@ycodium-ai/plugin-im 0.2.3096 → 0.2.3102

package/README.md

@@ -4,6 +4,17 @@ Talk to your agents from Telegram, WeCom, or Lark. Message the bot (or mention
 it in a group) and it starts a turn on this machine; the conclusion comes back
 to the chat, and anything the agent needs approved lands there too.
 
+In group chats, each message sent to the agent starts with a line saying who
+spoke, including the group name when available. Telegram supplies the sender's
+first and last name (or username) and the group title. Lark looks up the sender's
+name and the group name; displaying real names requires 通讯录（用户信息）读取权限
+(contact/user information read permission) on the app. Without that permission,
+the bot still works. WeCom smart bot callbacks supply neither name. When a name
+is unavailable, the line uses a short code such as `member 3f2a`, stable for that
+person in that bot and derived without exposing the platform user id. Private
+chats have no source line. In a group, the source line comes before any quoted
+reply and the user's words.
+
 ## What it does
 
 Each settings-card row is one **bot card** (alias, platform, credentials, access
@@ -202,7 +213,9 @@ a resource (`RESOURCE_MESSAGE_TYPES` in `src/larkInbound.ts`); the sender allow-
 applies. Lark rich text is read by `src/larkPost.ts` (every image, `<image N>` placeholders in
 order, the client's `md` field preferred). Known types we do not handle are reported with
 `unsupportedType` and answered with one line, rate-limited per chat. A chat pointed at a team
-cannot carry attachments. WeCom reports `image`, `file`, `video` and the images of `mixed` (a group "mention plus picture"; text items and `<image N>` placeholders keep their order, and a mixed with only images still has content, so it starts a turn) in `resources`, with the download URL and `aeskey` packed into the resource key. `fetchResource` (`src/wecomMedia.ts`) GETs the URL (valid five minutes) and decrypts: `aeskey` is base64 for a 32-byte key, the IV is its first 16 bytes, AES-256-CBC with auto padding off, then PKCS#7 removed with a **32-byte block** (pad value 1 to 32, every pad byte equal, else the media is rejected). Without an `aeskey` the bytes are used as they are. The ciphertext is capped at limit + 32, the plaintext at the limit, and the file name comes from `Content-Disposition` (`filename*=UTF-8''…` first, then `filename="…"`) through `ImFetchedResource`. A WeCom `voice` message is its transcript as text, not an attachment. `quote` is not read on any platform.
+cannot carry attachments. WeCom reports `image`, `file`, `video` and the images of `mixed` (a group "mention plus picture"; text items and `<image N>` placeholders keep their order, and a mixed with only images still has content, so it starts a turn) in `resources`, with the download URL and `aeskey` packed into the resource key. `fetchResource` (`src/wecomMedia.ts`) GETs the URL (valid five minutes) and decrypts: `aeskey` is base64 for a 32-byte key, the IV is its first 16 bytes, AES-256-CBC with auto padding off, then PKCS#7 removed with a **32-byte block** (pad value 1 to 32, every pad byte equal, else the media is rejected). Without an `aeskey` the bytes are used as they are. The ciphertext is capped at limit + 32, the plaintext at the limit, and the file name comes from `Content-Disposition` (`filename*=UTF-8''…` first, then `filename="…"`) through `ImFetchedResource`. A WeCom `voice` message is its transcript as text, not an attachment.
+
+Lark, Telegram and the WeCom smart bot read quoted text and attachment summaries into the agent's message; quoted attachment bytes are not downloaded. Telegram uses the selected `quote.text` when present and ignores forum-topic service anchors. Lark reads an explicit `parent_id` with a five-second timeout, excluding a topic's automatic reference to its root. If the original cannot be read, a short reason accompanies the user's question and the turn still starts. WeCom App and personal WeChat do not read quotes.
 
 Outbound files. The plugin contributes one MCP tool, `im_send_file` (`src/sendFile.ts`;
 `ctx.toolkit` name `im`), with `path` and an optional `description` (the caption). It sends only