botmux 3.7.1 → 3.8.0

package/dist/services/message-listener-store.js

@@ -0,0 +1,138 @@
+import { getBot } from '../bot-registry.js';
+import { rmwBotEntry } from './config-store.js';
+function stringList(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    const values = raw
+        .map(value => typeof value === 'string' ? value.trim() : '')
+        .filter(Boolean);
+    return values.length > 0 ? [...new Set(values)] : undefined;
+}
+function senderTypes(raw) {
+    if (!Array.isArray(raw))
+        return undefined;
+    const values = raw
+        .map(value => value === 'app' ? 'bot' : value)
+        .filter((value) => value === 'user' || value === 'bot');
+    return values.length > 0 ? [...new Set(values)] : undefined;
+}
+export function sanitizeMessageListenerUpdate(raw) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return undefined;
+    const entry = raw;
+    const enabled = entry.enabled === true;
+    const prompt = typeof entry.prompt === 'string' ? entry.prompt.trim() : '';
+    const name = typeof entry.name === 'string' && entry.name.trim() ? entry.name.trim() : undefined;
+    const replyCardTitle = typeof entry.replyCardTitle === 'string' && entry.replyCardTitle.trim()
+        ? entry.replyCardTitle.trim()
+        : undefined;
+    const workingDir = typeof entry.workingDir === 'string' && entry.workingDir.trim() ? entry.workingDir.trim() : undefined;
+    const rawSender = entry.senderPolicy && typeof entry.senderPolicy === 'object' && !Array.isArray(entry.senderPolicy)
+        ? entry.senderPolicy
+        : {};
+    const senderPolicy = {};
+    const mode = rawSender.mode === 'include_only' ? 'include_only' : 'all_except_excluded';
+    const includeSenderOpenIds = stringList(rawSender.includeSenderOpenIds);
+    const excludeSenderOpenIds = stringList(rawSender.excludeSenderOpenIds);
+    const includeSenderTypes = senderTypes(rawSender.includeSenderTypes);
+    const excludeSenderTypes = senderTypes(rawSender.excludeSenderTypes);
+    if (mode !== 'all_except_excluded')
+        senderPolicy.mode = mode;
+    if (includeSenderOpenIds)
+        senderPolicy.includeSenderOpenIds = includeSenderOpenIds;
+    if (excludeSenderOpenIds)
+        senderPolicy.excludeSenderOpenIds = excludeSenderOpenIds;
+    if (includeSenderTypes)
+        senderPolicy.includeSenderTypes = includeSenderTypes;
+    if (excludeSenderTypes)
+        senderPolicy.excludeSenderTypes = excludeSenderTypes;
+    if (rawSender.excludeSelf === false)
+        senderPolicy.excludeSelf = false;
+    const rawMessage = entry.messagePolicy && typeof entry.messagePolicy === 'object' && !Array.isArray(entry.messagePolicy)
+        ? entry.messagePolicy
+        : {};
+    const messagePolicy = { scope: 'top_level' };
+    const includeMsgTypes = stringList(rawMessage.includeMsgTypes);
+    if (includeMsgTypes)
+        messagePolicy.includeMsgTypes = includeMsgTypes;
+    return {
+        enabled,
+        ...(name ? { name } : {}),
+        ...(replyCardTitle ? { replyCardTitle } : {}),
+        ...(workingDir ? { workingDir } : {}),
+        prompt,
+        ...(Object.keys(senderPolicy).length > 0 ? { senderPolicy } : {}),
+        messagePolicy,
+    };
+}
+export function validateMessageListenerUpdate(update) {
+    if (!update)
+        return { ok: false, reason: 'invalid_listener' };
+    if (!update.enabled)
+        return { ok: true };
+    if (!update.prompt.trim())
+        return { ok: false, reason: 'prompt_required' };
+    const mode = update.senderPolicy?.mode === 'include_only' ? 'include_only' : 'all_except_excluded';
+    if (mode === 'include_only' && (update.senderPolicy?.includeSenderOpenIds?.length ?? 0) === 0) {
+        return { ok: false, reason: 'sender_required' };
+    }
+    return { ok: true };
+}
+export function getMessageListenerConfig(larkAppId, chatId) {
+    try {
+        return getBot(larkAppId).config.messageListeners?.[chatId] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function updateMessageListenerConfig(larkAppId, chatId, patch) {
+    let bot;
+    try {
+        bot = getBot(larkAppId);
+    }
+    catch {
+        return { ok: false, reason: 'bot_not_registered' };
+    }
+    const normalized = patch.enabled ? {
+        enabled: true,
+        ...(patch.name ? { name: patch.name } : {}),
+        ...(patch.replyCardTitle ? { replyCardTitle: patch.replyCardTitle } : {}),
