@xmanrui/dsh-im 1.1.0 → 1.3.0

package/src/channels/weixin/weixin-bridge.mjs

@@ -1,4 +1,5 @@
 import {
+  extractWeixinFiles,
   extractWeixinImages,
   extractWeixinText,
   splitWeixinText,
@@ -31,6 +32,11 @@ import {
   imagePromptUserMessage,
   promptContentForMessage,
 } from '../shared/image-prompt.mjs';
+import {
+  hasInboundFiles,
+  inboundFileUserMessage,
+  prefetchInboundFiles,
+} from '../shared/inbound-file.mjs';
 import { rememberConnectionTestTarget } from '../shared/connection-test.mjs';
 import {
   materializeOutboundArtifact,
@@ -49,7 +55,7 @@ const GENERIC_PROCESSING_ERROR = '消息处理失败，请稍后重试。';
 const HELP_TEXT = [
   '微信已连接 DeepSeek Harness。',
   '',
-  '直接发送文字、图片或带文字识别结果的语音即可继续当前会话。',
+  '直接发送文字、图片、文件或带文字识别结果的语音即可继续当前会话。',
   '/new  开启一个全新会话',
   '/compact  压缩当前会话的较早上下文',
   '/workspace 工作区绝对路径  切换工作区',
@@ -77,15 +83,33 @@ function nonEmptyString(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : null;
 }
 
+export function weixinInboundMessage(message, api) {
+  return {
+    content: extractWeixinText(message) ?? '',
+    images: typeof api?.inboundImages === 'function'
+      ? api.inboundImages(message)
+      : extractWeixinImages(message),
+    files: typeof api?.inboundFiles === 'function'
+      ? api.inboundFiles(message)
+      : extractWeixinFiles(message),
+  };
+}
+
 function hasWeixinImageItems(message) {
   return Array.isArray(message?.item_list)
     && message.item_list.some((item) => item?.image_item && typeof item.image_item === 'object');
 }
 
+function hasWeixinFileItems(message) {
+  return Array.isArray(message?.item_list)
+    && message.item_list.some((item) => item?.file_item && typeof item.file_item === 'object');
+}
+
 function canClaimInteractionReply(message, pending) {
   return pending.questions[pending.index]
     && nonEmptyString(message?.from_user_id) === pending.actor
     && !hasWeixinImageItems(message)
+    && !hasWeixinFileItems(message)
     && nonEmptyString(extractWeixinText(message));
 }
 
@@ -204,7 +228,7 @@ export class WeixinHarnessBridge {
     const runId = nonEmptyString(message?.run_id) ?? undefined;
     const pending = this.#pendingInteractions.get(key);
     const commandText = nonEmptyString(extractWeixinText(message)) ?? '';
-    const commandRunner = isControlCommand(commandText)
+    const commandRunner = hasWeixinFileItems(message) ? null : isControlCommand(commandText)
       ? runControlCommand
       : (isModelCommand(commandText)
           ? runModelCommand
@@ -238,7 +262,9 @@ export class WeixinHarnessBridge {
       key,
       actor: sender,
       messageId,
-      text: hasWeixinImageItems(message) ? '' : extractWeixinText(message),
+      text: hasWeixinImageItems(message) || hasWeixinFileItems(message)
+        ? ''
+        : extractWeixinText(message),
       addressed: true,
       hasPendingQuestion: Boolean(pending),
       questionCompletion: pending?.submitting || pending?.claimedReplyMessageId
@@ -290,10 +316,16 @@ export class WeixinHarnessBridge {
     releaseMessageId = true,
     alreadyRecorded = false,
   } = {}) {
+    const preparedMessage = message.from_user_id === this.#ownerUserId
+      ? prefetchInboundFiles(
+          weixinInboundMessage(message, this.#api),
+          { signal: this.#signal },
+        )
+      : undefined;
     const previous = this.#queues.get(key) ?? Promise.resolve();
     const current = previous
       .catch(() => undefined)
-      .then(() => this.#process(message, key, { alreadyRecorded }))
+      .then(() => this.#process(message, key, { alreadyRecorded, preparedMessage }))
       .finally(() => {
         if (releaseMessageId) this.#acceptedMessageIds.delete(messageId);
         if (this.#queues.get(key) === current) this.#queues.delete(key);
@@ -331,6 +363,7 @@ export class WeixinHarnessBridge {
     const result = await runner(text, this.#harness, this.#state, key, {
       signal: this.#signal,
       hasImages: hasWeixinImageItems(message),
+      hasFiles: hasWeixinFileItems(message),
       pendingInteraction: this.#pendingInteractions.has(key)
         || this.#approvals.hasPending(key),
       control: { owner: this, key },
@@ -348,7 +381,7 @@ export class WeixinHarnessBridge {
     this.#status.lastMessageError = null;
   }
 
