dsh-lark-bot 0.19.14 → 0.19.16

package/README.md

@@ -113,7 +113,7 @@ dsh --profile dsh-lark                              # ② 启动
 
 ## 兼容性
 
-- **DeepSeek Harness（`dsh`）**：已验证 **0.1.0-rc.8**（2026-08-22），经官方 `@deepseek-ai/dsh-sdk-client` / `dsh-acp` 接入；锁定版本与升级政策见 [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md)。
+- **DeepSeek Harness（`dsh`）**：已验证 **0.1.0-rc.8**（2026-08-25），经官方 `@deepseek-ai/dsh-sdk-client` / `dsh-acp` 接入；锁定版本与升级政策见 [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md)。
 - **运行时**：Node.js ≥ 22.19；**平台**：Linux / macOS / Windows。adapter 默认 `sdk`（原生续跑 / 流式 / 图片块），可切 `acp` / `headless` / `web`。
 
 ## 配置说明

package/README_EN.md

@@ -114,7 +114,7 @@ Command help, status, and cards are bilingual; `/help` is the full authoritative
 
 ## Compatibility
 
-- **DeepSeek Harness (`dsh`)**: verified against **0.1.0-rc.8** (2026-08-22) via the official `@deepseek-ai/dsh-sdk-client` / `dsh-acp`; locked versions & upgrade policy in [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md).
+- **DeepSeek Harness (`dsh`)**: verified against **0.1.0-rc.8** (2026-08-25) via the official `@deepseek-ai/dsh-sdk-client` / `dsh-acp`; locked versions & upgrade policy in [`docs/COMPATIBILITY.md`](docs/COMPATIBILITY.md).
 - **Runtime**: Node.js ≥ 22.19; **Platforms**: Linux / macOS / Windows. Default adapter `sdk` (native resume / streaming / image blocks); switchable to `acp` / `headless` / `web`.
 
 ## Configuration

package/dist/cli.js

@@ -129,7 +129,7 @@ var init_dsh_compat = __esm({
       sdkServer: "0.1.0-rc.8",
       acp: "0.1.0-rc.8",
       node: ">=22.19.0",
-      verifiedAt: "2026-08-22"
+      verifiedAt: "2026-08-25"
     };
   }
 });
@@ -3706,6 +3706,7 @@ var DEFAULTS = {
   tenant: "feishu",
   provider: "",
   model: "",
+  imageMaxDimension: 2e3,
   runTimeoutMs: 3e5,
   stopGraceMs: 5e3,
   groupPollMs: 3e3,
@@ -3889,6 +3890,11 @@ function loadRuntimeEnv(source = process.env) {
     provider: nonEmpty(source.DSH_LARK_PROVIDER) ?? DEFAULTS.provider,
     model: nonEmpty(source.DSH_LARK_MODEL) ?? DEFAULTS.model,
     maxTokens: parseMaxTokens(source.DSH_LARK_MAX_TOKENS),
+    imageMaxDimension: parseMinOneInt(
+      source.DSH_LARK_IMAGE_MAX_DIMENSION,
+      DEFAULTS.imageMaxDimension,
+      "DSH_LARK_IMAGE_MAX_DIMENSION"
+    ),
     runTimeoutMs: parseTimeout(source.DSH_LARK_RUN_TIMEOUT_MS),
     stopGraceMs: parseStopGrace(source.DSH_LARK_STOP_GRACE_MS),
     groupNoAt: parseBoolean(source.DSH_LARK_GROUP_NO_AT, false),
@@ -6190,7 +6196,7 @@ async function runDoctor(options) {
 
 // src/cli/commands/run.ts
 import { mkdir as mkdir22 } from "fs/promises";
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { join as join27 } from "path";
 
 // src/bot/active-runs.ts
@@ -11229,6 +11235,9 @@ function abortError() {
   return error;
 }
 
+// src/onboard/sink-qr-providers.ts
+import { createDecipheriv, randomBytes as randomBytes2, randomUUID as randomUUID8 } from "crypto";
+
 // src/notify/sinks/text.ts
 function renderSinkText(message) {
   const zhLine = `${message.title.zh}\uFF08scope \`${message.scope}\`\uFF09${message.detail ? `\uFF1A${message.detail}` : ""}`;
@@ -11310,63 +11319,131 @@ function splitDestination(value) {
 }
 
