks("message_sent")) return;
-  const canonical = buildCanonicalSentMessageHookContext({
-    to: params.to,
-    content: params.content,
-    success: params.success,
-    error: params.error,
-    channelId: CHANNEL_ID,
-    accountId: params.accountId,
-    conversationId: params.to
-  });
-  fireAndForgetHook(
-    Promise.resolve(
-      hookRunner.runMessageSent(
-        toPluginMessageSentEvent(canonical),
-        toPluginMessageContext(canonical)
-      )
-    ),
-    "workchat: message_sent plugin hook failed"
-  );
+function isDuplicateMessage(accountId, msgId) {
+  if (!msgId) return false;
+  const seen = loadSeen(accountId);
+  return seen.index.has(msgId);
 }
-var CHANNEL_ID;
-var init_outbound_hooks = __esm({
-  "src/messaging/outbound-hooks.ts"() {
+function recordMessageProcessed(accountId, msgId) {
+  if (!msgId) return true;
+  const seen = loadSeen(accountId);
+  if (seen.index.has(msgId)) return false;
+  seen.index.add(msgId);
+  seen.ids.push(msgId);
+  if (seen.ids.length > SEEN_LIMIT) {
+    const drop = seen.ids.length - SEEN_LIMIT;
+    for (const old of seen.ids.splice(0, drop)) seen.index.delete(old);
+  }
+  persistSeen(accountId, seen);
+  return true;
+}
+function _resetSeenMsgIdsForTest() {
+  cache.clear();
+}
+var SEEN_LIMIT, cache;
+var init_seen_msgids = __esm({
+  "src/storage/seen-msgids.ts"() {
     "use strict";
+    init_state_dir();
     init_logger();
-    CHANNEL_ID = "openclaw-workchat";
+    SEEN_LIMIT = 500;
+    cache = /* @__PURE__ */ new Map();
   }
 });
 
@@ -27828,6 +28215,28 @@ function loadWorkChatOutboundHooks() {
   workchatOutboundHooksPromise ??= Promise.resolve().then(() => (init_outbound_hooks(), outbound_hooks_exports));
   return workchatOutboundHooksPromise;
 }
+async function downloadInboundMedia(url2, deps) {
+  try {
+    if (deps.channelRuntime?.media?.fetchRemoteMedia) {
+      const fetched = await deps.channelRuntime.media.fetchRemoteMedia({
+        url: url2,
+        maxBytes: WORKCHAT_MEDIA_MAX_BYTES
+      });
+      return { buffer: fetched.buffer, contentType: fetched.contentType };
+    }
+  } catch (err) {
+    logger.warn(`fetchRemoteMedia failed, trying plain fetch: ${String(err)}`);
+  }
+  const res = await globalThis.fetch(url2);
+  if (!res.ok) {
+    throw new Error(`inbound media download failed: HTTP ${res.status}`);
+  }
+  const buffer = Buffer.from(await res.arrayBuffer());
+  if (buffer.length > WORKCHAT_MEDIA_MAX_BYTES) {
+    throw new Error(`inbound media exceeds limit (${buffer.length} bytes)`);
+  }
+  return { buffer, contentType: res.headers.get("content-type") ?? void 0 };
+}
 async function applyWorkChatMessageSendingHook2(params) {
   try {
     const hooks = await loadWorkChatOutboundHooks();
@@ -27843,31 +28252,30 @@ function emitWorkChatMessageSent2(params) {
 async function handleAgentLifecycleEvent(frameType, result, deps) {
   const eventData = result.eventData;
   if (!eventData) return;
-  const agentId = String(eventData.id ?? eventData.agentId ?? "");
+  const agentId = String(eventData.id ?? eventData.agentId ?? "").trim();
   if (!agentId) {
     logger.warn(`${frameType}: missing agent id, ignoring`);
     return;
   }
-  const userId = String(eventData.futureId ?? eventData.userId ?? "");
+  const userId = String(eventData.futureId ?? eventData.userId ?? "").trim();
   logger.info(`${frameType}: agentId=${agentId} userId=${userId ? "present" : "missing"}`);
   deps.log(`${frameType}: agentId=${agentId}`);
-  const isRebind = listWorkChatAccountIdsCount() > 0;
+  const { completeWorkChatBinding: completeWorkChatBinding2 } = await Promise.resolve().then(() => (init_login_qr(), login_qr_exports));
