@zoulabo/line-hive 0.1.20 → 0.1.21

package/README.md

@@ -13,7 +13,7 @@
   <a href="https://www.npmjs.com/package/@zoulabo/line-hive"><img src="https://img.shields.io/npm/v/@zoulabo/line-hive?color=cb3837&label=npm" alt="npm version"></a>
   <img src="https://img.shields.io/badge/node-%3E%3D18-brightgreen" alt="Node.js ≥18">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT License"></a>
-  <img src="https://img.shields.io/badge/tests-246%20passing-brightgreen" alt="246 tests passing">
+  <img src="https://img.shields.io/badge/tests-339%20passing-brightgreen" alt="339 tests passing">
 </p>
 
 <p align="center">
@@ -34,7 +34,8 @@
 - 🔍 **PDF intelligence** — text extraction, scanned PDF→image rendering, per-page navigation
 - 🌐 **Multi-language** — English and Japanese, auto-detected from LINE profile
 - 🔧 **Zero config tunnel** — built-in ngrok management (or bring your own tunnel)
-- 🛡️ **Security hardened** — PDF JS disabled, workspace-scoped file access, no shell injection
+- 🛡️ **Security hardened** — workspace-scoped file access, path containment, sandboxed PDF parsing
+- 🔐 **Access control** — first user is auto-registered as primary admin; restricted mode activates on follow or status check, blocking other users by default
 
 ## Contents
 
@@ -266,7 +267,7 @@ npx @zoulabo/line-hive init --editor cursor  # switch editor type
 | `line_check_messages` | Fetch unclaimed inbound messages | No |
 | `line_list_agents` | List all active agents across editor windows | No |
 | `line_read_file` | Read content from a received file (PDF text, scanned PDF→image, image resize, text decode) | No |
-| `line_render_markdown` | Convert Markdown to HTML (built-in, no library install needed) | No |
+| `line_render_markdown` | Convert Markdown → HTML with auto-injected CDN (Mermaid, highlight.js, KaTeX). TTL-managed. | No |
 
 ### Recommended Pattern
 
@@ -304,8 +305,8 @@ Auto-detected from the user's LINE profile. Currently **English** (default) and
 
 - **Push quota** — free tier: 200/month. Status queries via `?` use reply tokens (free). Send `?` periodically to replenish the token pool.
 - **Reply token expiry** — ~15 min. Falls back to push when exhausted.
-- **Files** — receive images & files (stored as base64 in SQLite). Send via `imageBase64`, `imageFilePath`, or `filePath`. Stickers, video, and audio are currently ignored.
-- **Single user** — designed for one developer per LINE channel.
+- **Files** — receive images & files (stored on disk in `.line-hive-tmp/incoming/`, 24h TTL). Send via `imageBase64`, `imageFilePath`, or `filePath`. Served files have a configurable TTL (default 2h, max 24h) with auto-cleanup. Stickers are currently ignored; video and audio are stored as files.
+- **Single user** — designed for one primary user (admin) per LINE channel. The first follow or status check auto-activates restricted mode; additional users require manual allowlisting via store methods.
 - **Single webhook URL** — all agent instances share one tunnel endpoint.
 - **Multi-workspace** — only the first editor claims the webhook port/tunnel. Others piggyback via shared SQLite.
 - **Claude Code** — `line_ask` can block up to 2 hours; ensure `MCP_TOOL_TIMEOUT` is not too short. Always use `--editor claude-code` for init.
@@ -350,7 +351,7 @@ For standalone `npm start`:
 
 Designed for **AI-agent-driven development**. The repo includes skill files (`.github/skills/`) that teach agents the codebase. Point your agent at the repo and let it work.
 