 // src/onboard/sink-qr-providers.ts
-var WeChatQrProvider = class {
-  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
-    this.baseUrl = baseUrl;
+var API_HEADERS = { "content-type": "application/json", accept: "application/json" };
+var BIND_STATUS = { NONE: 0, PENDING: 1, COMPLETED: 2, EXPIRED: 3 };
+var QqQrProvider = class {
+  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "q.qq.com", fetchImpl = fetch, genKey = () => randomBytes2(32).toString("base64")) {
+    this.portalHost = portalHost;
     this.fetchImpl = fetchImpl;
+    this.genKey = genKey;
   }
-  baseUrl;
+  portalHost;
   fetchImpl;
-  type = "wechat";
+  genKey;
+  type = "qq";
+  sessions = /* @__PURE__ */ new Map();
   async begin(_options) {
-    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode`, { method: "POST" });
+    const aesKey = this.genKey();
+    const response = await this.fetchImpl(`https://${this.portalHost}/lite/create_bind_task`, {
+      method: "POST",
+      headers: API_HEADERS,
+      body: JSON.stringify({ key: aesKey })
+    });
     const payload = await response.json().catch(() => ({}));
-    const qrUrl = payload.qrcode ?? payload.url ?? "";
-    if (!response.ok || !qrUrl) {
-      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
+    const taskId = payload.data?.task_id;
+    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
+      throw new Error(`qq create_bind_task failed: ${payload.msg ?? ""} (http ${response.status})`);
     }
-    return { providerType: this.type, sessionId: qrUrl, qrUrl, expireIn: 180 };
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { taskId, aesKey });
+    const qrUrl = `https://q.qq.com/qqbot/openclaw/connect.html?task_id=${encodeURIComponent(taskId)}&_wv=2&source=dsh-lark-bot`;
+    return { providerType: this.type, sessionId, qrUrl, expireIn: 600 };
   }
   async poll(sessionId, _signal) {
-    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/getupdates`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ qrcode: sessionId })
-    }).catch(() => void 0);
-    void response;
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    let data = {};
+    try {
+      const response = await this.fetchImpl(`https://${this.portalHost}/lite/poll_bind_result`, {
+        method: "POST",
+        headers: API_HEADERS,
+        body: JSON.stringify({ task_id: state.taskId })
+      });
+      const payload = await response.json();
+      if (!response.ok || payload.retcode !== void 0 && payload.retcode !== 0) return { phase: "pending" };
+      data = payload.data ?? {};
+    } catch {
+      return { phase: "pending" };
+    }
+    const status = data.status ?? BIND_STATUS.NONE;
+    if (status === BIND_STATUS.COMPLETED && data.bot_appid && data.bot_encrypt_secret) {
+      let clientSecret;
+      try {
+        clientSecret = decryptSecret(data.bot_encrypt_secret, state.aesKey);
+      } catch (error) {
+        this.sessions.delete(sessionId);
+        return { phase: "failed", error: `decrypt failed: ${error instanceof Error ? error.message : String(error)}` };
+      }
+      const target = data.user_openid ? `user:${data.user_openid}` : "";
+      this.sessions.delete(sessionId);
+      return {
+        phase: "completed",
+        channel: {
+          id: "",
+          type: "qq",
+          label: "QQ",
+          destination: target,
+          secret: `${data.bot_appid}:${clientSecret}`
+        }
+      };
+    }
+    if (status === BIND_STATUS.EXPIRED) {
+      this.sessions.delete(sessionId);
+      return { phase: "expired" };
+    }
     return { phase: "pending" };
   }
 };
-var QqQrProvider = class {
-  constructor(portalHost = process.env.DSH_LARK_QQ_PORTAL_HOST ?? "api.sgroup.qq.com", fetchImpl = fetch) {
-    this.portalHost = portalHost;
+var WeChatQrProvider = class {