+  const accountId = frameType === "init_agent" ? `agent-${agentId}` : deps.accountId;
   try {
-    const removed = await pruneStaleWorkChatAccounts(agentId);
+    const removed = await pruneOtherWorkChatAccounts(accountId);
     if (removed.length > 0) {
-      deps.log(`rebind: removed stale account(s): ${removed.join(", ")}`);
+      deps.log(`rebind: removed previous account(s): ${removed.join(", ")}`);
     }
   } catch (err) {
     logger.error(`rebind cleanup failed: ${String(err)}`);
   }
-  const { completeWorkChatBinding: completeWorkChatBinding2 } = await Promise.resolve().then(() => (init_login_qr(), login_qr_exports));
-  const accountId = frameType === "init_agent" ? isRebind ? `agent-${agentId}` : "default" : deps.accountId;
   try {
     saveWorkChatAccount(accountId, {
       agentId,
       ...userId ? { userId } : {}
     });
-    registerWorkChatAccountId(accountId);
+    await registerWorkChatAccountId(accountId);
     const { bindAgentToAccount: bindAgentToAccount2 } = await Promise.resolve().then(() => (init_bind_agent(), bind_agent_exports));
     await bindAgentToAccount2(accountId, agentId, userId);
     logger.info(`${frameType}: bound agent to account accountId=${accountId}`);
@@ -27889,9 +28297,6 @@ async function handleAgentLifecycleEvent(frameType, result, deps) {
     void notifyAgentCreatedStatus(deps.apiOpts, agentId);
   }
 }
-function listWorkChatAccountIdsCount() {
-  return listIndexedWorkChatAccountIds().length;
-}
 function loadCreateTypingCallbacks() {
   createTypingCallbacksPromise ??= (async () => {
     for (const specifier of ["openclaw/plugin-sdk/channel-runtime", "openclaw/plugin-sdk/channel-message"]) {
@@ -27975,13 +28380,21 @@ async function processOneFrame(result, rawFrame, deps) {
     logger.debug("inbound: empty body, ignoring");
     return;
   }
+  if (message.messageId) {
+    const { isDuplicateMessage: isDuplicateMessage2, recordMessageProcessed: recordMessageProcessed2 } = await Promise.resolve().then(() => (init_seen_msgids(), seen_msgids_exports));
+    if (isDuplicateMessage2(deps.accountId, message.messageId)) {
+      logger.info(`inbound: duplicate msgId=${message.messageId}, dropping`);
+      return;
+    }
+    recordMessageProcessed2(deps.accountId, message.messageId);
+  }
   const receivedAt = Date.now();
   const debug = isDebugMode(deps.accountId);
   const debugTrace = [];
   const debugTs = { received: receivedAt };
   const ctx = workChatMessageToMsgContext(message, deps.accountId);
   logger.info(
-    `inbound: from=${ctx.From} to=${ctx.To} bodyLen=${ctx.Body.length} conversationId=${ctx.ConversationId ?? "(none)"}`
+    `inbound: from=${ctx.From} to=${ctx.To} bodyLen=${ctx.Body.length} conversationId=${ctx.ConversationId ?? "(none)"} hasMedia=${Boolean(ctx.MediaUrl)}`
   );
   logger.debug(`inbound raw frame: ${rawFrame.slice(0, 200)}`);
   if (ctx.Body.trim().startsWith("/")) {
@@ -27996,6 +28409,24 @@ async function processOneFrame(result, rawFrame, deps) {
       return;
     }
   }
+  if (ctx.MediaUrl && deps.channelRuntime?.media?.saveMediaBuffer) {
+    try {
+      const media = await downloadInboundMedia(ctx.MediaUrl, deps);
+      if (media) {
+        const saved = await deps.channelRuntime.media.saveMediaBuffer(
+          media.buffer,
+          media.contentType,
+          "inbound",
+          WORKCHAT_MEDIA_MAX_BYTES
+        );
+        ctx.MediaPath = saved.path;
+        ctx.MediaType = media.contentType ?? ctx.MediaType;
+        logger.info(`inbound media saved: path=${saved.path} type=${media.contentType}`);
+      }
+    } catch (err) {
+      deps.errLog(`inbound media download failed url=${redactBody(ctx.MediaUrl)}: ${String(err)}`);
