herdr-dingtalk-omo-bridge 0.1.0 → 0.2.1

package/README.md

@@ -1,8 +1,19 @@
 # herdr-dingtalk-omo-bridge
 
+[![npm version](https://img.shields.io/npm/v/herdr-dingtalk-omo-bridge)](https://www.npmjs.com/package/herdr-dingtalk-omo-bridge)
+[![npm downloads](https://img.shields.io/npm/dw/herdr-dingtalk-omo-bridge)](https://www.npmjs.com/package/herdr-dingtalk-omo-bridge)
+[![CI](https://github.com/CurrenWong/herdr-dingtalk-omo-bridge/actions/workflows/ci.yml/badge.svg)](https://github.com/CurrenWong/herdr-dingtalk-omo-bridge/actions/workflows/ci.yml)
+[![license](https://img.shields.io/github/license/CurrenWong/herdr-dingtalk-omo-bridge)](LICENSE)
+
 A [Herdr](https://herdr.dev) plugin that makes an **OmO** coding agent reachable
 from DingTalk — and tells you, on the message itself, what state it is in.
 
+```bash
+npx herdr-dingtalk-omo-bridge@latest install
+# or
+herdr plugin install CurrenWong/herdr-dingtalk-omo-bridge
+```
+
 Send a message in DingTalk:
 
 1. the message gets tagged 👌**Received** within a few hundred milliseconds;
@@ -28,10 +39,30 @@ when Herdr restarts, and leaves you a TUI you can watch while it works.
 - [Troubleshooting](#troubleshooting)
 - [Security notes](#security-notes)
 - [Known limitations](#known-limitations)
+- [Publishing](#publishing)
 - [中文说明](#中文说明)
 
 ---
 
+## Publishing
+
+Two channels, both driven by manual GitHub Actions workflows:
+
+| Workflow | Registry | Package name |
+|---|---|---|
+| `publish.yml` | npmjs.org | `herdr-dingtalk-omo-bridge` |
+| `publish-github-packages.yml` | npm.pkg.github.com | `@currenwong/herdr-dingtalk-omo-bridge` |
+
+The npmjs one stages the tarball and then waits for a 2FA approval, because this
+account has 2FA and npm no longer accepts tokens that bypass it. The GitHub
+Packages one authenticates with the job's own `GITHUB_TOKEN`, so it needs no
+secret — the workflow rewrites the package name in the runner, since GitHub
+namespaces everything under the account and the npmjs package is unscoped.
+
+Bump `version` in `package.json` and tag the commit before releasing. A release,
+an npm version and a git tag that disagree about what `vX.Y.Z` means is the
+kind of thing that is only noticed months later.
+
 ## Contributing
 
 ```bash
@@ -190,6 +221,12 @@ Either way, confirm it landed:
 herdr plugin list        # expect: dingtalk-omo-bridge (DingTalk ↔ OmO Bridge) enabled
 ```
 
+> **Which registry?** Install from npmjs (`npx herdr-dingtalk-omo-bridge@latest`)
+> or straight from this repo. A copy is also mirrored to GitHub Packages as
+> `@currenwong/herdr-dingtalk-omo-bridge` so it shows under the repository's
+> Packages panel, but that one needs a GitHub token to install, so it is not the
+> recommended path. See [Publishing](#publishing) if you fork this.
+
 ### 3. Register the bot
 
 ```bash
@@ -314,6 +351,25 @@ herdr pane send-text <pane> <text>
 herdr pane send-keys <pane> enter
 ```
 
+### Attachments
+
+A picture message never carries the image. DingTalk sends a `downloadCode`, and
+the file has to be redeemed in two steps:
+
+```
+POST https://api.dingtalk.com/v1.0/robot/messageFiles/download   { downloadCode, robotCode }
+  -> { downloadUrl }            (short-lived)
+GET  <downloadUrl>              -> bytes
+```
+
+The bridge saves the result into `<agent cwd>/.dingtalk-inbox/` (override with
+`LAB_ATTACHMENT_DIR`) and sends the agent a prompt naming that path, so it can
+open the file with its usual tools. Names are sanitised but keep their script:
+`账单 2026.pdf` survives as `账单_2026.pdf` rather than being reduced to
+`_2026.pdf`.
+
+Files over 20 MB are refused rather than pulled into the workspace.
+
 ### The message tags
 
