pi-cloud 2.0.0 → 2.0.1

package/server/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync } from "node:fs";
 import { spawn as spawn3 } from "node:child_process";
 import * as os9 from "node:os";
@@ -53,8 +53,8 @@ function configuredAllowedRoots() {
   return raw.split(",").map((root) => root.trim()).filter(Boolean);
 }
 function isInsideRoot(candidate, root) {
-  const relative3 = path2.relative(root, candidate);
-  return relative3 === "" || !relative3.startsWith("..") && !path2.isAbsolute(relative3);
+  const relative4 = path2.relative(root, candidate);
+  return relative4 === "" || !relative4.startsWith("..") && !path2.isAbsolute(relative4);
 }
 async function realpathIfExists(candidate) {
   try {
@@ -101,6 +101,23 @@ async function resolveAllowedPath(requestedPath) {
   }
   return resolvedPath;
 }
+async function resolveAllowedExistingPath(requestedPath) {
+  const resolvedPath = path2.resolve(expandHomePath(requestedPath));
+  if (isPathCheckDisabled()) return fs.realpath(resolvedPath);
+  const configuredRoots = configuredAllowedRoots().map((root) => path2.resolve(expandHomePath(root)));
+  const matchedRoot = configuredRoots.find((root) => isInsideRoot(resolvedPath, root));
+  if (!matchedRoot) throw new PathAccessError(resolvedPath);
+  const relativePath = path2.relative(matchedRoot, resolvedPath);
+  if (relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
+    throw new PathAccessError(resolvedPath);
+  }
+  const realPath = await fs.realpath(resolvedPath);
+  const roots = await allowedRoots();
+  if (!roots.some((root) => isInsideRoot(realPath, root))) {
+    throw new PathAccessError(resolvedPath);
+  }
+  return realPath;
+}
 
 // src/services/project-mover.ts
 var ProjectMover = class {
@@ -1762,11 +1779,11 @@ function sendError(reply, error) {
 // src/routes/files.ts
 import { spawn } from "child_process";
 import { isUtf8 } from "buffer";
-import { createReadStream as createReadStream2 } from "fs";
+import { constants as fsConstants, createReadStream as createReadStream2 } from "fs";
 import * as fs2 from "fs/promises";
 import * as path3 from "path";
 import { ZipArchive } from "archiver";
-import { glob } from "glob";
+import { globIterate } from "glob";
 
 // src/utils/archive-preview.ts
 import { createReadStream } from "node:fs";
@@ -1882,6 +1899,13 @@ function listTarEntries(filePath, gzipped) {
 }
 
 // src/routes/files.ts
+var MAX_FILE_TREE_DEPTH = 10;
+var MAX_FILE_TREE_NODES = 5e3;
+var FILE_TREE_TIMEOUT_MS = 5e3;
+var MAX_TEXT_FILE_BYTES = 10 * 1024 * 1024;
+var MAX_FILE_SEARCH_RESULTS = 5e3;
+var FILE_SEARCH_TIMEOUT_MS = 5e3;
+var FILE_SEARCH_IGNORES = ["**/.git/**", "**/node_modules/**"];
 var imageMimeTypes = /* @__PURE__ */ new Map([
   [".apng", "image/apng"],
   [".avif", "image/avif"],
@@ -1995,7 +2019,7 @@ async function createTreeNode(dirPath, entry) {
     const rawTarget = await fs2.readlink(fullPath);
     linkTarget = path3.isAbsolute(rawTarget) ? rawTarget : path3.resolve(dirPath, rawTarget);
     try {
-      const targetStats = await fs2.stat(fullPath);
+      const targetStats = await fs2.stat(await resolveAllowedExistingPath(fullPath));
       if (targetStats.isDirectory()) {
         isDirectory = true;
         targetType = "directory";
@@ -2020,29 +2044,41 @@ async function createTreeNode(dirPath, entry) {
   }
   return node;
 }
-async function buildFileTree(dirPath, depth, currentDepth = 0, options = {
-  includeHidden: false,
-  excludeNames: /* @__PURE__ */ new Set(["node_modules"]),
-  filterType: "all",
-  sort: "name"
-}) {
+async function buildFileTree(dirPath, depth, currentDepth, options, budget) {
   if (currentDepth >= depth) return [];
-  const entries = await fs2.readdir(dirPath, { withFileTypes: true });
   const nodes = [];
-  for (const entry of entries) {
-    if (!options.includeHidden && entry.name.startsWith(".")) continue;
-    if (options.excludeNames.has(entry.name)) continue;
-    const node = await createTreeNode(dirPath, entry);
-    if (options.sort === "modified") {
-      node.mtime = (await fs2.lstat(node.path)).mtimeMs;
-    }
-    if (options.filterType !== "all" && options.filterType !== node.type) {
-      continue;
-    }
-    if (node.type === "directory" && !node.isSymlink) {
-      node.children = await buildFileTree(node.path, depth, currentDepth + 1, options);
+  const accessDirPath = await resolveAllowedExistingPath(dirPath);
+  const directory = await fs2.opendir(accessDirPath);
+  try {
+    let entry = await directory.read();
+    while (entry !== null) {
+      if (budget.remainingNodes <= 0 || Date.now() >= budget.deadline) {
+        budget.truncated = true;
+        break;
+      }
+      if (!options.includeHidden && entry.name.startsWith(".")) {
+        entry = await directory.read();
+        continue;
+      }
+      if (options.excludeNames.has(entry.name)) {
+        entry = await directory.read();
+        continue;
+      }
+      const node = await createTreeNode(dirPath, entry);
+      if (options.sort === "modified") {
+        node.mtime = (await fs2.lstat(path3.join(accessDirPath, entry.name))).mtimeMs;
+      }
+      if (options.filterType === "all" || options.filterType === node.type) {
+        budget.remainingNodes--;
+        if (node.type === "directory" && !node.isSymlink) {
+          node.children = await buildFileTree(node.path, depth, currentDepth + 1, options, budget);
+        }
+        nodes.push(node);
+      }
+      entry = await directory.read();
     }
-    nodes.push(node);
+  } finally {
+    await directory.close();
   }
   return nodes.sort((a, b) => {
     if (options.sort === "modified") {
@@ -2053,7 +2089,7 @@ async function buildFileTree(dirPath, depth, currentDepth = 0, options = {
   });
 }
 async function fileRoutes(app) {
-  app.get("/tree", async (req) => {
+  app.get("/tree", async (req, reply) => {
     const {
       path: dirPath,
       depth,
@@ -2062,21 +2098,31 @@ async function fileRoutes(app) {
       exclude,
       sort
     } = req.query;
+    const requestedDepth = depth === void 0 ? 3 : Number(depth);
+    if (!Number.isInteger(requestedDepth) || requestedDepth < 1 || requestedDepth > MAX_FILE_TREE_DEPTH) {
+      return reply.code(400).send({ error: `depth must be an integer between 1 and ${MAX_FILE_TREE_DEPTH}` });
+    }
     const resolvedPath = await resolveAllowedPath(dirPath);
     const excludeNames = new Set(
       (exclude === void 0 ? "node_modules" : exclude).split(",").map((name) => name.trim()).filter(Boolean)
     );
-    const tree = await buildFileTree(resolvedPath, parseInt(depth || "3"), 0, {
+    const budget = {
+      remainingNodes: MAX_FILE_TREE_NODES,
+      deadline: Date.now() + FILE_TREE_TIMEOUT_MS,
+      truncated: false
+    };
+    const tree = await buildFileTree(resolvedPath, requestedDepth, 0, {
       includeHidden: parseBoolean(hidden, false),
       excludeNames,
       filterType: parseFilterType(type),
       sort: parseTreeSort(sort)
-    });
+    }, budget);
     const parentPath = path3.dirname(resolvedPath);
     return {
       path: resolvedPath,
       parentPath: parentPath === resolvedPath ? null : parentPath,
-      tree
+      tree,
+      truncated: budget.truncated
     };
   });
   app.get("/download", async (req, reply) => {
@@ -2119,9 +2165,11 @@ async function fileRoutes(app) {
   app.get("/read", async (req, reply) => {
     const { path: filePath } = req.query;
     const resolvedPath = await resolveAllowedPath(filePath);
+    let accessPath;
     let stats;
     try {
-      stats = await fs2.stat(resolvedPath);
+      accessPath = await resolveAllowedExistingPath(resolvedPath);
+      stats = await fs2.stat(accessPath);
     } catch (error) {
       if (error.code === "ENOENT") {
         return reply.code(404).send({ error: "File not found", path: resolvedPath });
@@ -2133,7 +2181,7 @@ async function fileRoutes(app) {
       try {
         return {
           path: resolvedPath,
-          content: await archivePreview(resolvedPath),
+          content: await archivePreview(accessPath),
           kind: "archive",
           mtime: stats.mtimeMs
         };
@@ -2165,24 +2213,52 @@ async function fileRoutes(app) {
         mtime: stats.mtimeMs
       });
     }
-    let content;
+    let handle;
     try {
-      content = await fs2.readFile(resolvedPath);
+      handle = await fs2.open(accessPath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+      const openedStats = await handle.stat();
+      if (openedStats.size > MAX_TEXT_FILE_BYTES) {
+        return reply.code(413).send({
+          error: "File is too large to open as text",
+          maxBytes: MAX_TEXT_FILE_BYTES,
+          path: resolvedPath
+        });
+      }
+      const chunks = [];
+      let totalBytes = 0;
+      while (true) {
+        const remainingBytes = MAX_TEXT_FILE_BYTES + 1 - totalBytes;
+        const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, remainingBytes));
+        const { bytesRead } = await handle.read(buffer, 0, buffer.byteLength, null);
+        if (bytesRead === 0) break;
+        totalBytes += bytesRead;
+        if (totalBytes > MAX_TEXT_FILE_BYTES) {
+          return reply.code(413).send({