+  constructor(baseUrl = process.env.DSH_LARK_WECHAT_ILINK_URL ?? "https://ilinkai.weixin.qq.com", fetchImpl = fetch) {
+    this.baseUrl = baseUrl;
     this.fetchImpl = fetchImpl;
   }
-  portalHost;
+  baseUrl;
   fetchImpl;
-  type = "qq";
+  type = "wechat";
+  sessions = /* @__PURE__ */ new Map();
   async begin(_options) {
-    const response = await this.fetchImpl(`https://${this.portalHost}/app/create_bind_task`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({})
+    const response = await this.fetchImpl(`${this.baseUrl}/ilink/bot/get_bot_qrcode?bot_type=3`, {
+      method: "GET"
     });
     const payload = await response.json().catch(() => ({}));
-    const taskId = payload.data?.task_id;
-    if (!response.ok || !taskId || payload.retcode !== void 0 && payload.retcode !== 0) {
-      throw new Error(`qq create_bind_task failed: http ${response.status}`);
+    const qrcode2 = payload.qrcode ?? payload.url ?? "";
+    if (!response.ok || !qrcode2) {
+      throw new Error(payload.msg ?? `wechat get_bot_qrcode failed: http ${response.status}`);
     }
-    const qrUrl = `https://q.qq.com/bot/#/bind-task?key=${encodeURIComponent(taskId)}`;
-    return { providerType: this.type, sessionId: taskId, qrUrl, expireIn: 180 };
+    const sessionId = randomUUID8();
+    this.sessions.set(sessionId, { qrcode: qrcode2 });
+    return { providerType: this.type, sessionId, qrUrl: qrcode2, expireIn: 180 };
   }
   async poll(sessionId, _signal) {
-    const response = await this.fetchImpl(`https://${this.portalHost}/app/poll_bind_result`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ task_id: sessionId })
-    }).catch(() => void 0);
-    void response;
-    return { phase: "pending" };
+    const state = this.sessions.get(sessionId);
+    if (!state) return { phase: "failed", error: "unknown session" };
+    const statusUrl = `${this.baseUrl}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(state.qrcode)}`;
+    try {
+      const response = await this.fetchImpl(statusUrl, {
+        method: "GET",
+        headers: { "iLink-App-Id": "bot", "iLink-App-ClientVersion": "131072" }
+      });
+      const payload = await response.json().catch(() => ({}));
+      const status = String(payload.status ?? "wait").toLowerCase();
+      if (status === "confirmed" || status === "success" || status === "scanned" || status === "2") {
+        const token = payload.token ?? payload.access_token ?? "";
+        const userId = payload.openid ?? payload.user_id ?? payload.to_user_id ?? "";
+        this.sessions.delete(sessionId);
+        return {
+          phase: "completed",
+          channel: { id: "", type: "wechat", label: "\u5FAE\u4FE1", destination: userId ? `${userId}|` : "", secret: token }
+        };
+      }
+      if (status === "expired") {
+        this.sessions.delete(sessionId);
+        return { phase: "expired" };
+      }
+      return { phase: "pending" };
+    } catch {
+      return { phase: "pending" };
+    }
   }
 };
 function buildSinkQrProviders() {
@@ -11378,7 +11455,21 @@ function coerceSinkQrChannel(input) {
 }
 function normalizeWechatDestination(value) {
   if (value.includes("|")) return value;
-  return splitDestination(value)[0] ? `${value}|` : value;
+  const [id] = splitDestination(value);
+  return id ? `${id}|` : value;
+}
+function decryptSecret(encryptedBase64, keyBase64) {
+  const key = Buffer.from(keyBase64, "base64");
+  const raw = Buffer.from(encryptedBase64, "base64");
+  if (key.length !== 32) throw new Error("bind key must be 32 bytes");
+  if (raw.length < 12 + 16) throw new Error("ciphertext too short");
+  const iv = raw.subarray(0, 12);
+  const body3 = raw.subarray(12);
+  const tag = body3.subarray(body3.length - 16);
+  const ciphertext = body3.subarray(0, body3.length - 16);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
 }
 