-- `npm test` must pass (~246 tests, <1s)
+- `npm test` must pass (~339 tests, <1s)
 - `npx tsc --noEmit` must be clean
 - Let the agents read skills first, then write the code
 
@@ -400,6 +401,7 @@ Don't use `--editor vscode` — that's for GitHub Copilot.
 - **SQLite** (WAL mode) shared across all agent instances at `~/.line-hive/line-hive.db`
 - **Heartbeat** every 10s — dead agents auto-cleaned after 2 min
 - **Reply token pooling** — webhook saves tokens for free replies (saves push quota)
+- **TTL-managed file serving** — images, HTML, and documents served from disk with configurable TTL (default 2h, max 24h); expired files auto-cleaned every 60s
 - **Session correlation** — `line_ask` creates a session, webhook fulfills it on reply
 - **Multi-agent routing** — user selects agent via quick reply buttons, or auto-routes to `needs_input` agent
 - **Embedded tunnel** — ngrok auto-managed as child process (optional; any tunnel to localhost:19780 works)

package/dist/constants.js

@@ -10,6 +10,12 @@ export const MAX_TIMEOUT_MS = 86400000; // 24 hours
 export const POLL_INTERVAL_MS = 2000;
 // Reply token pool
 export const REPLY_TOKEN_MAX_AGE_MS = 900000; // 15 min
+// Served file TTL
+export const DEFAULT_FILE_TTL_MS = 2 * 60 * 60 * 1000; // 2 hours
+export const MAX_FILE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+// Incoming media disk storage
+export const INCOMING_MEDIA_DIR = ".line-hive-tmp/incoming";
 // Config keys
 export const CONFIG_TARGETED_AGENT = "targeted_agent_id";
+export const CONFIG_ALLOWED_USERS = "allowed_users";
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,kBAAkB;AAClB,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,mBAAmB;AACnB,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,WAAW;AAEnD,wCAAwC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,mBAAmB;AACnB,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,CAAC,SAAS;AAEvD,cAAc;AACd,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,kBAAkB;AAClB,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC,mBAAmB;AACnB,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,WAAW;AAEnD,wCAAwC;AACxC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,mBAAmB;AACnB,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,CAAC,SAAS;AAEvD,kBAAkB;AAClB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAW,UAAU;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAS,WAAW;AAEvE,8BAA8B;AAC9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,cAAc;AACd,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC"}

