agent-messenger 2.23.4 → 2.23.5

package/src/platforms/webex/commands/file.test.ts

@@ -0,0 +1,96 @@
+import { afterEach, beforeEach, expect, it, spyOn } from 'bun:test'
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { WebexClient } from '../client'
+import { toRestId } from '../id-normalizer'
+
+const roomId = toRestId('space_456', 'ROOM')
+
+const mockMessage = {
+  id: toRestId('msg_123', 'MESSAGE'),
+  ref: 'msg_123',
+  roomId,
+  roomRef: 'space_456',
+  roomType: 'group' as const,
+  text: '',
+  personId: toRestId('person_789', 'PEOPLE'),
+  personRef: 'person_789',
+  personEmail: 'user@example.com',
+  files: ['https://files.wbx2.com/files/f1'],
+  created: '2025-01-29T10:00:00.000Z',
+}
+
+import { downloadAction, uploadAction } from './file'
+
+let mockUploadFile: ReturnType<typeof spyOn>
+let mockDownloadContent: ReturnType<typeof spyOn>
+let consoleLogSpy: ReturnType<typeof spyOn>
+const protoSpies: ReturnType<typeof spyOn>[] = []
+let workDir: string
+
+function protoSpy(method: keyof WebexClient) {
+  const s = spyOn(WebexClient.prototype, method as never)
+  protoSpies.push(s)
+  return s
+}
+
+beforeEach(() => {
+  protoSpy('login').mockImplementation(async function (this: WebexClient) {
+    return this
+  })
+  protoSpy('dispose').mockResolvedValue(undefined)
+  mockUploadFile = protoSpy('uploadFile').mockResolvedValue(mockMessage)
+  mockDownloadContent = protoSpy('downloadContent').mockResolvedValue({
+    data: new TextEncoder().encode('file-bytes').buffer,
+    filename: 'report.pdf',
+    contentType: 'application/pdf',
+  })
+  consoleLogSpy = spyOn(console, 'log').mockImplementation(() => {})
+  workDir = mkdtempSync(join(tmpdir(), 'webex-file-test-'))
+})
+
+afterEach(() => {
+  for (const s of protoSpies) s.mockRestore()
+  protoSpies.length = 0
+  consoleLogSpy.mockRestore()
+  rmSync(workDir, { recursive: true, force: true })
+})
+
+it('upload reads the local file and forwards filename plus text to uploadFile', async () => {
+  const filePath = join(workDir, 'note.txt')
+  writeFileSync(filePath, 'hello world')
+
+  await uploadAction(roomId, filePath, { text: 'see attached' })
+
+  expect(mockUploadFile).toHaveBeenCalledTimes(1)
+  const [space, file, options] = mockUploadFile.mock.calls[0] as [
+    string,
+    { content: Blob; filename: string },
+    { text?: string },
+  ]
+  expect(space).toBe(roomId)
+  expect(file.filename).toBe('note.txt')
+  expect(options.text).toBe('see attached')
+})
+
+it('upload prints the resulting message with file urls', async () => {
+  const filePath = join(workDir, 'note.txt')
+  writeFileSync(filePath, 'hello world')
+
+  await uploadAction(roomId, filePath, {})
+
+  const printed = JSON.parse(consoleLogSpy.mock.calls[0]?.[0] as string)
+  expect(printed.id).toBe(mockMessage.id)
+  expect(printed.files).toEqual(['https://files.wbx2.com/files/f1'])
+})
+
+it('download writes content to the given output path', async () => {
+  const outPath = join(workDir, 'out.pdf')
+
+  await downloadAction('https://webexapis.com/v1/contents/c1', outPath, {})
+
+  expect(mockDownloadContent).toHaveBeenCalledWith('https://webexapis.com/v1/contents/c1')
+  expect(readFileSync(outPath, 'utf8')).toBe('file-bytes')
+})

package/src/platforms/webex/commands/file.ts

@@ -0,0 +1,87 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { basename, resolve } from 'node:path'
+
+import { Command } from 'commander'
+
+import { handleError } from '@/shared/utils/error-handler'
+import { formatOutput } from '@/shared/utils/output'
+
+import { WebexClient } from '../client'
+
+async function withWebexClient<T>(run: (client: WebexClient) => Promise<T>): Promise<T> {
+  const client = new WebexClient()
+  try {
+    await client.login()
+    return await run(client)
+  } finally {
+    await client.dispose()
+  }
+}
+
+export async function uploadAction(
+  space: string,
+  path: string,
+  options: { text?: string; markdown?: boolean; parent?: string; pretty?: boolean },
+): Promise<void> {
+  try {
+    const filePath = resolve(path)
+    const content = await readFile(filePath)
+    const message = await withWebexClient((client) =>
+      client.uploadFile(
+        space,
+        { content: new Blob([content]), filename: basename(filePath) },
+        { text: options.text, markdown: options.markdown, parentId: options.parent },
+      ),
+    )
+
+    const output = {
+      id: message.id,
+      ref: message.ref,
+      roomId: message.roomId,
+      roomRef: message.roomRef,
+      files: message.files,
+      created: message.created,
+    }
+    console.log(formatOutput(output, options.pretty))
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
+export async function downloadAction(
+  content: string,
+  output: string | undefined,
+  options: { pretty?: boolean },
+): Promise<void> {
+  try {
+    const { data, filename, contentType } = await withWebexClient((client) => client.downloadContent(content))
+    const outputPath = output ? resolve(output) : resolve(process.cwd(), basename(filename))
+    await writeFile(outputPath, Buffer.from(data))
+
+    console.log(formatOutput({ downloaded: outputPath, filename, contentType, size: data.byteLength }, options.pretty))
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
+export const fileCommand = new Command('file')
+  .description('File commands')
+  .addCommand(
+    new Command('upload')
+      .description('Upload a local file to a space')
+      .argument('<space>', 'Space/Room ID')
+      .argument('<path>', 'Local file path')
+      .option('--text <text>', 'Optional message to send with the file')
+      .option('--markdown', 'Treat --text as markdown')
+      .option('--parent <id>', 'Reply within a thread (parent message ID)')
+      .option('--pretty', 'Pretty print JSON output')
+      .action(uploadAction),
+  )
+  .addCommand(
+    new Command('download')
+      .description('Download a file attachment by content URL or ID')
+      .argument('<content>', 'File content URL (from message.files) or content ID')
+      .argument('[output]', 'Output path (defaults to original filename)')
+      .option('--pretty', 'Pretty print JSON output')
+      .action(downloadAction),
+  )