+            error: "File is too large to open as text",
+            maxBytes: MAX_TEXT_FILE_BYTES,
+            path: resolvedPath
+          });
+        }
+        chunks.push(buffer.subarray(0, bytesRead));
+      }
+      const content = Buffer.concat(chunks, totalBytes);
+      if (isBinaryFile(resolvedPath, content)) {
+        return reply.code(415).send({
+          error: "Unsupported file type",
+          kind: "binary",
+          path: resolvedPath,
+          mtime: openedStats.mtimeMs
+        });
+      }
+      return { path: resolvedPath, content: content.toString("utf-8"), mtime: openedStats.mtimeMs };
     } catch (error) {
       if (error.code === "ENOENT") {
         return reply.code(404).send({ error: "File not found", path: resolvedPath });
       }
       throw error;
+    } finally {
+      await handle?.close();
     }
-    if (isBinaryFile(resolvedPath, content)) {
-      return reply.code(415).send({
-        error: "Unsupported file type",
-        kind: "binary",
-        path: resolvedPath,
-        mtime: stats.mtimeMs
-      });
-    }
-    return { path: resolvedPath, content: content.toString("utf-8"), mtime: stats.mtimeMs };
   });
   app.get("/preview-asset", async (req, reply) => {
     const { root, path: relativePath } = req.query;
@@ -2223,14 +2299,22 @@ async function fileRoutes(app) {
     if (!imageMimeType && !isPdf) {
       return reply.code(415).send({ error: "Unsupported file type" });
     }
-    if (isPdf) {
-      return reply.type("application/pdf").send(createReadStream2(resolvedPath));
-    }
-    const content = await fs2.readFile(resolvedPath);
-    if (imageMimeType === "image/svg+xml") {
-      reply.header("Content-Security-Policy", "sandbox; default-src 'none'");
+    let handle;
+    try {
+      const accessPath = await resolveAllowedExistingPath(resolvedPath);
+      handle = await fs2.open(accessPath, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+      const stream = handle.createReadStream();
+      handle = void 0;
+      if (isPdf) {
+        return reply.type("application/pdf").send(stream);
+      }
+      if (imageMimeType === "image/svg+xml") {
+        reply.header("Content-Security-Policy", "sandbox; default-src 'none'");
+      }
+      return reply.type(imageMimeType).send(stream);
+    } finally {
+      await handle?.close();
     }
-    return reply.type(imageMimeType).send(content);
   });
   app.post("/write", async (req) => {
     const { path: filePath, content } = req.body;
@@ -2384,11 +2468,45 @@ async function fileRoutes(app) {
     });
     return { success: true };
   });
-  app.get("/search", async (req) => {
+  app.get("/search", async (req, reply) => {
     const { pattern, path: searchPath } = req.query;
+    if (!pattern?.trim()) {
+      return reply.code(400).send({ error: "Search pattern is required" });
+    }
+    const normalizedPattern = pattern.replace(/\\/g, "/");
+    const patternSegments = normalizedPattern.split("/");
+    const unsafeMagic = ["{", "}", "[", "]"].some((character) => normalizedPattern.includes(character)) || /[?*+@!]\(/.test(normalizedPattern);
+    const unsafeDotSegment = patternSegments.some((segment) => segment === ".." || segment.includes(".") && /^[.*?]+$/.test(segment));
+    if (path3.isAbsolute(pattern) || unsafeMagic || unsafeDotSegment) {
+      return reply.code(400).send({ error: "Search pattern must stay within the requested path" });
+    }
     const resolvedSearchPath = await resolveAllowedPath(searchPath || ".");
-    const files = await glob(pattern, { cwd: resolvedSearchPath });
-    return { files };
+    const files = [];
+    const signal = AbortSignal.timeout(FILE_SEARCH_TIMEOUT_MS);
+    try {
+      for await (const file of globIterate(normalizedPattern, {
+        cwd: resolvedSearchPath,
+        root: resolvedSearchPath,
+        ignore: FILE_SEARCH_IGNORES,
+        nodir: true,
+        signal
+      })) {
+        const relativePath = path3.relative(resolvedSearchPath, path3.resolve(resolvedSearchPath, file));
+        if (relativePath.startsWith("..") || path3.isAbsolute(relativePath)) {
+          return reply.code(400).send({ error: "Search pattern must stay within the requested path" });
+        }
+        if (files.length === MAX_FILE_SEARCH_RESULTS) {
+          return { files, truncated: true };
+        }
+        files.push(file);
+      }
+    } catch (error) {
+      if (signal.aborted) {
+        return reply.code(408).send({ error: "File search timed out" });
+      }
+      throw error;
+    }
+    return { files, truncated: false };
   });
 }
 
@@ -2674,6 +2792,205 @@ async function changelogRoutes(app) {
   });
 }
 
+// src/services/speech-to-text.ts
+var DEFAULT_BASE_URL = "https://api.openai.com/v1";
+var DEFAULT_MODEL = "gpt-4o-mini-transcribe";
+var MAX_TRANSCRIPTION_ATTEMPTS = 3;
+var RETRY_DELAY_MS = 500;
+var MAX_AUDIO_BYTES = 25 * 1024 * 1024;
+function audioExtension(contentType) {
+  if (contentType.includes("amr")) return "amr";
+  if (contentType.includes("mp4")) return "m4a";
+  if (contentType.includes("mpeg")) return "mp3";
+  if (contentType.includes("ogg")) return "ogg";
+  if (contentType.includes("wav")) return "wav";
+  return "webm";
+}
+function isRetryableStatus(status) {
+  return status === 429 || status >= 500;
+}
+function wait(ms) {
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
+}
+function isSpeechToTextConfigured() {
+  return Boolean(process.env.PI_CLOUD_STT_API_KEY?.trim() || process.env.OPENAI_API_KEY?.trim());
+}
+async function transcribeAudio(audio, contentType, options = {}) {
+  const apiKey = process.env.PI_CLOUD_STT_API_KEY?.trim() || process.env.OPENAI_API_KEY?.trim();
+  if (!apiKey) throw new Error("Speech-to-text is not configured.");
+  const baseUrl = (process.env.PI_CLOUD_STT_BASE_URL?.trim() || DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const model = process.env.PI_CLOUD_STT_MODEL?.trim() || DEFAULT_MODEL;
+  const language = process.env.PI_CLOUD_STT_LANGUAGE?.trim();
+  const fetchImpl = options.fetch ?? fetch;
+  const retryDelayMs = options.retryDelayMs ?? RETRY_DELAY_MS;
+  const form = new FormData();
+  form.append("file", new Blob([audio], { type: contentType }), `recording.${audioExtension(contentType)}`);
+  form.append("model", model);
+  if (language) form.append("language", language);
+  for (let attempt = 1; attempt <= MAX_TRANSCRIPTION_ATTEMPTS; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}/audio/transcriptions`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${apiKey}` },
+        body: form
+      });
+    } catch (error) {
+      if (attempt === MAX_TRANSCRIPTION_ATTEMPTS) {
+        throw new Error("Unable to reach the speech-to-text provider.", { cause: error });
+      }
+      await wait(retryDelayMs * attempt);
+      continue;
+    }
+    const result = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      if (isRetryableStatus(response.status) && attempt < MAX_TRANSCRIPTION_ATTEMPTS) {
+        await wait(retryDelayMs * attempt);
+        continue;
+      }
+      throw new Error(typeof result.error?.message === "string" ? result.error.message : "Transcription failed.");
+    }
+    if (typeof result.text !== "string") throw new Error("The speech-to-text provider returned an invalid response.");
+    return result.text;
+  }
+  throw new Error("Unable to reach the speech-to-text provider.");
+}
+
+// src/services/text-to-speech.ts
+var DEFAULT_MODEL2 = "mlx-community/Kokoro-82M-bf16";
+var DEFAULT_VOICE = "af_heart";
+var DEFAULT_FORMAT = "wav";
+var MAX_SYNTHESIS_ATTEMPTS = 3;
+var RETRY_DELAY_MS2 = 500;
+var MAX_TTS_TEXT_LENGTH = 1e5;
+var FORMAT_CONTENT_TYPES = {
+  aac: "audio/aac",
+  flac: "audio/flac",
+  mp3: "audio/mpeg",
+  ogg: "audio/ogg",
+  opus: "audio/ogg",
+  pcm: "audio/L16",
+  wav: "audio/wav"
+};
+function isRetryableStatus2(status) {
+  return status === 429 || status >= 500;
+}
+function wait2(ms) {
+  return new Promise((resolve10) => setTimeout(resolve10, ms));
+}
+function languageCode(language) {
+  if (language === "zh") return "z";
+  if (language === "en") return "a";
+  return language;
+}
+async function providerError(response) {
+  const result = await response.json().catch(() => ({}));
+  if (typeof result.error?.message === "string") return result.error.message;
+  if (typeof result.detail === "string") return result.detail;
+  return "Speech synthesis failed.";
+}
+function isTextToSpeechConfigured() {
+  return Boolean(process.env.PI_CLOUD_TTS_BASE_URL?.trim());
+}
+async function synthesizeSpeech(text, options = {}) {
+  const baseUrl = process.env.PI_CLOUD_TTS_BASE_URL?.trim().replace(/\/+$/, "");
+  if (!baseUrl) throw new Error("Text-to-speech is not configured.");
+  const model = process.env.PI_CLOUD_TTS_MODEL?.trim() || DEFAULT_MODEL2;
+  const voice = process.env.PI_CLOUD_TTS_VOICE?.trim() || DEFAULT_VOICE;
+  const language = process.env.PI_CLOUD_TTS_LANGUAGE?.trim();
+  const format = process.env.PI_CLOUD_TTS_FORMAT?.trim().toLowerCase() || DEFAULT_FORMAT;
+  const apiKey = process.env.PI_CLOUD_TTS_API_KEY?.trim();
+  const fetchImpl = options.fetch ?? fetch;
+  const retryDelayMs = options.retryDelayMs ?? RETRY_DELAY_MS2;
+  const body = {
+    model,