+        ...(patch.workingDir ? { workingDir: patch.workingDir } : {}),
+        prompt: patch.prompt,
+        ...(patch.senderPolicy && Object.keys(patch.senderPolicy).length > 0 ? { senderPolicy: patch.senderPolicy } : {}),
+        ...(patch.messagePolicy ? { messagePolicy: { ...patch.messagePolicy, scope: 'top_level' } } : { messagePolicy: { scope: 'top_level' } }),
+        replyPolicy: { mode: 'thread', sessionMode: 'per_message' },
+    } : null;
+    const validation = validateMessageListenerUpdate(patch);
+    if (!validation.ok)
+        return { ok: false, reason: validation.reason };
+    const result = await rmwBotEntry(larkAppId, (entry) => {
+        if (!normalized) {
+            if (entry.messageListeners && typeof entry.messageListeners === 'object') {
+                delete entry.messageListeners[chatId];
+                if (Object.keys(entry.messageListeners).length === 0)
+                    delete entry.messageListeners;
+            }
+            return { write: true, result: null };
+        }
+        if (!entry.messageListeners || typeof entry.messageListeners !== 'object' || Array.isArray(entry.messageListeners)) {
+            entry.messageListeners = {};
+        }
+        entry.messageListeners[chatId] = normalized;
+        return { write: true, result: normalized };
+    });
+    if (!result.ok)
+        return { ok: false, reason: result.reason };
+    if (!bot.config.messageListeners)
+        bot.config.messageListeners = {};
+    if (normalized)
+        bot.config.messageListeners[chatId] = normalized;
+    else {
+        delete bot.config.messageListeners[chatId];
+        if (Object.keys(bot.config.messageListeners).length === 0)
+            bot.config.messageListeners = undefined;
+    }
+    return { ok: true, listener: result.result };
+}
+//# sourceMappingURL=message-listener-store.js.map

package/dist/services/message-listener-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-listener-store.js","sourceRoot":"","sources":["../../src/services/message-listener-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYhD,SAAS,UAAU,CAAC,GAAY;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG;SACf,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG;SACf,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAG,GAA8B,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,cAAc,GAAG,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QAC5F,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE;QAC7B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzH,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QAClH,CAAC,CAAC,KAAK,CAAC,YAAuC;QAC/C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,YAAY,GAA0C,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACxF,MAAM,oBAAoB,GAAG,UAAU,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACxE,MAAM,oBAAoB,GAAG,UAAU,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,kBAAkB,GAAG,WAAW,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,qBAAqB;QAAE,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC;IAC7D,IAAI,oBAAoB;QAAE,YAAY,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;IACnF,IAAI,oBAAoB;QAAE,YAAY,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;IACnF,IAAI,kBAAkB;QAAE,YAAY,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC7E,IAAI,kBAAkB;QAAE,YAAY,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC7E,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK;QAAE,YAAY,CAAC,WAAW,GAAG,KAAK,CAAC;IAEtE,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;QACtH,CAAC,CAAC,KAAK,CAAC,aAAwC;QAChD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,aAAa,GAA2C,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACrF,MAAM,eAAe,GAAG,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IAC/D,IAAI,eAAe;QAAE,aAAa,CAAC,eAAe,GAAG,eAAe,CAAC;IAErE,OAAO;QACL,OAAO;QACP,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAyC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACnG,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,MAAc;IACxE,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,SAAiB,EACjB,MAAc,EACd,KAA4B;IAE5B,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAAC,CAAC;IAE9F,MAAM,UAAU,GAAiC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,IAAI;QACb,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,GAAG,KAAK,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;QACxI,