 // src/onboard/qr-image.ts
@@ -13628,7 +13719,7 @@ function safe(value, maxBytes) {
 }
 
 // src/session/projection-protocol.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var WebSessionProjectionSource = class {
   constructor(transport) {
     this.transport = transport;
@@ -13667,7 +13758,7 @@ var WebSessionProjectionSource = class {
     });
     return { events, hasMore: value.hasMore === true };
   }
-  async prompt(sessionId, text, rpcId = randomUUID8()) {
+  async prompt(sessionId, text, rpcId = randomUUID9()) {
     responseValue(await this.transport.rpc("session.prompt", {
       sessionId,
       mode: "queue",
@@ -14340,7 +14431,7 @@ function wait(ms) {
 }
 
 // src/commands/session-projection.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var SessionProjectionController = class {
   constructor(deps) {
     this.deps = deps;
@@ -14480,7 +14571,7 @@ workspace: \`${workspaceCwd}\``
     if (owner && owner.scope !== input.identity.scope && !this.deps.access.isAdmin(input.identity.actorId)) {
       throw new Error("\u8BE5 session \u5DF2\u7ED1\u5B9A\u5176\u4ED6\u98DE\u4E66 scope\uFF1B\u72EC\u5360\u8FC1\u79FB\u4EC5 profile \u7BA1\u7406\u5458\u53EF\u786E\u8BA4");
     }
-    const nonce = randomUUID9();
+    const nonce = randomUUID10();
     const expiresAt = Date.now() + (this.deps.confirmationTtlMs ?? 10 * 6e4);
     const timer = setTimeout(() => this.pending.delete(nonce), expiresAt - Date.now());
     timer.unref?.();
@@ -15517,7 +15608,7 @@ function attachRunCardAnchors(channel, anchors) {
 
 // src/notify/server.ts
 import { createServer } from "http";
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 var NotifyServer = class {
   server;
   token;
@@ -15804,7 +15895,7 @@ function readBody(req) {
   });
 }
 function generateNotifyToken() {
-  return `dsh-lark-${randomBytes2(18).toString("hex")}`;
+  return `dsh-lark-${randomBytes3(18).toString("hex")}`;
 }
 
 // src/notify/ask-handler.ts
@@ -15996,7 +16087,7 @@ async function settleCancelledCard(deps, chatId, cardMessageId, options) {
 }
 