+    input: text,
+    voice,
+    response_format: format,
+    ...language ? { language } : {},
+    ...language ? { lang_code: languageCode(language) } : {}
+  };
+  for (let attempt = 1; attempt <= MAX_SYNTHESIS_ATTEMPTS; attempt += 1) {
+    let response;
+    try {
+      response = await fetchImpl(`${baseUrl}/audio/speech`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+        },
+        body: JSON.stringify(body)
+      });
+    } catch (error) {
+      if (attempt === MAX_SYNTHESIS_ATTEMPTS) {
+        throw new Error("Unable to reach the text-to-speech provider.", { cause: error });
+      }
+      await wait2(retryDelayMs * attempt);
+      continue;
+    }
+    if (!response.ok) {
+      const message = await providerError(response);
+      if (isRetryableStatus2(response.status) && attempt < MAX_SYNTHESIS_ATTEMPTS) {
+        await wait2(retryDelayMs * attempt);
+        continue;
+      }
+      throw new Error(message);
+    }
+    const audio = Buffer.from(await response.arrayBuffer());
+    if (audio.length === 0) throw new Error("The text-to-speech provider returned an empty response.");
+    return {
+      audio,
+      contentType: response.headers.get("content-type")?.split(";")[0] || FORMAT_CONTENT_TYPES[format] || "application/octet-stream"
+    };
+  }
+  throw new Error("Unable to reach the text-to-speech provider.");
+}
+
+// src/routes/speech.ts
+async function speechRoutes(app, options = {}) {
+  app.addContentTypeParser(/^audio\//, { parseAs: "buffer", bodyLimit: MAX_AUDIO_BYTES }, (_req, body, done) => {
+    done(null, body);
+  });
+  app.get("/status", async () => ({
+    available: isSpeechToTextConfigured(),
+    ttsAvailable: isTextToSpeechConfigured()
+  }));
+  app.post("/transcribe", async (req, reply) => {
+    if (!isSpeechToTextConfigured()) {
+      return reply.status(503).send({ error: "Speech-to-text is not configured." });
+    }
+    const contentType = req.headers["content-type"]?.split(";")[0]?.trim().toLowerCase() || "";
+    if (!contentType.startsWith("audio/") || !Buffer.isBuffer(req.body) || req.body.length === 0) {
+      return reply.status(400).send({ error: "A non-empty audio request body is required." });
+    }
+    try {
+      return { text: await transcribeAudio(req.body, contentType, options) };
+    } catch (error) {
+      req.log.error({ err: error }, "Speech-to-text request failed");
+      return reply.status(502).send({ error: error instanceof Error ? error.message : "Transcription failed." });
+    }
+  });
+  app.post("/synthesize", async (req, reply) => {
+    if (!isTextToSpeechConfigured()) {
+      return reply.status(503).send({ error: "Text-to-speech is not configured." });
+    }
+    const text = req.body?.text;
+    if (typeof text !== "string" || !text.trim()) {
+      return reply.status(400).send({ error: "Non-empty text is required." });
+    }
+    if (text.length > MAX_TTS_TEXT_LENGTH) {
+      return reply.status(413).send({ error: `Text must not exceed ${MAX_TTS_TEXT_LENGTH} characters.` });
+    }
+    try {
+      const result = await synthesizeSpeech(text, options);
+      return reply.type(result.contentType).send(result.audio);
+    } catch (error) {
+      req.log.error({ err: error }, "Text-to-speech request failed");
+      return reply.status(502).send({ error: error instanceof Error ? error.message : "Speech synthesis failed." });
+    }
+  });
+}
+
 // src/routes/git.ts
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -2798,6 +3115,17 @@ async function runGit(cwd, args, maxBuffer3 = MAX_SLASH_COMMAND_OUTPUT_BYTES) {
     throw error;
   }
 }
+async function runGitNoIndex(cwd, args, maxBuffer3) {
+  try {
+    const { stdout } = await execFileAsync("git", ["diff", "--no-index", ...args], { cwd, maxBuffer: maxBuffer3 });
+    return stdout;
+  } catch (error) {
+    if (isMaxBufferError(error)) throw new OversizedGitOutputError();
+    const result = error;
+    if (result.code === 1) return result.stdout || "";
+    throw error;
+  }
+}
 async function isGitRepository(cwd) {
   try {
     return (await runGit(cwd, ["rev-parse", "--is-inside-work-tree"])).trim() === "true";
@@ -2880,6 +3208,20 @@ function textFromAssistantMessage(message) {
 function joinGitOutput(...parts) {
   return parts.map((part) => part.replace(/^(?:\r?\n)+|(?:\r?\n)+$/g, "")).filter((part) => part.trim()).join("\n\n");
 }
+async function appendUntrackedDiff(cwd, diff, args, path13, maxBytes) {
+  const pathArgs = path13 ? ["--", path13] : [];
+  const untracked = await runGit(cwd, ["ls-files", "--others", "--exclude-standard", "-z", ...pathArgs]);
+  const files = untracked.split("\0").filter(Boolean);
+  let output = diff;
+  for (const file of files) {
+    const separatorBytes = output.trim() ? 2 : 0;
+    const remainingBytes = maxBytes - Buffer.byteLength(output) - separatorBytes;
+    if (remainingBytes <= 0) throw new OversizedGitOutputError();
+    const fileDiff = await runGitNoIndex(cwd, [...args, "--", "/dev/null", file], remainingBytes);
+    output = joinGitOutput(output, fileDiff);
+  }
+  return output;
+}
 async function getCombinedDiff(cwd, args, maxBytes = MAX_SLASH_COMMAND_OUTPUT_BYTES) {
   const unstaged = await runGit(cwd, ["diff", ...args], maxBytes);
   const remainingBytes = maxBytes - Buffer.byteLength(unstaged);
@@ -3382,22 +3724,28 @@ async function gitRoutes(app, options = {}) {
     }
   });
   app.get("/diff", async (req, reply) => {
-    const { cwd, scope: rawScope, commit: rawCommit, path: path13 } = req.query;
+    const { cwd, scope: rawScope, commit: rawCommit, path: path13, includeUntracked } = req.query;
     const resolvedCwd = await resolveGitCwd(cwd);
     try {
       const commit = rawCommit ? parseCommit(rawCommit) : void 0;
       if (commit) {
         const diff2 = await runGit(resolvedCwd, ["show", "--format=", "--patch", commit]);
         const remainingBytes2 = MAX_SLASH_COMMAND_OUTPUT_BYTES - Buffer.byteLength(diff2);
-        const stat9 = remainingBytes2 > 0 ? await runGit(resolvedCwd, ["show", "--format=", "--stat", commit], remainingBytes2) : "";
-        return { cwd: resolvedCwd, scope: `commit-${commit}`, commit, stat: stat9, diff: diff2 };
+        const stat10 = remainingBytes2 > 0 ? await runGit(resolvedCwd, ["show", "--format=", "--stat", commit], remainingBytes2) : "";
+        return { cwd: resolvedCwd, scope: `commit-${commit}`, commit, stat: stat10, diff: diff2 };
       }
       const scope = parseDiffScope(rawScope);
       const pathArgs = path13 ? ["--", path13] : [];
-      const diff = await getDiff(resolvedCwd, pathArgs, scope);
+      let diff = await getDiff(resolvedCwd, pathArgs, scope);
+      if (includeUntracked === "true" && scope !== "staged") {
+        diff = await appendUntrackedDiff(resolvedCwd, diff, [], path13, MAX_SLASH_COMMAND_OUTPUT_BYTES);
+      }
       const remainingBytes = MAX_SLASH_COMMAND_OUTPUT_BYTES - Buffer.byteLength(diff);
-      const stat8 = remainingBytes > 0 ? await getDiff(resolvedCwd, ["--stat", ...pathArgs], scope, remainingBytes) : "";
-      return { cwd: resolvedCwd, scope, path: path13, stat: stat8, diff };
+      let stat9 = remainingBytes > 0 ? await getDiff(resolvedCwd, ["--stat", ...pathArgs], scope, remainingBytes) : "";
+      if (includeUntracked === "true" && scope !== "staged" && remainingBytes > 0) {
+        stat9 = await appendUntrackedDiff(resolvedCwd, stat9, ["--stat"], path13, remainingBytes);
+      }
+      return { cwd: resolvedCwd, scope, path: path13, stat: stat9, diff };
     } catch (error) {
       if (error instanceof OversizedGitOutputError) {
         return {
@@ -3914,6 +4262,65 @@ function sendGatewayError(reply, error) {
   return reply.status(400).send({ error: message });
 }
 
+// src/routes/wecom-gateway.ts
+async function wecomGatewayRoutes(app, options) {
+  app.addContentTypeParser(["application/xml", "text/xml"], { parseAs: "string" }, (_req, body, done) => done(null, body));
+  app.get("/callback", async (req, reply) => {
+    try {
+      const challenge = options.service.handleVerification(req.query);
+      return reply.type("text/plain; charset=utf-8").send(challenge);
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+  app.post("/callback", async (req, reply) => {
+    try {
+      const acknowledgement = options.service.handleCallback(
+        req.query,
+        typeof req.body === "string" ? req.body : ""
+      );
+      return reply.type("text/plain; charset=utf-8").send(acknowledgement);
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+  app.get("/status", async () => ({ status: options.service.status() }));
+  app.put("/configuration", async (req, reply) => {
+    try {
+      return options.service.saveConfiguration(req.body);
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+  app.delete("/configuration", async (_req, reply) => {
+    try {
+      options.service.disconnect();
+      return { status: options.service.status() };
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+  app.post("/callback-secrets", async (_req, reply) => {
+    try {
+      return options.service.regenerateCallbackSecrets();
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+  app.post("/test", async (_req, reply) => {