 These are plain REST calls against the DingTalk emotion API, which needs an app
@@ -406,7 +462,8 @@ node startup.mjs     # with the HERDR_* plugin env vars set
 | Bridge never connects | Another Stream client is already using this app. DingTalk permits exactly one connection per app — check for a second `dingtalk-bridge.mjs`. |
 | Tags never appear | Run `node probe-emotion.mjs <conv-id>`, and confirm the app has the robot capability that allows emotions. |
 | `msg.dec.err` on every tag | The message id was not accepted. Usually a stale or non-robot message. |
-| Reply says "只支持文本消息" / "Text messages only" | Working as intended — the bridge handles text, and OmO cannot receive images or files through the pane. |
+| Reply says "只支持文本消息" / "Text messages only" | The message carried neither text nor a `downloadCode`. Voice notes and rich-text in group chats are the usual cases. |
+| Reply says "附件下载失败" / "Could not download the attachment" | The `downloadCode` was rejected or the download URL expired. `downloadCode`s are single-use and short-lived; check the log line `!! attachment failed`. |
 | `check-reply.mjs` prints "no OmO sessions directory" | OmO is not installed, or has never run on this machine. The bridge reads answers from OmO's session logs, so there is nothing to read yet. |
 
 ## Security notes
@@ -463,9 +520,12 @@ If you get it running elsewhere, widening the manifest to
   conversation; concurrent senders queue rather than run in parallel.
 - **Tied to OmO's session-log format.** Another agent would need its own
   reply-extraction adapter (`sessionFileForCwd` / `lastAssistantText`).
-- **Text messages only.** Images and files cannot be handed to OmO through the
-  pane, so the bridge replies saying so rather than going quiet. Support would
-  mean downloading the media and writing it into the agent's working directory.
+- **Attachments are fetched, not inlined.** Images and files arrive as a
+  `downloadCode`; the bridge redeems it and writes the bytes into the agent's
+  working directory (`.dingtalk-inbox/`), then asks the agent to open that path.
+  Whether the agent can *interpret* the contents depends on its model — a
+  non-multimodal model will say it cannot read an image, which is the agent's
+  answer to give, not the bridge's.
 - **One turn at a time.** A message that arrives mid-turn gets "still working on
   the previous one" instead of queueing.
 - **No allowlist by default**, which on a shared bot is a real exposure. See
@@ -501,9 +561,19 @@ If you get it running elsewhere, widening the manifest to
 **标签是独立的 REST 调用**，需要 app accessToken（Stream 长连接本身拿不到），
 所以任何失败都只记日志、绝不吞掉正文回复。`LAB_EMOTIONS=0` 可整体关闭。
 
-**只支持文本消息**。图片和文件没法通过 pane 交给 OmO，所以桥会明确回一句
-「只支持文本消息」，而不是静默不理——静默跟机器人挂了是分不清的。同一时间
-只处理一轮，中途再发会收到「上一条还在处理中」。
+**图片和文件会被取回来。** 图片消息本身不含图片，只有一个 `downloadCode`；桥拿它
+去换临时下载地址、把字节存进 OmO 自己的工作目录，然后把**绝对路径**告诉 OmO（字节
+不进 prompt，避免把上下文和模型都不支持的二进制塞进去）。超过 20 MB 会直接拒绝。
+语音、群里的富文本这类既没有文本也没有 `downloadCode` 的消息，才会明确回一句
+「只支持文本消息」——静默跟机器人挂了是分不清的。
+
+**过程也会推给你。** 一轮任务可能要装包、试错、绕坑，过去这段时间是完全静默的。
+现在 OmO 边做边说的内容会以 `⏳` 前缀实时推送，最后再把真正的答案发出来。判别靠
+**结构**：带 `toolCall` 的消息是行动预告，纯文本才是结论——所以预告不会被当成
+结果。进度按字节偏移去重，每轮最多 10 条（`LAB_PROGRESS_LIMIT` 可调），因为钉钉
+机器人约 20 条/分钟限流。
+
+同一时间只处理一轮，中途再发会收到「上一条还在处理中」。
 