 // src/notify/approval-handler.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 init_tool_policy();
 function buildApprovalHandler(deps) {
   return async (payload, signal) => {
@@ -16039,7 +16130,7 @@ ${policyDenialText(denial)}
       return { ok: true, outcome: "rejected", denial };
     }
     if (payload.lowRisk) return { ok: true, outcome: "allowed-once" };
-    const id = `approval-${randomUUID10().replaceAll("-", "")}`;
+    const id = `approval-${randomUUID11().replaceAll("-", "")}`;
     const request = {
       id,
       ...payload.callId === void 0 ? {} : { callId: payload.callId },
@@ -16368,14 +16459,16 @@ var QqSink = class {
   type = "qq";
   async send(channel, message) {
     const [appId, clientSecret] = splitAppCredential(channel.secret);
-    const groupOpenId = channel.destination;
-    if (!appId || !clientSecret || !groupOpenId) {
+    const target = channel.destination;
+    if (!appId || !clientSecret || !target) {
       log.warn("sink:qq", "missing-credential", { channel: channel.id });
       return false;
     }
+    const isC2c = target.startsWith("user:");
+    const openId = isC2c ? target.slice("user:".length) : target;
+    const url = `${this.apiBase}/v2/${isC2c ? "users" : "groups"}/${encodeURIComponent(openId)}/messages`;
     try {
       const token = await this.fetchAccessToken(appId, clientSecret);
-      const url = `${this.apiBase}/v2/groups/${encodeURIComponent(groupOpenId)}/messages`;
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), 1e4);
       timer.unref?.();
@@ -16660,13 +16753,60 @@ async function onboardPersonalAgent(deps = {}) {
 // src/media/attachments.ts
 import { mkdir as mkdir16, readFile as readFile24, rename as rename3, rm as rm9, stat as stat9 } from "fs/promises";
 import { join as join23 } from "path";
+
+// src/media/image-scale.ts
+import { writeFile as writeFile8 } from "fs/promises";
+function formatFromExtension(path) {
+  const lower = path.toLowerCase();
+  if (lower.endsWith(".png")) return "png";
+  if (lower.endsWith(".jpg") || lower.endsWith(".jpeg")) return "jpeg";
+  if (lower.endsWith(".webp")) return "webp";
+  if (lower.endsWith(".gif")) return "gif";
+  return void 0;
+}
+async function downscaleImageIfNeeded(path, maxDimension) {
+  if (typeof maxDimension !== "number" || !Number.isFinite(maxDimension) || maxDimension <= 0) {
+    return path;
+  }
+  const format = formatFromExtension(path);
+  if (!format) return path;
+  let sharp;
+  try {
+    const mod = await import("sharp");
+    sharp = mod.default;
+  } catch {
+    return path;
+  }
+  if (!sharp) return path;
+  try {
+    const image = sharp(path, { failOn: "error" });
+    const meta = await image.metadata();
+    const width = meta.width ?? 0;
+    const height = meta.height ?? 0;
+    const longSide = Math.max(width, height);
+    if (longSide <= maxDimension) return path;
+    const data = await sharp(path, { failOn: "error" }).resize({
+      width: maxDimension,
+      height: maxDimension,
+      fit: "inside",
+      withoutEnlargement: true
+    }).toFormat(format).toBuffer();
+    await writeFile8(path, data);
+    return path;
+  } catch {
+    return path;
+  }
+}
+
+// src/media/attachments.ts
 var MAX_TEXT_FILE_BYTES = 256e3;
 function assertSafeMediaName(mediaDir, destination) {
   if (!isPathWithin(mediaDir, destination)) {
     throw new Error(`unsafe attachment destination rejected: ${destination}`);
   }
 }
-async function prepareAttachments(channel, message, mediaDir) {
+async function prepareAttachments(channel, message, mediaDir, options = {}) {
+  const { maxImageDimension = 0 } = options;
   await mkdir16(mediaDir, { recursive: true });
   const result = { imagePaths: [], textFileNotes: [] };
   for (const resource of message.resources) {
@@ -16687,7 +16827,8 @@ async function prepareAttachments(channel, message, mediaDir) {
         const imagePath = `${destination}${detected.extension}`;
         assertSafeMediaName(mediaDir, imagePath);
         await rename3(downloadPath, imagePath);
-        result.imagePaths.push(imagePath);
+        const finalPath = await downscaleImageIfNeeded(imagePath, maxImageDimension);
+        result.imagePaths.push(finalPath);
       } catch (error) {
         await rm9(downloadPath, { force: true });
         throw error;
@@ -17045,7 +17186,7 @@ function normalizeContextSnapshot(value) {
 
 // src/session/projection-store.ts
 import { readFile as readFile26 } from "fs/promises";
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var MAX_RECENT_MESSAGES = 64;
 var MAX_PROMPT_CORRELATIONS = 64;
 var PROMPT_CORRELATION_TTL_MS = 24 * 60 * 6e4;
@@ -17112,7 +17253,7 @@ var SessionProjectionStore = class {
         recentMessages: currentOwner?.scope === input.scope && currentOwner.workspaceCwd === input.workspaceCwd ? structuredClone(currentOwner.recentMessages) : [],
         promptCorrelations: structuredClone(currentOwner?.promptCorrelations ?? []),
         boundAt: (/* @__PURE__ */ new Date()).toISOString(),
-        generationId: randomUUID11()
+        generationId: randomUUID12()
       };
       this.data.bindings[targetKey] = binding;
       return {
@@ -17269,8 +17410,8 @@ function normalizeCorrelation(value) {
 
