@yanhaidao/wecom 2.4.120 → 2.5.110

package/dist/src/runtime/session-manager.js

@@ -0,0 +1,112 @@
+import { getPeerContextToken } from "../context-store.js";
+import { buildWecomContextTarget } from "../target.js";
+import { resolveRuntimeRoute } from "./routing-bridge.js";
+import { registerWecomSourceSnapshot } from "./source-registry.js";
+function readContextSessionId(ctx) {
+    const sessionId = "SessionId" in ctx ? ctx.SessionId : undefined;
+    return typeof sessionId === "string" && sessionId.trim() ? sessionId.trim() : undefined;
+}
+export async function prepareInboundSession(params) {
+    const { core, cfg, event, mediaService } = params;
+    const route = resolveRuntimeRoute({ core, cfg, event });
+    const source = event.transport === "bot-ws"
+        ? "bot-ws"
+        : event.transport === "agent-callback"
+            ? "agent-callback"
+            : undefined;
+    if (source) {
+        registerWecomSourceSnapshot({
+            accountId: event.accountId,
+            source,
+            messageId: event.messageId,
+            sessionKey: route.sessionKey,
+            peerKind: event.conversation.peerKind,
+            peerId: event.conversation.peerId,
+        });
+    }
+    const storePath = core.channel.session.resolveStorePath(cfg.session?.store, {
+        agentId: route.agentId,
+    });
+    const previousTimestamp = core.channel.session.readSessionUpdatedAt({
+        storePath,
+        sessionKey: route.sessionKey,
+    });
+    const envelopeOptions = core.channel.reply.resolveEnvelopeFormatOptions(cfg);
+    const body = core.channel.reply.formatAgentEnvelope({
+        channel: "WeCom",
+        from: `${event.conversation.peerKind}:${event.conversation.peerId}`,
+        previousTimestamp,
+        envelope: envelopeOptions,
+        body: event.text,
+    });
+    const firstAttachment = await mediaService.normalizeFirstAttachment(event);
+    const mediaPath = firstAttachment
+        ? await mediaService.saveInboundAttachment(event, firstAttachment)
+        : undefined;
+    const defaultOriginatingTo = event.conversation.peerKind === "group"
+        ? `wecom:group:${event.conversation.peerId}`
+        : `wecom:user:${event.conversation.peerId}`;
+    const contextToken = event.transport === "bot-ws"
+        ? getPeerContextToken(event.accountId, event.conversation.peerId)
+        : undefined;
+    const originatingTo = contextToken
+        ? buildWecomContextTarget(contextToken)
+        : defaultOriginatingTo;
+    const providerContext = event.transport === "bot-ws"
+        ? {
+            // Bot WS inbound turns already have a live reply handle bound to the
+            // current req_id. Mark the current surface as WeCom so core final text
+            // stays on that handle and replaces the placeholder instead of being
+            // re-routed as a second active-push message.
+            Provider: "wecom",
+            Surface: "wecom",
+        }
+        : {
+            Provider: "wecom",
+        };
+    const ctx = core.channel.reply.finalizeInboundContext({
+        Body: body,
+        RawBody: event.text,
+        CommandBody: event.text,
+        From: event.conversation.peerKind === "group"
+            ? `wecom:group:${event.conversation.peerId}`
+            : `wecom:user:${event.conversation.senderId}`,
+        To: event.conversation.peerKind === "group"
+            ? `wecom:group:${event.conversation.peerId}`
+            : `wecom:user:${event.conversation.peerId}`,
+        SessionKey: route.sessionKey,
+        AccountId: route.accountId,
+        ChatType: event.conversation.peerKind,
+        ConversationLabel: `${event.conversation.peerKind}:${event.conversation.peerId}`,
+        SenderName: event.senderName ?? event.conversation.senderId,
+        SenderId: event.conversation.senderId,
+        // Keep Originating* populated so explicit route-to-origin flows and message
+        // tools can still resolve the active peer context when needed.
+        ...providerContext,
+        OriginatingChannel: "wecom",
+        OriginatingTo: originatingTo,
+        MessageSid: event.messageId,
+        CommandAuthorized: true,
+        MediaPath: mediaPath,
+        MediaUrl: mediaPath,
+        MediaType: firstAttachment?.contentType,
+    });
+    if (source) {
+        registerWecomSourceSnapshot({
+            accountId: event.accountId,
+            source,
+            messageId: event.messageId,
+            sessionKey: ctx.SessionKey ?? route.sessionKey,
+            sessionId: readContextSessionId(ctx),
+            peerKind: event.conversation.peerKind,
+            peerId: event.conversation.peerId,
+        });
+    }
+    await core.channel.session.recordInboundSession({
+        storePath,
+        sessionKey: ctx.SessionKey ?? route.sessionKey,
+        ctx,
+        onRecordError: () => { },
+    });
+    return { route, ctx, storePath };
+}