 **⚠️ 默认没有白名单。** `DINGTALK_ALLOW_STAFF` 不设的话，任何能给这个机器人
 发消息的人都能驱动你本机的 OmO 读写文件、跑命令。正式用请务必设置。

package/attachments.mjs

@@ -0,0 +1,112 @@
+// Fetch an attachment the user sent to the bot, and decide where it lands.
+//
+// DingTalk never puts the bytes in the callback. A picture message arrives as
+//   { msgtype: "picture", content: { downloadCode, pictureDownloadCode } }
+// and the file itself has to be redeemed in two steps:
+//
+//   POST /v1.0/robot/messageFiles/download   { downloadCode, robotCode }
+//     -> { downloadUrl }
+//   GET  <downloadUrl>                        -> bytes
+//
+// The URL is short-lived and unauthenticated, which is why this runs immediately
+// rather than queueing the download for later.
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { basename, extname, join } from "node:path";
+
+// Cap what we are willing to pull into the agent's working directory.
+export const MAX_BYTES = 20 * 1024 * 1024;
+
+const EXT_BY_TYPE = new Map([
+  ["image/jpeg", ".jpg"],
+  ["image/jpg", ".jpg"],
+  ["image/png", ".png"],
+  ["image/gif", ".gif"],
+  ["image/webp", ".webp"],
+  ["image/bmp", ".bmp"],
+  ["audio/amr", ".amr"],
+  ["audio/mpeg", ".mp3"],
+  ["audio/wav", ".wav"],
+  ["video/mp4", ".mp4"],
+  ["application/pdf", ".pdf"],
+]);
+
+/** The download code inside a non-text message, or "" when there is none. */
+export function downloadCodeOf(msg) {
+  const c = msg?.content ?? {};
+  return String(c.downloadCode ?? c.pictureDownloadCode ?? "").trim();
+}
+
+/**
+ * A safe, stable filename for a saved attachment.
+ *
+ * Prefers the name the sender used (file messages carry `fileName`), because a
+ * human will recognise it; falls back to the message id. Whatever we end up with
+ * is stripped of path separators — this string becomes a filesystem path.
+ */
+export function attachmentName(msg, contentType = "") {
+  const hint = String(msg?.content?.fileName ?? "").trim();
+  // Keep letters from any script: \w alone would reduce "账单 2026.pdf" to
+  // "_2026.pdf", which is useless to the person who sent it.
+  const safeHint = basename(hint)
+    .replace(/[^\p{L}\p{N}._-]+/gu, "_")
+    .replace(/^_+|_+$/g, "")
+    .slice(0, 80);
+  const id = String(msg?.msgId ?? "attachment").replace(/[^\w-]+/g, "_").slice(0, 40);
+
+  const fromType = EXT_BY_TYPE.get(String(contentType).split(";")[0].trim().toLowerCase()) ?? "";
+  const fromHint = extname(safeHint).toLowerCase();
+  const ext = fromType || fromHint || ".bin";
+
+  if (safeHint) {
+    // Keep the sender's stem when we know it, unless it already ends in the
+    // extension we resolved from the content type.
+    const stem = fromHint ? safeHint.slice(0, -fromHint.length) : safeHint;
+    return `${stem || id}${ext}`;
+  }
+  return `${id}${ext}`;
+}
+
+/**
+ * Turn the access token into bytes on disk.
+ * Returns { path, bytes, contentType } or throws with a usable message.
+ */
+export async function saveAttachment({ msg, robotCode, accessToken, dir }) {
+  const downloadCode = downloadCodeOf(msg);
+  if (!downloadCode) throw new Error("message carries no downloadCode");
+
+  const token = await accessToken();
+
+  const res = await fetch("https://api.dingtalk.com/v1.0/robot/messageFiles/download", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "x-acs-dingtalk-access-token": token,
+    },
+    body: JSON.stringify({ downloadCode, robotCode }),
+  });
+  const body = await res.text();
+  if (!res.ok) {
+    throw new Error(`downloadCode rejected: HTTP ${res.status} ${body.slice(0, 200)}`);
+  }
+  const url = JSON.parse(body)?.downloadUrl;
+  if (!url) throw new Error(`no downloadUrl in response: ${body.slice(0, 200)}`);
+
+  const file = await fetch(url);
+  if (!file.ok) throw new Error(`downloadUrl fetch failed: HTTP ${file.status}`);
+
+  const declared = Number(file.headers.get("content-length") ?? 0);
+  if (declared > MAX_BYTES) {
+    throw new Error(`attachment is ${Math.round(declared / 1048576)}MB, limit is ${MAX_BYTES / 1048576}MB`);
+  }
+  const buf = Buffer.from(await file.arrayBuffer());
+  if (buf.length > MAX_BYTES) {
+    throw new Error(`attachment is ${Math.round(buf.length / 1048576)}MB, limit is ${MAX_BYTES / 1048576}MB`);
+  }
+
+  const contentType = file.headers.get("content-type") ?? "";
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  const path = join(dir, attachmentName(msg, contentType));
+  writeFileSync(path, buf);
+
+  return { path, bytes: buf.length, contentType };
+}