 // src/session/archive.ts
 import { execFile as execFile2 } from "child_process";
-import { randomBytes as randomBytes3 } from "crypto";
-import { access, mkdir as mkdir17, readdir as readdir3, readFile as readFile27, unlink, writeFile as writeFile8 } from "fs/promises";
+import { randomBytes as randomBytes4 } from "crypto";
+import { access, mkdir as mkdir17, readdir as readdir3, readFile as readFile27, unlink, writeFile as writeFile9 } from "fs/promises";
 import { join as join24 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile2);
@@ -17280,7 +17421,7 @@ function archiveScopeSlug(scope) {
 }
 function timestampId() {
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
-  return `${stamp}-${randomBytes3(3).toString("hex")}`;
+  return `${stamp}-${randomBytes4(3).toString("hex")}`;
 }
 function renderMarkdown(input, record) {
   const lines = [
@@ -17353,8 +17494,8 @@ var SessionArchive = class {
     const markdownPath = join24(scopeDir, `${id}.md`);
     await mkdir17(scopeDir, { recursive: true });
     await Promise.all([
-      writeFile8(jsonlPath, renderJsonl(input, { archiveId: id, archivedAt, source }), "utf8"),
-      writeFile8(
+      writeFile9(jsonlPath, renderJsonl(input, { archiveId: id, archivedAt, source }), "utf8"),
+      writeFile9(
         markdownPath,
         renderMarkdown(input, { archiveId: id, archivedAt, source }),
         "utf8"
@@ -17594,7 +17735,7 @@ async function safeRemove(path) {
 
 // src/workspace/git-worktree.ts
 import { execFile as execFile3 } from "child_process";
-import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes5 } from "crypto";
 import { access as access2, copyFile, mkdir as mkdir18, realpath as realpath2 } from "fs/promises";
 import { dirname as dirname16, join as join25 } from "path";
 import { promisify as promisify2 } from "util";
@@ -17655,7 +17796,7 @@ var GitWorktreeManager = class {
         return { cwd: target, created: false };
       }
     }
-    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes4(3).toString("hex")}`;
+    const branch = `dsh-lark/${slug}-${Date.now().toString(36)}-${randomBytes5(3).toString("hex")}`;
     await mkdir18(this.options.worktreesRoot, { recursive: true });
     await this.runGit(["worktree", "add", "-b", branch, target, "HEAD"], base);
     await this.ensureProjectRules(base, target);
@@ -18639,7 +18780,7 @@ function projectDiagnosticLogs(lines) {
 }
 
 // src/secret/registry.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var SecretRequestRegistry = class {
   constructor(writer, options = {}) {
     this.writer = writer;
@@ -18652,7 +18793,7 @@ var SecretRequestRegistry = class {
   now;
   register(input) {
     this.writer.validate(input.target, input.reference);
-    const id = `secret-${randomUUID12().replaceAll("-", "")}`;
+    const id = `secret-${randomUUID13().replaceAll("-", "")}`;
     let resolve6;
     const promise = new Promise((settle) => {
       resolve6 = settle;
@@ -18802,7 +18943,7 @@ function buildSecretHandler(deps) {
 init_own_package();
 
 // src/guardian/update-handoff.ts
-import { createHash as createHash3, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
 import { spawn as spawn7 } from "child_process";
 import { chmod, mkdir as mkdir21, readFile as readFile32, rm as rm10 } from "fs/promises";
 import { dirname as dirname19, join as join26 } from "path";
@@ -18976,7 +19117,7 @@ var GuardianUpdateHandoff = class {
     this.options = options;
     this.launch = options.launch ?? defaultLaunch;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.id = options.id ?? randomUUID13;
+    this.id = options.id ?? randomUUID14;
   }
   options;
   launch;
@@ -19092,14 +19233,14 @@ var GuardianUpdateHandoff = class {
 };
 