package/dist/src/runtime/source-registry.js

@@ -0,0 +1,174 @@
+const MAX_MESSAGE_FACTS = 2048;
+const MAX_SESSION_SNAPSHOTS = 1024;
+const MAX_CONVERSATION_SNAPSHOTS = 1024;
+const messageFacts = new Map();
+const sessionSnapshotsByAccountKey = new Map();
+const sessionSnapshotsByLooseKey = new Map();
+const conversationSnapshotsByAccountKey = new Map();
+const conversationSnapshotsByLooseKey = new Map();
+function normalizeOptional(value) {
+    const trimmed = String(value ?? "").trim();
+    return trimmed || undefined;
+}
+function messageFactKey(accountId, messageId) {
+    return `${accountId}::${messageId}`;
+}
+function accountScopedSessionKey(accountId, kind, value) {
+    return `${accountId}::${kind}::${value}`;
+}
+function normalizePeerId(value) {
+    const trimmed = String(value ?? "").trim();
+    return trimmed ? trimmed.toLowerCase() : undefined;
+}
+function normalizePeerKind(value) {
+    const trimmed = String(value ?? "").trim().toLowerCase();
+    return trimmed === "direct" || trimmed === "group" ? trimmed : undefined;
+}
+function accountScopedConversationKey(accountId, peerKind, peerId) {
+    return `${accountId}::peer::${peerKind}::${peerId}`;
+}
+function pruneOldest(map, maxSize) {
+    while (map.size > maxSize) {
+        const oldestKey = map.keys().next().value;
+        if (!oldestKey)
+            return;
+        map.delete(oldestKey);
+    }
+}
+function writeSessionSnapshot(snapshot) {
+    const sessionKey = normalizeOptional(snapshot.sessionKey);
+    const sessionId = normalizeOptional(snapshot.sessionId);
+    if (sessionKey) {
+        sessionSnapshotsByAccountKey.set(accountScopedSessionKey(snapshot.accountId, "sessionKey", sessionKey), snapshot);
+        sessionSnapshotsByLooseKey.set(`sessionKey::${sessionKey}`, snapshot);
+    }
+    if (sessionId) {
+        sessionSnapshotsByAccountKey.set(accountScopedSessionKey(snapshot.accountId, "sessionId", sessionId), snapshot);
+        sessionSnapshotsByLooseKey.set(`sessionId::${sessionId}`, snapshot);
+    }
+    pruneOldest(sessionSnapshotsByAccountKey, MAX_SESSION_SNAPSHOTS * 2);
+    pruneOldest(sessionSnapshotsByLooseKey, MAX_SESSION_SNAPSHOTS * 2);
+}
+function writeConversationSnapshot(snapshot) {
+    const peerKind = normalizePeerKind(snapshot.peerKind);
+    const peerId = normalizePeerId(snapshot.peerId);
+    if (!peerKind || !peerId) {
+        return;
+    }
+    conversationSnapshotsByAccountKey.set(accountScopedConversationKey(snapshot.accountId, peerKind, peerId), {
+        ...snapshot,
+        peerKind,
+        peerId,
+    });
+    conversationSnapshotsByLooseKey.set(`peer::${peerKind}::${peerId}`, {
+        ...snapshot,
+        peerKind,
+        peerId,
+    });
+    pruneOldest(conversationSnapshotsByAccountKey, MAX_CONVERSATION_SNAPSHOTS);
+    pruneOldest(conversationSnapshotsByLooseKey, MAX_CONVERSATION_SNAPSHOTS);
+}
+export function registerWecomSourceSnapshot(params) {
+    const accountId = normalizeOptional(params.accountId);
+    if (!accountId)
+        return;
+    const snapshot = {
+        accountId,
+        source: params.source,
+        recordedAt: Date.now(),
+        ...(normalizeOptional(params.messageId)
+            ? { messageId: normalizeOptional(params.messageId) }
+            : {}),
+        ...(normalizeOptional(params.sessionKey)
+            ? { sessionKey: normalizeOptional(params.sessionKey) }
+            : {}),
+        ...(normalizeOptional(params.sessionId)
+            ? { sessionId: normalizeOptional(params.sessionId) }
