@xgjktech/xg_cwork_im 1.0.8 → 1.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xgjktech/xg_cwork_im",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "XG CWork IM channel plugin for OpenClaw",
   "keywords": [
     "bot",

package/src/channel.ts

@@ -14,6 +14,7 @@ import { buildChannelConfigSchema } from "openclaw/plugin-sdk";
 import { z } from "zod";
 import { clearTokenCache, getToken } from "./auth.js";
 import { startWebSocket, type ImStreamClient } from "./connection.js";
+import { normalizeInboundWorkspaceSubdir, saveInboundFilesToWorkspace } from "./inbound-media-local.js";
 import { sendReplyDeliverBlock, sendTextMessage, type ReplyDeliverPayload } from "./send-service.js";
 import {
     imFormatToMimeType,
@@ -53,6 +54,7 @@ const XgImAccountConfigSchema = z.object({
     groupPolicy: z.enum(["open", "mention"]).optional().default("mention"),
     fileUploadFormField: z.string().min(1).optional(),
     maxAttachmentBytes: z.number().int().positive().optional(),
+    inboundMediaWorkspaceSubdir: z.string().optional(),
 });
 
 const XgImConfigSchema = z.object({
@@ -71,9 +73,26 @@ const XgImConfigSchema = z.object({
     reconnectJitter: z.number().min(0).max(1).optional().default(0.3),
     fileUploadFormField: z.string().min(1).optional(),
     maxAttachmentBytes: z.number().int().positive().optional(),
+    /**
+     * 非空时：将入站附件下载到 `resolveAgentWorkspaceDir(cfg)` 下该相对子目录，
+     * 再向 OpenClaw 传本地 file:// 路径（见 inbound-media-local）。
+     */
+    inboundMediaWorkspaceSubdir: z.string().optional(),
     // 多账户：对象 map（key 为 accountId）
     accounts: z.record(z.string(), XgImAccountConfigSchema).optional(),
 }).superRefine((val, ctx) => {
+    const badSubdir = (s: string | undefined): boolean =>
+        typeof s === "string" && s.trim().length > 0 && normalizeInboundWorkspaceSubdir(s) == null;
+
+    if (badSubdir(val.inboundMediaWorkspaceSubdir)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["inboundMediaWorkspaceSubdir"],
+            message:
+                "inboundMediaWorkspaceSubdir must be a relative path under workspace (no .., no absolute path)",
+        });
+    }
+
     const accounts = val.accounts;
     if (!accounts) return;
     for (const [key, acc] of Object.entries(accounts)) {
@@ -86,6 +105,14 @@ const XgImConfigSchema = z.object({
                 message: "appKey is required for account entries (except accounts.default)",
             });
         }
+        if (badSubdir(acc.inboundMediaWorkspaceSubdir)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["accounts", key, "inboundMediaWorkspaceSubdir"],
+                message:
+                    "inboundMediaWorkspaceSubdir must be a relative path under workspace (no .., no absolute path)",
+            });
+        }
     }
 });
 
@@ -129,6 +156,53 @@ function isConfigured(cfg: OpenClawConfig): boolean {
     }
 }
 
+/**
+ * OpenClaw 对入站命令：`CommandAuthorized === undefined` 会按 false 处理，文本 /command 会被静默忽略（仍走普通 AI）。
+ * 见 openclaw LINE #26996 等修复。此处与 channels.xg_cwork_im.allowFrom 对齐；allowFrom 为空表示不限制发送者。
+ */
+function isSenderInXgImAllowFrom(config: XgImConfig, senderId: string | undefined): boolean {
+    const allow = config.allowFrom ?? [];
+    if (allow.length === 0) return true;
+    const id = senderId?.trim();
+    if (!id) return false;
+    return allow.includes(id);
+}
+
+function resolveInboundCommandAuthorized(
+    rt: unknown,
+    cfg: OpenClawConfig,
+    p: { accountId: string; senderId: string | undefined; config: XgImConfig },
+): boolean {
+    const r = rt as {
+        channel?: {
+            commands?: {
+                resolveControlCommandGate?: (args: Record<string, unknown>) =>
+                    | boolean
+                    | { commandAuthorized?: boolean };
+            };
+        };
+    };
+    const fn = r?.channel?.commands?.resolveControlCommandGate;
+    if (typeof fn === "function") {
+        try {
+            const out = fn({
+                cfg,
+                channel: "xg_cwork_im",
+                accountId: p.accountId,
+                senderId: p.senderId ?? "",
+                chatType: "group",
+            });
+            if (typeof out === "boolean") return out;
+            if (out && typeof out === "object" && "commandAuthorized" in out) {
+                return Boolean((out as { commandAuthorized?: boolean }).commandAuthorized);
+            }
+        } catch {
+            /* 回退到 allowFrom */
+        }
+    }
+    return isSenderInXgImAllowFrom(p.config, p.senderId);
+}
+
 // ─── 日志适配器 ───────────────────────────────────────────────────────────────
 // ChannelLogSink 的 info/warn/error 方法接受单个 string
 
