weflow-cli 1.16.0 → 1.17.0

package/scripts/watch_mail.py

@@ -1,131 +1,131 @@
-#!/usr/bin/env python3
-"""Queue instructions the user sends to the agent mailbox.
-
-A pure script - no model, no tokens. It runs from Windows Task Scheduler and
-its only job is to notice new mail from an allowlisted sender and append it to
-a local queue file. Acting on those instructions happens later, from a normal
-session, which is when a model is running anyway.
-
-That split matters: waking a model every few minutes just to discover there is
-no mail costs tokens for nothing. This script does the waiting for free.
-
-    ~/.weflow-mail-queue.jsonl   one JSON object per pending instruction
-    ~/.weflow-mail-state.json    message ids already queued
-
-Only mail whose From address is exactly the allowlisted one is ever read or
-queued. Mail from anyone else is left untouched - not read, not marked, not
-queued.
-"""
-import json
-import os
-import subprocess
-import sys
-
-STATE_PATH = os.path.join(os.path.expanduser('~'), '.weflow-mail-state.json')
-QUEUE_PATH = os.path.join(os.path.expanduser('~'), '.weflow-mail-queue.jsonl')
-
-# Exact address, not a display name: a sender name can say anything.
-ALLOWED_SENDERS = {'1473517806@qq.com'}
-
-AGENTLY_CANDIDATES = [
-    # The npm shim is a .cmd on Windows; subprocess needs the extension spelled
-    # out, since a bare `agently-cli` is not an executable image.
-    r'C:\Users\Administrator\AppData\Roaming\npm\agently-cli.cmd',
-    'agently-cli.cmd',
-    'agently-cli',
-]
-
-
-def _runnable(candidate):
-    if os.path.isabs(candidate):
-        return os.path.isfile(candidate)
-    from shutil import which
-    return which(candidate) is not None
-
-
-def agently(args):
-    """Run agently-cli and return its parsed JSON, or None."""
-    executable = next((c for c in AGENTLY_CANDIDATES if _runnable(c)), None)
-    if not executable:
-        print('未找到 agently-cli，跳过。')
-        return None
-    try:
-        result = subprocess.run(
-            [executable, *args], capture_output=True, timeout=90, encoding='utf-8')
-    except (OSError, subprocess.SubprocessError) as error:
-        print(f'agently-cli 调用失败: {type(error).__name__}')
-        return None
-    # agently-cli pretty-prints its JSON across many lines, so parse the whole
-    # payload from the first brace rather than looking for a single-line blob.
-    text = result.stdout.strip()
-    start = text.find('{')
-    if start < 0:
-        return None
-    try:
-        return json.JSONDecoder().raw_decode(text[start:])[0]
-    except ValueError:
-        return None
-
-
-def load_json(path, fallback):
-    try:
-        with open(path, encoding='utf-8') as handle:
-            return json.load(handle)
-    except (OSError, ValueError):
-        return fallback
-
-
-def main():
-    state = load_json(STATE_PATH, {'seen': []})
-    seen = set(state.get('seen', []))
-
-    listing = agently(['message', '+list', '--limit', '20'])
-    if not listing or not listing.get('ok'):
-        print('读取邮箱失败（未授权或网络不通），本次跳过。')
-        return 0
-
-    messages = (listing.get('data') or {}).get('data') or []
-    queued = 0
-    for summary in messages:
-        sender = (summary.get('from') or {}).get('email', '')
-        if sender not in ALLOWED_SENDERS:
-            continue
-        message_id = summary.get('message_id', '')
-        if not message_id or message_id in seen:
-            continue
-
-        detail = agently(['message', '+read', '--id', message_id])
-        body = ''
-        if detail and detail.get('ok'):
-            body = ((detail.get('data') or {}).get('text')
-                    or (detail.get('data') or {}).get('body') or '')
-        if not body:
-            body = summary.get('snippet', '')
-
-        entry = {
-            'message_id': message_id,
-            'from': sender,
-            'subject': summary.get('subject', ''),
-            'created_at': summary.get('created_at', ''),
-            'body': body,
-        }
-        with open(QUEUE_PATH, 'a', encoding='utf-8') as handle:
-            handle.write(json.dumps(entry, ensure_ascii=False) + '\n')
-        seen.add(message_id)
-        queued += 1
-
-    if queued:
-        with open(STATE_PATH, 'w', encoding='utf-8') as handle:
-            json.dump({'seen': sorted(seen)}, handle, ensure_ascii=False, indent=2)
-        print(f'已排队 {queued} 封来自授权发件人的邮件。')
-    else:
-        # Still persist first-run state so the backlog is not queued later.
-        if not os.path.exists(STATE_PATH):
-            with open(STATE_PATH, 'w', encoding='utf-8') as handle:
-                json.dump({'seen': sorted(seen)}, handle, ensure_ascii=False, indent=2)
-        print('无新指令邮件。')
-    return 0
-
-