+            : {}),
+        ...(normalizePeerKind(params.peerKind) ? { peerKind: normalizePeerKind(params.peerKind) } : {}),
+        ...(normalizePeerId(params.peerId) ? { peerId: normalizePeerId(params.peerId) } : {}),
+        ...(normalizeOptional(params.upstreamCorpId)
+            ? { upstreamCorpId: normalizeOptional(params.upstreamCorpId) }
+            : {}),
+    };
+    if (snapshot.messageId) {
+        messageFacts.set(messageFactKey(accountId, snapshot.messageId), snapshot);
+        pruneOldest(messageFacts, MAX_MESSAGE_FACTS);
+    }
+    writeSessionSnapshot(snapshot);
+    writeConversationSnapshot(snapshot);
+}
+export function resolveWecomSourceSnapshot(params) {
+    const accountId = normalizeOptional(params.accountId);
+    const sessionKey = normalizeOptional(params.sessionKey);
+    const sessionId = normalizeOptional(params.sessionId);
+    const peerKind = normalizePeerKind(params.peerKind);
+    const peerId = normalizePeerId(params.peerId);
+    if (accountId && sessionKey) {
+        const scoped = sessionSnapshotsByAccountKey.get(accountScopedSessionKey(accountId, "sessionKey", sessionKey));
+        if (scoped)
+            return scoped;
+    }
+    if (accountId && sessionId) {
+        const scoped = sessionSnapshotsByAccountKey.get(accountScopedSessionKey(accountId, "sessionId", sessionId));
+        if (scoped)
+            return scoped;
+    }
+    if (sessionKey) {
+        const loose = sessionSnapshotsByLooseKey.get(`sessionKey::${sessionKey}`);
+        if (loose)
+            return loose;
+    }
+    if (sessionId) {
+        const loose = sessionSnapshotsByLooseKey.get(`sessionId::${sessionId}`);
+        if (loose)
+            return loose;
+    }
+    if (accountId && peerKind && peerId) {
+        const scoped = conversationSnapshotsByAccountKey.get(accountScopedConversationKey(accountId, peerKind, peerId));
+        if (scoped)
+            return scoped;
+    }
+    if (peerKind && peerId) {
+        const loose = conversationSnapshotsByLooseKey.get(`peer::${peerKind}::${peerId}`);
+        if (loose)
+            return loose;
+    }
+    return undefined;
+}
+export function clearWecomSourceAccount(accountId) {
+    const normalized = normalizeOptional(accountId);
+    if (!normalized)
+        return;
+    for (const [key, value] of messageFacts) {
+        if (value.accountId === normalized || key.startsWith(`${normalized}::`)) {
+            messageFacts.delete(key);
+        }
+    }
+    for (const [key, value] of sessionSnapshotsByAccountKey) {
+        if (value.accountId === normalized || key.startsWith(`${normalized}::`)) {
+            sessionSnapshotsByAccountKey.delete(key);
+        }
+    }
+    for (const [key, value] of sessionSnapshotsByLooseKey) {
+        if (value.accountId === normalized) {
+            sessionSnapshotsByLooseKey.delete(key);
+        }
+    }
+    for (const [key, value] of conversationSnapshotsByAccountKey) {
+        if (value.accountId === normalized || key.startsWith(`${normalized}::`)) {
+            conversationSnapshotsByAccountKey.delete(key);
+        }
+    }
+    for (const [key, value] of conversationSnapshotsByLooseKey) {
+        if (value.accountId === normalized) {
+            conversationSnapshotsByLooseKey.delete(key);
+        }
+    }
+}
+export function isWecomBotWsSource(params) {
+    return resolveWecomSourceSnapshot(params)?.source === "bot-ws";
+}
+export function isWecomAgentSource(params) {
+    return resolveWecomSourceSnapshot(params)?.source === "agent-callback";
+}