@@ -157,11 +231,26 @@ function collectFileItems(msgContent: WsMessageContent | undefined): MsgFileVO[]
 function buildInboundDisplayText(msgContent: WsMessageContent | undefined, fileItems: MsgFileVO[]): string {
     let rawText = msgContent?.text ?? "";
     if (fileItems.length > 0) {
-        const names = fileItems
-            .map((f) => f.name?.trim() || f.fileId || "未命名文件")
-            .join("、");
-        const fileNote = `[附件 ${fileItems.length} 个: ${names}]`;
-        rawText = rawText.trim() ? `${rawText.trim()}\n\n${fileNote}` : fileNote;
+        const lines = fileItems.map((f) => {
+            const name = f.name?.trim() || f.fileId || "未命名文件";
+            const mime = imFormatToMimeType(f.format);
+            return mime ? `- \`${name}\` (${mime})` : `- \`${name}\``;
+        });
+        const block = `**附件（${fileItems.length}）**\n${lines.join("\n")}`;
+        rawText = rawText.trim() ? `${rawText.trim()}\n\n${block}` : block;
+
+        const parsedParts = fileItems
+            .map((f) => {
+                const c = f.content?.trim();
+                if (!c) return null;
+                const name = f.name?.trim() || f.fileId || "未命名文件";
+                return `### ${name}\n\n${c}`;
+            })
+            .filter((x): x is string => x != null);
+        if (parsedParts.length > 0) {
+            const parsedBlock = `**附件解析内容**\n\n${parsedParts.join("\n\n")}`;
+            rawText = `${rawText.trim()}\n\n${parsedBlock}`;
+        }
     }
     return rawText;
 }
@@ -187,23 +276,39 @@ function mediaFieldsFromFileItems(fileItems: MsgFileVO[]): Record<string, unknow
     const mimes = fileItems.map(
         (f) => imFormatToMimeType(f.format) ?? "application/octet-stream",
     );
+    // OpenClaw 入站展示与媒体拉取以 MediaPath(s) 为准；[media attached: …] 依赖 Path，仅写 MediaUrl 时该段不出现。
+    // 不要同时写 Path 与 Url（同链接会被拼成两段，出现 `url | url`）。
+    if (fileItems.length === 1) {
+        return {
+            MediaPath: fileItems[0]!.url,
+            MediaType: mimes[0],
+        };
+    }
     return {
-        MediaPath: fileItems[0]!.url,
-        MediaUrl: fileItems[0]!.url,
         MediaPaths: fileItems.map((f) => f.url),
-        MediaUrls: fileItems.map((f) => f.url),
-        MediaType: mimes[0],
         MediaTypes: mimes,
     };
 }
 
-function untrustedContextFromExtAndBackground(
+/** ext / 用户 background / 附件元数据（不含下载 URL，避免预签名链过长；URL 已在入站 MediaPath(s)） */
+function buildUntrustedContext(
     msgExt: WsMessageContent["ext"],
     senderBackground: string | undefined,
+    fileItems: MsgFileVO[],
 ): string[] | undefined {
     const parts: string[] = [];
     if (msgExt) parts.push(JSON.stringify(msgExt));
     if (senderBackground) parts.push(String(senderBackground));
+    if (fileItems.length > 0) {
+        const summary = fileItems.map((f) => ({
+            name: f.name ?? null,
+            format: f.format ?? null,
+            fileId: f.fileId ?? null,
+            size: f.size ?? null,
+            contentChars: f.content?.trim() ? f.content.trim().length : null,
+        }));
+        parts.push(`xg_cwork_im.attachments: ${JSON.stringify(summary)}`);
+    }
     return parts.length > 0 ? parts : undefined;
 }
 
@@ -556,12 +661,25 @@ export const xgCworkImChannelPlugin: XgImChannelPlugin = {
                     }
 
                     const msgContent = params.msgContent;
-                    const fileItems = collectFileItems(msgContent);
+                    let fileItems = collectFileItems(msgContent);
                     const msgExt = msgContent?.ext;
                     const senderId = params.userInfo?.id;
                     const senderName = params.userInfo?.name || senderId || "";
                     const senderBackground = params.userInfo?.background;
 
+                    const inboundSub = config.inboundMediaWorkspaceSubdir?.trim();
+                    if (inboundSub && fileItems.length > 0 && normalizeInboundWorkspaceSubdir(inboundSub)) {
+                        fileItems = await saveInboundFilesToWorkspace({
+                            rt,
+                            cfg: ctx.cfg,
+                            config,
+                            workspaceSubdir: inboundSub,
+                            senderUserId: senderId,
+                            fileItems,
+                            log,
+                        });
+                    }
+
                     const text = buildInboundDisplayText(msgContent, fileItems);
 
                     if (!text.trim() && fileItems.length === 0) {
@@ -609,10 +727,17 @@ export const xgCworkImChannelPlugin: XgImChannelPlugin = {
                         envelope: envelopeOptions,
                     });
 
+                    const commandAuthorized = resolveInboundCommandAuthorized(rt, ctx.cfg, {
+                        accountId: account.accountId,
+                        senderId,
+                        config,
+                    });
+
                     const inboundCtx = rt.channel.reply.finalizeInboundContext({
                         Body: body,
                         RawBody: text,
                         CommandBody: text,
+                        CommandAuthorized: commandAuthorized,
                         From: params.groupId,
                         To: params.groupId,
                         SessionKey: route.sessionKey,
@@ -630,7 +755,7 @@ export const xgCworkImChannelPlugin: XgImChannelPlugin = {
                         OriginatingTo: params.groupId,
                         GroupChannel: route.sessionKey,
                         ...mediaFieldsFromFileItems(fileItems),
-                        UntrustedContext: untrustedContextFromExtAndBackground(msgExt, senderBackground),
+                        UntrustedContext: buildUntrustedContext(msgExt, senderBackground, fileItems),
                         // 同时保留原始 ext 供可能的后续逻辑使用
                         XgImExt: msgExt,
                     });