-if __name__ == '__main__':
-    sys.exit(main())
+#!/usr/bin/env python3
+"""Queue instructions the user sends to the agent mailbox.
+
+A pure script - no model, no tokens. It runs from Windows Task Scheduler and
+its only job is to notice new mail from an allowlisted sender and append it to
+a local queue file. Acting on those instructions happens later, from a normal
+session, which is when a model is running anyway.
+
+That split matters: waking a model every few minutes just to discover there is
+no mail costs tokens for nothing. This script does the waiting for free.
+
+    ~/.weflow-mail-queue.jsonl   one JSON object per pending instruction
+    ~/.weflow-mail-state.json    message ids already queued
+
+Only mail whose From address is exactly the allowlisted one is ever read or
+queued. Mail from anyone else is left untouched - not read, not marked, not
+queued.
+"""
+import json
+import os
+import subprocess
+import sys
+
+STATE_PATH = os.path.join(os.path.expanduser('~'), '.weflow-mail-state.json')
+QUEUE_PATH = os.path.join(os.path.expanduser('~'), '.weflow-mail-queue.jsonl')
+
+# Exact address, not a display name: a sender name can say anything.
+ALLOWED_SENDERS = {'1473517806@qq.com'}
+
+AGENTLY_CANDIDATES = [
+    # The npm shim is a .cmd on Windows; subprocess needs the extension spelled
+    # out, since a bare `agently-cli` is not an executable image.
+    r'C:\Users\Administrator\AppData\Roaming\npm\agently-cli.cmd',
+    'agently-cli.cmd',
+    'agently-cli',
+]
+
+
+def _runnable(candidate):
+    if os.path.isabs(candidate):
+        return os.path.isfile(candidate)
+    from shutil import which
+    return which(candidate) is not None
+
+
+def agently(args):
+    """Run agently-cli and return its parsed JSON, or None."""
+    executable = next((c for c in AGENTLY_CANDIDATES if _runnable(c)), None)
+    if not executable:
+        print('未找到 agently-cli，跳过。')
+        return None
+    try:
+        result = subprocess.run(
+            [executable, *args], capture_output=True, timeout=90, encoding='utf-8')
+    except (OSError, subprocess.SubprocessError) as error:
+        print(f'agently-cli 调用失败: {type(error).__name__}')
+        return None
+    # agently-cli pretty-prints its JSON across many lines, so parse the whole
+    # payload from the first brace rather than looking for a single-line blob.
+    text = result.stdout.strip()
+    start = text.find('{')
+    if start < 0:
+        return None
+    try:
+        return json.JSONDecoder().raw_decode(text[start:])[0]
+    except ValueError:
+        return None
+
+
+def load_json(path, fallback):
+    try:
+        with open(path, encoding='utf-8') as handle:
+            return json.load(handle)
+    except (OSError, ValueError):
+        return fallback
+
+
+def main():
+    state = load_json(STATE_PATH, {'seen': []})
+    seen = set(state.get('seen', []))
+
+    listing = agently(['message', '+list', '--limit', '20'])
+    if not listing or not listing.get('ok'):
+        print('读取邮箱失败（未授权或网络不通），本次跳过。')
+        return 0
+
+    messages = (listing.get('data') or {}).get('data') or []
+    queued = 0
+    for summary in messages:
+        sender = (summary.get('from') or {}).get('email', '')
+        if sender not in ALLOWED_SENDERS:
+            continue
+        message_id = summary.get('message_id', '')
+        if not message_id or message_id in seen:
+            continue
+
+        detail = agently(['message', '+read', '--id', message_id])
+        body = ''
+        if detail and detail.get('ok'):
+            body = ((detail.get('data') or {}).get('text')
+                    or (detail.get('data') or {}).get('body') or '')
+        if not body:
+            body = summary.get('snippet', '')
+
+        entry = {
+            'message_id': message_id,
+            'from': sender,
+            'subject': summary.get('subject', ''),
+            'created_at': summary.get('created_at', ''),
+            'body': body,
+        }
+        with open(QUEUE_PATH, 'a', encoding='utf-8') as handle:
+            handle.write(json.dumps(entry, ensure_ascii=False) + '\n')
+        seen.add(message_id)
+        queued += 1
+
+    if queued:
+        with open(STATE_PATH, 'w', encoding='utf-8') as handle:
+            json.dump({'seen': sorted(seen)}, handle, ensure_ascii=False, indent=2)
+        print(f'已排队 {queued} 封来自授权发件人的邮件。')
+    else:
+        # Still persist first-run state so the backlog is not queued later.
+        if not os.path.exists(STATE_PATH):
+            with open(STATE_PATH, 'w', encoding='utf-8') as handle:
+                json.dump({'seen': sorted(seen)}, handle, ensure_ascii=False, indent=2)
+        print('无新指令邮件。')
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/src/core/ntCore.ts

