@xmanrui/dsh-im 4.21.0 → 4.21.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmanrui/dsh-im",
-  "version": "4.21.0",
+  "version": "4.21.2",
   "description": "把十一种 IM 渠道和公网 AI Office 接入本机 DeepSeek Harness。 Connect eleven IM channels and a public AI Office to a local DeepSeek Harness.",
   "keywords": [
     "deepseek-harness",

package/plugin-src/client/channels/feishu/index.js

@@ -826,6 +826,7 @@ export function FeishuSettingsTab({ rpcCall }) {
   const [pageBusy, setPageBusy] = React.useState(false);
   const [provisionBusy, setProvisionBusy] = React.useState(false);
   const [credentialOpen, setCredentialOpen] = React.useState(false);
+  const [credentialDomain, setCredentialDomain] = React.useState("feishu");
   const [credentialBusy, setCredentialBusy] = React.useState(false);
   const [credentialError, setCredentialError] = React.useState(null);
   const [busyByBot, setBusyByBot] = React.useState({});
@@ -1041,13 +1042,13 @@ export function FeishuSettingsTab({ rpcCall }) {
     try {
       const snapshot = normalizeBotsSnapshot(await invoke(
         FEISHU_ENDPOINTS.bindCredentials,
-        { appId: identity, appSecret: secret },
+        { appId: identity, appSecret: secret, domain: credentialDomain },
       ));
       if (mountedRef.current && workspaceFence.canCommitMutation(snapshotVersion)) {
         mergeSnapshot(snapshot);
       }
       setCredentialOpen(false);
-      announce("飞书机器人凭据已绑定。");
+      announce(credentialDomain === "lark" ? "Lark 机器人凭据已绑定。" : "飞书机器人凭据已绑定。");
     } catch (error) {
       setCredentialError(presentError(error));
     } finally {
@@ -1055,7 +1056,7 @@ export function FeishuSettingsTab({ rpcCall }) {
       if (shouldRefresh && mountedRef.current) void loadStatus({ silent: true });
       setCredentialBusy(false);
     }
-  }, [announce, invoke, loadStatus, mergeSnapshot, workspaceFence]);
+  }, [announce, credentialDomain, invoke, loadStatus, mergeSnapshot, workspaceFence]);
 
   const cancelProvisioning = React.useCallback(async () => {
     const activeProvision = model.provisioning;
@@ -1449,16 +1450,30 @@ export function FeishuSettingsTab({ rpcCall }) {
 
   const credentialContent = credentialOpen
     ? h(CredentialBindingPanel, {
-        channel: "飞书",
+        key: credentialDomain,
+        channel: credentialDomain === "lark" ? "Lark" : "飞书",
         identityLabel: "App ID",
-        identityPlaceholder: "填写飞书开放平台 App ID",
+        identityPlaceholder: credentialDomain === "lark" ? "填写 Lark 开放平台 App ID" : "填写飞书开放平台 App ID",
         secretLabel: "App Secret",
-        secretPlaceholder: "填写飞书开放平台 App Secret",
+        secretPlaceholder: credentialDomain === "lark" ? "填写 Lark 开放平台 App Secret" : "填写飞书开放平台 App Secret",
         busy: credentialBusy,
         error: credentialError,
         onSubmit: bindCredentials,
         onCancel: () => { setCredentialOpen(false); setCredentialError(null); },
-      })
+      }, h("label", { className: "dim-credentialField" },
+        h("span", null, "应用平台"),
+        h("select", {
+          className: "dim-feishuGroupSelect",
+          "aria-label": "应用平台",
+          value: credentialDomain,
+          disabled: credentialBusy,
+          onChange: (event) => {
+            setCredentialDomain(event.target.value);
+            setCredentialError(null);
+          },
+        },
+        h("option", { value: "feishu" }, "飞书"),
+        h("option", { value: "lark" }, "Lark（国际版）"))))
     : null;
 
   const setCardRef = React.useCallback((botId, node) => {

package/plugin-src/client/credential-binding.js

@@ -47,6 +47,7 @@ export function CredentialBindingPanel({
   error = null,
   onSubmit,
   onCancel,
+  children,
 }) {
   const [identity, setIdentity] = React.useState('');
   const [secret, setSecret] = React.useState('');
@@ -66,6 +67,7 @@ export function CredentialBindingPanel({
     'aria-labelledby': headingId,
   },
   h('h3', { id: headingId, className: 'dim-credentialTitle' }, `手动接入${channel}机器人`),
+  children,
   h('form', {
     className: `dim-credentialForm${hasIdentity ? '' : ' dim-credentialFormSingle'}`,
     onSubmit: submit,