package/src/platforms/webex/commands/index.ts

@@ -1,4 +1,5 @@
 export { authCommand } from './auth'
+export { fileCommand } from './file'
 export { memberCommand } from './member'
 export { messageCommand } from './message'
 export { snapshotAction, snapshotCommand } from './snapshot'

package/src/platforms/webex/encryption.test.ts

@@ -106,4 +106,42 @@ describe('WebexEncryptionService', () => {
     expect(key).not.toBeNull()
     expect(provider.fetchKey).toHaveBeenCalledTimes(1)
   })
+
+  it('encryptBinary produces A256GCM scr material and ciphertext that differs from input', async () => {
+    const service = new WebexEncryptionService(new Map())
+
+    const plaintext = new Uint8Array([1, 2, 3, 4, 5])
+    const { scr, ciphertext } = service.encryptBinary(plaintext)
+
+    expect(scr.enc).toBe('A256GCM')
+    expect(scr.key).toMatch(/^[A-Za-z0-9_-]+$/)
+    expect(scr.iv).toMatch(/^[A-Za-z0-9_-]+$/)
+    expect(scr.tag).toMatch(/^[A-Za-z0-9_-]+$/)
+    expect(Buffer.from(scr.key, 'base64url')).toHaveLength(32)
+    expect(Buffer.from(scr.iv, 'base64url')).toHaveLength(12)
+    expect(Buffer.from(ciphertext)).not.toEqual(Buffer.from(plaintext))
+  })
+
+  it('encryptScr requires loc to be set before encrypting', async () => {
+    const service = await createKeyring(keyUri)
+    const { scr } = service.encryptBinary(new Uint8Array([9, 9, 9]))
+
+    const result = await service.encryptScr(keyUri, scr)
+
+    expect(result).toBeNull()
+  })
+
+  it('encryptScr wraps the scr as a JWE with kid once loc is set', async () => {
+    const service = await createKeyring(keyUri)
+    const { scr } = service.encryptBinary(new Uint8Array([9, 9, 9]))
+    scr.loc = 'https://files.wbx2.com/files/f1'
+
+    const jwe = await service.encryptScr(keyUri, scr)
+
+    expect(jwe).not.toBeNull()
+    const header = decodeJweHeader(jwe as string)
+    expect(header.alg).toBe('dir')
+    expect(header.enc).toBe('A256GCM')
+    expect(header.kid).toBe(keyUri)
+  })
 })

package/src/platforms/webex/encryption.ts

@@ -1,3 +1,5 @@
+import { createCipheriv, randomBytes } from 'node:crypto'
+
 import * as jose from 'node-jose'
 
 export interface WebexKeyProvider {
@@ -5,6 +7,26 @@ export interface WebexKeyProvider {
   close?(): Promise<void>
 }
 
+// SCR (Secure Content Resource): Webex's per-file AES-256-GCM material. The file bytes
+// are encrypted with this key, then the SCR itself is JWE-wrapped with the conversation key.
+export interface WebexScr {
+  enc: 'A256GCM'
+  key: string
+  iv: string
+  aad: string
+  loc?: string
+  tag: string
+}
+
+export interface WebexEncryptedBinary {
+  scr: WebexScr
+  ciphertext: Uint8Array
+}
+
+function toBase64Url(buffer: Buffer): string {
+  return buffer.toString('base64url')
+}
+
 export class WebexEncryptionService {
   private rawKeys: Map<string, string>
   private keyCache: Map<string, jose.JWK.Key> = new Map()
@@ -70,4 +92,41 @@ export class WebexEncryptionService {
       return null
     }
   }
+
+  encryptBinary(plaintext: Uint8Array): WebexEncryptedBinary {
+    const key = randomBytes(32)
+    const iv = randomBytes(12)
+    const aad = new Date().toISOString()
+
+    const cipher = createCipheriv('aes-256-gcm', key, iv)
+    cipher.setAAD(Buffer.from(aad, 'utf8'))
+    const ciphertext = Buffer.concat([cipher.update(Buffer.from(plaintext)), cipher.final()])
+    const tag = cipher.getAuthTag()
+
+    return {
+      scr: {
+        enc: 'A256GCM',
+        key: toBase64Url(key),
+        iv: toBase64Url(iv),
+        aad,
+        tag: toBase64Url(tag),
+      },
+      ciphertext,
+    }
+  }
+
+  async encryptScr(keyUri: string, scr: WebexScr): Promise<string | null> {
+    if (!scr.loc) return null
+    const key = await this.getKey(keyUri)
+    if (!key) return null
+
+    try {
+      return await jose.JWE.createEncrypt(
+        { format: 'compact', contentAlg: 'A256GCM' },
+        { key, header: { alg: 'dir', kid: keyUri }, reference: null },
+      ).final(JSON.stringify(scr), 'utf8')
+    } catch {
+      return null
+    }
+  }
 }