@@ -75,6 +75,42 @@ export interface NtMessagesResult extends NtResult {
   shards?: ShardReport
 }
 
+/** One shard's outcome in a `cursor-probe` run (nt_decrypt.py cursor-probe). */
+export interface NtCursorProbeShard {
+  /** basename only - the child never reports a full path */
+  name: string
+  opened: boolean
+  reason: string | null
+  /** number of Msg_* tables; null when the shard could not be read at all */
+  tables: number | null
+  tablesSampled?: number
+  /** per-table missing anchor-column sets, deduplicated; empty = every table has all three */
+  anchorColumnsMissing?: string[][]
+  rowsSampled?: number
+  /** sampled rows whose server_id was 0 or NULL (identity degrades for them) */
+  serverIdMissing?: number
+}
+
+export interface NtCursorProbeSample {
+  tablesPerShard: number
+  rowsPerTable: number
+  exhaustive: boolean
+  tablesTotal: number
+  tablesSampled: number
+  rowsSampled: number
+  serverIdMissing: number
+  /** sampled nonzero server ids seen in more than one (shard, table) location */
+  duplicateServerIds: number
+  duplicateServerIdSamples?: Array<{ serverId: string; locations: string[] }>
+}
+
+export interface NtCursorProbeResult extends NtResult {
+  shards?: NtCursorProbeShard[]
+  /** shards with at least one message table missing an anchor column */
+  schemaAnchorMissingTables?: number
+  sample?: NtCursorProbeSample
+}
+
 export interface NtContactsResult extends NtResult {
   contacts?: Contact[]
 }
@@ -392,6 +428,29 @@ export class NtCore {
     return { success: true, contacts: result.contacts || [] }
   }
 