package/dist/index.js

@@ -82,8 +82,8 @@ async function main() {
                 webhookServer = null;
             });
         }
-        catch {
-            // Port still in use — will retry on next heartbeat
+        catch (err) {
+            logger.debug({ error: err instanceof Error ? err.message : err }, "Port still in use — will retry on next heartbeat");
         }
     }
     // Initial attempt to claim the port
@@ -147,9 +147,39 @@ async function main() {
         }
     }, config.heartbeatIntervalMs);
     const cleanupTimer = setInterval(() => {
-        messageStore.cleanup();
+        const incomingMediaPaths = messageStore.cleanup();
         messageStore.expireSessions(Date.now());
         messageStore.cleanupDeadAgentSessions(config.heartbeatTimeoutMs);
+        // Clean up incoming media files from disk (returned by cleanup())
+        let incomingDeleted = 0;
+        for (const diskPath of incomingMediaPaths) {
+            try {
+                const fullPath = path.resolve(diskPath);
+                if (fs.existsSync(fullPath)) {
+                    fs.unlinkSync(fullPath);
+                    incomingDeleted++;
+                }
+            }
+            catch { /* ignore cleanup errors */ }
+        }
+        if (incomingDeleted > 0) {
+            logger.info({ count: incomingDeleted }, "Cleaned up incoming media files");
+        }
+        // Clean up expired served files from disk
+        const expiredFiles = messageStore.cleanupExpiredServedFiles();
+        const serveDir = path.resolve(".line-hive-tmp");
+        for (const filename of expiredFiles) {
+            try {
+                const filePath = path.join(serveDir, filename);
+                if (fs.existsSync(filePath)) {
+                    fs.unlinkSync(filePath);
+                }
+            }
+            catch { /* ignore cleanup errors */ }
+        }
+        if (expiredFiles.length > 0) {
+            logger.info({ count: expiredFiles.length }, "Cleaned up expired served files");
+        }
     }, config.cleanupIntervalMs);
     let shuttingDown = false;
     const shutdown = () => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAE3H,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,oDAAoD;AACpD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE;aAC9B,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACnC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC;aACD,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE/C,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,oIAAoI,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;IAChJ,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3C,kEAAkE;IAClE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEhC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACxD,kBAAkB,CACnB,CAAC;IAEF,8DAA8D;IAC9D,IAAI,aAAa,GAAiD,IAAI,CAAC;IACvE,IAAI,YAAY,GAA0C,IAAI,CAAC;IAC/D,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,yDAAyD;IACzD,SAAS,eAAe;QACtB,IAAI,WAAW;YAAE,OAAO,CAAC,kBAAkB;QAE3C,IAAI,CAAC;YACH,aAAa,GAAG,kBAAkB,CAAC;gBACjC,MAAM;gBACN,YAAY;gBACZ,WAAW;gBACX,UAAU;gBACV,MAAM;aACP,CAAC,CAAC;YAEH,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBACjC,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAC5B,wCAAwC,CACzC,CAAC;gBACF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,YAAY,GAAG,WAAW,CAAC;wBACzB,MAAM,EAAE,MAAM,CAAC,WAAW;wBAC1B,IAAI,EAAE,MAAM,CAAC,WAAW;wBACxB,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAC5B,uFAAuF,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,wEAAwE;YACxE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC7B,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,eAAe,EAAE,CAAC;IAElB,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,MAAM;QACN,YAAY;QACZ,WAAW;QACX,UAAU;QACV,MAAM;QACN,sBAAsB,EAAE,GAAG,EAAE;YAC3B,IAAI,mBAAmB,IAAI,0BAA0B,EAAE,CAAC;gBACtD,mBAAmB,GAAG,KAAK,CAAC,CAAC,mBAAmB;gBAChD,OAAO,0BAA0B,CAAC;YACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iEAAiE;IACjE,oFAAoF;IACpF,wFAAwF;IACxF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,0BAA0B,GAAkB,IAAI,CAAC;IACrD,CAAC,KAAK,IAAI,EAAE;QACV,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,YAAY;gBAC1B,CAAC,CAAC,MAAM,6BAA6B,CAAC,UAAU,CAAC;gBACjD,CAAC,CAAC,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAC;gBACpE,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBACH,0BAA0B,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;YACH,CAAC;YACD,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,uEAAuE;IACvE,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5C,WAAW,CAAC,SAAS,EAAE,CAAC;QACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAExD,qEAAqE;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,kDAAkD,CAAC,CAAC;gBAC9F,eAAe,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,YAAY,CAAC,OAAO,EAAE,CAAC;QACvB,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,YAAY,CAAC,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE7B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,aAAa,CAAC,cAAc,CAAC,CAAC;QAC9B,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,WAAW,CAAC,UAAU,EAAE,CAAC;QACzB,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEhC,iFAAiF;IACjF,sFAAsF;IACtF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAE3H,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE,oDAAoD;AACpD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE;aAC9B,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACnC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC;aACD,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE/C,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,oIAAoI,CAAC,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;IAChJ,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAE3C,kEAAkE;IAClE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEhC,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,CAAC,IAAI,CACT,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EACxD,kBAAkB,CACnB,CAAC;IAEF,8DAA8D;IAC9D,IAAI,aAAa,GAAiD,IAAI,CAAC;IACvE,IAAI,YAAY,GAA0C,IAAI,CAAC;IAC/D,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,yDAAyD;IACzD,SAAS,eAAe;QACtB,IAAI,WAAW;YAAE,OAAO,CAAC,kBAAkB;QAE3C,IAAI,CAAC;YACH,aAAa,GAAG,kBAAkB,CAAC;gBACjC,MAAM;gBACN,YAAY;gBACZ,WAAW;gBACX,UAAU;gBACV,MAAM;aACP,CAAC,CAAC;YAEH,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBACjC,WAAW,GAAG,IAAI,CAAC;gBACnB,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAC5B,wCAAwC,CACzC,CAAC;gBACF,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACvB,YAAY,GAAG,WAAW,CAAC;wBACzB,MAAM,EAAE,MAAM,CAAC,WAAW;wBAC1B,IAAI,EAAE,MAAM,CAAC,WAAW;wBACxB,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,CACT,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAC5B,uFAAuF,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,iEAAiE;YACjE,wEAAwE;YACxE,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC7B,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,kDAAkD,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,eAAe,EAAE,CAAC;IAElB,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,MAAM;QACN,YAAY;QACZ,WAAW;QACX,UAAU;QACV,MAAM;QACN,sBAAsB,EAAE,GAAG,EAAE;YAC3B,IAAI,mBAAmB,IAAI,0BAA0B,EAAE,CAAC;gBACtD,mBAAmB,GAAG,KAAK,CAAC,CAAC,mBAAmB;gBAChD,OAAO,0BAA0B,CAAC;YACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,iEAAiE;IACjE,oFAAoF;IACpF,wFAAwF;IACxF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,0BAA0B,GAAkB,IAAI,CAAC;IACrD,CAAC,KAAK,IAAI,EAAE;QACV,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACtG,MAAM,OAAO,GAAG,YAAY;gBAC1B,CAAC,CAAC,MAAM,6BAA6B,CAAC,UAAU,CAAC;gBACjD,CAAC,CAAC,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,mCAAmC,CAAC,CAAC;gBACpE,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC;oBACH,0BAA0B,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjE,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;YACH,CAAC;YACD,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2DAA2D;YAC3D,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,uEAAuE;IACvE,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAC5C,WAAW,CAAC,SAAS,EAAE,CAAC;QACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAExD,qEAAqE;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,kDAAkD,CAAC,CAAC;gBAC9F,eAAe,EAAE,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,MAAM,kBAAkB,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;QAClD,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxC,YAAY,CAAC,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAEjE,kEAAkE;QAClE,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACxB,eAAe,EAAE,CAAC;gBACpB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC7E,CAAC;QAED,0CAA0C;QAC1C,MAAM,YAAY,GAAG,YAAY,CAAC,yBAAyB,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE7B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,aAAa,CAAC,cAAc,CAAC,CAAC;QAC9B,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,WAAW,CAAC,UAAU,EAAE,CAAC;QACzB,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,aAAa,EAAE,CAAC;YAClB,aAAa,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEhC,iFAAiF;IACjF,sFAAsF;IACtF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACnE,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/line/webhook.js