package/plugin-src/client/i18n.js

@@ -698,6 +698,12 @@ const EN = Object.freeze({
   'Slack 工作区': 'Slack workspace',
   'Bot Token 与 App Token': 'Bot Token and App Token',
   '填写 Bot Token': 'Enter Bot Token',
+  '应用平台': 'App platform',
+  'Lark（国际版）': 'Lark (international)',
+  '手动接入Lark机器人': 'Connect Lark bot manually',
+  '填写 Lark 开放平台 App ID': 'Enter the Lark Developer App ID',
+  '填写 Lark 开放平台 App Secret': 'Enter the Lark Developer App Secret',
+  'Lark 机器人凭据已绑定。': 'Lark bot credentials connected.',
   '手动接入飞书机器人': 'Connect Feishu bot manually',
   '手动接入钉钉机器人': 'Connect DingTalk bot manually',
   '手动接入企业微信机器人': 'Connect WeCom bot manually',

package/plugin-src/host/channels/feishu/rpc.mjs

@@ -401,9 +401,10 @@ function validPayload(endpoint, payload) {
       : 'Group message permission update requires a single valid botId.';
   }
   if (endpoint === FEISHU_ENDPOINTS.bindCredentials) {
-    return hasOnlyKeys(payload, new Set(['appId', 'appSecret']))
+    return hasOnlyKeys(payload, new Set(['appId', 'appSecret', 'domain']))
       && validCredential(payload.appId, 256)
       && validCredential(payload.appSecret, 1024)
+      && (payload.domain === undefined || payload.domain === 'feishu' || payload.domain === 'lark')
       ? null
       : 'Credential binding requires App ID and App Secret.';
   }

package/plugin-src/host/index.mjs

@@ -17,6 +17,7 @@ import { installDeliveryRpc } from './delivery-rpc.mjs';
 import { installDeliveryHttp } from './delivery-http.mjs';
 import { createDeliveryService } from './delivery-service.mjs';
 import { installInboundTtlRpc } from './inbound-ttl-rpc.mjs';
+import { installInjectedContext } from './injected-context.mjs';
 import { installSessionSyncCoordinator } from './session-sync-coordinator.mjs';
 import { installSessionTitlePrefix } from './session-title-prefix.mjs';
 import { installUpdateRpc } from './update-rpc.mjs';
@@ -41,6 +42,7 @@ export function createImHostPlugin(internals = {}) {
   const startHostLanguageRpc = internals.installHostLanguageRpc ?? installHostLanguageRpc;
   const startUpdate = internals.installUpdateRpc ?? installUpdateRpc;
   const startInboundTtl = internals.installInboundTtlRpc ?? installInboundTtlRpc;
+  const startInjectedContext = internals.installInjectedContext ?? installInjectedContext;
   const startDelivery = internals.installDeliveryRpc ?? installDeliveryRpc;
   const startDeliveryHttp = internals.installDeliveryHttp ?? installDeliveryHttp;
   const startSessionSync = internals.installSessionSyncCoordinator
@@ -139,6 +141,11 @@ export function createImHostPlugin(internals = {}) {
     const logger = typeof ctx?.logger === 'function'
       ? ctx.logger(name)
       : (ctx?.logger ?? console);
+    try {
+      startInjectedContext(ctx, { logger });
+    } catch (error) {
+      logger.error?.('[dsh-im] failed to activate injected-context pairing; prompts keep the inline prefix', error);
+    }
     if (ctx?.connection?.fetch) {
       if (hostLanguage) {
         try {