+  /**
+   * The NT backend's data-side answer to D-027's stable-cursor question:
+   * anchor columns per message table (exhaustive) and a bounded sample of
+   * `server_id` coverage at both rowid ends of a few tables per shard.
+   * Read-only; the sampling bounds are labelled `exhaustive: false` in the
+   * result because they are a measurement, not a guarantee.
+   */
+  async cursorProbe(opts: { tablesPerShard?: number; rowsPerTable?: number } = {}): Promise<NtCursorProbeResult> {
+    const args: string[] = ['cursor-probe']
+    if (opts.tablesPerShard != null) args.push('--tables-per-shard', String(opts.tablesPerShard))
+    if (opts.rowsPerTable != null) args.push('--rows-per-table', String(opts.rowsPerTable))
+    const result = await this.callPython(args)
+    if (result.error) {
+      return { success: false, error: result.error }
+    }
+    return {
+      success: true,
+      shards: result.shards || [],
+      schemaAnchorMissingTables: result.schemaAnchorMissingTables,
+      sample: result.sample,
+    }
+  }
+
   // ====== SNS (朋友圈) ======
 
   /** 查询 SNS 朋友圈时间线 */

package/src/services/assistantService.ts

@@ -69,6 +69,20 @@ export interface TurnInput {
   message?: WechatInboundMessage
 }
 
+/**
+ * 来信里**已落盘**的图片文件（`wechatMediaDownload` 的下载侧产物，D-128）。
+ * 只收图片：语音/视频/文件的消费各自是新的出境决策，不搭车。没开下载或下载失败
+ * （`filePath` 为空）时这里为空——那种图片消息照旧整条忽略，行为不变。
+ */
+function inboundImageFiles(msg?: WechatInboundMessage): Array<{ filePath: string }> {
+  if (!msg?.components?.length) return []
+  const out: Array<{ filePath: string }> = []
+  for (const c of msg.components) {
+    if (c.type === 'image' && c.filePath) out.push({ filePath: c.filePath })
+  }
+  return out
+}
+
 /**
  * 一轮的结果。**"回什么"与"往哪回"分开**：这里只说回什么，往哪回由调用方的 `deliver` 决定。
  *
@@ -392,6 +406,11 @@ export class AssistantService {
    * 消息是串行处理的（queue），所以实例字段在这里是安全的。
    */
   private turnCalls = new Set<string>()
+  /**
+   * 本轮**来信自带**的图片文件（D-128）。消息串行处理，实例字段安全（同 `turnCalls`）。
+   * `runToolCall` 建 ctx 时带上，`look_at_image` 的 `#信N` 句柄从这里取。
+   */
+  private turnInboundImages: Array<{ filePath: string }> = []
 
   /** 白名单为空时，把"该把谁加进去"连同**完整**的发送者 ID 打一行。
    *
@@ -485,6 +504,7 @@ export class AssistantService {
     }
     this.turnCalls.add(callKey)
     const ctx: ToolContext = { userId, memory: this.memory }
+    if (this.turnInboundImages.length) ctx.inboundImages = this.turnInboundImages
     const raw = await executeTool(name, args, ctx)
     trace.toolCalls += 1
     trace.steps.push({
@@ -576,22 +596,37 @@ export class AssistantService {
    * **外部只许经由 `enqueueTurn` 调用**（它保证串行）；直接调会被 `inFlight` 挡下——
    * 见那个字段的注释。
    */
-  async handleMessage(userId: string, text: string, kind: string): Promise<string> {
+  async handleMessage(userId: string, text: string, kind: string,
+                      inboundImages: Array<{ filePath: string }> = []): Promise<string> {
     if (this.inFlight) {
       throw new Error('handleMessage 重入：它依赖串行调用（记忆窗口、turnCalls 都是实例字段）')
     }
     this.inFlight = true
     try {
-      return await this.handleMessageInner(userId, text, kind)
+      return await this.handleMessageInner(userId, text, kind, inboundImages)
     } finally {
       this.inFlight = false
     }
   }
 