-  async #process(message, key, { alreadyRecorded = false } = {}) {
+  async #process(message, key, { alreadyRecorded = false, preparedMessage } = {}) {
     this.#signal?.throwIfAborted();
     const messageId = weixinMessageId(message);
     const sender = nonEmptyString(message?.from_user_id);
@@ -366,38 +399,36 @@ export class WeixinHarnessBridge {
 
     const contextToken = typeof message.context_token === 'string' ? message.context_token : undefined;
     const runId = typeof message.run_id === 'string' ? message.run_id : undefined;
-    const text = extractWeixinText(message) ?? '';
     try {
-      const images = typeof this.#api.inboundImages === 'function'
-        ? this.#api.inboundImages(message)
-        : extractWeixinImages(message);
-      const promptMessage = { content: text, images };
+      const promptMessage = preparedMessage ?? weixinInboundMessage(message, this.#api);
+      const text = promptMessage.content;
       const hasImages = hasInboundImages(promptMessage);
-      if (!text && !hasImages) {
-        await this.#send(sender, '目前支持文字、图片，以及微信已转成文字的语音消息。', contextToken, runId);
+      const hasFiles = hasInboundFiles(promptMessage);
+      if (!text && !hasImages && !hasFiles) {
+        await this.#send(sender, '目前支持文字、图片、文件，以及微信已转成文字的语音消息。', contextToken, runId);
         await this.#state.markSeen(messageId);
         return;
       }
 
       const command = text.trim().toLowerCase();
-      if (!hasImages && command === '/help') {
+      if (!hasImages && !hasFiles && command === '/help') {
         await this.#send(sender, HELP_TEXT, contextToken, runId);
         await this.#state.markSeen(messageId);
         return;
       }
-      if (!hasImages && command === '/status') {
+      if (!hasImages && !hasFiles && command === '/status') {
         await this.#harness.ensureRunning({ signal: this.#signal });
         await this.#send(sender, '微信与 DeepSeek Harness 连接正常。', contextToken, runId);
         await this.#state.markSeen(messageId);
         return;
       }
-      if (!hasImages && command === '/new') {
+      if (!hasImages && !hasFiles && command === '/new') {
         await this.#state.clearSession(key);
         await this.#send(sender, '已开启新会话。请发送你的问题。', contextToken, runId);
         await this.#state.markSeen(messageId);
         return;
       }
-      const workspaceCommand = hasImages
+      const workspaceCommand = hasImages || hasFiles
         ? null
         : await runWorkspaceCommand(text, this.#harness, key);
       if (workspaceCommand) {
@@ -407,7 +438,7 @@ export class WeixinHarnessBridge {
         await this.#state.markSeen(messageId);
         return;
       }
-      const compactCommand = hasImages
+      const compactCommand = hasImages || hasFiles
         ? null
         : await runCompactCommand(
             text,
@@ -446,6 +477,7 @@ export class WeixinHarnessBridge {
               runId,
             }),
             onInteractionResolved: (resolution) => this.#handleInteractionResolved(resolution),
+            files: promptMessage.files,
           },
         }));
       } finally {
@@ -490,7 +522,9 @@ export class WeixinHarnessBridge {
       }
       if (this.#signal?.aborted) return;
       this.#status.lastError = error?.message ?? String(error);
-      const userMessage = imagePromptUserMessage(error) ?? GENERIC_PROCESSING_ERROR;
+      const userMessage = inboundFileUserMessage(error)
+        ?? imagePromptUserMessage(error)
+        ?? GENERIC_PROCESSING_ERROR;
       this.#status.lastMessageError = safeMessageError(error, userMessage);
       this.#logger.error?.('[dsh-weixin] failed to process an inbound message:', error);
       try {

