@yanhaidao/wecom 2.3.260 → 2.4.120

package/src/shared/media-asset.ts

@@ -0,0 +1,78 @@
+import path from "node:path";
+
+import { resolveWecomEgressProxyUrlFromNetwork } from "../config/index.js";
+import { wecomFetch } from "../http.js";
+import type { WecomNetworkConfig } from "../types/index.js";
+
+function inferContentTypeFromFilePath(filePath: string): string {
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+  const mimeTypes: Record<string, string> = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    bmp: "image/bmp",
+    mp3: "audio/mpeg",
+    wav: "audio/wav",
+    amr: "audio/amr",
+    mp4: "video/mp4",
+    pdf: "application/pdf",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xls: "application/vnd.ms-excel",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ppt: "application/vnd.ms-powerpoint",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    txt: "text/plain",
+    csv: "text/csv",
+    tsv: "text/tab-separated-values",
+    md: "text/markdown",
+    json: "application/json",
+    xml: "application/xml",
+    yaml: "application/yaml",
+    yml: "application/yaml",
+    zip: "application/zip",
+    rar: "application/vnd.rar",
+    "7z": "application/x-7z-compressed",
+    tar: "application/x-tar",
+    gz: "application/gzip",
+    tgz: "application/gzip",
+    rtf: "application/rtf",
+    odt: "application/vnd.oasis.opendocument.text",
+  };
+  return mimeTypes[ext] || "application/octet-stream";
+}
+
+export async function resolveOutboundMediaAsset(params: {
+  mediaUrl: string;
+  network?: WecomNetworkConfig;
+  timeoutMs?: number;
+}): Promise<{ buffer: Buffer; filename: string; contentType: string }> {
+  const { mediaUrl, network, timeoutMs = 30000 } = params;
+  if (/^https?:\/\//i.test(mediaUrl)) {
+    const response = await wecomFetch(
+      mediaUrl,
+      { method: "GET" },
+      {
+        proxyUrl: resolveWecomEgressProxyUrlFromNetwork(network),
+        timeoutMs,
+      },
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to download media: ${response.status}`);
+    }
+    const buffer = Buffer.from(await response.arrayBuffer());
+    const contentType = response.headers.get("content-type") || "application/octet-stream";
+    const filename = path.basename(new URL(mediaUrl).pathname) || "media";
+    return { buffer, filename, contentType };
+  }
+
+  const fs = await import("node:fs/promises");
+  const buffer = await fs.readFile(mediaUrl);
+  return {
+    buffer,
+    filename: path.basename(mediaUrl),
+    contentType: inferContentTypeFromFilePath(mediaUrl),
+  };
+}

package/src/shared/media-service.test.ts

@@ -0,0 +1,111 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { WecomMediaService } from "./media-service.js";
+
+describe("WecomMediaService", () => {
+  const fetchRemoteMedia = vi.fn();
+  const saveMediaBuffer = vi.fn();
+
+  beforeEach(() => {
+    fetchRemoteMedia.mockReset();
+    saveMediaBuffer.mockReset();
+  });
+
+  it("passes configured wecom mediaMaxMb to remote attachment fetches and saves", async () => {
+    const service = new WecomMediaService(
+      {
+        channel: {
+          media: {
+            fetchRemoteMedia,
+            saveMediaBuffer,
+          },
+        },
+      } as never,
+      {
+        channels: {
+          wecom: {
+            mediaMaxMb: 24,
+          },
+        },
+      } as never,
+    );
+
+    fetchRemoteMedia.mockResolvedValue({
+      buffer: Buffer.from("file"),
+      contentType: "application/pdf",
+      fileName: "sample.pdf",
+    });
+    saveMediaBuffer.mockResolvedValue({
+      path: "/tmp/sample.pdf",
+    });
+
+    const event = {
+      accountId: "default",
+      attachments: [{ remoteUrl: "https://example.com/sample.pdf" }],
+    } as never;
+
+    const attachment = await service.normalizeFirstAttachment(event);
+
+    expect(fetchRemoteMedia).toHaveBeenCalledWith({
+      url: "https://example.com/sample.pdf",
+      maxBytes: 24 * 1024 * 1024,
+    });
+
+    await service.saveInboundAttachment(event, attachment!);
+
+    expect(saveMediaBuffer).toHaveBeenCalledWith(
+      expect.any(Buffer),
+      "application/pdf",
+      "inbound",
+      24 * 1024 * 1024,
+      "sample.pdf",
+    );
+  });
+
+  it("prefers account-specific mediaMaxMb for inbound saves", async () => {
+    const service = new WecomMediaService(
+      {
+        channel: {
+          media: {
+            fetchRemoteMedia,
+            saveMediaBuffer,
+          },
+        },
+      } as never,
+      {
+        channels: {
+          wecom: {
+            mediaMaxMb: 24,
+            accounts: {
+              ops: {
+                mediaMaxMb: 36,
+              },
+            },
+          },
+        },
+      } as never,
+    );
+
+    saveMediaBuffer.mockResolvedValue({
+      path: "/tmp/account-specific.pdf",
+    });
+
+    await service.saveInboundAttachment(
+      {
+        accountId: "ops",
+      } as never,
+      {
+        buffer: Buffer.from("file"),
+        contentType: "application/pdf",
+        filename: "ops.pdf",
+      },
+    );
+
+    expect(saveMediaBuffer).toHaveBeenCalledWith(
+      expect.any(Buffer),
+      "application/pdf",
+      "inbound",
+      36 * 1024 * 1024,
+      "ops.pdf",
+    );
+  });
+});