-  private async handleMessageInner(userId: string, text: string, kind: string): Promise<string> {
-    if (kind !== 'text') return '目前只支持文字消息哦'
+  private async handleMessageInner(userId: string, text: string, kind: string,
+                                   inboundImages: Array<{ filePath: string }> = []): Promise<string> {
+    // kind==='image' 只有在**带着已落盘图片**时才是 D-128 那条新路；裸的图片消息
+    // （runTurn 已经过滤掉的那种）走到这里仍按老规矩拒绝。
+    if (kind !== 'text' && !(kind === 'image' && inboundImages.length)) {
+      return '目前只支持文字消息哦'
+    }
 
-    const t = text.trim()
+    let t = text.trim()
+    // 每轮重置（空数组也覆盖）：上一轮的图片不能漏到这一轮的句柄空间里。
+    this.turnInboundImages = inboundImages
+    // 来信图片的句柄指路牌：**能看才摆**（strict 且非本地推理不摆——与 get_messages 的
+    // `#N` 同一规则，不摆出一个工具必定会拒绝的东西）。文件本身挂在工具 ctx 上，
+    // 这里只告诉模型"有图、看的话用哪个句柄"。
+    if (inboundImages.length && (privacyGate.mode() !== 'strict' || privacyGate.isLocalInference())) {
+      const handles = inboundImages.map((_f, i) => `#信${i + 1}`).join('、')
+      t += `（这张来信带 ${inboundImages.length} 张图片：${handles}。要看就用 look_at_image，不看也可以直接聊。）`
+    }
     const startedAt = Date.now()
     this.turnCalls.clear()
     // 一轮的轨迹：判断了什么、调了什么、几轮、为什么停。**内置指令也要记**——
@@ -786,7 +821,12 @@ export class AssistantService {
    */
   private async runTurn(input: TurnInput, onLog?: (line: string) => void): Promise<TurnOutcome> {
     if (!this.running) return { status: 'not-running' }
-    const { sessionId, text, kind, origin } = input
+    const { sessionId, kind, origin } = input
+    // D-128：带**已落盘**图片的来信从"整条忽略"变成一轮（文本占位）；没落盘的
+    // （没开下载 / 下载失败）照旧忽略——文件不在，句柄无从谈起。
+    const inboundImages = inboundImageFiles(input.message)
+    const imageAsTurn = kind === 'image' && inboundImages.length > 0
+    const text = imageAsTurn ? (input.text.trim() || '（发来一张图片）') : input.text
 
     if (origin === 'wechat') {
       const msg = input.message!
@@ -797,7 +837,7 @@ export class AssistantService {
         this.maybeAnnounceWhitelistBootstrap(access, msg, onLog)
         return { status: 'denied', reason: access.reason }
       }
-      if (kind !== 'text') {
+      if (kind !== 'text' && !imageAsTurn) {
         onLog?.(`  → 忽略非文本消息 (${kind})`)
         return { status: 'ignored', reason: 'non-text' }
       }
@@ -815,7 +855,7 @@ export class AssistantService {
     }
 
     try {
-      const reply = await this.handleMessage(sessionId, text, kind)
+      const reply = await this.handleMessage(sessionId, text, kind, inboundImages)
       this.dailyCount++
       // **这里不报"已回复"**：回没回得出去是投递方才知道的事（微信的 sendText 会失败）。
       // 两处都报的话，微信那条路会在日志里出现两遍"已回复"，看着像处理了两条消息。

package/src/services/assistantTools.ts

@@ -306,6 +306,12 @@ export interface ToolContext {
    * 附到对话里（见 `assistantService.toApiMessages`）。
    */
   pendingImages?: AttachedImage[]
+  /**
+   * 本轮**来信自带**的图片（Bot 通道按 `wechatMediaDownload` 落盘解密过的文件，D-128）。
+   * `look_at_image` 的 `#信N` 句柄指向这里：文件已在本机，不走 `read_image.py`。
+   * 与 `pendingImages` 的分工：那是"模型这一轮已经看过的"，这是"来信里还没看的"。
+   */
+  inboundImages?: Array<{ filePath: string }>
   /**
    * 调用方是**外部机器**（MCP 那条路）时置 true。
    *
@@ -328,6 +334,28 @@ export interface AttachedImage {
 /** 一轮对话里最多看几张图。每次调用一张，这是上限——图片按体积算钱，也按体积算隐私。 */
 const MAX_IMAGES_PER_TURN = 2
 