+    }
+  }
   const rawBody = ctx.Body?.trim() ?? "";
   ctx.CommandBody = rawBody;
   const senderId = ctx.From;
@@ -28096,7 +28527,10 @@ async function processOneFrame(result, rawFrame, deps) {
       const rawText = String(payload.text ?? "");
       const f = new StreamingMarkdownFilter2();
       let text = f.feed(rawText) + f.flush();
-      logger.info(`outbound: to=${ctx.To} textLen=${text.length}`);
+      const mediaUrl = payload.mediaUrl ?? payload.mediaUrls?.[0];
+      logger.info(
+        `outbound: to=${ctx.To} textLen=${text.length} mediaUrl=${mediaUrl ? "present" : "none"}`
+      );
       if (debug) {
         debugDeliveries.push({
           textLen: text.length,
@@ -28107,7 +28541,8 @@ async function processOneFrame(result, rawFrame, deps) {
       const sendingResult = await applyWorkChatMessageSendingHook2({
         to: ctx.To,
         text,
-        accountId: deps.accountId
+        accountId: deps.accountId,
+        mediaUrl
       });
       if (sendingResult.cancelled) {
         logger.info(`outbound: cancelled by message_sending hook to=${ctx.To}`);
@@ -28115,6 +28550,40 @@ async function processOneFrame(result, rawFrame, deps) {
       }
       text = sendingResult.text;
       try {
+        if (mediaUrl) {
+          const { isLocalMediaSource: isLocalMediaSource2, resolveLocalMediaPath: resolveLocalMediaPath2, downloadRemoteMediaToTemp: downloadRemoteMediaToTemp2, sendWorkChatMediaFile: sendWorkChatMediaFile2 } = await Promise.resolve().then(() => (init_send_media(), send_media_exports));
+          let filePath;
+          if (isLocalMediaSource2(mediaUrl)) {
+            filePath = resolveLocalMediaPath2(mediaUrl);
+            logger.debug(`outbound: local media resolved filePath=${filePath}`);
+          } else if (mediaUrl.startsWith("http://") || mediaUrl.startsWith("https://")) {
+            logger.debug(`outbound: downloading remote mediaUrl=${mediaUrl.slice(0, 80)}...`);
+            filePath = await downloadRemoteMediaToTemp2(mediaUrl);
+          } else {
+            logger.warn(
+              `outbound: unrecognized mediaUrl scheme, sending text only mediaUrl=${mediaUrl.slice(0, 80)}`
+            );
+            filePath = "";
+          }
+          if (filePath) {
+            await sendWorkChatMediaFile2({
+              account: {
+                ...deps.account,
+                agentId: ctx.AgentId ?? deps.account.agentId,
+                userId: ctx.From || deps.account.userId
+              },
+              to: ctx.To,
+              filePath,
+              text,
+              replyToMessageId: ctx.MessageSid,
+              conversationId: ctx.ConversationId,
+              agentId: ctx.AgentId
+            });
+            emitWorkChatMessageSent2({ to: ctx.To, content: text, success: true, accountId: deps.accountId });
+            logger.info(`outbound: media reply sent OK to=${ctx.To}`);
+            return;
+          }
+        }
         const result2 = await replyWorkChatMessage2({
           account: {
             ...deps.account,
@@ -28139,7 +28608,14 @@ async function processOneFrame(result, rawFrame, deps) {
     onError: (err, info) => {
       deps.errLog(`workchat reply ${info.kind}: ${String(err)}`);
       const errMsg = err instanceof Error ? err.message : String(err);
-      const notice = `\u26A0\uFE0F \u6D88\u606F\u53D1\u9001\u5931\u8D25\uFF1A${errMsg}`;
+      let notice;
+      if (errMsg.includes("remote media download failed")) {
+        notice = `\u26A0\uFE0F \u5A92\u4F53\u6587\u4EF6\u4E0B\u8F7D\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u94FE\u63A5\u662F\u5426\u53EF\u8BBF\u95EE\u3002`;