package/dingtalk-bridge.mjs

@@ -20,7 +20,9 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, statS
 import { homedir } from "node:os";
 import { join, resolve as resolvePath } from "node:path";
 import { DWClient, TOPIC_ROBOT } from "dingtalk-stream";
+import { saveAttachment } from "./attachments.mjs";
 import { ACTIONS, classifyInbound } from "./inbound.mjs";
+import { assistantMessagesSince, lastAssistantText } from "./session-log.mjs";
 import { DEFAULT_PLUGIN_ID, defaultConfigDir, defaultStateDir } from "./herdr-paths.mjs";
 
 const HERDR = process.env.HERDR_BIN_PATH ?? "herdr";
@@ -36,6 +38,16 @@ const TARGET = process.env.LAB_TARGET_PANE ?? "";
 const ANSWER_TIMEOUT_MS = Number(process.env.LAB_AGENT_TIMEOUT_MS ?? 300000);
 const READ_LINES = 60;
 const OMO_SESSIONS = join(homedir(), ".omo", "agent", "sessions");
+// Attachments are written into the agent's working directory, not the plugin's
+// state dir: the agent opens them by path, and a relative path in its own
+// workspace is the least surprising thing to hand it.
+const ATTACHMENT_DIR = process.env.LAB_ATTACHMENT_DIR ?? ".dingtalk-inbox";
+// One DingTalk markdown message comfortably carries a few thousand characters;
+// beyond this the tail is cut and the reply says so.
+const PUSH_LIMIT = Number(process.env.LAB_PUSH_LIMIT ?? 4000);
+// DingTalk rate-limits a robot to roughly 20 messages a minute, so cap how much
+// of a long-running agent's narration gets forwarded.
+const PROGRESS_LIMIT = Number(process.env.LAB_PROGRESS_LIMIT ?? 10);
 