+    try {
+      return { status: await options.service.testConnection() };
+    } catch (error) {
+      return sendWecomError(reply, error);
+    }
+  });
+}
+function sendWecomError(reply, error) {
+  const statusCode = Number(error?.statusCode) || 400;
+  const message = error instanceof Error ? error.message : "WeCom gateway request failed";
+  return reply.status(statusCode).send({ error: message });
+}
+
 // src/routes/git-hosting.ts
 import { execFile as execFile2 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
@@ -4742,7 +5149,8 @@ async function authRoutes(app, options) {
       autoExtractMemory: getPreferenceValue("memory.autoExtract") === "true",
       theme: getTheme(),
       language: getLanguage(),
-      soundNotification: getSoundNotification()
+      soundNotification: getSoundNotification(),
+      autoSpeakAssistant: getPreferenceValue("ui.autoSpeakAssistant") === "true"
     };
   }
   function requireAuth(req, reply) {
@@ -4855,8 +5263,9 @@ async function authRoutes(app, options) {
     const hasTheme = hasPreference(body, "theme");
     const hasLanguage = hasPreference(body, "language");
     const hasSoundNotification = hasPreference(body, "soundNotification");
+    const hasAutoSpeakAssistant = hasPreference(body, "autoSpeakAssistant");
     const hasGitCloneParentPath = hasPreference(body, "gitCloneParentPath");
-    if (!hasShowHintInfo && !hasShowCodeBlockLanguageHeaders && !hasStreamingMessageBehavior && !hasEditorAutoRefresh && !hasConfirmSessionDelete && !hasNewSessionShortcut && !hasFullscreenShortcut && !hasShowGoToTopButton && !hasShowChatViewOptionsButton && !hasAutoExtractMemory && !hasTheme && !hasLanguage && !hasSoundNotification && !hasGitCloneParentPath) {
+    if (!hasShowHintInfo && !hasShowCodeBlockLanguageHeaders && !hasStreamingMessageBehavior && !hasEditorAutoRefresh && !hasConfirmSessionDelete && !hasNewSessionShortcut && !hasFullscreenShortcut && !hasShowGoToTopButton && !hasShowChatViewOptionsButton && !hasAutoExtractMemory && !hasTheme && !hasLanguage && !hasSoundNotification && !hasAutoSpeakAssistant && !hasGitCloneParentPath) {
       return reply.status(400).send({ error: "At least one preference must be provided" });
     }
     if (hasShowHintInfo && typeof body.showHintInfo !== "boolean") {
@@ -4898,6 +5307,9 @@ async function authRoutes(app, options) {
     if (hasSoundNotification && body.soundNotification !== "off" && body.soundNotification !== "beep" && body.soundNotification !== "chime" && body.soundNotification !== "ding") {
       return reply.status(400).send({ error: "soundNotification must be off, beep, chime, or ding" });
     }
+    if (hasAutoSpeakAssistant && typeof body.autoSpeakAssistant !== "boolean") {
+      return reply.status(400).send({ error: "autoSpeakAssistant must be a boolean" });
+    }
     if (hasGitCloneParentPath && (typeof body.gitCloneParentPath !== "string" || !body.gitCloneParentPath.trim())) {
       return reply.status(400).send({ error: "gitCloneParentPath must be a non-empty string" });
     }
@@ -4914,6 +5326,7 @@ async function authRoutes(app, options) {
     if (hasTheme) setPreferenceValue("ui.theme", String(body.theme));
     if (hasLanguage) setPreferenceValue("ui.language", String(body.language));
     if (hasSoundNotification) setPreferenceValue("ui.soundNotification", String(body.soundNotification));
+    if (hasAutoSpeakAssistant) setPreferenceValue("ui.autoSpeakAssistant", String(body.autoSpeakAssistant));
     if (hasGitCloneParentPath) setPreferenceValue("ui.gitCloneParentPath", String(body.gitCloneParentPath).trim());
     return getPreferences();
   });
@@ -6081,11 +6494,52 @@ var projectHistorySchemaMigration = {
   }
 };
 
+// src/db/migrations/004-wecom-gateway-schema.ts
+var wecomGatewaySchemaMigration = {
+  version: 4,
+  name: "wecom-gateway-schema",
+  up(db) {
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS wecom_gateway_credentials (
+        id INTEGER PRIMARY KEY CHECK (id = 1),
+        corp_id TEXT NOT NULL,
+        corp_secret TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        callback_token TEXT NOT NULL,
+        encoding_aes_key TEXT NOT NULL,
+        allowed_users_json TEXT NOT NULL DEFAULT '[]',
+        callback_verified_at TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS wecom_gateway_sessions (
+        session_key TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        pi_session_id TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+
+      CREATE TABLE IF NOT EXISTS wecom_gateway_configs (
+        client_id TEXT PRIMARY KEY,
+        agent_profile TEXT,
+        default_cwd TEXT,
+        skill_mode TEXT,
+        skill_preset_id TEXT,
+        created_at TEXT NOT NULL,
+        updated_at TEXT NOT NULL
+      );
+    `);
+  }
+};
+
 // src/db/migrations/index.ts
 var migrations = [
   applicationSchemaMigration,
   gatewaySchemaMigration,
-  projectHistorySchemaMigration
+  projectHistorySchemaMigration,
+  wecomGatewaySchemaMigration
 ];
 function runDatabaseMigrations(db) {
   db.exec(`
@@ -11431,7 +11885,7 @@ function createMemoryRuntime(options) {
 
 // src/services/worktree-manager.ts
 import { execFile as execFileCallback } from "child_process";
-import { copyFile, mkdir as mkdir5, readdir as readdir4 } from "fs/promises";
+import { copyFile, mkdir as mkdir5, readdir as readdir3 } from "fs/promises";
 import { basename as basename5, dirname as dirname8, isAbsolute as isAbsolute3, join as join13 } from "path";
 import { promisify as promisify4 } from "util";
 var defaultExecFile = promisify4(execFileCallback);
@@ -11460,7 +11914,7 @@ var WorktreeManager = class {
     const baseRepoPath = await this.getRepoRoot(projectPath).catch(() => void 0);
     if (!baseRepoPath) return [];
     const files = [];
-    const entries = await readdir4(baseRepoPath, { withFileTypes: true });
+    const entries = await readdir3(baseRepoPath, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isFile() || !this.isRootFileName(entry.name)) continue;
       if (await this.isIgnored(baseRepoPath, entry.name)) files.push(entry.name);
@@ -12562,9 +13016,9 @@ var FeishuGatewayService = class {
       console.warn("[feishu-gateway] failed to decrypt encrypted callback payload", {
         reason: error instanceof Error ? error.message : "unknown error"
       });
-      const gatewayError = new Error("Invalid Feishu encrypted callback payload");
-      gatewayError.statusCode = 400;
-      throw gatewayError;
+      const gatewayError2 = new Error("Invalid Feishu encrypted callback payload");
+      gatewayError2.statusCode = 400;
+      throw gatewayError2;
     }
   }
   verifyToken(payload, config) {
@@ -14077,6 +14531,704 @@ function extractLastAssistantText2(messages) {
   return void 0;
 }
 
+// src/services/wecom-gateway.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { stat as stat8 } from "node:fs/promises";
+import { isAbsolute as isAbsolute6 } from "node:path";
+
+// src/services/wecom-crypto.ts
+import { createDecipheriv as createDecipheriv3, createHash as createHash8, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+function verifyWecomSignature(input) {
+  const expected = createHash8("sha1").update([input.token, input.timestamp, input.nonce, input.encrypted].sort().join("")).digest();
+  if (!/^[0-9a-f]{40}$/i.test(input.signature)) return false;
+  const actual = Buffer.from(input.signature, "hex");
+  return timingSafeEqual2(expected, actual);
+}
+function decryptWecomPayload(encrypted, encodingAesKey, expectedReceiveId) {
+  const key = parseEncodingAesKey(encodingAesKey);
+  const ciphertext = Buffer.from(encrypted, "base64");
+  if (!ciphertext.length || ciphertext.length % 16 !== 0) throw new Error("Invalid WeCom encrypted payload");
+  const decipher = createDecipheriv3("aes-256-cbc", key, key.subarray(0, 16));
+  decipher.setAutoPadding(false);
+  const padded = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  const plaintext = removePkcs7Padding(padded);
+  if (plaintext.length < 20) throw new Error("Invalid WeCom decrypted payload");
+  const messageLength = plaintext.readUInt32BE(16);
+  const messageStart = 20;
+  const messageEnd = messageStart + messageLength;
+  if (messageEnd > plaintext.length) throw new Error("Invalid WeCom message length");
+  const receiveId = plaintext.subarray(messageEnd).toString("utf8");
+  if (receiveId !== expectedReceiveId) throw new Error("Invalid WeCom callback receive ID");
+  return plaintext.subarray(messageStart, messageEnd).toString("utf8");
+}
+function parseEncodingAesKey(value) {
+  if (!/^[A-Za-z0-9]{43}$/.test(value)) throw new Error("WeCom EncodingAESKey must contain 43 letters or digits");
+  const key = Buffer.from(`${value}=`, "base64");
+  if (key.length !== 32) throw new Error("Invalid WeCom EncodingAESKey");
+  return key;
+}
+function removePkcs7Padding(value) {
+  const padding = value[value.length - 1];
+  if (!padding || padding > 32 || padding > value.length) throw new Error("Invalid WeCom PKCS#7 padding");
+  for (let index = value.length - padding; index < value.length; index += 1) {
+    if (value[index] !== padding) throw new Error("Invalid WeCom PKCS#7 padding");
+  }