+      } else if (errMsg.includes("file upload response") || errMsg.includes("upload failed")) {
+        notice = `\u26A0\uFE0F \u5A92\u4F53\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002`;
+      } else {
+        notice = `\u26A0\uFE0F \u6D88\u606F\u53D1\u9001\u5931\u8D25\uFF1A${errMsg}`;
+      }
       void sendWorkChatErrorNotice({
         account: deps.account,
         to: ctx.To,
@@ -28209,7 +28685,7 @@ ${debugTrace.join("\n")}`;
     }
   }
 }
-var workchatOutboundHooksPromise, createTypingCallbacksPromise;
+var workchatOutboundHooksPromise, WORKCHAT_MEDIA_MAX_BYTES, createTypingCallbacksPromise;
 var init_process_message = __esm({
   "src/messaging/process-message.ts"() {
     "use strict";
@@ -28223,6 +28699,7 @@ var init_process_message = __esm({
     init_inbound();
     init_slash_commands();
     workchatOutboundHooksPromise = null;
+    WORKCHAT_MEDIA_MAX_BYTES = 100 * 1024 * 1024;
   }
 });
 
@@ -28277,8 +28754,8 @@ async function monitorWorkChatProvider(opts) {
         localIp: opts.localIp
       });
       const url2 = `${endpoint}?ticket=${encodeURIComponent(ticket)}`;
-      const dispatcher = apiOpts.allowInsecureTls ? new import_undici3.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
-      ws = new import_undici3.WebSocket(url2, dispatcher ? { dispatcher } : void 0);
+      const dispatcher = apiOpts.allowInsecureTls ? new import_undici2.Agent({ connect: { rejectUnauthorized: false } }) : void 0;
+      ws = new import_undici2.WebSocket(url2, dispatcher ? { dispatcher } : void 0);
       await new Promise((resolve, reject) => {
         const timer = setTimeout(
           () => reject(new Error("workchat websocket connection timeout")),
@@ -28411,11 +28888,11 @@ async function monitorWorkChatProvider(opts) {
     }
   }
 }
-var import_undici3, WS_CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_BASE_MS, RECONNECT_BACKOFF_MAX_MS, RATE_LIMIT_BACKOFF_MS;
+var import_undici2, WS_CONNECT_TIMEOUT_MS, RECONNECT_BACKOFF_BASE_MS, RECONNECT_BACKOFF_MAX_MS, RATE_LIMIT_BACKOFF_MS;
 var init_monitor = __esm({
   "src/monitor/monitor.ts"() {
     "use strict";
-    import_undici3 = __toESM(require_undici(), 1);
+    import_undici2 = __toESM(require_undici(), 1);
     init_api();
     init_api();
     init_inbound();
@@ -29529,8 +30006,10 @@ import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-sch
 
 // src/channel.ts
 init_accounts();
+init_types();
 init_login_qr();
 init_send();
+init_send_media();
 init_logger();
 function resolveOutboundAccount(cfg, accountId) {
   const allIds = listWorkChatAccountIds(cfg);
@@ -29583,7 +30062,8 @@ var workchatPlugin = {
     messageToolHints: () => [
       "To send a message to the current WorkChat user, use the message tool with action='send'. You do not need to specify 'to' \u2014 the current conversation recipient is used automatically.",
       "IMPORTANT: When creating a cron job (scheduled task) for the current WorkChat user, you MUST set delivery.to to the user's WorkChat ID (the numeric ID from the current conversation) AND set delivery.accountId to the current AccountId. Without an explicit 'to', the cron delivery will fail with 'requires target'. Without an explicit 'accountId', the message may be sent from the wrong bot account. Example: delivery: { mode: 'announce', channel: 'openclaw-workchat', to: '<current_user_id>', accountId: '<current_AccountId>' }.",
-      "IMPORTANT: When sending media, set 'media' to a URL the WorkChat platform can fetch (an HTTPS URL). Local file paths are not supported by the WorkChat send API yet \u2014 include the link in the message text instead."