 // Every string the bot says to the user lives here so the plugin is not welded
 // to one language. Set LAB_LANG=en for English; anything else falls back to the
@@ -51,6 +63,11 @@ const TEXT = {
     busy: "上一条还在处理中，稍等。",
     handleFailed: (msg) => `桥接出错：${msg}`,
     unsupported: (type) => `只支持文本消息，收到的是 ${type}。图片和文件没法交给 OmO。`,
+    attachmentPrompt: ({ type, path, size }) =>
+      `用户通过钉钉发来一个 ${type} 附件，已保存到本地：\n${path}\n（${size}）\n\n请查看这个文件并回应。如果无法直接读取其中的内容，请说明原因，不要猜测。`,
+    attachmentFailed: (err) => `附件下载失败：${err}`,
+    truncated: (n) => `…（内容过长，已截断剩余 ${n} 字符）`,
+    progress: (text) => `⏳ ${text}`,
   },
   en: {
     fallbackTitle: "Reply",
@@ -61,6 +78,11 @@ const TEXT = {
     busy: "Still working on the previous message.",
     handleFailed: (msg) => `Bridge error: ${msg}`,
     unsupported: (type) => `Text messages only — this one was "${type}". Images and files cannot be handed to OmO.`,
+    attachmentPrompt: ({ type, path, size }) =>
+      `The user sent a ${type} attachment through DingTalk. It is saved locally at:\n${path}\n(${size})\n\nPlease look at it and respond. If you cannot actually read its contents, say so rather than guessing.`,
+    attachmentFailed: (err) => `Could not download the attachment: ${err}`,
+    truncated: (n) => `…(${n} more characters truncated)`,
+    progress: (text) => `⏳ ${text}`,
   },
 };
 const t = (key, ...args) => TEXT[LANG][key](...args);
@@ -156,27 +178,6 @@ function sessionFileForCwd(cwd) {
   return best;
 }
 
-function lastAssistantText(file, fromByte) {
-  if (!file || !existsSync(file.path)) return null;
-  const fd = readFileSync(file.path, "utf8");
-  const slice = fromByte > 0 && fromByte <= fd.length ? fd.slice(fromByte) : fd;
-  let answer = null;
-  for (const line of slice.split("\n")) {
-    if (!line.trim()) continue;
-    let row;
-    try {
-      row = JSON.parse(line);
-    } catch {
-      continue; // a partially written tail line; the next poll will see it whole
-    }
-    if (row.type !== "message" || row.message?.role !== "assistant") continue;
-    const parts = (row.message.content ?? [])
-      .filter((c) => c.type === "text" && c.text)
-      .map((c) => c.text.trim());
-    if (parts.length) answer = parts.join("\n\n");
-  }
-  return answer;
-}
 
 function stripAnsi(text) {
   return text
@@ -336,7 +337,11 @@ const state = { started_at: new Date().toISOString(), seen: 0, last_push: null }
 
 // Returns {text, ok} so the caller knows whether to tag the turn Done or
 // Error — a timeout or a blocked prompt is not a successful answer.
-async function askAgent(paneId, text, cwd) {
+//
+// `onProgress` receives the agent's narration as it happens. Those messages are
+// useless as an answer but genuinely useful while waiting, especially for turns
+// that spend a minute installing a package first.
+async function askAgent(paneId, text, cwd, onProgress) {
   const snap = sessionFileForCwd(cwd);
   log("session snapshot", JSON.stringify({ file: snap?.path ?? null, size: snap?.size ?? 0 }));
   const paneBefore = TARGET ? readPane(paneId) : "";
@@ -349,6 +354,11 @@ async function askAgent(paneId, text, cwd) {
 