@@ -1,8 +1,10 @@
 import http from "http";
 import crypto from "crypto";
+import fs from "fs";
+import path from "path";
 import { buildDeleteQueueReply, errorMessage, parsePostbackData, textWithQuickReply, textWithQueueQuickReply, formatTimeAgo, STATUS_ICONS, getAgentDisplayName, } from "./messages.js";
 import { sendWithTokenPool } from "../util/sendWithTokenPool.js";
-import { CONFIG_TARGETED_AGENT } from "../constants.js";
+import { CONFIG_TARGETED_AGENT, INCOMING_MEDIA_DIR } from "../constants.js";
 import { t, resolveLocale } from "../i18n.js";
 export function verifySignature(secret, body, signature) {
     if (!secret || !signature) {
@@ -42,6 +44,18 @@ async function resolveUserLocale(deps, userId) {
     }
     return "en";
 }
+/**
+ * Register the user as default (if first user) and auto-enable restricted mode.
+ * When the first user interacts with the bot and no allowed_users list exists yet,
+ * this switches from open mode to restricted mode with the first user auto-allowed.
+ */
+function registerAndAutoAllow(deps, userId) {
+    const isFirst = deps.messageStore.registerDefaultUserIfMissing(userId);
+    if (isFirst && deps.messageStore.getAllowedUsers().length === 0) {
+        deps.messageStore.addAllowedUser(userId);
+        deps.logger?.info({ userId: userId.slice(0, 8) }, "First user auto-allowed, restricted mode enabled");
+    }
+}
 /** Format a single agent's status into a line of text */
 export function formatAgentStatus(agent, locale = "en") {
     const m = t(locale);
@@ -136,8 +150,8 @@ async function replyViaPool(deps, replyToken, message, eventTimestamp) {
     }
 }
 /**
- * Download an image preview from the LINE Content API and return as base64.
- * Uses the /preview endpoint (~240×240, ~30KB) to keep payloads small.
+ * Download an image from the LINE Content API at full resolution.
+ * Uses the full content endpoint (not preview) to get the original image.
  * For external images (forwarded), fetches from the original URL directly.
  */
 async function downloadImagePreview(deps, event) {
@@ -154,7 +168,8 @@ async function downloadImagePreview(deps, event) {
             url = provider.originalContentUrl;
         }
         else if (messageId) {
-            url = `https://api-data.line.me/v2/bot/message/${messageId}/content/preview`;
+            // Full-resolution content endpoint (not /preview)
+            url = `https://api-data.line.me/v2/bot/message/${messageId}/content`;
         }
         else {
             return null;
@@ -168,16 +183,15 @@ async function downloadImagePreview(deps, event) {
             deps.logger?.warn({ status: res.status, messageId }, "Image download failed");
             return null;
         }
-        // Limit download size to 5MB to prevent memory exhaustion
+        // Limit download size to 10MB to prevent memory exhaustion
         const contentLength = res.headers.get("content-length");
-        if (contentLength && parseInt(contentLength, 10) > 5 * 1024 * 1024) {
+        if (contentLength && parseInt(contentLength, 10) > 10 * 1024 * 1024) {
             deps.logger?.warn({ contentLength }, "Image too large, skipping download");
             return null;
         }
         const buffer = Buffer.from(await res.arrayBuffer());
-        const base64 = buffer.toString("base64");
         const mimeType = res.headers.get("content-type") || "image/jpeg";
-        return { base64, mimeType };
+        return { buffer, mimeType };
     }
     catch (error) {
         deps.logger?.warn({ error }, "Image download error");
@@ -209,10 +223,9 @@ async function downloadFileContent(deps, event) {
             return null;
         }
         const buffer = Buffer.from(await res.arrayBuffer());
-        const base64 = buffer.toString("base64");
         const mimeType = res.headers.get("content-type") || "application/octet-stream";
         return {
-            base64,
+            buffer,
             mimeType,
             fileName: event.message?.fileName,
             fileSize: event.message?.fileSize,
@@ -223,6 +236,36 @@ async function downloadFileContent(deps, event) {
         return null;
     }
 }
+/**
+ * Write downloaded media to disk under `.line-hive-tmp/incoming/`.
+ * Returns the relative disk path (from project root) for storage in media_json.
+ *
+ * Naming: `{lineMessageId}-{sanitizedFilename}` or `{lineMessageId}.{ext}`
+ */
+function writeIncomingMedia(lineMessageId, buffer, mimeType, fileName) {
+    const dir = path.resolve(INCOMING_MEDIA_DIR);
+    fs.mkdirSync(dir, { recursive: true });
+    // Derive extension from filename or mime type
+    const mimeToExt = {
+        "image/jpeg": ".jpg", "image/png": ".png", "image/gif": ".gif",
+        "image/webp": ".webp", "audio/mpeg": ".mp3", "audio/m4a": ".m4a",
+        "audio/ogg": ".ogg", "video/mp4": ".mp4", "application/pdf": ".pdf",
+    };
+    let safeName;
+    if (fileName) {
+        // Sanitize user-provided filename: keep alphanumeric, dots, hyphens, underscores
+        safeName = fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+    }
+    else {
+        const ext = mimeToExt[mimeType] || "";
+        safeName = `${lineMessageId}${ext}`;
+    }
+    const diskName = `${lineMessageId}-${safeName}`;
+    const diskPath = path.join(dir, diskName);