+      "To send an image or audio file to the current user, use the message tool with action='send' and set 'media' to a local file path or a remote HTTPS URL. Supported audio formats: wav, m4a, mp3; supported image formats: bmp, gif, jpg, jpeg, png, webp. Remote URLs are downloaded and re-uploaded to WorkChat storage automatically \u2014 the client renders image/audio cards, never bare links.",
+      "IMPORTANT: When generating or saving a file to send, always use an absolute path (e.g. /tmp/photo.png or C:\\tmp\\photo.png on Windows), never a relative path like ./photo.png. Relative paths cannot be resolved and the file will not be delivered."
     ]
   },
   reload: { configPrefixes: ["channels.openclaw-workchat"] },
@@ -29618,13 +30098,62 @@ var workchatPlugin = {
     },
     sendMedia: async (ctx) => {
       const account = resolveOutboundAccount(ctx.cfg, ctx.accountId);
-      const text = ctx.text?.trim() ? ctx.text : ctx.mediaUrl ?? "";
-      const result = await pushWorkChatMessage({
-        account,
+      const aLog = logger.withAccount(account.accountId);
+      const mediaUrl = ctx.mediaUrl?.trim();
+      let text = ctx.text ?? "";
+      const { applyWorkChatMessageSendingHook: applyWorkChatMessageSendingHook3, emitWorkChatMessageSent: emitWorkChatMessageSent3 } = await Promise.resolve().then(() => (init_outbound_hooks(), outbound_hooks_exports));
+      const sendingResult = await applyWorkChatMessageSendingHook3({
         to: ctx.to,
-        text
+        text,
+        accountId: account.accountId,
+        mediaUrl
+      }).catch((err) => {
+        aLog.warn(`message_sending hook error, proceeding: ${String(err)}`);
+        return { cancelled: false, text };
       });
-      return { channel: "openclaw-workchat", messageId: result.messageId };
+      if (sendingResult.cancelled) {
+        aLog.info(`sendMedia: cancelled by message_sending hook to=${ctx.to}`);
+        return { channel: "openclaw-workchat", messageId: "" };
+      }
+      text = sendingResult.text;
+      if (!mediaUrl) {
+        try {
+          const result = await pushWorkChatMessage({ account, to: ctx.to, text });
+          emitWorkChatMessageSent3({ to: ctx.to, content: text, success: true, accountId: account.accountId });
+          return { channel: "openclaw-workchat", messageId: result.messageId };
+        } catch (err) {
+          emitWorkChatMessageSent3({ to: ctx.to, content: text, success: false, error: String(err), accountId: account.accountId });
+          throw err;
+        }
+      }
+      let filePath;
+      try {
+        if (isLocalMediaSource(mediaUrl)) {
+          filePath = resolveLocalMediaPath(mediaUrl);
+          aLog.debug(`sendMedia: uploading local file ${filePath}`);
+        } else {
+          aLog.debug(`sendMedia: downloading remote mediaUrl=${mediaUrl.slice(0, 80)}...`);
+          filePath = await downloadRemoteMediaToTemp(mediaUrl);
+          aLog.debug(`sendMedia: remote media downloaded to ${filePath}`);
+        }
+      } catch (err) {
+        emitWorkChatMessageSent3({ to: ctx.to, content: text, success: false, error: String(err), accountId: account.accountId });
+        throw err;
+      }
+      try {
+        const result = await sendWorkChatMediaFile({
+          account,
+          to: ctx.to,
+          filePath,
+          text,
+          replyToMessageId: ctx.replyToId?.trim() || void 0
+        });
+        emitWorkChatMessageSent3({ to: ctx.to, content: text, success: true, accountId: account.accountId });
+        return { channel: "openclaw-workchat", messageId: result.messageId };
+      } catch (err) {
+        emitWorkChatMessageSent3({ to: ctx.to, content: text, success: false, error: String(err), accountId: account.accountId });
+        throw err;
+      }
     }
   },
   status: {
@@ -29705,11 +30234,13 @@ var workchatPlugin = {
     loginWithQrStart: async ({ accountId, force, verbose }) => {
       const { loadConfig } = await import("openclaw/plugin-sdk/config-runtime");
       const cfg = loadConfig();