package/plugin-src/host/injected-context.mjs

@@ -0,0 +1,104 @@
+import { getImHostLanguage } from '../../src/channels/shared/i18n.mjs';
+import { rewriteInjectedContextMessages } from '../../src/channels/shared/injected-context.mjs';
+import {
+  IM_SOURCE_GUIDANCE_CONTEXT,
+  IM_SOURCE_GUIDANCE_ORDER,
+  imSourceGuidance,
+} from '../../src/channels/shared/im-source-guidance.mjs';
+
+/** Row label for a quoted reply, in the mirrored Host interface language. */
+const REPLY_LABELS = Object.freeze({ zh: '\u5f15\u7528', en: 'Quoted' });
+
+/** Row label for a source block that names no readable field of its own. */
+const SOURCE_LABELS = Object.freeze({ zh: '\u6765\u6e90', en: 'Source' });
+
+/** Read the current reply-row label; an unknown language falls back to English. */
+function replyLabel() {
+  try {
+    return getImHostLanguage() === 'en' ? REPLY_LABELS.en : REPLY_LABELS.zh;
+  } catch {
+    return REPLY_LABELS.en;
+  }
+}
+
+/** Read the current nameless-source-row label; unknown languages fall back. */
+function sourceLabel() {
+  try {
+    return getImHostLanguage() === 'en' ? SOURCE_LABELS.en : SOURCE_LABELS.zh;
+  } catch {
+    return SOURCE_LABELS.en;
+  }
+}
+
+/**
+ * Pair every injected context block with the user message that carried it, and
+ * materialize the source guidance as session-level prompt context.
+ *
+ * The prompt RPC cannot carry a message source, so a channel writes its source
+ * block, guidance and quoted reply into the prompt text. `agent/pre-step` is
+ * the one point where the claimed messages are already known and nothing is
+ * committed yet: splitting the blocks there records each as its own
+ * plugin-sourced message next to exactly the user message it belongs to,
+ * whatever the inbox interleaved meanwhile. A Host without the Agent loop never
+ * dispatches the event, and the prompt then keeps its inline blocks.
+ *
+ * Guidance is not per message but per conversation, so it is registered as
+ * dynamic prompt context instead: the Host appends one durable snapshot per
+ * Session and only re-renders it when a channel publishes different guidance.
+ * Deployment policy still decides whether such snapshots exist at all, which is
+ * why the message-side copy is kept until a channel has published a matching
+ * value for that Session.
+ *
+ * @param ctx - owning Host context.
+ * @param options.logger - Host logger for a rewrite that could not be trusted.
+ * @param options.registry - guidance registry; tests inject their own.
+ * @returns the Cordis disposer, or null when the context cannot listen.
+ */
+export function installInjectedContext(ctx, { logger, registry = imSourceGuidance } = {}) {
+  if (typeof ctx?.on !== 'function') return null;
+
+  const startGuidanceContext = (promptCtx) => {
+    if (typeof promptCtx?.systemPrompt?.context !== 'function') return null;
+    return promptCtx.systemPrompt.context({
+      name: IM_SOURCE_GUIDANCE_CONTEXT,
+      order: IM_SOURCE_GUIDANCE_ORDER,
+      text: (assembly) => registry.get(assembly?.agent?.session?.id) ?? '',
+    });
+  };
+  if (typeof ctx.inject === 'function') {
+    // Same gating the outbound artifact tool uses: register once the service
+    // exists instead of requiring it at load time.
+    ctx.inject(['systemPrompt'], startGuidanceContext);
+  } else {
+    startGuidanceContext(ctx);
+  }
+
+  const disposeDisposed = ctx.on('agent/disposed', ({ agent }) => {
+    const sessionId = agent?.session?.id;
+    if (typeof sessionId === 'string') registry.forget(sessionId);
+  }, { global: true });
+
+  const listener = async ({ agent }, next) => {
+    const decision = await next();
+    if (decision === null || typeof decision !== 'object' || decision.kind !== 'enter') {
+      return decision;
+    }
+    try {
+      const rewritten = rewriteInjectedContextMessages(decision.messages, {
+        labels: { reply: replyLabel(), source: sourceLabel() },
+        ownedGuidance: registry.get(agent?.session?.id),
+      });
+      return rewritten === null ? decision : { ...decision, messages: rewritten };
+    } catch (error) {
+      // A failed split must never cost the user their message: the blocks then
+      // stay inline, which is the same fallback a Host without Agents uses.
+      logger?.warn?.('[dsh-im] unable to split the injected context blocks:', error?.message ?? error);
+      return decision;
+    }
+  };
+  const disposePreStep = ctx.on('agent/pre-step', listener, { global: true });
+  return () => {
+    disposePreStep?.();
+    disposeDisposed?.();
+  };
+}

package/scripts/verify-lan-management.mjs

@@ -5,6 +5,7 @@ import { access, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises
 import { request as httpRequest } from 'node:http';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
 