+  return value.subarray(0, value.length - padding);
+}
+
+// src/services/wecom-gateway.ts
+var WECOM_API_BASE_URL = "https://qyapi.weixin.qq.com";
+var TOKEN_REFRESH_SKEW_MS2 = 5 * 60 * 1e3;
+var DEDUP_TTL_MS3 = 5 * 60 * 1e3;
+var TEXT_CHUNK_MAX_BYTES = 1900;
+function generateEncodingAesKey() {
+  while (true) {
+    const key = randomBytes3(32).toString("base64").slice(0, 43);
+    if (/^[A-Za-z0-9]+$/.test(key)) return key;
+  }
+}
+var WecomGatewayService = class {
+  constructor(db, gatewaySettings, sessionService) {
+    this.db = db;
+    this.sessionService = sessionService;
+    this.gatewaySettings = gatewaySettings || new GatewaySettingsStore(db);
+    this.presetStore = new SkillPresetStore(db);
+  }
+  db;
+  sessionService;
+  gatewaySettings;
+  presetStore;
+  seen = /* @__PURE__ */ new Map();
+  queues = /* @__PURE__ */ new Map();
+  tokenCache;
+  environmentCallbackVerified = false;
+  status() {
+    const config = this.loadConfig();
+    const managedBy = this.isEnvironmentManaged() ? "environment" : this.loadSavedCredentials() ? "database" : "none";
+    return {
+      configured: Boolean(config.corpId && config.corpSecret && config.agentId && config.callbackToken && config.encodingAesKey),
+      managedBy,
+      ...config.corpId ? { corpId: config.corpId } : {},
+      ...config.agentId ? { agentId: config.agentId } : {},
+      allowedUsers: config.allowedUsers,
+      callbackVerified: managedBy === "database" ? Boolean(this.loadSavedCredentials()?.callbackVerified) : this.environmentCallbackVerified
+    };
+  }
+  saveConfiguration(input) {
+    if (this.isEnvironmentManaged()) throw new Error("WeCom credentials are managed by environment variables");
+    const corpId = input.corpId.trim();
+    const corpSecret = input.corpSecret.trim();
+    const agentId = input.agentId.trim();
+    if (!corpId || !corpSecret || !/^\d+$/.test(agentId)) throw new Error("Corp ID, app secret, and a numeric Agent ID are required");
+    const allowedUsers = normalizeList(input.allowedUsers);
+    const existing = this.loadSavedCredentials();
+    const callbackToken = existing?.callbackToken || randomBytes3(16).toString("hex");
+    const encodingAesKey = existing?.encodingAesKey || generateEncodingAesKey();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.prepare(`
+      INSERT INTO wecom_gateway_credentials (
+        id, corp_id, corp_secret, agent_id, callback_token, encoding_aes_key,
+        allowed_users_json, callback_verified_at, created_at, updated_at
+      ) VALUES (1, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        corp_id = excluded.corp_id,
+        corp_secret = excluded.corp_secret,
+        agent_id = excluded.agent_id,
+        callback_token = excluded.callback_token,
+        encoding_aes_key = excluded.encoding_aes_key,
+        allowed_users_json = excluded.allowed_users_json,
+        callback_verified_at = NULL,
+        updated_at = excluded.updated_at
+    `).run(corpId, corpSecret, agentId, callbackToken, encodingAesKey, JSON.stringify(allowedUsers), now, now);
+    this.tokenCache = void 0;
+    return { status: this.status(), callbackToken, encodingAesKey };
+  }
+  regenerateCallbackSecrets() {
+    if (this.isEnvironmentManaged()) throw new Error("WeCom credentials are managed by environment variables");
+    const saved = this.loadSavedCredentials();
+    if (!saved) throw new Error("Save the WeCom configuration first");
+    const callbackToken = randomBytes3(16).toString("hex");
+    const encodingAesKey = generateEncodingAesKey();
+    this.db.prepare(`
+      UPDATE wecom_gateway_credentials
+      SET callback_token = ?, encoding_aes_key = ?, callback_verified_at = NULL, updated_at = ?
+      WHERE id = 1
+    `).run(callbackToken, encodingAesKey, (/* @__PURE__ */ new Date()).toISOString());
+    return { status: this.status(), callbackToken, encodingAesKey };
+  }
+  disconnect() {
+    if (this.isEnvironmentManaged()) throw new Error("WeCom credentials are managed by environment variables");
+    const clients = this.db.prepare("SELECT client_id FROM wecom_gateway_sessions").all();
+    for (const { client_id: clientId } of clients) this.sessionService.disposeSession(clientId);
+    this.db.exec("DELETE FROM wecom_gateway_sessions; DELETE FROM wecom_gateway_configs; DELETE FROM wecom_gateway_credentials;");
+    this.tokenCache = void 0;
+  }
+  async testConnection() {
+    const config = this.requireConfig();
+    this.tokenCache = void 0;
+    await this.getAccessToken(config);
+    return this.status();
+  }
+  handleVerification(query) {
+    const config = this.requireConfig();
+    const encrypted = stringValue3(query.echostr);
+    this.verifySignature(query, encrypted, config);
+    const challenge = decryptWecomPayload(encrypted, config.encodingAesKey, config.corpId);
+    this.markCallbackVerified();
+    return challenge;
+  }
+  handleCallback(query, body) {
+    const config = this.requireConfig();
+    const encrypted = xmlValue(body, "Encrypt");
+    if (!encrypted) throw gatewayError("Invalid WeCom callback envelope", 400);
+    this.verifySignature(query, encrypted, config);
+    const message = parseWecomMessage(decryptWecomPayload(encrypted, config.encodingAesKey, config.corpId));
+    this.markCallbackVerified();
+    if (!message || message.agentId !== config.agentId) return "success";
+    if (config.allowedUsers.length && !config.allowedUsers.includes(message.userId)) return "success";
+    if (this.markDuplicate(message.messageId)) return "success";
+    if (!["text", "image", "voice"].includes(message.messageType)) {
+      void this.sendReply(config, message.userId, "This WeCom gateway supports text, image, and voice messages only.").catch((error) => {
+        console.warn("[wecom-gateway] unsupported-message reply failed:", error instanceof Error ? error.message : error);
+      });
+      return "success";
+    }
+    this.enqueue({
+      messageId: message.messageId,
+      userId: message.userId,
+      text: message.text,
+      messageType: message.messageType,
+      mediaId: message.mediaId,
+      picUrl: message.picUrl
+    }, config);
+    return "success";
+  }
+  verifySignature(query, encrypted, config) {
+    const valid = encrypted && verifyWecomSignature({
+      token: config.callbackToken,
+      timestamp: stringValue3(query.timestamp),
+      nonce: stringValue3(query.nonce),
+      encrypted,
+      signature: stringValue3(query.msg_signature)
+    });
+    if (!valid) throw gatewayError("Invalid WeCom callback signature", 401);
+  }
+  requireConfig() {
+    const config = this.loadConfig();
+    if (!config.corpId || !config.corpSecret || !config.agentId || !config.callbackToken || !config.encodingAesKey) {
+      throw gatewayError("WeCom gateway is not configured", 503);
+    }
+    return config;
+  }
+  loadConfig() {
+    const gatewaySettings = this.gatewaySettings.get();
+    const saved = this.loadSavedCredentials();
+    const skillset = this.resolveSkillsetConfig(gatewaySettings.defaultSkillset);
+    return {
+      corpId: process.env.PI_CLOUD_WECOM_CORP_ID?.trim() || saved?.corpId || "",
+      corpSecret: process.env.PI_CLOUD_WECOM_CORP_SECRET?.trim() || saved?.corpSecret || "",
+      agentId: process.env.PI_CLOUD_WECOM_AGENT_ID?.trim() || saved?.agentId || "",
+      callbackToken: process.env.PI_CLOUD_WECOM_CALLBACK_TOKEN?.trim() || saved?.callbackToken || "",
+      encodingAesKey: process.env.PI_CLOUD_WECOM_ENCODING_AES_KEY?.trim() || saved?.encodingAesKey || "",
+      allowedUsers: process.env.PI_CLOUD_WECOM_ALLOWED_USERS !== void 0 ? parseList2(process.env.PI_CLOUD_WECOM_ALLOWED_USERS) : saved?.allowedUsers || [],
+      defaultCwd: gatewaySettings.cwds[0],
+      cwdChoices: gatewaySettings.cwds,
+      agentProfile: gatewaySettings.defaultProfile,
+      modelProvider: gatewaySettings.defaultModelProvider,
+      modelId: gatewaySettings.defaultModelId,
+      ...skillset
+    };
+  }
+  isEnvironmentManaged() {
+    return [
+      "PI_CLOUD_WECOM_CORP_ID",
+      "PI_CLOUD_WECOM_CORP_SECRET",
+      "PI_CLOUD_WECOM_AGENT_ID",
+      "PI_CLOUD_WECOM_CALLBACK_TOKEN",
+      "PI_CLOUD_WECOM_ENCODING_AES_KEY"
+    ].some((key) => Boolean(process.env[key]?.trim()));
+  }
+  loadSavedCredentials() {
+    const row = this.db.prepare(`
+      SELECT corp_id, corp_secret, agent_id, callback_token, encoding_aes_key,
+             allowed_users_json, callback_verified_at
+      FROM wecom_gateway_credentials WHERE id = 1
+    `).get();
+    if (!row) return null;
+    let allowedUsers = [];
+    try {
+      allowedUsers = normalizeList(JSON.parse(row.allowed_users_json));
+    } catch {
+    }
+    return {
+      corpId: row.corp_id,
+      corpSecret: row.corp_secret,
+      agentId: row.agent_id,
+      callbackToken: row.callback_token,
+      encodingAesKey: row.encoding_aes_key,
+      allowedUsers,
+      callbackVerified: Boolean(row.callback_verified_at)
+    };
+  }
+  markCallbackVerified() {
+    if (this.isEnvironmentManaged()) {
+      this.environmentCallbackVerified = true;
+      return;
+    }
+    this.db.prepare("UPDATE wecom_gateway_credentials SET callback_verified_at = ?, updated_at = ? WHERE id = 1").run((/* @__PURE__ */ new Date()).toISOString(), (/* @__PURE__ */ new Date()).toISOString());