package/dist/src/runtime.js

@@ -0,0 +1 @@
+export { getActiveBotWsReplyHandle, getAccountRuntime, getAccountRuntimeSnapshot, getBotWsPushHandle, getWecomRuntime, registerActiveBotWsReplyHandle, registerAccountRuntime, registerBotWsPushHandle, setWecomRuntime, unregisterActiveBotWsReplyHandle, unregisterBotWsPushHandle, unregisterAccountRuntime, } from "./app/index.js";

package/dist/src/shared/command-auth.js

@@ -0,0 +1,57 @@
+import { isWecomSenderAllowed, normalizeWecomAllowFromEntry } from "../domain/policies.js";
+export async function resolveWecomCommandAuthorization(params) {
+    const { core, cfg, accountConfig, rawBody, senderUserId } = params;
+    const dmPolicy = (accountConfig.dm?.policy ?? "pairing");
+    const configAllowFrom = (accountConfig.dm?.allowFrom ?? []).map((v) => String(v));
+    const shouldComputeAuth = core.channel.commands.shouldComputeCommandAuthorized(rawBody, cfg);
+    // WeCom channel currently does NOT support the `openclaw pairing` CLI workflow
+    // ("Channel wecom does not support pairing"). So we must not rely on pairing
+    // store approvals for command authorization here.
+    //
+    // Policy semantics:
+    // - open: commands are allowed for everyone by default (unless higher-level access-groups deny).
+    // - allowlist: commands require allowFrom entries.
+    // - pairing: treated the same as allowlist for WeCom (since pairing CLI is unsupported).
+    const effectiveAllowFrom = dmPolicy === "open" ? ["*"] : configAllowFrom;
+    const senderAllowed = isWecomSenderAllowed(senderUserId, effectiveAllowFrom);
+    const allowAllConfigured = effectiveAllowFrom.some((entry) => normalizeWecomAllowFromEntry(entry) === "*");
+    const authorizerConfigured = allowAllConfigured || effectiveAllowFrom.length > 0;
+    const useAccessGroups = cfg.commands?.useAccessGroups !== false;
+    const commandAuthorized = shouldComputeAuth
+        ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
+            useAccessGroups,
+            authorizers: [{ configured: authorizerConfigured, allowed: senderAllowed }],
+        })
+        : undefined;
+    return {
+        shouldComputeAuth,
+        dmPolicy,
+        senderAllowed,
+        authorizerConfigured,
+        commandAuthorized,
+        effectiveAllowFrom,
+    };
+}
+export function buildWecomUnauthorizedCommandPrompt(params) {
+    const user = params.senderUserId || "unknown";
+    const policy = params.dmPolicy;
+    const scopeLabel = params.scope === "bot" ? "Bot（智能机器人）" : "Agent（自建应用）";
+    const dmPrefix = params.scope === "bot" ? "channels.wecom.bot.dm" : "channels.wecom.agent.dm";
+    const allowCmd = (value) => `openclaw config set ${dmPrefix}.allowFrom '${value}'`;
+    const policyCmd = (value) => `openclaw config set ${dmPrefix}.policy "${value}"`;
+    if (policy === "disabled") {
+        return [
+            `无权限执行命令（${scopeLabel} 已禁用：dm.policy=disabled）`,
+            `触发者：${user}`,
+            `管理员：${policyCmd("open")}（全放开）或 ${policyCmd("allowlist")}（白名单）`,
+        ].join("\n");
+    }
+    // WeCom 不支持 pairing CLI，因此这里统一给出“open / allowlist”两种明确的配置指令
+    return [
+        `无权限执行命令（入口：${scopeLabel}，userid：${user}）`,
+        `管理员全放开：${policyCmd("open")}`,
+        `管理员放行该用户：${policyCmd("allowlist")}`,
+        `然后设置白名单：${allowCmd(JSON.stringify([user]))}`,
+        `如果仍被拦截：检查 commands.useAccessGroups/访问组`,
+    ].join("\n");
+}

package/{src/shared/index.ts → dist/src/shared/index.js}

@@ -1,5 +1,4 @@
 /**
  * WeCom Shared 模块导出
  */
-
 export { parseXml, extractMsgType, extractFromUser, extractContent, extractChatId, extractToUser } from "./xml-parser.js";