+/**
+ * 来信图片的大小上限（D-128）。超了就明说"太大"，**不缩放**：入站文件是证据形态，
+ * 缩了再给模型看，模型说的就不是那张图（导出路径缩放是因为那是给人看的页面）。
+ */
+const MAX_INBOUND_IMAGE_BYTES = 4 * 1024 * 1024
+
+/** 从文件头魔数判图片类型，不信任文件名——来信文件的名字来自服务端报文。 */
+function sniffImageMime(buf: Buffer): string | null {
+  if (buf.length >= 8 && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) {
+    return 'image/png'
+  }
+  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) {
+    return 'image/jpeg'
+  }
+  if (buf.length >= 12
+    && buf.subarray(0, 4).toString('latin1') === 'RIFF'
+    && buf.subarray(8, 12).toString('latin1') === 'WEBP') {
+    return 'image/webp'
+  }
+  return null
+}
+
 function fmtTime(ts: number): string {
   const n = Number(ts)
   const d = n > 1e12 ? new Date(n) : new Date(n * 1000)
@@ -738,16 +766,17 @@ export const TOOL_DEFS: ToolDef[] = [
     type: 'function',
     function: {
       name: 'look_at_image',
-      description: '看聊天里的一张图片（把图片本身交给模型看，不只是"这里有一张图"）。'
-        + '`image` 填 get_messages 输出里 `[图片 #1234]` 的编号。'
-        + '一轮最多看两张；隐私模式为 strict 时不可用（聊天图片不出发本机）。',
+      description: '看一张图片（把图片本身交给模型看，不只是"这里有一张图"）。'
+        + '看聊天记录里的图：`image` 填 get_messages 输出里 `[图片 #1234]` 的编号，`contact` 给会话。'
+        + '看**本轮来信自带**的图：`image` 填 `#信1`（只有来信带图时才会出现这个句柄），不用 contact。'
+        + '一轮最多看两张；隐私模式为 strict 时不可用（图片不出发本机）。',
       parameters: {
         type: 'object',
         properties: {
-          contact: { type: 'string', description: '这张图所在会话的联系人显示名' },
-          image: { type: 'string', description: 'get_messages 里 [图片 #N] 的编号 N' },
+          contact: { type: 'string', description: '聊天记录那条路：这张图所在会话的联系人显示名（#信N 不需要）' },
+          image: { type: 'string', description: '[图片 #N] 的编号 N，或来信图片的 #信N' },
         },
-        required: ['contact', 'image'],
+        required: ['image'],
       },
     },
   },
@@ -1471,20 +1500,54 @@ export async function executeTool(name: string, args: Record<string, any>, ctx:
         // 句柄在 get_messages 里长这样：`[图片 #1234]`。允许带不带 `#` 都接受——模型从
         // 上下文里抄一个编号过来，"抄得像不像"不该决定它能不能看图。
         const image = String(args.image ?? '').replace(/^#/, '').trim()
-        if (!contact || !image) return '(缺少 contact 或 image 参数)'
-        if (!/^\d+$/.test(image)) {
-          return `(image 要填 get_messages 里 [图片 #N] 的编号，收到的是「${image.slice(0, 20)}」)`