+  }
+  markDuplicate(id) {
+    const now = Date.now();
+    for (const [key, expiresAt] of this.seen) {
+      if (expiresAt <= now) this.seen.delete(key);
+    }
+    if (this.seen.has(id)) return true;
+    this.seen.set(id, now + DEDUP_TTL_MS3);
+    return false;
+  }
+  enqueue(message, config) {
+    const clientId = `wecom:dm:${message.userId}`;
+    const previous = this.queues.get(clientId) || Promise.resolve();
+    const next = previous.catch(() => void 0).then(() => this.processMessage(clientId, message, config)).catch((error) => console.error("[wecom-gateway] message handling failed:", error)).finally(() => {
+      if (this.queues.get(clientId) === next) this.queues.delete(clientId);
+    });
+    this.queues.set(clientId, next);
+  }
+  async processMessage(clientId, message, config) {
+    const effectiveConfig = this.resolveChatConfig(clientId, config);
+    if (await this.handleCommand(clientId, message, config, effectiveConfig)) return;
+    if (!effectiveConfig.defaultCwd) {
+      await this.sendReply(config, message.userId, "No gateway folders configured. Add at least one allowed folder in Web UI Settings > Gateway.");
+      return;
+    }
+    let promptText = message.text;
+    if (message.messageType === "voice") {
+      if (!message.mediaId) {
+        await this.sendReply(config, message.userId, "The WeCom voice message did not include downloadable media. Try sending it again.");
+        return;
+      }
+      try {
+        promptText = (await transcribeAudio(await this.downloadVoice(config, message.mediaId), "audio/amr")).trim();
+      } catch (error) {
+        console.warn("[wecom-gateway] failed to transcribe inbound voice:", error instanceof Error ? error.message : error);
+        await this.sendReply(config, message.userId, "The voice message could not be transcribed. Check the speech-to-text configuration and try again.");
+        return;
+      }
+      if (!promptText) {
+        await this.sendReply(config, message.userId, "The voice message did not contain recognizable speech. Try sending it again.");
+        return;
+      }
+    }
+    const session = await this.ensureSession(clientId, effectiveConfig);
+    let images = [];
+    if (message.messageType === "image") {
+      if (!message.mediaId) {
+        await this.sendReply(config, message.userId, "The WeCom image message did not include downloadable media. Try sending it again.");
+        return;
+      }
+      try {
+        images = [await this.downloadImage(config, message.mediaId)];
+      } catch (error) {
+        console.warn("[wecom-gateway] failed to download inbound image:", error instanceof Error ? error.message : error);
+        await this.sendReply(config, message.userId, "The image could not be downloaded from WeCom. Try sending it again.");
+        return;
+      }
+    }
+    const imageResult = validateImages(images, session.model);
+    if (!imageResult.ok) {
+      await this.sendReply(config, message.userId, imageResult.message);
+      return;
+    }
+    promptText ||= imageResult.images.length ? "Please analyze the attached image." : "";
+    const chunks = [];
+    const unsubscribe = session.subscribe((event) => {
+      const update = event?.type === "message_update" ? event.assistantMessageEvent : void 0;
+      if (update?.type === "text_delta" && typeof update.delta === "string") chunks.push(update.delta);
+    });
+    try {
+      await this.sessionService.runForegroundWithClientProfileProxy(clientId, () => session.prompt(promptText, imageResult.images.length ? { images: imageResult.images } : void 0));
+    } finally {
+      unsubscribe();
+    }
+    const response = chunks.join("").trim() || extractLastAssistantText3(session.messages) || "(Pi finished without a text response.)";
+    await this.sendReply(config, message.userId, response);
+  }
+  async ensureSession(clientId, config) {
+    await this.sessionService.setClientAgentProfile(clientId, config.agentProfile || "default");
+    const active = this.sessionService.getSession(clientId);
+    if (active) return active;
+    const mapped = this.db.prepare("SELECT pi_session_id FROM wecom_gateway_sessions WHERE client_id = ?").get(clientId);
+    if (mapped) {
+      const persisted = await this.sessionService.findPersistedSession(clientId, mapped.pi_session_id);
+      if (persisted) return this.sessionService.resumeSession(clientId, persisted.path);
+    }
+    const preset = config.skillPresetId ? this.presetStore.getById(config.skillPresetId) : null;
+    const result = await this.sessionService.createSession(clientId, {
+      cwd: config.defaultCwd,
+      modelProvider: config.modelProvider,
+      modelId: config.modelId,
+      enabledSkills: preset?.mode === "enabled" ? preset.skills : void 0,
+      disabledSkills: preset?.mode === "disabled" ? preset.skills : void 0,
+      presetId: preset?.id,
+      skillMode: preset?.mode || config.skillMode || "all"
+    });
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.prepare(`
+      INSERT INTO wecom_gateway_sessions (session_key, client_id, pi_session_id, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(session_key) DO UPDATE SET pi_session_id = excluded.pi_session_id, updated_at = excluded.updated_at
+    `).run(clientId, clientId, result.session.sessionId, now, now);
+    return result.session;
+  }
+  async handleCommand(clientId, message, baseConfig, effectiveConfig) {
+    const commandText = normalizeGatewayCommandText(message.text);
+    const [command = "", ...args] = commandText.split(/\s+/);
+    const normalized = command.toLowerCase();
+    if (!normalized.startsWith("/")) return false;
+    try {
+      if (normalized === "/new" || normalized === "/reset") {
+        this.resetSession(clientId);
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, this.resolveChatConfig(clientId, baseConfig), "Reset this WeCom chat. A fresh Pi session will start with your next message."));
+        return true;
+      }
+      if (normalized === "/help") {
+        await this.sendReply(baseConfig, message.userId, this.formatHelp());
+        return true;
+      }
+      if (normalized === "/status") {
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, effectiveConfig));
+        return true;
+      }
+      if (normalized === "/profiles") {
+        const profiles = await this.sessionService.listAgentProfiles();
+        await this.sendReply(baseConfig, message.userId, ["Available profiles:", ...profiles.map((profile) => `${profile.id === (effectiveConfig.agentProfile || "default") ? "*" : " "} ${profile.id}`)].join("\n"));
+        return true;
+      }
+      if (normalized === "/profile" || normalized === "/use-profile" || normalized === "/set-profile") {
+        const profile = args[0]?.trim();
+        if (!profile) throw new Error("Usage: /profile <profile-id>");
+        const profiles = await this.sessionService.listAgentProfiles();
+        if (!profiles.some((item) => item.id === profile)) throw new Error(`Unknown profile: ${profile}`);
+        this.saveChatConfig(clientId, { agentProfile: profile });
+        this.resetSession(clientId);
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, this.resolveChatConfig(clientId, baseConfig), "Profile updated."));
+        return true;
+      }
+      if (normalized === "/cwds" || normalized === "/pwds") {
+        await this.sendReply(baseConfig, message.userId, baseConfig.cwdChoices.length ? baseConfig.cwdChoices.map((cwd, index) => `${index + 1}: ${cwd}`).join("\n") : "No gateway folders configured.");
+        return true;
+      }
+      if (normalized === "/cwd") {
+        const slot = Number(args[0]);
+        if (!Number.isInteger(slot) || slot < 1 || slot > baseConfig.cwdChoices.length) throw new Error(`Usage: /cwd <1-${baseConfig.cwdChoices.length}>`);
+        const target = baseConfig.cwdChoices[slot - 1];
+        if (!isAbsolute6(target) || !(await stat8(target)).isDirectory()) throw new Error(`Configured CWD ${slot} must be an existing absolute directory`);
+        this.saveChatConfig(clientId, { defaultCwd: target });
+        this.resetSession(clientId);
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, this.resolveChatConfig(clientId, baseConfig), "Working directory updated."));
+        return true;
+      }
+      if (normalized === "/skillsets") {
+        await this.sendReply(baseConfig, message.userId, this.formatSkillsets(effectiveConfig.skillPresetId));
+        return true;
+      }
+      if (normalized === "/skillset") {
+        const selected = args.join(" ").trim();
+        if (!selected) throw new Error("Usage: /skillset <all|preset-name>");
+        this.saveChatConfig(clientId, this.resolveSkillsetConfig(selected, true));
+        this.resetSession(clientId);
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, this.resolveChatConfig(clientId, baseConfig), "Skillset updated."));
+        return true;
+      }
+      if (normalized === "/clear-config") {
+        this.db.prepare("DELETE FROM wecom_gateway_configs WHERE client_id = ?").run(clientId);
+        this.resetSession(clientId);