+    fs.writeFileSync(diskPath, buffer);
+    // Return path relative to project root (for storage in media_json)
+    return path.join(INCOMING_MEDIA_DIR, diskName);
+}
 async function handleFileEvent(deps, event, userId) {
     const replyToken = event.replyToken;
     const webhookEventId = getWebhookEventId(event);
@@ -230,7 +273,17 @@ async function handleFileEvent(deps, event, userId) {
     const fileSize = event.message?.fileSize;
     // Download file content immediately (LINE auto-deletes content after a period)
     const media = await downloadFileContent(deps, event);
-    const mediaJson = media ? JSON.stringify(media) : null;
+    let mediaJson = null;
+    if (media) {
+        const lineMessageId = event.message?.id ?? webhookEventId;
+        const diskPath = writeIncomingMedia(lineMessageId, media.buffer, media.mimeType, media.fileName);
+        mediaJson = JSON.stringify({
+            mimeType: media.mimeType,
+            diskPath,
+            fileName: media.fileName,
+            fileSize: media.fileSize,
+        });
+    }
     const locale = await resolveUserLocale(deps, userId);
     const chatTargetedAgentId = deps.messageStore.getConfig(CONFIG_TARGETED_AGENT);
     const sizeStr = fileSize ? ` (${Math.round(fileSize / 1024)}KB)` : "";
@@ -261,7 +314,12 @@ async function handleImageEvent(deps, event, userId) {
     const webhookEventId = getWebhookEventId(event);
     // Download image preview immediately (LINE auto-deletes content after a period)
     const media = await downloadImagePreview(deps, event);
-    const mediaJson = media ? JSON.stringify({ mimeType: media.mimeType, base64: media.base64 }) : null;
+    let mediaJson = null;
+    if (media) {
+        const lineMessageId = event.message?.id ?? webhookEventId;
+        const diskPath = writeIncomingMedia(lineMessageId, media.buffer, media.mimeType);
+        mediaJson = JSON.stringify({ mimeType: media.mimeType, diskPath });
+    }
     // Resolve user locale
     const locale = await resolveUserLocale(deps, userId);
     // For chat messages, use targeted routing if user has selected an agent
@@ -277,7 +335,7 @@ async function handleImageEvent(deps, event, userId) {
     }, { targetedAgentId: chatTargetedAgentId });
     if (messageResult.deduped)
         return;
-    // Auto-register userId
+    // Auto-register userId (no auto-allow for image events)
     deps.messageStore.registerDefaultUserIfMissing(userId);
     if (!replyToken)
         return;
@@ -331,8 +389,13 @@ async function handleTextEvent(deps, event, text, userId) {
     if (isControlCommand && messageResult.messageId) {
         deps.messageStore.markMessageConsumed(messageResult.messageId);
     }
-    // Auto-register userId from incoming webhook (DB-only, no env/file writes)
-    deps.messageStore.registerDefaultUserIfMissing(userId);
+    // Auto-register: only auto-allow on status command ("?"), not on chat/other
+    if (command.type === "status") {
+        registerAndAutoAllow(deps, userId);
+    }
+    else {
+        deps.messageStore.registerDefaultUserIfMissing(userId);
+    }
     if (!replyToken) {
         return;
     }
@@ -356,7 +419,7 @@ async function handlePostbackEvent(deps, event, data, userId) {
     const replyToken = event.replyToken;
     if (!replyToken)
         return;
-    // Auto-register userId if needed
+    // Auto-register userId (no auto-allow for postback events)
     deps.messageStore.registerDefaultUserIfMissing(userId);
     // Resolve user locale
     const locale = await resolveUserLocale(deps, userId);
@@ -600,7 +663,8 @@ async function handleCommandReply(deps, command, replyToken, messageId, eventTim
         deps.logger?.info({ targetAgent: agentDisplayName }, "Chat routed to targeted agent");
         // If agent is actively waiting (has active session), save token silently —
         // agent will respond within seconds via line_ask polling.
-        if (deps.messageStore.hasWaitingSession()) {
+        // Scope to THIS agent to avoid stale sessions from dead agents suppressing acks.
+        if (deps.messageStore.getWaitingSessionForAgent(targetAgent.agentId)) {
             deps.messageStore.saveReplyToken(replyToken, eventTimestamp ?? Date.now());
             return;
         }
@@ -645,6 +709,11 @@ export async function handleWebhook(deps, body, signature) {
         const userId = event.source?.userId;
         if (!userId)
             continue;
+        // Access control: reject messages from unauthorized users
+        if (!deps.messageStore.isUserAllowed(userId)) {
+            deps.logger?.info({ userId: userId.slice(0, 8) }, "Blocked message from unauthorized user");
+            continue;
+        }
         if (event.type === "message" && event.message?.type === "text") {
             const text = event.message?.text ?? "";
             await handleTextEvent(deps, event, text, userId);
@@ -667,6 +736,14 @@ export async function handleWebhook(deps, body, signature) {
             const removed = deps.messageStore.deleteByLineMessageId(event.unsend.messageId);
             deps.logger?.info({ lineMessageId: event.unsend.messageId, removed }, "Unsend: message deleted");
         }
+        else if (event.type === "follow") {
+            // New user added bot as friend — auto-register and auto-allow