+        if (!image) return '(缺少 image 参数)'
+        // 来信自带的图（D-128）：句柄 `信N`，与聊天记录的 `#N` 是两个空间。静态校验
+        // 先于隐私门——参数错就是参数错，与档位无关。
+        const inbound = /^信(\d+)$/.exec(image)
+        if (!inbound) {
+          if (!contact) return '(缺少 contact 参数：看聊天记录里的图要说明在哪个会话)'
+          if (!/^\d+$/.test(image)) {
+            return `(image 要填 get_messages 里 [图片 #N] 的编号或来信的 #信N，收到的是「${image.slice(0, 20)}」)`
+          }
         }
         // 第一层门：strict 模式（第三方聊天正文不出境）下图片也不出去。第二层在
         // `toApiMessages` 里——"工具肯给"与"这道门肯放"是两件事。
         if (privacyGate.mode() === 'strict' && !privacyGate.isLocalInference()) {
-          return '(当前隐私模式是 strict：聊天图片不发出本机，用不了这个工具。'
+          return '(当前隐私模式是 strict：图片不发出本机，用不了这个工具。'
             + '要让我看图，得把 assistantPrivacy 改成 balanced)'
         }
         const budget = ctx.pendingImages ?? []
         if (budget.length >= MAX_IMAGES_PER_TURN) {
           return `(这一轮已经看过 ${MAX_IMAGES_PER_TURN} 张图了，先把已经看到的说完，别再取)`
         }
+
+        // ---- 来信自带的图：文件已在本机（wechatMediaDownload 落盘解密过），
+        // 不走 read_image.py。
+        if (inbound) {
+          const files = ctx.inboundImages ?? []
+          const n = Number(inbound[1])
+          const ref = files[n - 1]
+          if (!ref) {
+            return `(本轮来信没有 #信${n} 这张图${files.length ? `（只有 #信1 到 #信${files.length}）` : '：来信没带可看的图片文件'})`
+          }
+          let buf: Buffer
+          try {
+            buf = readFileSync(ref.filePath)
+          } catch {
+            return `(读不到 #信${n} 的图片文件：落盘文件已不在（可能被清理过）)`
+          }
+          if (buf.length > MAX_INBOUND_IMAGE_BYTES) {
+            // 不缩放（D-128）：入站文件是证据形态，缩了再给模型看，模型说的就不是那张图。
+            return `(这张来信图片 ${(buf.length / 1048576).toFixed(1)} MB，超过 ${MAX_INBOUND_IMAGE_BYTES / 1048576} MB 上限，没有附上)`
+          }
+          const mime = sniffImageMime(buf)
+          if (!mime) {
+            return `(#信${n} 的文件头不是 png/jpeg/webp，附上也没有意义)`
+          }
+          ;(ctx.pendingImages ??= []).push({ b64: buf.toString('base64'), mime })
+          return `(已附上来信图片 #信${n}（${buf.length} 字节）。你能看到它了，直接据此回答。)`
+        }
+
         const talker = await resolveTalker(contact)
         // 90 秒。建媒体索引是这条路唯一的成本，且随会话大小走：实测单聊 ~1 秒、
         // 一个 3 万条消息的大群 18.9 秒（而那个群本机只有缩略图）。取到的图会落在