package/src/shared/media-service.ts

@@ -1,14 +1,27 @@
-import type { PluginRuntime } from "openclaw/plugin-sdk";
-
-import type { NormalizedMediaAttachment } from "./media-types.js";
-import type { UnifiedInboundEvent } from "../types/index.js";
+import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk";
+import { resolveWecomMediaMaxBytes } from "../config/index.js";
 import { decryptWecomMediaWithMeta } from "../media.js";
+import type { UnifiedInboundEvent } from "../types/index.js";
+import type { NormalizedMediaAttachment } from "./media-types.js";
 
 export class WecomMediaService {
-  constructor(private readonly core: PluginRuntime) {}
+  constructor(
+    private readonly core: PluginRuntime,
+    private readonly cfg: OpenClawConfig,
+  ) {}
+
+  private resolveInboundMaxBytes(accountId: string): number {
+    return resolveWecomMediaMaxBytes(this.cfg, accountId);
+  }
 
-  async downloadRemoteMedia(params: { url: string }): Promise<NormalizedMediaAttachment> {
-    const loaded = await this.core.channel.media.fetchRemoteMedia({ url: params.url });
+  async downloadRemoteMedia(params: {
+    url: string;
+    maxBytes: number;
+  }): Promise<NormalizedMediaAttachment> {
+    const loaded = await this.core.channel.media.fetchRemoteMedia({
+      url: params.url,
+      maxBytes: params.maxBytes,
+    });
     return {
       buffer: loaded.buffer,
       contentType: loaded.contentType,
@@ -22,8 +35,14 @@ export class WecomMediaService {
    * Bot-webhook: uses the account-level EncodingAESKey.
    * Both use AES-256-CBC with PKCS#7 padding (32-byte block), IV = key[:16].
    */
-  async downloadEncryptedMedia(params: { url: string; aesKey: string }): Promise<NormalizedMediaAttachment> {
-    const decrypted = await decryptWecomMediaWithMeta(params.url, params.aesKey);
+  async downloadEncryptedMedia(params: {
+    url: string;
+    aesKey: string;
+    maxBytes: number;
+  }): Promise<NormalizedMediaAttachment> {
+    const decrypted = await decryptWecomMediaWithMeta(params.url, params.aesKey, {
+      maxBytes: params.maxBytes,
+    });
     return {
       buffer: decrypted.buffer,
       contentType: decrypted.sourceContentType,
@@ -31,26 +50,35 @@ export class WecomMediaService {
     };
   }
 
-  async saveInboundAttachment(event: UnifiedInboundEvent, attachment: NormalizedMediaAttachment): Promise<string> {
+  async saveInboundAttachment(
+    event: UnifiedInboundEvent,
+    attachment: NormalizedMediaAttachment,
+  ): Promise<string> {
+    const maxBytes = this.resolveInboundMaxBytes(event.accountId);
     const saved = await this.core.channel.media.saveMediaBuffer(
       attachment.buffer,
       attachment.contentType,
       "inbound",
-      undefined,
+      maxBytes,
       attachment.filename,
     );
     return saved.path;
   }
 