   const deadline = Date.now() + ANSWER_TIMEOUT_MS;
   let sawWorking = false;
+  // Narration is deduped by byte offset so a row seen on two polls is not sent
+  // twice. Capped because DingTalk rate-limits a robot to ~20 messages/minute.
+  const narrated = new Set();
+  let progressSent = 0;
+
   while (Date.now() < deadline) {
     await sleep(900);
     const info = agentInfo();
@@ -356,8 +366,25 @@ async function askAgent(paneId, text, cwd) {
     if (snap) {
       const fresh = sessionFileForCwd(cwd);
       const file = fresh && fresh.path !== snap.path ? fresh : snap;
-      const answer = lastAssistantText(file, snap.path === file.path ? snap.size : 0);
-      if (answer) {
+      const fromByte = snap.path === file.path ? snap.size : 0;
+
+      if (onProgress) {
+        for (const m of assistantMessagesSince(file, fromByte)) {
+          if (m.final || narrated.has(m.offset)) continue;
+          if (progressSent >= PROGRESS_LIMIT) break;
+          narrated.add(m.offset);
+          progressSent += 1;
+          log("progress", JSON.stringify(m.text.slice(0, 200)));
+          await onProgress(m.text).catch((err) => log("!! progress push failed", err.message));
+        }
+      }
+
+      const answer = lastAssistantText(file, fromByte);
+      // While the agent is still "working", its latest text is commentary on
+      // what it is about to do, not a conclusion. The structural check inside
+      // lastAssistantText catches the common case (narration bundled with a
+      // toolCall); this also catches narration sent as its own text-only row.
+      if (answer && info?.agent_status !== "working") {
         log("answer from session log", JSON.stringify(answer.slice(0, 300)));
         return { text: answer, ok: true };
       }
@@ -429,8 +456,43 @@ async function handle(msg) {
   }
   log("-> agent", JSON.stringify({ agent: AGENT, pane: paneId, cwd: info?.cwd, status: info?.agent_status }));
 
-  const answer = await askAgent(paneId, verdict.text, info?.cwd);
-  await push(msg.sessionWebhook, answer.text.slice(0, 4000));
+  // Attachments are redeemed into the agent's working directory so the agent
+  // can open them with its normal tools. DingTalk never sends the bytes in the
+  // callback, and the download URL it hands back is short-lived, so this has to
+  // happen now rather than being queued.
+  let promptText = verdict.text;
+  if (verdict.action === ACTIONS.ATTACHMENT) {
+    const dir = join(info?.cwd ?? process.cwd(), ATTACHMENT_DIR);
+    try {
+      const saved = await saveAttachment({
+        msg,
+        robotCode: msg.robotCode ?? msg.chatbotCorpId ?? CLIENT_ID,
+        accessToken,
+        dir,
+      });
+      log("attachment saved", JSON.stringify({ path: saved.path, bytes: saved.bytes, type: saved.contentType }));
+      promptText = t("attachmentPrompt", {
+        type: verdict.msgtype,
+        path: saved.path,
+        size: `${Math.max(1, Math.round(saved.bytes / 1024))} KB`,
+      });
+    } catch (err) {
+      log("!! attachment failed", err.message);
+      await push(msg.sessionWebhook, t("attachmentFailed", err.message));
+      await finish(false);
+      return;
+    }
+  }
+
+  const answer = await askAgent(paneId, promptText, info?.cwd, async (progress) => {
+    // Marked so a running commentary is never mistaken for the result.
+    await push(msg.sessionWebhook, t("progress", progress.slice(0, 800)));
+  });
+  // Truncating silently would look like the agent stopped mid-sentence.
+  const body = answer.text.length > PUSH_LIMIT
+    ? `${answer.text.slice(0, PUSH_LIMIT)}\n\n${t("truncated", answer.text.length - PUSH_LIMIT)}`
+    : answer.text;
+  await push(msg.sessionWebhook, body);
   await finish(answer.ok);
 }
 

package/inbound.mjs

@@ -1,18 +1,23 @@
 // Decide what to do with an inbound DingTalk message.
 //
 // Pulled out of the bridge's handle() so the rules can be tested without a
-// Stream connection: dingtalk-bridge.mjs connects at module top level, so it
-// cannot be imported by a test.
+// Stream connection: dingtalk-bridge.mjs connects at module level and cannot be
+// imported by a test.
 //
-// The order matters and used to be wrong. The bridge checked for empty text
-// before anything else, so a non-text message (an image, a file) got no tag,
-// no reply and nothing but a log line — indistinguishable from the bot being
-// dead. Unsupported *types* are now answered explicitly.
+// Order matters and used to be wrong. The bridge checked for empty text before
+// anything else, so a non-text message got no tag, no reply and nothing but a
+// log line — indistinguishable from the bot being dead. Now:
+//
+//   REJECT       not allowed to talk to this bot
+//   ATTACHMENT   allowed, and carries a downloadCode we can redeem
+//   UNSUPPORTED  allowed, but there is nothing we can act on
+//   PROCESS      hand the text to the agent
 