package/src/channels/whatsapp/config-store.mjs

@@ -5,6 +5,13 @@ import { dirname } from 'node:path';
 const EMPTY_DOCUMENT = Object.freeze({ version: 2, bots: Object.freeze([]) });
 const BOT_ID_PATTERN = /^whatsapp_[a-f0-9]{24}$/;
 const AUTH_DIRECTORY_PATTERN = /^[a-f0-9-]{36}$/;
+const WHATSAPP_PHONE_NUMBER = /^[1-9]\d{4,14}$/;
+
+export const WHATSAPP_ACCESS_MODES = Object.freeze({
+  selfOnly: 'self-only',
+  privateAllowlist: 'private-allowlist',
+  open: 'open',
+});
 
 function cleanString(value) {
   return typeof value === 'string' && value.trim() ? value.trim() : null;
@@ -28,6 +35,35 @@ export function maskWhatsappAccount(accountJid) {
   return `${digits.slice(0, 4)}••••${digits.slice(-4)}`;
 }
 
+export function normalizeWhatsappAllowedNumbers(value) {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value)) {
+    throw new TypeError('allowedNumbers must be an array of WhatsApp phone numbers');
+  }
+  const normalized = value.map((entry) => {
+    const number = typeof entry === 'string' ? entry.trim().replace(/^\+/, '') : '';
+    if (!WHATSAPP_PHONE_NUMBER.test(number)) {
+      throw new TypeError('allowedNumbers contains an invalid WhatsApp phone number');
+    }
+    return number;
+  });
+  return Object.freeze([...new Set(normalized)]);
+}
+
+export function normalizeWhatsappAccessPolicy(value = {}) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new TypeError('WhatsApp access policy must be an object');
+  }
+  const accessMode = value.accessMode ?? WHATSAPP_ACCESS_MODES.selfOnly;
+  if (!Object.values(WHATSAPP_ACCESS_MODES).includes(accessMode)) {
+    throw new TypeError('WhatsApp accessMode is invalid');
+  }
+  return Object.freeze({
+    accessMode,
+    allowedNumbers: normalizeWhatsappAllowedNumbers(value.allowedNumbers),
+  });
+}
+
 export class WhatsappConfigStore {
   #path;
   #value = EMPTY_DOCUMENT;
@@ -112,6 +148,12 @@ export class WhatsappConfigStore {
     if (!accountJid || !botId || !authDirectory || !name
       || !BOT_ID_PATTERN.test(botId) || !AUTH_DIRECTORY_PATTERN.test(authDirectory)
       || deriveWhatsappBotId(accountJid) !== botId) return null;
+    let accessPolicy;
+    try {
+      accessPolicy = normalizeWhatsappAccessPolicy(value);
+    } catch {
+      return null;
+    }
     return Object.freeze({
       botId,
       accountJid,
@@ -119,6 +161,7 @@ export class WhatsappConfigStore {
       name,
       createdAt: cleanString(value.createdAt) ?? new Date().toISOString(),
       connectedAt: cleanString(value.connectedAt),
+      ...accessPolicy,
     });
   }
 

package/src/channels/whatsapp/whatsapp-controller.mjs

@@ -1,7 +1,11 @@
 import { randomUUID } from 'node:crypto';
 
 import { connectionTestMessage } from '../shared/connection-test.mjs';
-import { deriveWhatsappBotId, maskWhatsappAccount } from './config-store.mjs';
+import {
+  deriveWhatsappBotId,
+  maskWhatsappAccount,
+  normalizeWhatsappAccessPolicy,
+} from './config-store.mjs';
 
 const ACTIVE_ATTEMPT_STATES = new Set(['starting', 'pending', 'connecting']);
 const TERMINAL_ATTEMPT_STATES = new Set(['connected', 'failed', 'cancelled']);
@@ -218,6 +222,20 @@ export class WhatsappController {
     });
   }
 