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE;KAC5D,CAAC,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,UAAU,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAEpE,MAAM,MAAM,GAAG,MAAM,WAAW,CAA+B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QAClF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,KAAK,CAAC,gBAAgB,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC,gBAAgB,CAAC;YACtF,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnH,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB;QAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG,EAAE,CAAC;IACnE,IAAI,UAAU;QAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;SAC5D,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACrG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC"}

package/dist/services/message-listener.d.ts

@@ -0,0 +1,112 @@
+import { type BotState, type MessageListenerConfig } from '../bot-registry.js';
+export declare const MAX_MESSAGE_LISTENER_PROMPT_BYTES: number;
+export type MessageListenerSenderType = 'user' | 'bot';
+export interface MessageListenerMatch {
+    name?: string;
+    replyCardTitle?: string;
+    prompt: string;
+    workingDir?: string;
+    messageText: string;
+    messageTitle?: string;
+    msgType: string;
+    senderOpenId?: string;
+    senderName?: string;
+    senderType: MessageListenerSenderType;
+}
+export interface MessageListenerPreviewMatch extends MessageListenerMatch {
+    messageId: string;
+    createTime?: string;
+}
+export declare const DEFAULT_MESSAGE_LISTENER_PREVIEW_LIMIT = 5;
+export declare const MAX_MESSAGE_LISTENER_PREVIEW_LIMIT = 20;
+export declare function listenerSenderType(raw: unknown): MessageListenerSenderType;
+export declare function messageTypeOf(message: any): string;
+export declare function extractListenerMessageTitle(message: any): string | undefined;
+export declare function extractListenerMessageText(message: any): string;
+export declare function findMessageListenerForChat(bot: BotState, chatId: string): MessageListenerConfig | undefined;
+export declare function evaluateMessageListener(input: {
+    bot: BotState;
+    chatId: string;
+    message: any;
+    senderOpenId?: string;
+    senderName?: string;
+    senderTypeRaw?: string;
+    /**
+     * True when `senderOpenId` is a bot's app_id form that could NOT be resolved
+     * to a per-app open_id (the polled history API reports bots by app_id; a
+     * third-party bot with no cross-ref / observed mapping stays unresolved).
+     * Such a sender defeats open_id-based exclusion, so the exclude path fails
+     * closed. The caller resolves app_id→open_id where possible before this.
+     */
+    senderIdentityUnverified?: boolean;
+    explicitlyMentionedThisBot: boolean;
+}): MessageListenerMatch | undefined;
+/** Raw sender fields as parsed from a message (realtime event or REST history). */
+export interface ListenerRawSender {
+    senderOpenId?: string;
+    senderName?: string;
+    senderTypeRaw?: string;
+    senderIdType?: string;
+}
+/**
+ * Canonicalize a message sender to the identity domain listener configs are
+ * keyed on (open_id). SHARED by every leg that feeds evaluateMessageListener
+ * (30s poll backfill AND dashboard preview/run-preview) so they can never
+ * diverge on identity handling.
+ *
+ * Bots are reported by app_id in the REST message-history API; a listener's
+ * sender filters store per-app open_ids. We map app_id → open_id ONLY via an
+ * authorization-grade map (see buildListenerBotAppIdToOpenId, which uses the
+ * strict resolver). A bot we cannot prove stays `identityUnverified`, so the
+ * matcher fails closed on open_id-based exclusion. Non-bot senders and bots
+ * already carrying an open_id pass through verified.
+ */
+export declare function resolveListenerSenderIdentity(sender: ListenerRawSender, appIdToOpenId: Map<string, string>): {
+    senderOpenId?: string;
+    identityUnverified: boolean;
+};
+/**
+ * Build an authorization-grade app_id → open_id map for the candidate bot
+ * senders. Uses the STRICT resolver (three-signal agreement, never the stale
+ * discovery stores) and only asks about CONFIGURED app_ids (the strict resolver
+ * rejects the whole batch on any non-configured subject, and a genuine
+ * third-party bot must stay unverified regardless). Anything unproven is absent
+ * from the map → resolveListenerSenderIdentity marks it unverified.