 export const ACTIONS = {
-  REJECT: "reject", // not allowed to talk to this bot
-  UNSUPPORTED: "unsupported", // allowed, but this kind of message is not handled
-  PROCESS: "process", // hand it to the agent
+  REJECT: "reject",
+  ATTACHMENT: "attachment",
+  UNSUPPORTED: "unsupported",
+  PROCESS: "process",
 };
 
 /**
@@ -24,14 +29,19 @@ export function classifyInbound(msg, { allow = [] } = {}) {
   const msgtype = msg?.msgtype ?? "text";
   const text = String(msg?.text?.content ?? "").trim();
   const staffId = msg?.senderStaffId;
+  const content = msg?.content ?? {};
+  const downloadCode = String(content.downloadCode ?? content.pictureDownloadCode ?? "").trim();
 
   if (allow.length && !allow.includes(staffId)) {
     return { action: ACTIONS.REJECT, msgtype, text, staffId };
   }
 
-  // `text` messages that are empty (whitespace, or a payload we cannot read)
-  // fall in here too: from the user's point of view it is still not something
-  // we can act on, and silence is the worst answer.
+  // A non-text message with a downloadCode is something we can actually fetch:
+  // images, files, voice notes. Text messages never carry one.
+  if (msgtype !== "text" && downloadCode) {
+    return { action: ACTIONS.ATTACHMENT, msgtype, text, staffId, downloadCode };
+  }
+
   if (msgtype !== "text" || !text) {
     return { action: ACTIONS.UNSUPPORTED, msgtype, text, staffId };
   }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "herdr-dingtalk-omo-bridge",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "herdr-dingtalk-omo-bridge",
-      "version": "0.1.0",
+      "version": "0.2.1",
       "license": "MIT",
       "dependencies": {
         "dingtalk-stream": "^2.1.6-beta.1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-dingtalk-omo-bridge",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Herdr plugin that bridges DingTalk messages to an OmO coding-agent session, posts the answer back, and tags each message as received/done.",
   "keywords": [
     "herdr",
@@ -18,6 +18,7 @@
     "bin/",
     "installer.mjs",
     "herdr-plugin.toml",
+    "attachments.mjs",
     "auth.mjs",
     "check-reply.mjs",
     "dingtalk-bridge.mjs",
@@ -25,6 +26,7 @@
     "inbound.mjs",
     "probe.mjs",
     "probe-emotion.mjs",
+    "session-log.mjs",
     "startup.mjs",
     "supervise.mjs",
     "npm-shrinkwrap.json",
@@ -46,7 +48,7 @@
     "node": ">=20"
   },
   "scripts": {
-    "check": "node --check auth.mjs && node --check check-reply.mjs && node --check dingtalk-bridge.mjs && node --check herdr-paths.mjs && node --check inbound.mjs && node --check installer.mjs && node --check bin/herdr-dingtalk-omo-bridge.mjs && node --check probe.mjs && node --check probe-emotion.mjs && node --check startup.mjs && node --check supervise.mjs",
+    "check": "node --check auth.mjs && node --check attachments.mjs && node --check check-reply.mjs && node --check dingtalk-bridge.mjs && node --check herdr-paths.mjs && node --check inbound.mjs && node --check installer.mjs && node --check bin/herdr-dingtalk-omo-bridge.mjs && node --check probe.mjs && node --check probe-emotion.mjs && node --check startup.mjs && node --check session-log.mjs && node --check supervise.mjs",
     "check-paths": "node .github/scripts/check-paths.mjs",
     "check-manifest": "node .github/scripts/check-manifest.mjs",
     "scan-secrets": "node .github/scripts/scan-secrets.mjs .",