+        await this.sendReply(baseConfig, message.userId, await this.formatStatus(clientId, this.resolveChatConfig(clientId, baseConfig), "WeCom chat config cleared."));
+        return true;
+      }
+    } catch (error) {
+      await this.sendReply(baseConfig, message.userId, `Command failed: ${error instanceof Error ? error.message : "unknown error"}
+
+${this.formatHelp()}`);
+      return true;
+    }
+    await this.sendReply(baseConfig, message.userId, `Unknown command: ${command}
+
+${this.formatHelp()}`);
+    return true;
+  }
+  resolveChatConfig(clientId, base) {
+    const chat = this.loadChatConfig(clientId);
+    const useBaseModel = !chat.agentProfile || chat.agentProfile === base.agentProfile;
+    return {
+      ...base,
+      agentProfile: chat.agentProfile || base.agentProfile,
+      defaultCwd: chat.defaultCwd && base.cwdChoices.includes(chat.defaultCwd) ? chat.defaultCwd : base.defaultCwd,
+      modelProvider: useBaseModel ? base.modelProvider : void 0,
+      modelId: useBaseModel ? base.modelId : void 0,
+      skillMode: chat.skillMode || base.skillMode,
+      skillPresetId: chat.skillMode ? chat.skillPresetId : base.skillPresetId
+    };
+  }
+  loadChatConfig(clientId) {
+    const row = this.db.prepare("SELECT agent_profile, default_cwd, skill_mode, skill_preset_id FROM wecom_gateway_configs WHERE client_id = ?").get(clientId);
+    return row ? {
+      agentProfile: row.agent_profile || void 0,
+      defaultCwd: row.default_cwd || void 0,
+      skillMode: row.skill_mode || void 0,
+      skillPresetId: row.skill_preset_id
+    } : {};
+  }
+  saveChatConfig(clientId, patch) {
+    const next = { ...this.loadChatConfig(clientId), ...patch };
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.prepare(`
+      INSERT INTO wecom_gateway_configs (client_id, agent_profile, default_cwd, skill_mode, skill_preset_id, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(client_id) DO UPDATE SET
+        agent_profile = excluded.agent_profile,
+        default_cwd = excluded.default_cwd,
+        skill_mode = excluded.skill_mode,
+        skill_preset_id = excluded.skill_preset_id,
+        updated_at = excluded.updated_at
+    `).run(clientId, next.agentProfile || null, next.defaultCwd || null, next.skillMode || null, next.skillPresetId || null, now, now);
+  }
+  resetSession(clientId) {
+    this.sessionService.disposeSession(clientId);
+    this.db.prepare("DELETE FROM wecom_gateway_sessions WHERE client_id = ?").run(clientId);
+  }
+  async formatStatus(clientId, config, prefix) {
+    const profiles = await this.sessionService.listAgentProfiles();
+    const profile = profiles.find((item) => item.id === (config.agentProfile || "default")) || profiles[0];
+    const active = this.sessionService.getSession(clientId);
+    return [
+      prefix,
+      "Pi session status",
+      "",
+      `- Profile: ${profile?.id || "default"}`,
+      `- CWD: ${config.defaultCwd || "(not configured)"}`,
+      `- Provider: ${active?.model?.provider || config.modelProvider || profile?.defaultProvider || "(profile default)"}`,
+      `- Model: ${active?.model?.id || config.modelId || profile?.defaultModel || "(profile default)"}`,
+      `- Skillset: ${this.formatSkillsetName(config.skillPresetId)}`,
+      `- Session: ${active ? `active (${active.sessionId})` : "not started"}`
+    ].filter((line) => line !== void 0).join("\n");
+  }
+  formatHelp() {
+    return [
+      "Pi Cloud WeCom commands",
+      "/new - reset this chat session",
+      "/status - show current configuration",
+      "/profiles - list profiles",
+      "/profile <id> - switch profile",
+      "/cwds - list allowed folders",
+      "/cwd <number> - switch folder",
+      "/skillsets - list skillsets",
+      "/skillset <name> - switch skillset",
+      "/clear-config - restore gateway defaults",
+      "/help - show this help",
+      "",
+      GATEWAY_COMMON_ALIAS_HELP
+    ].join("\n");
+  }
+  resolveSkillsetConfig(skillset, strict = false) {
+    const selected = skillset?.trim();
+    if (!selected || selected.toLowerCase() === "all") return { skillMode: "all", skillPresetId: null };
+    const preset = this.findSkillPreset(selected);
+    if (preset) return { skillMode: preset.mode, skillPresetId: preset.id };
+    if (strict) throw new Error(`Unknown skillset: ${selected}`);
+    console.warn("[wecom-gateway] default gateway skillset was not found; using all skills", { skillset: selected });
+    return { skillMode: "all", skillPresetId: null };
+  }
+  formatSkillsets(currentPresetId) {
+    const presets = this.presetStore.list();
+    return [
+      "Available skillsets:",
+      `${currentPresetId ? " " : "*"} all - use all skills`,
+      ...presets.map((preset) => `${preset.id === currentPresetId ? "*" : " "} ${preset.name} (${preset.mode}: ${preset.skills.join(", ") || "none"})`)
+    ].join("\n");
+  }
+  formatSkillsetName(presetId) {
+    if (!presetId) return "all";
+    const preset = this.presetStore.getById(presetId);
+    return preset ? `${preset.name} (${preset.mode})` : `unknown preset (${presetId})`;
+  }
+  findSkillPreset(nameOrId) {
+    const normalized = nameOrId.trim().toLowerCase();
+    return this.presetStore.list().find((preset) => preset.id === nameOrId || preset.name.toLowerCase() === normalized) || null;
+  }
+  async sendReply(config, userId, text) {
+    for (const chunk of splitUtf8Text(formatWecomMarkdown(text), TEXT_CHUNK_MAX_BYTES)) {
+      let token = await this.getAccessToken(config);
+      let data = await this.sendApplicationMarkdown(config, token, userId, chunk);
+      if ([40014, 42001].includes(Number(data.errcode))) {
+        this.tokenCache = void 0;
+        token = await this.getAccessToken(config);
+        data = await this.sendApplicationMarkdown(config, token, userId, chunk);
+      }
+      if (Number(data.errcode) !== 0) throw new Error(`WeCom send message failed: ${stringValue3(data.errmsg) || `errcode=${data.errcode}`}`);
+    }
+  }
+  async sendApplicationMarkdown(config, token, userId, text) {
+    const response = await fetch(`${WECOM_API_BASE_URL}/cgi-bin/message/send?access_token=${encodeURIComponent(token)}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        touser: userId,
+        msgtype: "markdown",
+        agentid: Number(config.agentId),
+        markdown: { content: text },
+        safe: 0,
+        enable_duplicate_check: 1,
+        duplicate_check_interval: 1800
+      })
+    });
+    return parseWecomResponse(response);
+  }
+  async downloadImage(config, mediaId) {
+    const bytes = await this.downloadMedia(config, mediaId, MAX_IMAGE_BYTES, "An image is larger than 10 MB.");
+    const mimeType = sniffImageMimeType(bytes);
+    if (!mimeType) throw new Error("WeCom media response was not a supported image");
+    return { type: "image", data: bytes.toString("base64"), mimeType };
+  }
+  downloadVoice(config, mediaId) {
+    return this.downloadMedia(config, mediaId, MAX_AUDIO_BYTES, "A voice message is larger than 25 MB.");
+  }
+  async downloadMedia(config, mediaId, maxBytes, tooLargeMessage) {
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+      const token = await this.getAccessToken(config);
+      const response = await fetch(`${WECOM_API_BASE_URL}/cgi-bin/media/get?access_token=${encodeURIComponent(token)}&media_id=${encodeURIComponent(mediaId)}`);
+      const contentType = response.headers.get("content-type") || "";
+      if (contentType.toLowerCase().includes("application/json")) {
+        const data = await parseWecomResponse(response);
+        const errorCode = Number(data.errcode);
+        if (attempt === 0 && [40014, 42001].includes(errorCode)) {
+          this.tokenCache = void 0;
+          continue;
+        }
+        throw new Error(`WeCom media download failed: ${stringValue3(data.errmsg) || `errcode=${data.errcode}`}`);
+      }
+      if (!response.ok) throw new Error(`WeCom media download failed: HTTP ${response.status}`);
+      return readResponseBytes(response, maxBytes, tooLargeMessage);
+    }
+    throw new Error("WeCom media download failed after refreshing the access token");
+  }
+  async getAccessToken(config) {
+    const now = Date.now();
+    if (this.tokenCache && this.tokenCache.expiresAt - TOKEN_REFRESH_SKEW_MS2 > now) return this.tokenCache.token;
+    const response = await fetch(`${WECOM_API_BASE_URL}/cgi-bin/gettoken?corpid=${encodeURIComponent(config.corpId)}&corpsecret=${encodeURIComponent(config.corpSecret)}`);
+    const data = await parseWecomResponse(response);
+    const token = stringValue3(data.access_token);
+    if (Number(data.errcode) !== 0 || !token) throw new Error(`WeCom access token failed: ${stringValue3(data.errmsg) || `errcode=${data.errcode}`}`);
+    this.tokenCache = { token, expiresAt: now + (Number(data.expires_in) || 7200) * 1e3 };
+    return token;
+  }
+};
+async function readResponseBytes(response, maxBytes, tooLargeMessage) {
+  const contentLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+    await response.body?.cancel();
+    throw new Error(tooLargeMessage);
+  }
+  if (!response.body) return Buffer.alloc(0);
+  const reader = response.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      totalBytes += value.byteLength;
