botmux 3.2.0 → 3.2.1

package/dist/core/dashboard-images.d.ts

@@ -0,0 +1,29 @@
+import type { LarkAttachment } from '../types.js';
+export declare const DASHBOARD_IMAGE_MAX_COUNT = 8;
+export declare const DASHBOARD_IMAGE_MAX_BYTES: number;
+export declare const DASHBOARD_IMAGE_MAX_TOTAL_BYTES: number;
+export interface DashboardImageUpload {
+    name: string;
+    mimeType: string;
+    dataBase64: string;
+}
+export type DashboardImagesResult = {
+    ok: true;
+    images: DashboardImageUpload[];
+} | {
+    ok: false;
+    error: string;
+};
+/** Validate browser-pasted images before any group or session is created.
+ * SVG is deliberately excluded: the dashboard only accepts bounded raster
+ * formats and verifies the file signature instead of trusting MIME/filename. */
+export declare function parseDashboardImageUploads(value: unknown): DashboardImagesResult;
+/** Persist validated uploads inside this bot's read-isolation attachment
+ * bucket. Each target daemon writes its own copy, so no bot needs access to a
+ * sibling appId's files. */
+export declare function materializeDashboardImages(larkAppId: string, images: DashboardImageUpload[]): LarkAttachment[];
+/** Remove only a materialization directory created by the helper above.
+ * Bucket and basename checks keep cleanup scoped to this bot's exact
+ * attachment directory even if a malformed path reaches this function. */
+export declare function cleanupMaterializedDashboardImages(larkAppId: string, attachments: readonly LarkAttachment[]): void;
+//# sourceMappingURL=dashboard-images.d.ts.map

package/dist/core/dashboard-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-images.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-images.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAShE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,EAAE,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA8BjC;;gFAEgF;AAChF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAyBhF;AAED;;4BAE4B;AAC5B,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,oBAAoB,EAAE,GAC7B,cAAc,EAAE,CAelB;AAED;;0EAE0E;AAC1E,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,cAAc,EAAE,GACrC,IAAI,CAQN"}