+ *
+ * SHARED by the poll and preview legs so both resolve identity identically.
+ */
+export declare function buildListenerBotAppIdToOpenId(larkAppId: string, chatId: string, candidateAppIds: Set<string>): Promise<Map<string, string>>;
+/** Collect the app_id-form bot senders present in a message batch (the only
+ *  subjects worth asking the strict resolver about). */
+export declare function collectListenerBotAppIds(messages: any[], senderForMessage: (message: any) => ListenerRawSender): Set<string>;
+export declare function normalizeMessageListenerPreviewLimit(raw: unknown): number;
+export declare function previewMessageListenerMatches(input: {
+    bot: BotState;
+    chatId: string;
+    messages: any[];
+    limit: number;
+    senderForMessage(message: any): ListenerRawSender;
+    /** Authorization-grade app_id → open_id map (see buildListenerBotAppIdToOpenId).
+     *  Omitted → every bot sender in app_id form is treated as unverified. */
+    appIdToOpenId?: Map<string, string>;
+    explicitlyMentionedThisBot?: (message: any, senderOpenId?: string) => boolean;
+}): MessageListenerPreviewMatch[];
+/**
+ * Trusted operator directive for a listener match: the admin-authored name +
+ * prompt only. Contains NO observed (untrusted) group-message bytes, so it is
+ * safe to place in a trusted application-context block (e.g. triggerSessionTurn's
+ * `<botmux_task trusted="true">`). The observed message must be delivered
+ * separately through the untrusted event channel (payload / rawText).
+ */
+export declare function renderMessageListenerInstruction(match: MessageListenerMatch): string;
+/**
+ * Self-contained listener prompt for callers that feed a SINGLE string to the
+ * CLI as the whole turn (the daemon new-topic path). The trusted operator
+ * `<instruction>` and the untrusted `<observed_message>` are kept in separate
+ * blocks, and the observed body is BOTH xml-escaped AND explicitly marked
+ * `trusted="false"` so a group member cannot close `</observed_message>` /
+ * `</message_listener>` early and forge a trusted `<instruction>`. `match.prompt`
+ * stays raw because it is operator-authored config, not attacker-controlled.
+ */
+export declare function renderMessageListenerPrompt(match: MessageListenerMatch): string;
+//# sourceMappingURL=message-listener.d.ts.map

package/dist/services/message-listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-listener.d.ts","sourceRoot":"","sources":["../../src/services/message-listener.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,QAAQ,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAK3F,eAAO,MAAM,iCAAiC,QAAY,CAAC;AAE3D,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,sCAAsC,IAAI,CAAC;AACxD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CAE1E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,CAElD;AAwBD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CA6B5E;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,GAAG,GAAG,MAAM,CAgC/D;AA8CD,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAK3G;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,GAAG,EAAE,QAAQ,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,GAAG,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,0BAA0B,EAAE,OAAO,CAAC;CACrC,GAAG,oBAAoB,GAAG,SAAS,CA+CnC;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAA;CAAE,CAoBxD;AAED;;;;;;;;;GASG;AACH,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqB9B;AAED;wDACwD;AACxD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,GAAG,EAAE,EACf,gBAAgB,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,iBAAiB,GACpD,GAAG,CAAC,MAAM,CAAC,CAUb;AAED,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAIzE;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,GAAG,EAAE,QAAQ,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,OAAO,EAAE,GAAG,GAAG,iBAAiB,CAAC;IAClD;8EAC0E;IAC1E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CAC/E,GAAG,2BAA2B,EAAE,CA2BhC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CASpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,oBAAoB,GAAG,MAAM,CAoB/E"}

package/dist/services/message-listener.js

@@ -0,0 +1,391 @@
+import { getAllBots } from '../bot-registry.js';
+import { extractCardContent, unwrapUserDslContent } from '../im/lark/message-parser.js';
