freddie 0.0.124 → 0.0.126

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "freddie",
-  "version": "0.0.124",
+  "version": "0.0.126",
   "type": "module",
   "description": "Open JS agent harness built on pi-mono, floosie, xstate, and anentrypoint-design",
   "bin": {

package/plugins/platform-discord/handler.js

@@ -5,6 +5,17 @@ import WebSocket from 'ws'
 const OP = { DISPATCH: 0, HEARTBEAT: 1, IDENTIFY: 2, RESUME: 6, RECONNECT: 7, INVALID_SESSION: 9, HELLO: 10, HEARTBEAT_ACK: 11 }
 // GUILD_MESSAGES(1<<9) + DIRECT_MESSAGES(1<<12) + MESSAGE_CONTENT(1<<15)
 const DEFAULT_INTENTS = (1 << 9) | (1 << 12) | (1 << 15)
+// Discord CDN attachment URLs are directly fetchable with no auth, but with no
+// auth also comes no trust in the advertised size -- guard against buffering
+// something unreasonably large into memory.
+const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024
+const ATTACHMENT_FETCH_TIMEOUT_MS = 10000
+
+function contentTypeCategory(contentType) {
+    const t = (contentType || '').split('/')[0]
+    if (t === 'image' || t === 'audio' || t === 'video') return t
+    return 'other'
+}
 
 export class DiscordAdapter extends EventEmitter {
     constructor(opts = {}) {
@@ -66,7 +77,42 @@ export class DiscordAdapter extends EventEmitter {
         if (p.t === 'MESSAGE_CREATE') {
             const m = p.d
             if (m.author?.bot) return   // ignore bots and our own messages
-            this.emit('message', { from: m.author?.id, text: m.content || '', raw: m, platform: 'discord' })
+            const base = { from: m.author?.id, text: m.content || '', raw: m, platform: 'discord' }
+            if (!m.attachments?.length) { this.emit('message', base); return }
+            // ws.on('message', ...) below is a sync callback and can't await this,
+            // so the fetch-and-emit path runs as a detached async task: the
+            // message still emits exactly once, after attachment fetches settle,
+            // and one attachment's failure (via allSettled) never blocks the
+            // others or drops the message itself.
+            this._resolveAttachments(m.attachments).then(media => {
+                this.emit('message', { ...base, media })
+            })
+            return
+        }
+    }
+
+    async _resolveAttachments(attachments) {
+        const results = await Promise.allSettled(attachments.map(a => this._fetchAttachment(a)))
+        return results.filter(r => r.status === 'fulfilled' && r.value).map(r => r.value)
+    }
+
+    async _fetchAttachment(a) {
+        if (a.size > MAX_ATTACHMENT_BYTES) {
+            console.error(`DiscordAdapter: skipping attachment ${a.filename} (${a.size} bytes exceeds ${MAX_ATTACHMENT_BYTES} byte guard)`)
+            return null
+        }
+        const ac = new AbortController()
+        const timer = setTimeout(() => ac.abort(), ATTACHMENT_FETCH_TIMEOUT_MS)
+        try {
+            const res = await fetch(a.url, { signal: ac.signal })
+            if (!res.ok) throw new Error(`attachment fetch failed with status ${res.status}`)
+            const buffer = Buffer.from(await res.arrayBuffer())
+            return { type: contentTypeCategory(a.content_type), mimeType: a.content_type || '', buffer, filename: a.filename }
+        } catch (err) {
+            console.error(`DiscordAdapter: attachment fetch failed for ${a.filename}`, err)
+            return null
+        } finally {
+            clearTimeout(timer)
         }
     }
 

package/plugins/platform-whatsapp/handler.js

@@ -28,6 +28,29 @@ export class WhatsappAdapter extends EventEmitter {
         try { return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) } catch { return false }
     }
 
+    // WhatsApp Cloud API media download is a two-step handshake: the webhook
+    // payload only ever carries a media id, never a fetchable URL directly.
+    // Step 1 resolves that id to a short-lived signed URL (also bearer-authed);
+    // step 2 fetches the actual bytes from that URL, still with the same
+    // bearer token (Meta requires it on both hops). Each hop is bounded by an
+    // AbortController timeout so a slow/hung Meta response can never wedge the
+    // webhook handler indefinitely.
+    async _downloadMedia(mediaId, timeoutMs = 10000) {
+        const authHeader = { authorization: `Bearer ${this.token}` }
+        const withTimeout = async (url) => {
+            const ac = new AbortController()
+            const timer = setTimeout(() => ac.abort(), timeoutMs)
+            try { return await fetch(url, { headers: authHeader, signal: ac.signal }) }
+            finally { clearTimeout(timer) }
+        }
+        const meta = await withTimeout(`${this.api}/${mediaId}`).then(r => r.json())
+        if (!meta?.url) throw new Error('WhatsappAdapter: media lookup returned no url: ' + JSON.stringify(meta))
+        const res = await withTimeout(meta.url)
+        if (!res.ok) throw new Error(`WhatsappAdapter: media fetch failed with status ${res.status}`)
+        const buffer = Buffer.from(await res.arrayBuffer())
+        return { buffer, mimeType: meta.mime_type || res.headers.get('content-type') || '' }
+    }
+
     async start() {
         if (!this.token || !this.phoneId) throw new Error('WhatsappAdapter: WHATSAPP_API_TOKEN + WHATSAPP_PHONE_NUMBER_ID required')
         const app = express()
@@ -38,19 +61,34 @@ export class WhatsappAdapter extends EventEmitter {
             if (req.query['hub.verify_token'] === this.verifyToken) return res.send(req.query['hub.challenge'])
             res.sendStatus(403)
         })
-        app.post(this.path, (req, res) => {
+        app.post(this.path, async (req, res) => {
             if (!this._verifySignature(req)) return res.sendStatus(401)
             const entries = req.body?.entry || []
             for (const e of entries) for (const c of (e.changes || [])) {
                 const msgs = c.value?.messages || []
                 for (const m of msgs) {
-                    this.emit('message', {
+                    const event = {
                         from: m.from,
                         text: m.text?.body || '',
                         // surface the platform message id for dedup, and the message type
                         // so media-only messages are recognisable upstream.
                         raw: { ...m, id: m.id, type: m.type },
-                    })
+                    }
+                    const mediaObj = m.image || m.audio || m.document || m.video
+                    if (mediaObj?.id) {
+                        const type = m.image ? 'image' : m.audio ? 'audio' : m.document ? 'document' : 'video'
+                        try {
+                            const { buffer, mimeType } = await this._downloadMedia(mediaObj.id)
+                            event.media = { type, mimeType, buffer }
+                        } catch (err) {
+                            // Never let a failed/slow media fetch block the rest of the
+                            // webhook batch or the ack below -- note media as
+                            // present-but-unfetched so the pipeline still proceeds.
+                            console.error('WhatsappAdapter: media download failed', err)
+                            event.media = { type, mimeType: mediaObj.mime_type || '', buffer: null, error: String(err?.message || err) }
+                        }
+                    }
+                    this.emit('message', event)
                 }
             }
             res.json({ ok: true })