package/dist/core/dashboard-images.js

@@ -0,0 +1,113 @@
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { basename, dirname, extname, join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { getAttachmentsDir } from './attachment-path.js';
+export const DASHBOARD_IMAGE_MAX_COUNT = 8;
+export const DASHBOARD_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+export const DASHBOARD_IMAGE_MAX_TOTAL_BYTES = 25 * 1024 * 1024;
+const IMAGE_EXTENSIONS = {
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+};
+function hasExpectedSignature(bytes, mimeType) {
+    if (mimeType === 'image/png') {
+        return bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
+    }
+    if (mimeType === 'image/jpeg')
+        return bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff;
+    if (mimeType === 'image/gif')
+        return bytes.length >= 6 && (bytes.subarray(0, 6).toString('ascii') === 'GIF87a' || bytes.subarray(0, 6).toString('ascii') === 'GIF89a');
+    if (mimeType === 'image/webp') {
+        return bytes.length >= 12 && bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP';
+    }
+    return false;
+}
+function decodeBase64(value) {
+    if (!value || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
+        return null;
+    const bytes = Buffer.from(value, 'base64');
+    return bytes.length > 0 ? bytes : null;
+}
+function normalizedImageName(value, mimeType, index) {
+    const extension = IMAGE_EXTENSIONS[mimeType];
+    const raw = typeof value === 'string' ? basename(value.trim()) : '';
+    const stem = (raw ? raw.slice(0, raw.length - extname(raw).length) : `pasted-image-${index + 1}`)
+        .replace(/[^\p{L}\p{N}._-]+/gu, '-')
+        .replace(/^[.-]+|[.-]+$/g, '')
+        .slice(0, 80) || `pasted-image-${index + 1}`;
+    return `${stem}${extension}`;
+}
+/** Validate browser-pasted images before any group or session is created.
+ * SVG is deliberately excluded: the dashboard only accepts bounded raster
+ * formats and verifies the file signature instead of trusting MIME/filename. */
+export function parseDashboardImageUploads(value) {
+    if (value === undefined || value === null)
+        return { ok: true, images: [] };
+    if (!Array.isArray(value))
+        return { ok: false, error: 'bad_images' };
+    if (value.length > DASHBOARD_IMAGE_MAX_COUNT)
+        return { ok: false, error: 'too_many_images' };
+    const images = [];
+    let totalBytes = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const item = value[index];
+        if (!item || typeof item !== 'object')
+            return { ok: false, error: 'bad_image' };
+        const mimeType = typeof item.mimeType === 'string' ? item.mimeType.trim().toLowerCase() : '';
+        if (!IMAGE_EXTENSIONS[mimeType])
+            return { ok: false, error: 'unsupported_image_type' };
+        const dataBase64 = typeof item.dataBase64 === 'string' ? item.dataBase64.trim() : '';
+        const bytes = decodeBase64(dataBase64);
+        if (!bytes || !hasExpectedSignature(bytes, mimeType))
+            return { ok: false, error: 'invalid_image_data' };
+        if (bytes.length > DASHBOARD_IMAGE_MAX_BYTES)
+            return { ok: false, error: 'image_too_large' };
+        totalBytes += bytes.length;
+        if (totalBytes > DASHBOARD_IMAGE_MAX_TOTAL_BYTES)
+            return { ok: false, error: 'images_too_large' };
+        images.push({
+            name: normalizedImageName(item.name, mimeType, index),
+            mimeType,
+            dataBase64,
+        });
+    }
+    return { ok: true, images };
+}
+/** Persist validated uploads inside this bot's read-isolation attachment
+ * bucket. Each target daemon writes its own copy, so no bot needs access to a
+ * sibling appId's files. */
+export function materializeDashboardImages(larkAppId, images) {
+    if (images.length === 0)
+        return [];
+    const messageId = `dashboard-${randomUUID()}`;
+    const dir = getAttachmentsDir(larkAppId, messageId);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    try {
+        return images.map((image, index) => {
+            const path = join(dir, `${String(index + 1).padStart(2, '0')}-${image.name}`);
+            writeFileSync(path, Buffer.from(image.dataBase64, 'base64'), { mode: 0o600, flag: 'wx' });
+            return { type: 'image', path, name: image.name };
+        });
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Remove only a materialization directory created by the helper above.
+ * Bucket and basename checks keep cleanup scoped to this bot's exact
+ * attachment directory even if a malformed path reaches this function. */
+export function cleanupMaterializedDashboardImages(larkAppId, attachments) {
+    if (attachments.length === 0)
+        return;
+    const bucket = resolve(getAttachmentsDir(larkAppId, '.'));
+    const dirs = new Set(attachments.map(attachment => resolve(dirname(attachment.path))));
+    for (const dir of dirs) {
+        if (dirname(dir) !== bucket || !basename(dir).startsWith('dashboard-'))
+            continue;
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=dashboard-images.js.map