 // src/upgrade/channel-update.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 var OFFER_TTL_MS = 10 * 6e4;
 var ChannelUpdateController = class {
   constructor(options) {
     this.options = options;
     this.current = options.current ?? currentVersion();
     this.probe = options.probe ?? (() => latestVersion({ cacheMs: 0 }));
-    this.id = options.id ?? randomUUID14;
+    this.id = options.id ?? randomUUID15;
     this.now = options.now ?? Date.now;
     this.ttl = options.offerTtlMs ?? OFFER_TTL_MS;
   }
@@ -19458,7 +19599,7 @@ async function startBridgeEngine(options) {
         ledgerClaimed = await claimJobDispatch({
           jobs,
           messageIds: ledgerMessageIds,
-          runId: `dispatch-${randomUUID15()}`,
+          runId: `dispatch-${randomUUID16()}`,
           first,
           channel: streaming
         });
@@ -19468,7 +19609,8 @@ async function startBridgeEngine(options) {
           attachments: await prepareAttachments(
             larkChannel,
             message,
-            paths.mediaDir(profileName)
+            paths.mediaDir(profileName),
+            { maxImageDimension: env.imageMaxDimension }
           )
         })));
         const messages = prepared.flatMap(({ message, attachments }) => [
@@ -19917,7 +20059,7 @@ function waitForShutdown() {
 init_dsh_runtime();
 init_own_package();
 import { spawn as spawn8 } from "child_process";
-import { mkdir as mkdir23, readFile as readFile33, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir23, readFile as readFile33, writeFile as writeFile10 } from "fs/promises";
 import { homedir as homedir17 } from "os";
 import { join as join28 } from "path";
 import { parse } from "yaml";
@@ -20017,7 +20159,7 @@ allowBuilds:
     existing = existing.replace(/(allowBuilds:\s*\n)/, `$1  ${allowBuilds}
 `);
   }
-  await writeFile9(workspaceFile, existing, "utf8");
+  await writeFile10(workspaceFile, existing, "utf8");
 }
 async function preserveInstalledPnpmVersion(profileDir) {
   const packageFile = join28(profileDir, "package.json");
@@ -20040,7 +20182,7 @@ async function preserveInstalledPnpmVersion(profileDir) {
       return;
     }
     profilePackage.packageManager = packageManager;
-    await writeFile9(packageFile, `${JSON.stringify(profilePackage, null, 2)}
+    await writeFile10(packageFile, `${JSON.stringify(profilePackage, null, 2)}
 `, "utf8");
   } catch {
   }
@@ -20573,7 +20715,7 @@ ${changeLines.join("\n")}
 import { join as join33 } from "path";
 
 // src/guardian/service.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { readFileSync as readFileSync6 } from "fs";
 import { homedir as homedir21 } from "os";
 import { join as join32 } from "path";
@@ -20646,7 +20788,7 @@ init_process();
 
 // src/guardian/safe-profile.ts
 init_dsh_runtime();
-import { mkdir as mkdir26, writeFile as writeFile10 } from "fs/promises";
+import { mkdir as mkdir26, writeFile as writeFile11 } from "fs/promises";
 import { existsSync as existsSync8 } from "fs";
 import { join as join31 } from "path";
 var SAFE_CORE_BUNDLES = [
@@ -20666,7 +20808,7 @@ async function ensureSafeProfile(options) {
   let created = false;
   const manifest = join31(root, "package.json");
   if (!existsSync8(manifest)) {
-    await writeFile10(
+    await writeFile11(
       manifest,
       `${JSON.stringify(
         {
@@ -20689,7 +20831,7 @@ async function ensureSafeProfile(options) {
   }
   const rootConfig = join31(root, "cordis.yml");
   if (!existsSync8(rootConfig)) {
-    await writeFile10(
+    await writeFile11(
       rootConfig,
       "# dsh profile root - an empty entry list; the tree is composed as patches.\n[]\n",
       "utf8"
@@ -20698,12 +20840,12 @@ async function ensureSafeProfile(options) {
   }
   const userPatch = join31(root, "cordis.patch.yml");
   if (!existsSync8(userPatch)) {
-    await writeFile10(userPatch, "[]\n", "utf8");
+    await writeFile11(userPatch, "[]\n", "utf8");
     created = true;
   }
   const workspace = join31(root, "pnpm-workspace.yaml");
   if (!existsSync8(workspace)) {
-    await writeFile10(
+    await writeFile11(
       workspace,
       [
         "packages:",
@@ -21420,7 +21562,7 @@ var GuardianService = class {
     }
     const transcript = this.transcripts.get(scope) ?? [];
     const prompt = buildSafePrompt(transcript, msg.content);
-    const runId = randomUUID16();
+    const runId = randomUUID17();
     const density = this.options.safeDensity;
     const timeoutMs = this.options.safeTimeoutMs;
     const now = Date.now();