 const harnessRoot = process.argv[2];
 if (!harnessRoot || process.argv.includes('--help')) {
@@ -18,6 +19,7 @@ await access(join(pluginRoot, 'lib/index.js'));
 // DSH 0.1.5 CLI intentionally permits only loopback listening. Exercise its
 // real HTTP carrier with a trusted LAN authority, while keeping TCP local.
 const lanIp = '192.168.1.100';
+const domain = 'dsh.example.test';
 
 const directory = await mkdtemp(join(tmpdir(), 'dsh-im-lan-test-'));
 const home = join(directory, 'home');
@@ -43,12 +45,12 @@ function request(url, { method = 'GET', headers = {}, body } = {}) {
   });
 }
 
-function start() {
+function start(trustedHosts = [lanIp]) {
   const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => (
     !/^DSH_/i.test(key) && !/(?:KEY|SECRET|TOKEN|PASSWORD|PROXY)/i.test(key)
   )));
   child = spawn(process.execPath, [cli, 'web', '--no-open', '--host', '127.0.0.1',
-    '--port', '0', '--trusted-host', lanIp], {
+    '--port', '0', ...trustedHosts.flatMap(host => ['--trusted-host', host])], {
     cwd: directory,
     env: { ...env, DSH_HOME: home, DSH_AGENTS_HOME: join(directory, '.agents'),
       DSH_TELEMETRY_DISABLED: '1', SSH_CONNECTION: '', SSH_TTY: '' },
@@ -107,6 +109,18 @@ function rpc(browser, channel = 'feishu', method = 'connection.status', headers
   });
 }
 
+async function readyStatus(browser, channel = 'feishu') {
+  const deadline = Date.now() + 10_000;
+  // HTTP readiness can precede the channel controllers finishing startup.
+  for (;;) {
+    const response = await rpc(browser, channel);
+    const result = response.status === 200 ? JSON.parse(response.body).result : null;
+    if (result?.ok !== false || result.error?.code !== `${channel}-initializing`
+      || Date.now() >= deadline) return response;
+    await delay(100);
+  }
+}
+
 function expectStatus(name, response, expected, businessOk = false) {
   assert.equal(response.status, expected, `${name}: ${response.body.slice(0, 300)}`);
   if (businessOk) {
@@ -146,9 +160,10 @@ try {
   expectStatus('LAN authenticated web page', await request(new URL('/', lan.origin), {
     headers: { cookie: lan.cookie },
   }), 200);
-  for (const channel of ['feishu', 'weixin', 'dingtalk', 'wecom', 'wecom-app', 'qq',
-    'slack', 'telegram', 'discord', 'whatsapp', 'imessage', 'office']) {
-    expectStatus(`LAN default: ${channel}`, await rpc(lan, channel), 200, true);
+  const channels = ['feishu', 'weixin', 'dingtalk', 'wecom', 'wecom-app', 'qq',
+    'slack', 'telegram', 'discord', 'whatsapp', 'imessage', 'office'];
+  for (const channel of channels) {
+    expectStatus(`LAN default: ${channel}`, await readyStatus(lan, channel), 200, true);
   }
   const delivery = await rpc(lan, 'dsh-im-delivery', 'target.list', {}, { botId: 'bot_missing' });
   expectStatus('LAN delivery reaches business handler', delivery, 200);
@@ -159,15 +174,45 @@ try {
   expectStatus('LAN update remains local-only', await rpc(lan, 'dsh-im', 'update.status'), 403);
   expectStatus('LAN TTL remains local-only', await rpc(lan, 'dsh-im-settings', 'settings.inbound-ttl.get'), 403);
   const local = await login(launchUrl, '127.0.0.1');
-  expectStatus('Loopback default: feishu', await rpc(local), 200, true);
+  const localhost = await login(launchUrl, 'localhost');
+  for (const browser of [local, localhost]) {
+    const hostname = new URL(browser.origin).hostname;
+    for (const channel of channels) {
+      expectStatus(`${hostname} default: ${channel}`, await readyStatus(browser, channel), 200, true);
+    }
+    // Emulate a browser/proxy dropping the Origin port; this is a header-level
+    // reproduction, not evidence that a particular browser emits that header.
+    expectStatus(`${hostname} port-less Origin rejected`, await rpc(browser, 'dingtalk',
+      'connection.status', { origin: `http://${hostname}` }), 403);
+    expectStatus(`${hostname} cross-site request rejected`, await rpc(browser, 'dingtalk',
+      'connection.status', { 'sec-fetch-site': 'cross-site' }), 403);
+  }
+  expectStatus('Loopback Host/Origin hostname mismatch rejected', await rpc(local, 'dingtalk',
+    'connection.status', { origin: localhost.origin }), 403);
+  expectStatus('Authenticated domain without --trusted-host rejected',
+    await rpc(await login(launchUrl, domain), 'dingtalk'), 403);
+
+  await stop();
+  const domainLaunchUrl = await start([lanIp, domain]);
+  const trustedDomain = await login(domainLaunchUrl, domain);
+  expectStatus('Trusted domain without login rejected',
+    await rpc({ origin: trustedDomain.origin }, 'dingtalk'), 401);
+  for (const channel of channels) {
+    expectStatus(`Domain with --trusted-host: ${channel}`, await readyStatus(trustedDomain, channel), 200, true);
+  }
+  const otherTrustedOrigin = new URL(trustedDomain.origin);
+  otherTrustedOrigin.hostname = lanIp;
+  expectStatus('Two trusted hosts still require matching Origin', await rpc(trustedDomain,
+    'dingtalk', 'connection.status', { origin: otherTrustedOrigin.origin }), 403);
 