-  async normalizeFirstAttachment(event: UnifiedInboundEvent): Promise<NormalizedMediaAttachment | undefined> {
+  async normalizeFirstAttachment(
+    event: UnifiedInboundEvent,
+  ): Promise<NormalizedMediaAttachment | undefined> {
     const first = event.attachments?.[0];
     if (!first?.remoteUrl) {
       return undefined;
     }
+    // Keep fetch/decrypt/save on the same account-aware limit instead of falling back
+    // to the core media store default (5MB).
+    const maxBytes = this.resolveInboundMaxBytes(event.accountId);
     // Bot-ws media is AES-encrypted; use decryption when aesKey is present
     if (first.aesKey) {
-      return this.downloadEncryptedMedia({ url: first.remoteUrl, aesKey: first.aesKey });
+      return this.downloadEncryptedMedia({ url: first.remoteUrl, aesKey: first.aesKey, maxBytes });
     }
-    return this.downloadRemoteMedia({ url: first.remoteUrl });
+    return this.downloadRemoteMedia({ url: first.remoteUrl, maxBytes });
   }
 }

package/src/target.ts

@@ -26,6 +26,35 @@ export interface ScopedWecomTarget {
     rawTarget: string;
 }
 
+function parseUpstreamScopedTarget(raw: string): {
+    accountId?: string;
+    userId: string;
+} | undefined {
+    const legacyScoped = raw.match(/^wecom-agent-upstream:([^:]+):([^:]+):(.+)$/i);
+    if (legacyScoped) {
+        return {
+            accountId: legacyScoped[1]?.trim(),
+            userId: legacyScoped[3]?.trim() || "",
+        };
+    }
+
+    const queryIndex = raw.indexOf("?upstream_corp=");
+    if (queryIndex < 0 || !raw.startsWith("wecom-agent:")) {
+        return undefined;
+    }
+
+    const pathPart = raw.slice(0, queryIndex);
+    const match = pathPart.match(/^wecom-agent:([^:]+):user:(.+)$/i);
+    if (!match) {
+        return undefined;
+    }
+
+    return {
+        accountId: match[1]?.trim(),
+        userId: match[2]?.trim() || "",
+    };
+}
+
 export function buildWecomContextTarget(contextToken: string): string {
     return `wecom:context:${contextToken}`;
 }
@@ -118,6 +147,17 @@ export function resolveScopedWecomTarget(raw: string | undefined, defaultAccount
     if (!raw?.trim()) return undefined;
 
     const trimmed = raw.trim();
+
+    const upstreamScoped = parseUpstreamScopedTarget(trimmed);
+    if (upstreamScoped) {
+        const accountId = upstreamScoped.accountId || defaultAccountId;
+        return {
+            accountId,
+            target: { touser: upstreamScoped.userId },
+            rawTarget: upstreamScoped.userId,
+        };
+    }
+
     const agentScoped = trimmed.match(/^wecom-agent:([^:]+):(.+)$/i);
     if (agentScoped) {
         const accountId = agentScoped[1]?.trim() || defaultAccountId;

package/src/transport/agent-api/client.ts

@@ -1,7 +1,9 @@
 import type { ResolvedAgentAccount } from "../../types/index.js";
+import { LIMITS } from "../../types/constants.js";
 import {
   downloadMedia as downloadLegacyMedia,
   getAccessToken as getLegacyAccessToken,
+  getUpstreamAccessToken as getLegacyUpstreamAccessToken,
   sendMedia as sendLegacyMedia,
   sendText as sendLegacyText,
 } from "./core.js";
@@ -10,6 +12,14 @@ export async function getAgentApiAccessToken(agent: ResolvedAgentAccount): Promi
   return getLegacyAccessToken(agent);
 }
 