-      const account = resolveWorkChatAccount(cfg, accountId ?? "default");
+      const requestedAccountId = accountId?.trim() || listWorkChatAccountIds(cfg)[0];
+      const existing = requestedAccountId ? resolveWorkChatAccount(cfg, requestedAccountId) : void 0;
+      const section = cfg.channels?.["openclaw-workchat"];
       const result = await startWorkChatLoginWithQr({
-        baseUrl: account.baseUrl,
-        appKey: account.appKey,
-        appSecret: account.appSecret
+        baseUrl: existing?.baseUrl || section?.baseUrl || DEFAULT_BASE_URL,
+        appKey: existing?.appKey || section?.appKey?.trim() || void 0,
+        appSecret: existing?.appSecret || section?.appSecret?.trim() || void 0
       });
       return {
         qrDataUrl: result.qrcodeUrl,
@@ -29816,6 +30347,9 @@ function assertHostCompatibility(hostVersion) {
   );
 }
 
+// index.ts
+init_accounts();
+
 // node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -30633,10 +31167,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path6) {
-  if (!path6)
+function getElementAtPath(obj, path8) {
+  if (!path8)
     return obj;
-  return path6.reduce((acc, key) => acc?.[key], obj);
+  return path8.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -30976,11 +31510,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path6, issues) {
+function prefixIssues(path8, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path6);
+    iss.path.unshift(path8);
     return iss;
   });
 }
@@ -31442,16 +31976,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path6 = []) => {
+  const processError = (error63, path8 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path6, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -31490,17 +32024,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path6 = []) => {
+  const processError = (error63, path8 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path8, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path8, ...issue2.path]);
       } else {
-        const fullpath = [...path6, ...issue2.path];
+        const fullpath = [...path8, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -31539,8 +32073,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path6) {
+  const path8 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path8) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -48669,13 +49203,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path6 = ref.slice(1).split("/").filter(Boolean);
-  if (path6.length === 0) {
+  const path8 = ref.slice(1).split("/").filter(Boolean);
+  if (path8.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path6[0] === defsKey) {
-    const key = path6[1] === void 0 ? void 0 : decodeJSONPointerSegment(path6[1]);
+  if (path8[0] === defsKey) {
+    const key = path8[1] === void 0 ? void 0 : decodeJSONPointerSegment(path8[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -49309,21 +49843,21 @@ function visit(schema, fnOrHandlers) {
     const h = fnOrHandlers[node2._zod.def.type];
     return h ? h(node2, rewritten) : node2;
   };
-  const cache = /* @__PURE__ */ new Map();
+  const cache2 = /* @__PURE__ */ new Map();
   function run(s) {
-    const cached2 = cache.get(s);
+    const cached2 = cache2.get(s);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache.get(s)
+        getter: () => cache2.get(s)
       });
     }
     if (cached2 !== void 0)
       return cached2;
-    cache.set(s, RESOLVING);
+    cache2.set(s, RESOLVING);
     const inner = mapInner(s);
     const mapped = fn(inner, inner !== s);
-    cache.set(s, mapped);
+    cache2.set(s, mapped);
     return mapped;
   }
   function mapInner(s) {
@@ -49552,6 +50086,9 @@ var openclaw_workchat_default = {
   configSchema: buildChannelConfigSchema(WorkChatConfigSchema),
   register(api) {
     assertHostCompatibility(api.runtime?.version);
+    void migrateLegacyDefaultWorkChatAccount().catch((err) => {
+      console.error("[openclaw-workchat] legacy default account migration failed:", err);
+    });
     api.registerChannel({ plugin: workchatPlugin });
   }
 };