   await stop();
   await writeFile(join(profile, 'cordis.patch.yml'), '- id: xmanrui-dsh-im\n  config:\n    rpcAuthority: loopback\n');
   const restrictedUrl = await start();
   expectStatus('Explicit loopback rejects LAN', await rpc(await login(restrictedUrl, lanIp)), 403);
-  expectStatus('Explicit loopback accepts localhost', await rpc(await login(restrictedUrl, '127.0.0.1')), 200, true);
+  expectStatus('Explicit loopback accepts 127.0.0.1', await readyStatus(await login(restrictedUrl, '127.0.0.1')), 200, true);
+  expectStatus('Explicit loopback accepts localhost', await readyStatus(await login(restrictedUrl, 'localhost')), 200, true);
   console.table(results);
-  console.log(`Passed ${results.length} real HTTP checks using LAN Host/Origin ${lanIp}.`);
+  console.log(`Passed ${results.length} real HTTP checks using loopback, LAN ${lanIp} and domain ${domain}.`);
   console.log('TCP connections stayed on loopback. This checks the original CLI, authentication and built plugin, not a second-device browser.');
   console.log('The temporary profile contains no bot credentials and is removed after the server stops.');
 } finally {

package/src/channels/dingtalk/dingtalk-bridge.mjs

@@ -30,7 +30,11 @@ import {
 } from '../shared/preset-command.mjs';
 import { runWorkspaceCommand } from '../shared/workspace-command.mjs';
 import { askInWorkspaceSession } from '../shared/workspace-session.mjs';
-import { captureContextEnhancement, enhanceContextContent } from '../shared/context-enhancement.mjs';
+import {
+  captureContextEnhancement,
+  captureContextEnhancementSource,
+  enhanceContextContent,
+} from '../shared/context-enhancement.mjs';
 import {
   BatchInputManager,
   batchInputBusyMessage,
@@ -43,6 +47,7 @@ import {
   imagePromptUserMessage,
 } from '../shared/image-prompt.mjs';
 import {
+  InboundFileError,
   hasInboundFiles,
   inboundFileUserMessage,
   prefetchInboundFiles,
@@ -195,6 +200,13 @@ function downloadCodeFor(value) {
   return nonEmptyString(value?.downloadCode) ?? nonEmptyString(value?.pictureDownloadCode);
 }
 
+function dingtalkImageEntries(msgtype, content) {
+  if (msgtype === 'picture') return [content];
+  if (msgtype !== 'richtext') return [];
+  return richTextEntries(content)
+    .filter((entry) => String(entry?.type ?? '').toLowerCase() === 'picture');
+}
+
 function dingtalkTimestampMs(value) {
   const number = typeof value === 'string' && value.trim() ? Number(value) : value;
   if (!Number.isFinite(number) || number < 0) return null;
@@ -206,24 +218,36 @@ function usefulReplyText(value) {
   return text && !/^\[interactive card message\]$/iu.test(text) ? text : null;
 }
 