+  async setAccessPolicy(botId, value) {
+    if (this.#closed) throw new Error('WhatsApp controller is closed');
+    const accessPolicy = normalizeWhatsappAccessPolicy(value);
+    await this.#withBotTransition(botId, async () => {
+      if (this.#closed) throw new Error('WhatsApp controller is closed');
+      const config = this.#configStore.get(botId);
+      if (!config) throw new Error('Unknown WhatsApp bot');
+      const saved = await this.#configStore.save({ ...config, ...accessPolicy });
+      this.#runtimes.get(botId)?.setAccessPolicy?.(saved);
+      this.#touch();
+    });
+    return this.status();
+  }
+
   async deleteBot(botId) {
     const config = this.#configStore.get(botId);
     if (!config) throw new Error('Unknown WhatsApp bot');
@@ -266,6 +284,7 @@ export class WhatsappController {
           messagesReceived: runtimeStatus?.messagesReceived ?? 0,
           messagesReplied: runtimeStatus?.messagesReplied ?? 0,
         },
+        accessPolicy: normalizeWhatsappAccessPolicy(config),
         error: structuredClone(this.#errors.get(config.botId) ?? null),
       };
     });
@@ -310,6 +329,8 @@ export class WhatsappController {
       name: identity.name,
       createdAt: previous?.createdAt ?? new Date().toISOString(),
       connectedAt: new Date().toISOString(),
+      accessMode: previous?.accessMode,
+      allowedNumbers: previous?.allowedNumbers,
     };
     try {
       if (record.controller.signal.aborted || this.#closed) throw Object.assign(new Error(), { name: 'AbortError' });

package/src/channels/whatsapp/whatsapp-runtime.mjs

@@ -10,6 +10,10 @@ import { splitMessageText } from '../shared/editable-message-stream.mjs';
 import { ImagePromptError } from '../shared/image-prompt.mjs';
 import { trackOutboundArtifactProviderPromise } from '../shared/semantic/artifact.mjs';
 import { createWhatsappBridgeStatus, WhatsappHarnessBridge } from './whatsapp-bridge.mjs';
+import {
+  WHATSAPP_ACCESS_MODES,
+  normalizeWhatsappAccessPolicy,
+} from './config-store.mjs';
 import { createWhatsappWebSession } from './whatsapp-web-session.mjs';
 
 const IMAGE_MEDIA_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp', 'image/gif']);
@@ -166,6 +170,39 @@ function whatsappImageSource(message, content, download, { viewOnce = false } =
   };
 }
 
+function whatsappFileSource(message, content, download) {
+  const media = content?.documentMessage;
+  if (!media) return null;
+  const mediaType = typeof media.mimetype === 'string' && media.mimetype
+    ? media.mimetype.toLowerCase() : undefined;
+  if (IMAGE_MEDIA_TYPES.has(mediaType)) return null;
+  return {
+    name: typeof media.fileName === 'string' && media.fileName
+      ? media.fileName : 'whatsapp-file',
+    ...(mediaType ? { mediaType } : {}),
+    size: mediaSize(media.fileLength),
+    async load({ signal } = {}) {
+      signal?.throwIfAborted();
+      const stream = await download(message, 'stream', { options: { signal } });
+      signal?.throwIfAborted();
+      return { stream };
+    },
+  };
+}
+
+export function createWhatsappMediaDownloader({
+  socket,
+  logger = console,
+  download = downloadMediaMessage,
+} = {}) {
+  if (typeof download !== 'function') throw new TypeError('WhatsApp media downloader is required');
+  if (typeof socket?.updateMediaMessage !== 'function') return download;
+  return (message, type, options) => download(message, type, options, {
+    logger,
+    reuploadRequest: (candidate) => socket.updateMediaMessage(candidate),
+  });
+}
+
 export function normalizeWhatsappMessage(message, accountJid, {
   download = downloadMediaMessage,
 } = {}) {
@@ -181,6 +218,7 @@ export function normalizeWhatsappMessage(message, accountJid, {
     && [remoteJid, alternateRemoteJid].some((jid) => jid && areJidsSameUser(jid, accountJid));
   if (fromMe && !selfChat) return null;
   const senderJid = selfChat ? accountJid : group ? message.key.participant : remoteJid;
+  const senderAlternateJid = group ? message.key.participantAlt : alternateRemoteJid;
   if (typeof senderJid !== 'string' || !senderJid) return null;
   const viewOnce = hasViewOnceWrapper(message.message);
   const content = normalizeMessageContent(message.message);
@@ -190,21 +228,40 @@ export function normalizeWhatsappMessage(message, accountJid, {
   const replyToSelf = typeof context?.participant === 'string'
     && areJidsSameUser(context.participant, accountJid);
   const image = whatsappImageSource(message, content, download, { viewOnce });
+  const file = whatsappFileSource(message, content, download);
   return {
     messageId: `${remoteJid}:${messageId}`,
     providerMessageId: messageId,
     senderId: senderJid,
+    senderAlternateId: typeof senderAlternateJid === 'string' ? senderAlternateJid : '',
     senderIsBot: false,
     kind: group ? 'group' : 'direct',
     conversationId: remoteJid,
     content: messageText(content),
     images: image ? [image] : [],
+    files: file ? [file] : [],
     addressed: !group || mentioned || replyToSelf,
     selfChat,
     replyTarget: { jid: remoteJid, quoted: message, selfChat },
   };
 }
 