+import { resolveCurrentChatBotOpenIdsByLarkAppIds } from '../im/lark/client.js';
+import { logger } from '../utils/logger.js';
+export const MAX_MESSAGE_LISTENER_PROMPT_BYTES = 32 * 1024;
+export const DEFAULT_MESSAGE_LISTENER_PREVIEW_LIMIT = 5;
+export const MAX_MESSAGE_LISTENER_PREVIEW_LIMIT = 20;
+export function listenerSenderType(raw) {
+    return raw === 'app' || raw === 'bot' ? 'bot' : 'user';
+}
+export function messageTypeOf(message) {
+    return String(message?.message_type ?? message?.msg_type ?? '').trim() || 'text';
+}
+function listenerMessageRawContent(message) {
+    const content = message?.content ?? message?.body?.content;
+    return typeof content === 'string' ? content : '';
+}
+function listenerMessageContent(message) {
+    const content = listenerMessageRawContent(message);
+    if (!content)
+        return '';
+    return messageTypeOf(message) === 'interactive'
+        ? unwrapUserDslContent(content) ?? content
+        : content;
+}
+function firstTrimmedString(...values) {
+    for (const value of values) {
+        if (typeof value !== 'string')
+            continue;
+        const trimmed = value.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    return undefined;
+}
+export function extractListenerMessageTitle(message) {
+    const content = listenerMessageContent(message);
+    if (!content)
+        return undefined;
+    const msgType = messageTypeOf(message);
+    if (msgType === 'interactive') {
+        const renderedTitle = content.match(/<card\s+title=(["'])(.*?)\1/i)?.[2];
+        if (renderedTitle?.trim())
+            return renderedTitle.trim();
+        try {
+            const card = JSON.parse(content);
+            return firstTrimmedString(card?.title, card?.header?.title?.content, card?.header?.title?.i18n?.zh_cn, card?.header?.title?.i18n?.en_us);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (msgType === 'post') {
+        try {
+            const obj = JSON.parse(content);
+            const inner = obj?.zh_cn ?? obj?.en_us ?? obj;
+            return firstTrimmedString(inner?.title, obj?.title);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+export function extractListenerMessageText(message) {
+    const content = listenerMessageContent(message);
+    if (!content)
+        return '';
+    const msgType = messageTypeOf(message);
+    if (msgType === 'interactive')
+        return extractCardContent(content);
+    if (msgType === 'image') {
+        try {
+            const obj = JSON.parse(content);
+            const key = firstTrimmedString(obj?.image_key, obj?.img_key);
+            return key ? `[图片消息: ${key}]` : '[图片消息]';
+        }
+        catch {
+            return '[图片消息]';
+        }
+    }
+    try {
+        const obj = JSON.parse(content);
+        if (typeof obj?.text === 'string')
+            return obj.text.trim();
+        const inner = obj?.zh_cn ?? obj?.en_us ?? obj;
+        if (Array.isArray(inner?.content)) {
+            const parts = [];
+            for (const para of inner.content) {
+                if (!Array.isArray(para))
+                    continue;
+                for (const node of para) {
+                    if (node?.tag === 'text' && typeof node.text === 'string')
+                        parts.push(node.text);
+                }
+            }
+            return parts.join('').trim();
+        }
+    }
+    catch {
+        return '';
+    }
+    return '';
+}
+function contains(list, value) {
+    return !!value && !!list && list.includes(value);
+}
+function senderTypeAllowed(listener, type) {
+    const policy = listener.senderPolicy;
+    if (policy?.includeSenderTypes && policy.includeSenderTypes.length > 0 && !policy.includeSenderTypes.includes(type)) {
+        return false;
+    }
+    if (policy?.excludeSenderTypes?.includes(type))
+        return false;
+    return true;
+}
+function senderOpenIdAllowed(listener, openId, identityUnverified) {
+    const policy = listener.senderPolicy;
+    const mode = policy?.mode === 'include_only' ? 'include_only' : 'all_except_excluded';
+    if (mode === 'include_only') {
+        // Allow-list: an unverified sender (a bot whose identity could not be
+        // canonicalized to a per-app open_id) can never appear in an open_id
+        // include list, so it simply does not match — already fail-safe.