-function dingtalkReplyReference(message, options) {
-  const replyEnvelope = message?.text;
-  if (replyEnvelope?.isReplyMsg !== true) return null;
-  const replied = replyEnvelope?.repliedMsg;
-  if (!replied || typeof replied !== 'object') {
-    return { unavailableReason: 'not-delivered' };
-  }
-
+function dingtalkReplyMessage(message) {
+  if (message?.text?.isReplyMsg !== true) return null;
+  const replied = message.text.repliedMsg;
+  if (!replied || typeof replied !== 'object') return null;
   const msgtype = nonEmptyString(replied.msgType ?? replied.msgtype)?.toLowerCase() ?? '';
   const repliedContent = parsedMessageContent({ content: replied.content }) ?? {};
-  const pseudoMessage = {
+  // Quoted richText entries use msgType instead of the direct callback's type.
+  const content = msgtype === 'richtext' ? {
+    ...repliedContent,
+    richText: richTextEntries(repliedContent).map((entry) => ({
+      ...entry, type: entry?.type ?? entry?.msgType ?? entry?.msgtype,
+    })),
+  } : repliedContent;
+  return {
     msgtype,
+    robotCode: message.robotCode,
     text: {
       content: nonEmptyString(repliedContent.text)
         ?? (typeof replied.content === 'string' ? replied.content : ''),
     },
-    content: repliedContent,
+    content,
   };
+}
+
+function dingtalkReplyReference(message, options) {
+  if (message?.text?.isReplyMsg !== true) return null;
+  const pseudoMessage = dingtalkReplyMessage(message);
+  if (!pseudoMessage) return { unavailableReason: 'not-delivered' };
+  const replied = message.text.repliedMsg;
+  const { msgtype, content: repliedContent } = pseudoMessage;
   const normalized = dingtalkInboundMessage(pseudoMessage, options);
   let attachments = [];
   if (msgtype === 'picture') {
@@ -232,8 +256,7 @@ function dingtalkReplyReference(message, options) {
     const name = nonEmptyString(repliedContent.fileName ?? repliedContent.file_name);
     attachments = [{ kind: 'file', ...(name ? { name } : {}) }];
   } else if (msgtype === 'richtext') {
-    attachments = richTextEntries(repliedContent)
-      .filter((entry) => String(entry?.type ?? '').toLowerCase() === 'picture')
+    attachments = dingtalkImageEntries(msgtype, repliedContent)
       .map(() => ({ kind: 'image' }));
   } else if (msgtype === 'voice' || msgtype === 'audio') {
     attachments = [{ kind: 'audio' }];
@@ -278,6 +301,43 @@ function dingtalkReplyReference(message, options) {
   };
 }
 