+            registerAndAutoAllow(deps, userId);
+            // Save reply token if available
+            if (event.replyToken) {
+                deps.messageStore.saveReplyToken(event.replyToken, event.timestamp);
+            }
+        }
     }
     return { statusCode: 200, body: "OK" };
 }
@@ -681,37 +758,65 @@ export function startWebhookServer(deps) {
             const prefix = url.startsWith("/files/") ? "/files/" : "/images/";
             // Strip query string and decode percent-encoding for clean ID extraction
             const rawId = url.slice(prefix.length).split("?")[0];
-            // Strip file extension (e.g. "abc123.html" → "abc123") for store lookup
-            const imageId = decodeURIComponent(rawId).replace(/\.[^.]+$/, "");
-            if (!imageId || imageId.includes("/") || imageId.includes("..")) {
+            const decodedRawId = decodeURIComponent(rawId);
+            if (!decodedRawId || decodedRawId.includes("/") || decodedRawId.includes("..")) {
                 res.statusCode = 404;
                 res.end("Not found");
                 return;
             }
-            const image = deps.messageStore.getOutgoingImage(imageId);
-            if (!image) {
-                res.statusCode = 404;
-                res.end("Not found");
+            // Check TTL — all disk-served files MUST be tracked.
+            // Untracked files on disk return 404 (strict mode).
+            // Race: cleanup may delete between check and readFile → 404 (acceptable).
+            const fileExpiry = deps.messageStore.getServedFileExpiry(decodedRawId);
+            if (fileExpiry?.isExpired) {
+                res.statusCode = 410;
+                res.end("Gone — file expired");
                 return;
             }
-            // Add charset for text-based content types
-            const contentType = image.mimeType.startsWith("text/")
-                ? `${image.mimeType}; charset=utf-8`
-                : image.mimeType;
-            res.setHeader("Content-Type", contentType);
-            res.setHeader("Content-Length", image.data.length);
-            res.setHeader("Cache-Control", "public, max-age=3600");
-            // Prevent MIME sniffing (defense-in-depth)
-            res.setHeader("X-Content-Type-Options", "nosniff");
-            // Images and browser-viewable types display inline; others trigger download
-            if (image.mimeType.startsWith("image/") || image.mimeType === "text/html" || image.mimeType === "application/pdf") {
-                res.setHeader("Content-Disposition", "inline");
-            }
-            else {
-                res.setHeader("Content-Disposition", "attachment");
+            // Try disk (files MUST be tracked in served_files table)
+            const serveDir = path.resolve(".line-hive-tmp");
+            const diskPath = path.resolve(".line-hive-tmp", decodedRawId);
+            if (fileExpiry && diskPath.startsWith(serveDir + path.sep) && fs.existsSync(diskPath)) {
+                try {
+                    const fileBuffer = fs.readFileSync(diskPath);
+                    const ext = path.extname(diskPath).toLowerCase();
+                    const mimeMap = {
+                        ".html": "text/html",
+                        ".css": "text/css",
+                        ".js": "application/javascript",
+                        ".json": "application/json",
+                        ".png": "image/png",
+                        ".jpg": "image/jpeg",
+                        ".jpeg": "image/jpeg",
+                        ".gif": "image/gif",
+                        ".webp": "image/webp",
+                        ".svg": "image/svg+xml",
+                        ".pdf": "application/pdf",
+                    };
+                    const mimeType = mimeMap[ext] || "application/octet-stream";
+                    const contentType = mimeType.startsWith("text/") ? `${mimeType}; charset=utf-8` : mimeType;
+                    res.setHeader("Content-Type", contentType);
+                    res.setHeader("Content-Length", fileBuffer.length);
+                    res.setHeader("Cache-Control", "public, max-age=60");
+                    res.setHeader("X-Content-Type-Options", "nosniff");
+                    if (mimeType.startsWith("image/") || mimeType === "text/html" || mimeType === "application/pdf") {
+                        res.setHeader("Content-Disposition", "inline");
+                    }
+                    else {
+                        res.setHeader("Content-Disposition", "attachment");
+                    }
+                    res.statusCode = 200;
+                    res.end(fileBuffer);
+                }
+                catch (err) {
+                    deps.logger?.warn({ error: err instanceof Error ? err.message : err, file: decodedRawId }, "Failed to serve file");
+                    res.statusCode = 500;
+                    res.end("Internal error");
+                }
+                return;
             }
-            res.statusCode = 200;
-            res.end(image.data);
+            res.statusCode = 404;
+            res.end("Not found");
             return;
         }
         if (method !== "POST" || url !== deps.config.webhookPath) {