+        return contains(policy?.includeSenderOpenIds, openId);
+    }
+    // all_except_excluded: an unverified sender defeats an open_id-based
+    // exclusion (the excluded open_id would never equal an app_id form), so a
+    // blocked bot would leak through on the polled backfill path. Fail closed:
+    // when the operator has ANY open_id exclusion we cannot evaluate for this
+    // sender, refuse rather than assume "not excluded". An empty exclude list
+    // makes no open_id decision, so "listen to all (except self)" still works.
+    if (identityUnverified && (policy?.excludeSenderOpenIds?.length ?? 0) > 0) {
+        return false;
+    }
+    return !contains(policy?.excludeSenderOpenIds, openId);
+}
+function msgTypeAllowed(listener, msgType) {
+    const include = listener.messagePolicy?.includeMsgTypes;
+    if (!include || include.length === 0)
+        return msgType === 'text' || msgType === 'post';
+    return include.includes(msgType);
+}
+export function findMessageListenerForChat(bot, chatId) {
+    const listener = bot.config.messageListeners?.[chatId];
+    if (!listener?.enabled)
+        return undefined;
+    if (!listener.prompt?.trim())
+        return undefined;
+    return listener;
+}
+export function evaluateMessageListener(input) {
+    if (input.explicitlyMentionedThisBot)
+        return undefined;
+    const messageId = String(input.message?.message_id ?? '');
+    const rootId = input.message?.root_id ? String(input.message.root_id) : '';
+    const threadId = input.message?.thread_id ? String(input.message.thread_id) : '';
+    const parentId = input.message?.parent_id ? String(input.message.parent_id) : '';
+    // REST history returns a top-level topic root as message_id=om_* plus
+    // thread_id=omt_*. Replies carry root_id/parent_id. Do not reject the root
+    // solely because thread_id uses a different id namespace.
+    if ((rootId && rootId !== messageId) || (parentId && parentId !== messageId))
+        return undefined;
+    if (threadId && threadId.startsWith('om_') && threadId !== messageId)
+        return undefined;
+    const listener = findMessageListenerForChat(input.bot, input.chatId);
+    if (!listener)
+        return undefined;
+    const senderType = listenerSenderType(input.senderTypeRaw);
+    // Self-exclusion must cover BOTH identity forms the bot appears under:
+    // realtime events carry the bot's open_id (ou_…), but the message-history API
+    // (polled backfill) reports the bot's own messages under its app_id
+    // (== larkAppId). Comparing only against botOpenId (an open_id) silently
+    // fails on the polled path and would let the bot's own posts self-trigger.
+    const ownIds = [input.bot.botOpenId, input.bot.config.larkAppId].filter(Boolean);
+    if ((listener.senderPolicy?.excludeSelf ?? true) && input.senderOpenId && ownIds.includes(input.senderOpenId)) {
+        return undefined;
+    }
+    if (!senderTypeAllowed(listener, senderType))
+        return undefined;
+    if (!senderOpenIdAllowed(listener, input.senderOpenId, input.senderIdentityUnverified ?? false))
+        return undefined;
+    const msgType = messageTypeOf(input.message);
+    if (!msgTypeAllowed(listener, msgType))
+        return undefined;
+    const messageText = extractListenerMessageText(input.message);
+    if (!messageText && (msgType === 'text' || msgType === 'post'))
+        return undefined;
+    const messageTitle = extractListenerMessageTitle(input.message);
+    return {
+        name: listener.name,
+        replyCardTitle: listener.replyCardTitle,
+        prompt: listener.prompt,
+        workingDir: listener.workingDir,
+        messageText,
+        messageTitle,
+        msgType,
+        senderOpenId: input.senderOpenId,
+        senderName: input.senderName,
+        senderType,
+    };
+}
+/**
+ * Canonicalize a message sender to the identity domain listener configs are
+ * keyed on (open_id). SHARED by every leg that feeds evaluateMessageListener
+ * (30s poll backfill AND dashboard preview/run-preview) so they can never
+ * diverge on identity handling.