package/dist/src/shared/media-asset.js

@@ -0,0 +1,65 @@
+import path from "node:path";
+import { resolveWecomEgressProxyUrlFromNetwork } from "../config/index.js";
+import { wecomFetch } from "../http.js";
+function inferContentTypeFromFilePath(filePath) {
+    const ext = path.extname(filePath).slice(1).toLowerCase();
+    const mimeTypes = {
+        jpg: "image/jpeg",
+        jpeg: "image/jpeg",
+        png: "image/png",
+        gif: "image/gif",
+        webp: "image/webp",
+        bmp: "image/bmp",
+        mp3: "audio/mpeg",
+        wav: "audio/wav",
+        amr: "audio/amr",
+        mp4: "video/mp4",
+        pdf: "application/pdf",
+        doc: "application/msword",
+        docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        xls: "application/vnd.ms-excel",
+        xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        ppt: "application/vnd.ms-powerpoint",
+        pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+        txt: "text/plain",
+        csv: "text/csv",
+        tsv: "text/tab-separated-values",
+        md: "text/markdown",
+        json: "application/json",
+        xml: "application/xml",
+        yaml: "application/yaml",
+        yml: "application/yaml",
+        zip: "application/zip",
+        rar: "application/vnd.rar",
+        "7z": "application/x-7z-compressed",
+        tar: "application/x-tar",
+        gz: "application/gzip",
+        tgz: "application/gzip",
+        rtf: "application/rtf",
+        odt: "application/vnd.oasis.opendocument.text",
+    };
+    return mimeTypes[ext] || "application/octet-stream";
+}
+export async function resolveOutboundMediaAsset(params) {
+    const { mediaUrl, network, timeoutMs = 30000 } = params;
+    if (/^https?:\/\//i.test(mediaUrl)) {
+        const response = await wecomFetch(mediaUrl, { method: "GET" }, {
+            proxyUrl: resolveWecomEgressProxyUrlFromNetwork(network),
+            timeoutMs,
+        });
+        if (!response.ok) {
+            throw new Error(`Failed to download media: ${response.status}`);
+        }
+        const buffer = Buffer.from(await response.arrayBuffer());
+        const contentType = response.headers.get("content-type") || "application/octet-stream";
+        const filename = path.basename(new URL(mediaUrl).pathname) || "media";
+        return { buffer, filename, contentType };
+    }
+    const fs = await import("node:fs/promises");
+    const buffer = await fs.readFile(mediaUrl);
+    return {
+        buffer,
+        filename: path.basename(mediaUrl),
+        contentType: inferContentTypeFromFilePath(mediaUrl),
+    };
+}

package/dist/src/shared/media-service.js

@@ -0,0 +1,59 @@
+import { resolveWecomMediaMaxBytes } from "../config/index.js";
+import { decryptWecomMediaWithMeta } from "../media.js";
+export class WecomMediaService {
+    core;
+    cfg;
+    constructor(core, cfg) {
+        this.core = core;
+        this.cfg = cfg;
+    }
+    resolveInboundMaxBytes(accountId) {
+        return resolveWecomMediaMaxBytes(this.cfg, accountId);
+    }
+    async downloadRemoteMedia(params) {
+        const loaded = await this.core.channel.media.fetchRemoteMedia({
+            url: params.url,
+            maxBytes: params.maxBytes,
+        });
+        return {
+            buffer: loaded.buffer,
+            contentType: loaded.contentType,
+            filename: loaded.fileName,
+        };
+    }
+    /**
+     * Download and decrypt WeCom AES-encrypted media.
+     * Bot-ws: each message carries a unique per-URL aeskey in the message body.
+     * Bot-webhook: uses the account-level EncodingAESKey.
+     * Both use AES-256-CBC with PKCS#7 padding (32-byte block), IV = key[:16].
+     */
+    async downloadEncryptedMedia(params) {
+        const decrypted = await decryptWecomMediaWithMeta(params.url, params.aesKey, {
+            maxBytes: params.maxBytes,
+        });
+        return {
+            buffer: decrypted.buffer,
+            contentType: decrypted.sourceContentType,
+            filename: decrypted.sourceFilename,
+        };
+    }
+    async saveInboundAttachment(event, attachment) {
+        const maxBytes = this.resolveInboundMaxBytes(event.accountId);
+        const saved = await this.core.channel.media.saveMediaBuffer(attachment.buffer, attachment.contentType, "inbound", maxBytes, attachment.filename);
+        return saved.path;
+    }
+    async normalizeFirstAttachment(event) {
+        const first = event.attachments?.[0];
+        if (!first?.remoteUrl) {
+            return undefined;
+        }
+        // Keep fetch/decrypt/save on the same account-aware limit instead of falling back
+        // to the core media store default (5MB).
+        const maxBytes = this.resolveInboundMaxBytes(event.accountId);
+        // Bot-ws media is AES-encrypted; use decryption when aesKey is present
+        if (first.aesKey) {
+            return this.downloadEncryptedMedia({ url: first.remoteUrl, aesKey: first.aesKey, maxBytes });
+        }
+        return this.downloadRemoteMedia({ url: first.remoteUrl, maxBytes });
+    }
+}

package/dist/src/shared/media-types.js

@@ -0,0 +1 @@
+export {};