+export async function getUpstreamAgentApiAccessToken(params: {
+  primaryAgent: ResolvedAgentAccount;
+  upstreamCorpId: string;
+  upstreamAgentId: number;
+}): Promise<string> {
+  return getLegacyUpstreamAccessToken(params);
+}
+
 export async function sendAgentApiText(params: {
   agent: ResolvedAgentAccount;
   toUser?: string;
@@ -42,3 +52,226 @@ export async function downloadAgentApiMedia(params: {
 }): Promise<{ buffer: Buffer; contentType: string; filename?: string }> {
   return downloadLegacyMedia(params);
 }
+
+export async function downloadUpstreamAgentApiMedia(params: {
+  upstreamAgent: ResolvedAgentAccount;
+  primaryAgent: ResolvedAgentAccount;
+  mediaId: string;
+  maxBytes?: number;
+}): Promise<{ buffer: Buffer; contentType: string; filename?: string }> {
+  const { upstreamAgent, primaryAgent, mediaId, maxBytes } = params;
+
+  const token = await getUpstreamAgentApiAccessToken({
+    primaryAgent,
+    upstreamCorpId: upstreamAgent.corpId,
+    upstreamAgentId: upstreamAgent.agentId!,
+  });
+  const url = `https://qyapi.weixin.qq.com/cgi-bin/media/get?access_token=${encodeURIComponent(token)}&media_id=${encodeURIComponent(mediaId)}`;
+
+  const { wecomFetch, readResponseBodyAsBuffer } = await import("../../http.js");
+  const { resolveWecomEgressProxyUrlFromNetwork } = await import("../../config/index.js");
+
+  const res = await wecomFetch(url, undefined, {
+    proxyUrl: resolveWecomEgressProxyUrlFromNetwork(upstreamAgent.network),
+    timeoutMs: LIMITS.REQUEST_TIMEOUT_MS,
+  });
+
+  if (!res.ok) {
+    throw new Error(`download failed: ${res.status}`);
+  }
+
+  const contentType = res.headers.get("content-type") || "application/octet-stream";
+  const disposition = res.headers.get("content-disposition") || "";
+  const filename = (() => {
+    const mStar = disposition.match(/filename\*\s*=\s*([^;]+)/i);
+    if (mStar) {
+      const raw = mStar[1]!.trim().replace(/^"(.*)"$/, "$1");
+      const parts = raw.split("''");
+      const encoded = parts.length === 2 ? parts[1]! : raw;
+      try {
+        return decodeURIComponent(encoded);
+      } catch {
+        return encoded;
+      }
+    }
+    const m = disposition.match(/filename\s*=\s*([^;]+)/i);
+    if (!m) return undefined;
+    return m[1]!.trim().replace(/^"(.*)"$/, "$1") || undefined;
+  })();
+
+  if (contentType.includes("application/json")) {
+    const json = (await res.json()) as { errcode?: number; errmsg?: string };
+    throw new Error(`download failed: ${json?.errcode} ${json?.errmsg}`);
+  }
+
+  const buffer = await readResponseBodyAsBuffer(res, maxBytes);
+  return { buffer, contentType, filename };
+}
+
+/**
+ * 发送文本消息给上下游用户
+ * 使用下游企业的 access_token 和 agentId
+ */
+export async function sendUpstreamAgentApiText(params: {
+  upstreamAgent: ResolvedAgentAccount;
+  primaryAgent: ResolvedAgentAccount;
+  toUser?: string;
+  toParty?: string;
+  toTag?: string;
+  chatId?: string;
+  text: string;
+}): Promise<void> {
+  const { upstreamAgent, primaryAgent, toUser, toParty, toTag, chatId, text } = params;
+
+  // 获取下游企业的 access_token
+  const token = await getUpstreamAgentApiAccessToken({
+    primaryAgent,
+    upstreamCorpId: upstreamAgent.corpId,
+    upstreamAgentId: upstreamAgent.agentId!,
+  });
+
+  const useChat = Boolean(chatId);
+  const url = useChat
+    ? `https://qyapi.weixin.qq.com/cgi-bin/appchat/send?access_token=${encodeURIComponent(token)}`
+    : `https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=${encodeURIComponent(token)}`;
+
+  const body = useChat
+    ? { chatid: chatId, msgtype: "text", text: { content: text } }
+    : {
+        touser: toUser,
+        toparty: toParty,
+        totag: toTag,
+        msgtype: "text",
+        agentid: upstreamAgent.agentId,
+        text: { content: text },
+      };
+