package/session-log.mjs

@@ -0,0 +1,110 @@
+// Reading OmO's session log by byte offset.
+//
+// Lives in its own module because getting this wrong is invisible: the bridge
+// polls right after typing a prompt, so a reader that mistakes byte offsets for
+// string indices returns the *previous* turn's answer, reports success, and
+// looks fast while doing it. That happened once already.
+import { existsSync, readFileSync } from "node:fs";
+
+/**
+ * Rows appended after `fromByte`.
+ *
+ * `fromByte` is a byte count (statSync().size). The file is read as a Buffer and
+ * sliced as bytes — reading it as a string and slicing by index compares bytes
+ * against UTF-16 code units, which diverge as soon as the content is not ASCII.
+ *
+ * Returns null when nothing new has been written.
+ */
+export function rowsAppendedSince(file, fromByte) {
+  if (!file || !existsSync(file.path)) return null;
+  const buf = readFileSync(file.path);
+  if (buf.length <= fromByte) return null;
+
+  const rows = [];
+  for (const line of buf.subarray(fromByte).toString("utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      rows.push(JSON.parse(line));
+    } catch {
+      // A partially written tail line; the next poll will see it whole.
+    }
+  }
+  return rows;
+}
+
+/**
+ * Every assistant message appended since `fromByte`, in order.
+ *
+ * Each entry carries `offset` (a stable identity for dedup across polls) and
+ * `final`, which is true only for a message made purely of text.
+ *
+ * `final === false` means the agent is narrating what it is about to do — those
+ * messages arrive bundled with the toolCall they announce. They are useful as
+ * progress reports and misleading as answers, so the caller can do both:
+ * forward them while waiting, and never end the turn on one.
+ */
+export function assistantMessagesSince(file, fromByte) {
+  const rows = rowsAppendedSince(file, fromByte);
+  if (!rows?.length) return [];
+
+  const out = [];
+  let offset = fromByte;
+  const buf = readFileSync(file.path);
+  const tail = buf.subarray(fromByte).toString("utf8");
+
+  for (const line of tail.split("\n")) {
+    const start = offset;
+    offset += Buffer.byteLength(line, "utf8") + 1;
+    if (!line.trim()) continue;
+
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (row.type !== "message" || row.message?.role !== "assistant") continue;
+
+    const content = row.message.content;
+    if (typeof content === "string") {
+      const text = content.trim();
+      if (text) out.push({ offset: start, text, final: true });
+      continue;
+    }
+    if (!Array.isArray(content)) continue;
+
+    const stillActing = content.some((c) => typeof c !== "string" && (c?.type ?? "") !== "text");
+    const text = content
+      .map((c) => (typeof c === "string" ? c : c.text))
+      .filter((t) => typeof t === "string" && t.trim())
+      .map((t) => t.trim())
+      .join("\n\n");
+    if (text) out.push({ offset: start, text, final: !stillActing });
+  }
+  return out;
+}
+
+/**
+ * The assistant's answer among the rows appended since `fromByte`, or null if
+ * the turn has not produced one yet.
+ *
+ * Two guards, each for a failure that actually happened:
+ *
+ *  * the user row must be present, or a poll that outraces the agent can match a
+ *    leftover assistant row and call the turn finished;
+ *  * an assistant row that carries anything other than text is *not* an answer.
+ *    OmO narrates before it acts — "I need to extract text from the PDF, I'll
+ *    use Python" arrives as an assistant message bundled with the toolCall that
+ *    follows it. Accepting that reported the plan as the result, 70 seconds
+ *    before the real answer existed.
+ */
+export function lastAssistantText(file, fromByte) {
+  const rows = rowsAppendedSince(file, fromByte);
+  if (!rows?.length) return null;
+
+  const sawUser = rows.some((r) => r.type === "message" && r.message?.role === "user");
+  if (!sawUser) return null;
+
+  const candidates = assistantMessagesSince(file, fromByte).filter((m) => m.final);
+  return candidates.length ? candidates[candidates.length - 1].text : null;
+}