+ *
+ * Bots are reported by app_id in the REST message-history API; a listener's
+ * sender filters store per-app open_ids. We map app_id → open_id ONLY via an
+ * authorization-grade map (see buildListenerBotAppIdToOpenId, which uses the
+ * strict resolver). A bot we cannot prove stays `identityUnverified`, so the
+ * matcher fails closed on open_id-based exclusion. Non-bot senders and bots
+ * already carrying an open_id pass through verified.
+ */
+export function resolveListenerSenderIdentity(sender, appIdToOpenId) {
+    const isBotAppId = sender.senderIdType === 'app_id'
+        || sender.senderTypeRaw === 'app'
+        || sender.senderTypeRaw === 'bot';
+    if (!isBotAppId) {
+        return { senderOpenId: sender.senderOpenId, identityUnverified: false };
+    }
+    // A bot with no sender id at all cannot be evaluated against open_id filters.
+    if (!sender.senderOpenId) {
+        return { senderOpenId: undefined, identityUnverified: true };
+    }
+    // Already an open_id (some history rows carry open_id for bots) → verified.
+    if (sender.senderOpenId.startsWith('ou_')) {
+        return { senderOpenId: sender.senderOpenId, identityUnverified: false };
+    }
+    const mapped = appIdToOpenId.get(sender.senderOpenId);
+    if (mapped)
+        return { senderOpenId: mapped, identityUnverified: false };
+    // app_id-form bot we could not strictly resolve: keep the app_id but flag it
+    // unverified so open_id-based exclusion fails closed.
+    return { senderOpenId: sender.senderOpenId, identityUnverified: true };
+}
+/**
+ * Build an authorization-grade app_id → open_id map for the candidate bot
+ * senders. Uses the STRICT resolver (three-signal agreement, never the stale
+ * discovery stores) and only asks about CONFIGURED app_ids (the strict resolver
+ * rejects the whole batch on any non-configured subject, and a genuine
+ * third-party bot must stay unverified regardless). Anything unproven is absent
+ * from the map → resolveListenerSenderIdentity marks it unverified.
+ *
+ * SHARED by the poll and preview legs so both resolve identity identically.
+ */
+export async function buildListenerBotAppIdToOpenId(larkAppId, chatId, candidateAppIds) {
+    const map = new Map();
+    if (candidateAppIds.size === 0)
+        return map;
+    const configuredAppIds = new Set(getAllBots().map(b => b.config.larkAppId).filter(Boolean));
+    const subjectAppIds = [...candidateAppIds].filter(appId => configuredAppIds.has(appId));
+    if (subjectAppIds.length === 0)
+        return map;
+    try {
+        const resolution = await resolveCurrentChatBotOpenIdsByLarkAppIds(larkAppId, chatId, subjectAppIds);
+        if (resolution.ok) {
+            for (const mapping of resolution.mappings) {
+                if (mapping.larkAppId && mapping.subjectOpenId) {
+                    map.set(mapping.larkAppId, mapping.subjectOpenId);
+                }
+            }
+        }
+        else {
+            logger.debug(`[message-listener:${larkAppId}] strict bot-id resolution declined for ${chatId.substring(0, 12)}: ${resolution.error}`);
+        }
+    }
+    catch (err) {
+        logger.debug(`[message-listener:${larkAppId}] strict bot-id resolution threw for ${chatId.substring(0, 12)}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return map;
+}
+/** Collect the app_id-form bot senders present in a message batch (the only
+ *  subjects worth asking the strict resolver about). */
+export function collectListenerBotAppIds(messages, senderForMessage) {
+    const appIds = new Set();
+    for (const message of messages) {
+        const s = senderForMessage(message);
+        const isBotAppId = s.senderIdType === 'app_id' || s.senderTypeRaw === 'app' || s.senderTypeRaw === 'bot';
+        if (isBotAppId && s.senderOpenId && !s.senderOpenId.startsWith('ou_')) {
+            appIds.add(s.senderOpenId);
+        }
+    }
+    return appIds;
+}
+export function normalizeMessageListenerPreviewLimit(raw) {
+    const value = typeof raw === 'number' ? raw : Number(raw);
+    if (!Number.isFinite(value))