+// Resolve only the immediate quote, after command/interaction routing has finished.
+function prepareDingtalkReplyAttachments(message, promptMessage, options) {
+  const quoted = dingtalkReplyMessage(message);
+  if (!quoted) return promptMessage;
+  if (['audio', 'voice', 'video'].includes(quoted.msgtype)) quoted.msgtype = 'file';
+  const imageCodes = dingtalkImageEntries(quoted.msgtype, quoted.content).map(downloadCodeFor);
+  const fileCodes = quoted.msgtype === 'file' ? [downloadCodeFor(quoted.content)] : [];
+  if ([...imageCodes, ...fileCodes].some((code) => !code)) {
+    throw new InboundFileError(
+      'dingtalk-quoted-attachment-unavailable',
+      'DingTalk did not deliver a download reference for the quoted attachment.',
+      t('钉钉未提供引用附件的下载信息，无法读取原附件。请直接重新发送附件后再提问。'),
+    );
+  }
+  if (imageCodes.length === 0 && fileCodes.length === 0) return promptMessage;
+  const currentType = String(message?.msgtype ?? '').toLowerCase();
+  const currentContent = parsedMessageContent(message);
+  const seen = new Set([
+    ...dingtalkImageEntries(currentType, currentContent).map(downloadCodeFor),
+    ...(currentType === 'file' ? [downloadCodeFor(currentContent)] : []),
+  ].filter(Boolean));
+  const take = (code) => {
+    if (seen.has(code)) return false;
+    seen.add(code);
+    return true;
+  };
+  const normalized = dingtalkInboundMessage(quoted, options);
+  const images = normalized.images.filter((_, index) => take(imageCodes[index]));
+  const files = normalized.files.filter((_, index) => take(fileCodes[index]));
+  const prefetched = prefetchInboundFiles({ files }, { signal: options.signal });
+  return {
+    ...promptMessage,
+    images: [...promptMessage.images, ...images],
+    files: [...promptMessage.files, ...prefetched.files],
+  };
+}
+
 /** Normalize DingTalk picture and richText callbacks into lazy image references. */
 export function dingtalkInboundMessage(message, {
   api,
@@ -291,17 +351,7 @@ export function dingtalkInboundMessage(message, {
   const text = msgtype === 'text'
     ? nonEmptyString(message?.text?.content) ?? ''
     : richEntries.map(richTextEntryText).filter(Boolean).join('\n');
-  const imageCodes = [];
-  if (msgtype === 'picture') {
-    const code = downloadCodeFor(content);
-    if (code) imageCodes.push(code);
-  } else if (msgtype === 'richtext') {
-    for (const entry of richEntries) {
-      if (String(entry?.type ?? '').toLowerCase() !== 'picture') continue;
-      const code = downloadCodeFor(entry);
-      if (code) imageCodes.push(code);
-    }
-  }
+  const imageCodes = dingtalkImageEntries(msgtype, content).map(downloadCodeFor).filter(Boolean);
   const fileCode = msgtype === 'file' ? downloadCodeFor(content) : null;
   const replyTo = dingtalkReplyReference(message, {
     api,
@@ -838,6 +888,17 @@ export class DingtalkHarnessBridge {
       signal: this.#signal, isDirect: String(message.conversationType) === '1',
       pendingInteraction: this.#pendingInteractions.has(key) || this.#approvals.hasPending(key),
       control: { owner: this, key }, deferredDelivery: this.#deferred,
+      enhancement: captureContextEnhancementSource(
+        this.#contextEnhancement,
+        String(message.conversationType) === '1' ? 'direct' : 'group',
+        () => ({
+          channel: 'dingtalk',
+          senderId: senderStaffId(message),
+          senderName: message.senderNick,
+          conversationTitle: message.conversationTitle,
+          chatId: message.conversationId,
+        }),
+      ),
     };
     const access = evaluateInboundAccess(this.#accessPolicy, {
       conversationType: options.isDirect ? 'direct' : 'group',
@@ -1102,6 +1163,17 @@ export class DingtalkHarnessBridge {
           || this.#approvals.hasPending(key),
         control: { owner: this, key },
         deferredDelivery: this.#deferred,
+        enhancement: captureContextEnhancementSource(
+          this.#contextEnhancement,
+          String(message.conversationType) === '1' ? 'direct' : 'group',
+          () => ({
+            channel: 'dingtalk',
+            senderId: senderStaffId(message),
+            senderName: message.senderNick,
+            conversationTitle: message.conversationTitle,
+            chatId: message.conversationId,
+          }),
+        ),
       },
     );
     if (result?.stopped) {
@@ -1261,8 +1333,12 @@ export class DingtalkHarnessBridge {
         return;
       }
 
-      let content = hasImages || hasReply
-        ? await promptContentForInboundMessage(promptMessage, { signal: this.#signal })
+      const modelMessage = prepareDingtalkReplyAttachments(message, promptMessage, {
+        api: this.#api, clientId: this.#clientId, clientSecret: this.#clientSecret,
+        signal: this.#signal,
+      });
+      let content = hasInboundImages(modelMessage) || hasReply
+        ? await promptContentForInboundMessage(modelMessage, { signal: this.#signal })
         : undefined;
       const snapshot = this.#acceptedMessageIds.get(messageId);
       let contextEnhanced = false;
@@ -1300,6 +1376,7 @@ export class DingtalkHarnessBridge {
         text,
         content,
         titleText: batchSubmission?.title,
+        sourceGuidance: snapshot?.config?.guidance,
         contextEnhanced,
         createOptions: { signal: this.#signal },
         existsOptions: { signal: this.#signal },
@@ -1317,7 +1394,7 @@ export class DingtalkHarnessBridge {
             requiresMention: String(message.conversationType) === '2',
           }),
           onInteractionResolved: (resolution) => this.#handleInteractionResolved(resolution),
-          files: promptMessage.files,
+          files: modelMessage.files,
         },
       });
       if (batchSubmission) {