+      if (totalBytes > maxBytes) {
+        await reader.cancel();
+        throw new Error(tooLargeMessage);
+      }
+      chunks.push(Buffer.from(value));
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, totalBytes);
+}
+function parseWecomMessage(xml) {
+  const messageType = xmlValue(xml, "MsgType");
+  const userId = xmlValue(xml, "FromUserName");
+  const messageId = xmlValue(xml, "MsgId");
+  const agentId = xmlValue(xml, "AgentID");
+  if (!messageType || !userId || !messageId || !agentId) return null;
+  return {
+    messageType,
+    userId,
+    messageId,
+    agentId,
+    text: xmlValue(xml, "Content").trim(),
+    mediaId: xmlValue(xml, "MediaId") || void 0,
+    picUrl: xmlValue(xml, "PicUrl") || void 0
+  };
+}
+function xmlValue(xml, tag) {
+  const match = new RegExp(`<${tag}>(?:<!\\[CDATA\\[([\\s\\S]*?)\\]\\]>|([\\s\\S]*?))<\\/${tag}>`, "i").exec(xml);
+  return decodeXmlEntities((match?.[1] ?? match?.[2] ?? "").trim());
+}
+function decodeXmlEntities(value) {
+  return value.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function parseList2(value) {
+  return Array.from(new Set((value || "").split(",").map((item) => item.trim()).filter(Boolean)));
+}
+function normalizeList(value) {
+  return Array.from(new Set((Array.isArray(value) ? value : []).filter((item) => typeof item === "string").map((item) => item.trim()).filter(Boolean)));
+}
+function stringValue3(value) {
+  return typeof value === "string" ? value : value === void 0 || value === null ? "" : String(value);
+}
+function gatewayError(message, statusCode) {
+  const error = new Error(message);
+  error.statusCode = statusCode;
+  return error;
+}
+async function parseWecomResponse(response) {
+  const text = await response.text();
+  let data = {};
+  try {
+    data = JSON.parse(text);
+  } catch {
+  }
+  if (!response.ok) throw new Error(`WeCom HTTP ${response.status}: ${text.slice(0, 200)}`);
+  return data;
+}
+function extractLastAssistantText3(messages) {
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = messages[index];
+    if (message?.role !== "assistant") continue;
+    if (typeof message.content === "string" && message.content.trim()) return message.content.trim();
+    if (!Array.isArray(message.content)) continue;
+    const text = message.content.filter((part) => part?.type === "text" && typeof part.text === "string").map((part) => part.text).join("").trim();
+    if (text) return text;
+  }
+  return void 0;
+}
+function formatWecomMarkdown(text) {
+  return text.replace(/^([ \t]*)[-+*][ \t]+/gm, (_match, indentation) => `${indentation}${indentation ? "\u25E6" : "\u2022"} `);
+}
+function splitUtf8Text(text, maxBytes) {
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return [text];
+  const chunks = [];
+  let current = "";
+  let currentBytes = 0;
+  for (const character of text) {
+    const characterBytes = Buffer.byteLength(character, "utf8");
+    if (current && currentBytes + characterBytes > maxBytes) {
+      chunks.push(current);
+      current = "";
+      currentBytes = 0;
+    }
+    current += character;
+    currentBytes += characterBytes;
+  }
+  if (current) chunks.push(current);
+  return chunks;
+}
+
 // src/services/review-source-store.ts
 import * as os8 from "os";
 import * as path11 from "path";
@@ -14124,7 +15276,7 @@ var ClaudeCodeReviewSourceAdapter = class {
       try {
         const records = this.readRecords(filePath);
         if (!records.length) return [];
-        const stat8 = fs5.statSync(filePath);
+        const stat9 = fs5.statSync(filePath);
         const sessionRecord = records.find((record) => record.sessionId || record.session_id);
         const sessionId = sessionRecord?.sessionId || sessionRecord?.session_id || path7.basename(filePath, ".jsonl");
         const cwd = records.find((record) => record.cwd)?.cwd;
@@ -14140,8 +15292,8 @@ var ClaudeCodeReviewSourceAdapter = class {
             name: title,
             path: filePath,
             cwd,
-            created: new Date(timestamps.length ? Math.min(...timestamps) : stat8.birthtimeMs).toISOString(),
-            modified: new Date(timestamps.length ? Math.max(...timestamps) : stat8.mtimeMs).toISOString(),
+            created: new Date(timestamps.length ? Math.min(...timestamps) : stat9.birthtimeMs).toISOString(),
+            modified: new Date(timestamps.length ? Math.max(...timestamps) : stat9.mtimeMs).toISOString(),
             messageCount: messages.length,
             firstMessage: firstUserMessage ? this.messageText(firstUserMessage.content) : void 0
           }
@@ -14287,7 +15439,7 @@ var CodexReviewSourceAdapter = class {
       try {
         const records = this.readRecords(filePath);
         if (!records.length) return [];
-        const stat8 = fs6.statSync(filePath);
+        const stat9 = fs6.statSync(filePath);
         const metadata = records.find((record) => record.type === "session_meta")?.payload;
         const messages = this.recordsToMessages(records);
         const timestamps = records.map((record) => this.timestamp(record.timestamp)).filter((value) => value !== void 0);
@@ -14299,8 +15451,8 @@ var CodexReviewSourceAdapter = class {
             sourceId: "",
             path: filePath,
             cwd: this.stringValue(metadata?.cwd),
-            created: new Date(timestamps.length ? Math.min(...timestamps) : stat8.birthtimeMs).toISOString(),
-            modified: new Date(timestamps.length ? Math.max(...timestamps) : stat8.mtimeMs).toISOString(),
+            created: new Date(timestamps.length ? Math.min(...timestamps) : stat9.birthtimeMs).toISOString(),
+            modified: new Date(timestamps.length ? Math.max(...timestamps) : stat9.mtimeMs).toISOString(),
             messageCount: messages.length,
             firstMessage: firstUserMessage ? this.messageText(firstUserMessage.content) : void 0
           }
@@ -14866,7 +16018,7 @@ function createDefaultConfig() {
   if (process.env.NODE_ENV === "test") return;
   if (process.env.PI_CLOUD_AUTH_USERNAME || process.env.PI_CLOUD_AUTH_PASSWORD || process.env.PI_CLOUD_AUTH_PASSWORD_HASH) return;
   const username = "admin";
-  const password = randomBytes3(6).toString("base64url");
+  const password = randomBytes4(6).toString("base64url");
   const samplePath = path12.resolve(__dirname, "../../.env.example");
   const content = renderDefaultConfig(readFileSync4(samplePath, "utf8"), username, password);
   mkdirSync2(userConfigDir, { recursive: true, mode: 448 });
@@ -14887,6 +16039,7 @@ var CONTENT_SECURITY_POLICY = [
   "object-src 'none'",
   "frame-ancestors 'none'",
   "img-src 'self' data: blob:",
+  "media-src 'self' blob:",
   "font-src 'self' data:",
   "style-src 'self' 'unsafe-inline'",
   "script-src 'self'",
@@ -14909,6 +16062,7 @@ function isPublicRoute(req) {
   if (url === "/api/health") return true;
   if (url.startsWith("/api/auth")) return true;
   if (url === "/api/gateways/feishu/events") return true;
+  if (url === "/api/gateways/wecom/callback") return true;
   if (req.method === "GET" && !url.startsWith("/api/")) return true;
   return false;
 }
@@ -14989,6 +16143,7 @@ async function buildApp() {
   const githubSettings = new GithubSettingsStore(db);
   const feishuGateway = new FeishuGatewayService(db, gatewaySettings, piSessionService);
   const weixinGateway = new WeixinGatewayService(db, gatewaySettings, piSessionService);
+  const wecomGateway = new WecomGatewayService(db, gatewaySettings, piSessionService);
   weixinGateway.start();
   const repositoryCloner = new RepositoryCloner({
     spawnGit: (args, options) => spawn3("git", args, options),
@@ -15040,7 +16195,7 @@ async function buildApp() {
     reply.header("X-Content-Type-Options", "nosniff");
     reply.header("X-Frame-Options", "DENY");
     reply.header("Referrer-Policy", "no-referrer");
-    reply.header("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+    reply.header("Permissions-Policy", "camera=(), microphone=(self), geolocation=()");
     if (authConfig.cookieSecure) {
       reply.header("Strict-Transport-Security", "max-age=31536000");
     }
@@ -15089,6 +16244,7 @@ async function buildApp() {
   await app.register(taskRoutes, { prefix: "/api/tasks", store: projectTaskStore, starter: projectTaskStarter, activityStore: sessionActivityStore });
   await app.register(gatewayRoutes, { prefix: "/api/gateways", settings: gatewaySettings, weixin: weixinGateway });
   await app.register(feishuGatewayRoutes, { prefix: "/api/gateways/feishu", service: feishuGateway });
+  await app.register(wecomGatewayRoutes, { prefix: "/api/gateways/wecom", service: wecomGateway });
   const gitHostingRouteOptions = {
     settings: giteaSettings,
     githubSettings,
@@ -15108,6 +16264,7 @@ async function buildApp() {
   });
   await app.register(slashCommandRoutes, { prefix: "/api/slash-commands" });
   await app.register(changelogRoutes, { prefix: "/api/changelog" });
+  await app.register(speechRoutes, { prefix: "/api/speech" });
   await app.register(reviewSourceRoutes, { prefix: "/api/review-sources", reviewSourceService, pinStore: sessionPinStore });
   await app.register(chatWebSocket);
   await app.register(terminalWebSocket);