+export function whatsappInboundAllowed(message, {
+  accessMode = WHATSAPP_ACCESS_MODES.selfOnly,
+  allowedNumbers = new Set(),
+} = {}) {
+  if (accessMode === WHATSAPP_ACCESS_MODES.open) return true;
+  if (message?.kind !== 'direct') return false;
+  if (message.selfChat === true) return true;
+  if (accessMode !== WHATSAPP_ACCESS_MODES.privateAllowlist
+    || !(allowedNumbers instanceof Set)) return false;
+  const senderJids = [message.senderId, message.senderAlternateId]
+    .filter((jid) => typeof jid === 'string' && jid.endsWith('@s.whatsapp.net'));
+  return [...allowedNumbers].some((number) => senderJids.some((jid) => (
+    areJidsSameUser(jid, `${number}@s.whatsapp.net`)
+  )));
+}
+
 class RecentWhatsappOutboundIds {
   #ids = new Map();
 
@@ -390,6 +447,8 @@ export class WhatsappRuntime {
   #replyTimeoutMs;
   #connectTimeoutMs;
   #mediaUploadTimeoutMs;
+  #accessMode;
+  #allowedPrivateNumbers;
   #createSession;
   #status = createWhatsappRuntimeStatus();
   #abortController = null;
@@ -427,12 +486,21 @@ export class WhatsappRuntime {
       WHATSAPP_MEDIA_UPLOAD_TIMEOUT_MS,
     );
     this.#createSession = createSession;
+    this.setAccessPolicy(config);
   }
 
   get status() {
     return structuredClone(this.#status);
   }
 
+  setAccessPolicy(value) {
+    const policy = normalizeWhatsappAccessPolicy(value);
+    this.#accessMode = policy.accessMode;
+    this.#allowedPrivateNumbers = new Set(policy.allowedNumbers);
+    this.#config = { ...this.#config, ...policy };
+    return policy;
+  }
+
   async start() {
     if (this.#status.ready && this.#session) return this.status;
     if (this.#starting) return this.#starting;
@@ -462,10 +530,23 @@ export class WhatsappRuntime {
           new Error('WhatsApp linked-device session must be scanned again'),
           { code: 'relink-required' },
         )),
-        onMessage: async (raw) => {
-          const message = normalizeWhatsappMessage(raw, this.#config.accountJid);
+        onMessage: async (raw, context) => {
+          const message = normalizeWhatsappMessage(raw, this.#config.accountJid, {
+            download: createWhatsappMediaDownloader({
+              socket: context?.socket,
+              logger: this.#logger,
+            }),
+          });
           if (!message || outboundIds.has(message.providerMessageId) || !this.#bridge) return;
           this.#status.lastCheckedAt = Date.now();
+          if (!whatsappInboundAllowed(message, {
+            accessMode: this.#accessMode,
+            allowedNumbers: this.#allowedPrivateNumbers,
+          })) {
+            this.#status.messagesRejected += 1;
+            this.#status.lastRejectedAt = new Date().toISOString();
+            return;
+          }
           await this.#bridge.accept(message);
         },
         onDisconnect: ({ error }) => {

package/src/channels/whatsapp/whatsapp-web-session.mjs

@@ -190,7 +190,7 @@ export async function createWhatsappWebSession({
           const timestamp = messageTimestampMs(message?.messageTimestamp);
           if (timestamp === null || timestamp < sessionStartedAt - APPEND_RECENT_GRACE_MS) continue;
         }
-        Promise.resolve(onMessage(message)).catch(() => {
+        Promise.resolve(onMessage(message, { socket: nextSocket })).catch(() => {
           logger.error?.('[dsh-im:whatsapp] failed to process an inbound WhatsApp message');
         });
       }