package/dist/core/dashboard-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dashboard-images.js","sourceRoot":"","sources":["../../src/core/dashboard-images.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,MAAM,gBAAgB,GAA2B;IAC/C,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,OAAO;CACtB,CAAC;AAYF,SAAS,oBAAoB,CAAC,KAAa,EAAE,QAAgB;IAC3D,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACvH,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACvK,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;IACvI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,QAAgB,EAAE,KAAa;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,KAAK,GAAG,CAAC,EAAE,CAAC;SAC9F,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC;SACnC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,gBAAgB,KAAK,GAAG,CAAC,EAAE,CAAC;IAC/C,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED;;gFAEgF;AAChF,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAE7F,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChF,MAAM,QAAQ,GAAG,OAAQ,IAAY,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACvF,MAAM,UAAU,GAAG,OAAQ,IAAY,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACxG,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC7F,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,UAAU,GAAG,+BAA+B;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;QAClG,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,mBAAmB,CAAE,IAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC;YAC9D,QAAQ;YACR,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;4BAE4B;AAC5B,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,MAA8B;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,aAAa,UAAU,EAAE,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9E,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,kCAAkC,CAChD,SAAiB,EACjB,WAAsC;IAEtC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QACjF,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/core/dashboard-ipc-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dashboard-ipc-server.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-ipc-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AAgGjG,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAE/F;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAEnG;AACD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EAIpB,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAiC,cAAc,EAAW,MAAM,aAAa,CAAC;AAK1F,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAe1B,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAErE;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAM7E;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGhF;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,CAKhF;AAaD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAgC;AAM7F;;;wBAGwB;AACxB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAS/D;AAyED,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;AAMtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAA0B;AAKxE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAA0B;AA05BxE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAynDD,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;+EAG2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B"}
+{"version":3,"file":"dashboard-ipc-server.d.ts","sourceRoot":"","sources":["../../src/core/dashboard-ipc-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AAiGjG,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAE/F;AAID,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAEnG;AACD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EAIpB,KAAK,UAAU,EAChB,MAAM,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAiC,cAAc,EAAW,MAAM,aAAa,CAAC;AAK1F,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED,MAAM,MAAM,OAAO,GAAG,CACpB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAe1B,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAErE;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAM7E;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAGhF;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,CAKhF;AAaD,sEAAsE;AACtE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAgC;AAM7F;;;wBAGwB;AACxB,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAS/D;AAyED,YAAY,EAAE,UAAU,EAAE,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,CAAC;AAMtD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAA0B;AAKxE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAA0B;AAq6BxE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAynDD,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;+EAG2E;IAC3E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B"}

package/dist/core/dashboard-ipc-server.js

@@ -72,6 +72,7 @@ import { getChatMode, replyMessage, sendMessage, resolveUnionIdFromOpenId, listT
 import { parseApiMessage, cardContentHasUpgradeFallback, resolveMergedCardContent } from '../im/lark/message-parser.js';
 import { resumeSession, spawnDashboardSession, activateQueuedSession, closeCliMismatchedSessionsForBot, suspendActiveSessionsForBot } from './session-manager.js';
 import { parseSpawnRequest } from './session-create.js';
+import { cleanupMaterializedDashboardImages, materializeDashboardImages } from './dashboard-images.js';
 import { getCliDisplayName } from '../im/lark/card-builder.js';
 import { locateLimiter } from './dashboard-locate.js';
 import { buildTerminalUrl } from './terminal-url.js';
@@ -585,6 +586,14 @@ ipcRoute('POST', '/api/sessions/spawn', async (req, res) => {
     if (!parsed.ok)
         return jsonRes(res, 400, { ok: false, error: parsed.error });
     const postBanner = !!body.postBanner;
+    let attachments;
+    try {
+        attachments = materializeDashboardImages(cachedLarkAppId, parsed.value.images);
+    }
+    catch (err) {
+        logger.error(`[createSession] failed to persist Dashboard images: ${err?.message ?? err}`);
+        return jsonRes(res, 500, { ok: false, error: 'image_store_failed' });
+    }
     const r = await spawnDashboardSession(activeSessions, undefined, {
         larkAppId: cachedLarkAppId,
         chatId: parsed.value.chatId,
@@ -592,13 +601,16 @@ ipcRoute('POST', '/api/sessions/spawn', async (req, res) => {
         column: parsed.value.column,
         role: parsed.value.role,
         coworkers: parsed.value.coworkers,
+        attachments,
         title: parsed.value.title,
         postBanner,
         ownerOpenId: parsed.value.ownerOpenId,
         ownerUnionId: parsed.value.ownerUnionId,
     });
-    if (!r.ok)
+    if (!r.ok) {
+        cleanupMaterializedDashboardImages(cachedLarkAppId, attachments);
         return jsonRes(res, r.error === 'session_exists' ? 409 : 500, r);
+    }
     jsonRes(res, 200, r);
 });
 ipcRoute('POST', '/api/chat-reply-mode', async (req, res) => {