+  const { wecomFetch } = await import("../../http.js");
+  const { resolveWecomEgressProxyUrlFromNetwork } = await import("../../config/index.js");
+  
+  const res = await wecomFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    },
+    {
+      proxyUrl: resolveWecomEgressProxyUrlFromNetwork(upstreamAgent.network),
+      timeoutMs: LIMITS.REQUEST_TIMEOUT_MS,
+    },
+  );
+  
+  const json = (await res.json()) as {
+    errcode?: number;
+    errmsg?: string;
+    invaliduser?: string;
+    invalidparty?: string;
+    invalidtag?: string;
+  };
+
+  if (json?.errcode !== 0) {
+    throw new Error(`send failed: ${json?.errcode} ${json?.errmsg}`);
+  }
+
+  if (json?.invaliduser || json?.invalidparty || json?.invalidtag) {
+    const details = [
+      json.invaliduser ? `invaliduser=${json.invaliduser}` : "",
+      json.invalidparty ? `invalidparty=${json.invalidparty}` : "",
+      json.invalidtag ? `invalidtag=${json.invalidtag}` : "",
+    ]
+      .filter(Boolean)
+      .join(", ");
+    throw new Error(`send partial failure: ${details}`);
+  }
+}
+
+/**
+ * 发送媒体消息给上下游用户
+ * 使用下游企业的 access_token 和 agentId
+ */
+export async function sendUpstreamAgentApiMedia(params: {
+  upstreamAgent: ResolvedAgentAccount;
+  primaryAgent: ResolvedAgentAccount;
+  toUser?: string;
+  toParty?: string;
+  toTag?: string;
+  chatId?: string;
+  mediaId: string;
+  mediaType: "image" | "voice" | "video" | "file";
+  title?: string;
+  description?: string;
+}): Promise<void> {
+  const { upstreamAgent, primaryAgent, toUser, toParty, toTag, chatId, mediaId, mediaType, title, description } = params;
+  
+  // 获取下游企业的 access_token
+  const token = await getUpstreamAgentApiAccessToken({
+    primaryAgent,
+    upstreamCorpId: upstreamAgent.corpId,
+    upstreamAgentId: upstreamAgent.agentId!,
+  });
+
+  console.log(
+    `[wecom-upstream-api] sendMedia corpId=${upstreamAgent.corpId} agentId=${upstreamAgent.agentId} ` +
+      `toUser=${toUser ?? ""} mediaType=${mediaType}`,
+  );
+
+  const useChat = Boolean(chatId);
+  const url = useChat
+    ? `https://qyapi.weixin.qq.com/cgi-bin/appchat/send?access_token=${encodeURIComponent(token)}`
+    : `https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=${encodeURIComponent(token)}`;
+
+  const mediaPayload = mediaType === "video" 
+    ? { media_id: mediaId, title: title ?? "Video", description: description ?? "" } 
+    : { media_id: mediaId };
+    
+  const body = useChat
+    ? { chatid: chatId, msgtype: mediaType, [mediaType]: mediaPayload }
+    : {
+        touser: toUser,
+        toparty: toParty,
+        totag: toTag,
+        msgtype: mediaType,
+        agentid: upstreamAgent.agentId,
+        [mediaType]: mediaPayload,
+      };
+
+  const { wecomFetch } = await import("../../http.js");
+  const { resolveWecomEgressProxyUrlFromNetwork } = await import("../../config/index.js");
+  
+  const res = await wecomFetch(
+    url,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    },
+    {
+      proxyUrl: resolveWecomEgressProxyUrlFromNetwork(upstreamAgent.network),
+      timeoutMs: LIMITS.REQUEST_TIMEOUT_MS,
+    },
+  );
+  
+  const json = (await res.json()) as {
+    errcode?: number;
+    errmsg?: string;
+    invaliduser?: string;
+    invalidparty?: string;
+    invalidtag?: string;
+  };
+
+  if (json?.errcode !== 0) {
+    throw new Error(`send ${mediaType} failed: ${json?.errcode} ${json?.errmsg}`);
+  }
+
+  if (json?.invaliduser || json?.invalidparty || json?.invalidtag) {
+    const details = [
+      json.invaliduser ? `invaliduser=${json.invaliduser}` : "",
+      json.invalidparty ? `invalidparty=${json.invalidparty}` : "",
+      json.invalidtag ? `invalidtag=${json.invalidtag}` : "",
+    ]
+      .filter(Boolean)
+      .join(", ");
+    throw new Error(`send ${mediaType} partial failure: ${details}`);
+  }
+}