+        return DEFAULT_MESSAGE_LISTENER_PREVIEW_LIMIT;
+    return Math.min(MAX_MESSAGE_LISTENER_PREVIEW_LIMIT, Math.max(1, Math.floor(value)));
+}
+export function previewMessageListenerMatches(input) {
+    const limit = normalizeMessageListenerPreviewLimit(input.limit);
+    const appIdToOpenId = input.appIdToOpenId ?? new Map();
+    const matches = [];
+    for (const message of input.messages) {
+        const messageId = String(message?.message_id ?? '');
+        if (!messageId)
+            continue;
+        const sender = input.senderForMessage(message);
+        const resolved = resolveListenerSenderIdentity(sender, appIdToOpenId);
+        const match = evaluateMessageListener({
+            bot: input.bot,
+            chatId: input.chatId,
+            message,
+            senderOpenId: resolved.senderOpenId,
+            senderName: sender.senderName,
+            senderTypeRaw: sender.senderTypeRaw,
+            senderIdentityUnverified: resolved.identityUnverified,
+            explicitlyMentionedThisBot: input.explicitlyMentionedThisBot?.(message, resolved.senderOpenId) ?? false,
+        });
+        if (!match)
+            continue;
+        matches.push({
+            ...match,
+            messageId,
+            createTime: message?.create_time ? String(message.create_time) : undefined,
+        });
+    }
+    return matches.slice(Math.max(0, matches.length - limit));
+}
+/**
+ * Trusted operator directive for a listener match: the admin-authored name +
+ * prompt only. Contains NO observed (untrusted) group-message bytes, so it is
+ * safe to place in a trusted application-context block (e.g. triggerSessionTurn's
+ * `<botmux_task trusted="true">`). The observed message must be delivered
+ * separately through the untrusted event channel (payload / rawText).
+ */
+export function renderMessageListenerInstruction(match) {
+    return [
+        '<message_listener>',
+        match.name ? `  <name>${escapeXml(match.name)}</name>` : '',
+        '  <instruction>',
+        match.prompt,
+        '  </instruction>',
+        '</message_listener>',
+    ].filter(Boolean).join('\n');
+}
+/**
+ * Self-contained listener prompt for callers that feed a SINGLE string to the
+ * CLI as the whole turn (the daemon new-topic path). The trusted operator
+ * `<instruction>` and the untrusted `<observed_message>` are kept in separate
+ * blocks, and the observed body is BOTH xml-escaped AND explicitly marked
+ * `trusted="false"` so a group member cannot close `</observed_message>` /
+ * `</message_listener>` early and forge a trusted `<instruction>`. `match.prompt`
+ * stays raw because it is operator-authored config, not attacker-controlled.
+ */
+export function renderMessageListenerPrompt(match) {
+    const observedText = escapeXml(truncateUtf8(match.messageText, MAX_MESSAGE_LISTENER_PROMPT_BYTES));
+    return [
+        '<message_listener>',
+        match.name ? `  <name>${escapeXml(match.name)}</name>` : '',
+        '  <instruction>',
+        match.prompt,
+        '  </instruction>',
+        '  <observed_message',
+        '    trusted="false"',
+        `    sender_type="${escapeXml(match.senderType)}"`,
+        match.senderOpenId ? `    sender_open_id="${escapeXml(match.senderOpenId)}"` : '',
+        match.senderName ? `    sender_name="${escapeXml(match.senderName)}"` : '',
+        `    msg_type="${escapeXml(match.msgType)}"`,
+        match.messageTitle ? `    message_title="${escapeXml(match.messageTitle)}"` : '',
+        '  >',
+        observedText,
+        '  </observed_message>',
+        '</message_listener>',
+    ].filter(Boolean).join('\n');
+}
+function truncateUtf8(s, maxBytes) {
+    if (Buffer.byteLength(s, 'utf-8') <= maxBytes)
+        return s;
+    let used = 0;
+    let out = '';
+    for (const ch of s) {
+        const n = Buffer.byteLength(ch, 'utf-8');
+        if (used + n > maxBytes)
+            break;
+        out += ch;
+        used += n;
+    }
+    return out;
+}
+function escapeXml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+//# sourceMappingURL=message-listener.js.map