package/src/services/configService.ts

@@ -121,7 +121,7 @@ const CONFIG_DIR = join(homedir(), '.weflow-cli')
 const CONFIG_FILE = join(CONFIG_DIR, 'config.json')
 
 export class ConfigService {
-  private config: CliConfig = { dbPath: '', wxid: '', decryptKey: '', decryptKey3x: '', dataVersion: '', dbPath3x: '', ntDbPath: '', ntKey: '', ntSalt: '', contactDbPath: '', contactKey: '', contactSalt: '', wechatOcToken: '', wechatOcAccountId: '', wechatOcBaseUrl: '', wechatOcSyncBuf: '', wechatOcContextTokens: '', wechatMediaDownload: 'false', whitelist: [], blacklist: [], whitelistEntries: [], blacklistEntries: [], vaultRepo: '', aiEngine: 'deepseek', wereadApiKey: '', deepseekApiKey: '', typesafeApiKey: '', dashscopeApiKey: '', judgeProvider: 'native', openrouterApiKey: '', openrouterJudgeModel: '', judgeLocalUrl: '', snsDbPath: '', snsKey: '', snsSalt: '', favDbPath: '', favKey: '', favPassphrase: '', emoticonSeed: '', assistantPrivacy: 'strict', localModel: '', aiBaseUrl: '', aiModel: '', assistantWhitelist: '', assistantGroupWhitelist: '', assistantGroupRequireMention: 'true', assistantFastRoute: 'off', assistantPanelUser: '', quickReplyContacts: '', skillDirs: '', skillDisabled: '', dailySources: '', dailySourceCategories: '', dailyExcludeTopics: '', dailyAiEnabled: 'true' }
+  private config: CliConfig = { dbPath: '', wxid: '', decryptKey: '', decryptKey3x: '', dataVersion: '', dbPath3x: '', ntDbPath: '', ntKey: '', ntSalt: '', contactDbPath: '', contactKey: '', contactSalt: '', wechatOcToken: '', wechatOcAccountId: '', wechatOcBaseUrl: '', wechatOcSyncBuf: '', wechatOcContextTokens: '', wechatMediaDownload: 'false', whitelist: [], blacklist: [], whitelistEntries: [], blacklistEntries: [], vaultRepo: '', aiEngine: 'deepseek', wereadApiKey: '', deepseekApiKey: '', typesafeApiKey: '', dashscopeApiKey: '', judgeProvider: 'native', openrouterApiKey: '', openrouterJudgeModel: '', judgeLocalUrl: '', snsDbPath: '', snsKey: '', snsSalt: '', favDbPath: '', favKey: '', favPassphrase: '', emoticonSeed: '', assistantPrivacy: 'strict', localModel: '', aiBaseUrl: '', aiModel: '', assistantWhitelist: '', assistantGroupWhitelist: '', assistantGroupRequireMention: 'true', assistantFastRoute: 'off', assistantPanelUser: '', quickReplyContacts: '', skillDirs: '', skillDisabled: '', dailySources: '', dailySourceCategories: '', dailyExcludeTopics: '', dailyAiEnabled: 'true', dailyMailTo: '' }
 
   /** 本进程修改过、待回写的字段 (多进程并发写保护) */
   private dirty = new Set<keyof CliConfig>()
@@ -199,6 +199,7 @@ export class ConfigService {
           dailySourceCategories: data.dailySourceCategories || '',
           dailyExcludeTopics: data.dailyExcludeTopics || '',
           dailyAiEnabled: data.dailyAiEnabled === 'false' ? 'false' : 'true',
+          dailyMailTo: data.dailyMailTo || '',
         }
       }
     } catch (e) {
@@ -383,7 +384,7 @@ export class ConfigService {
   }
 
   clear(): void {
-    this.config = { dbPath: '', wxid: '', decryptKey: '', decryptKey3x: '', dataVersion: '', dbPath3x: '', ntDbPath: '', ntKey: '', ntSalt: '', contactDbPath: '', contactKey: '', contactSalt: '', wechatOcToken: '', wechatOcAccountId: '', wechatOcBaseUrl: '', wechatOcSyncBuf: '', wechatOcContextTokens: '', wechatMediaDownload: 'false', whitelist: [], blacklist: [], whitelistEntries: [], blacklistEntries: [], vaultRepo: '', aiEngine: 'deepseek', wereadApiKey: '', deepseekApiKey: '', typesafeApiKey: '', dashscopeApiKey: '', judgeProvider: 'native', openrouterApiKey: '', openrouterJudgeModel: '', judgeLocalUrl: '', snsDbPath: '', snsKey: '', snsSalt: '', favDbPath: '', favKey: '', favPassphrase: '', emoticonSeed: '', assistantPrivacy: 'strict', localModel: '', aiBaseUrl: '', aiModel: '', assistantWhitelist: '', assistantGroupWhitelist: '', assistantGroupRequireMention: 'true', assistantFastRoute: 'off', assistantPanelUser: '', quickReplyContacts: '', skillDirs: '', skillDisabled: '', dailySources: '', dailySourceCategories: '', dailyExcludeTopics: '', dailyAiEnabled: 'true' }
+    this.config = { dbPath: '', wxid: '', decryptKey: '', decryptKey3x: '', dataVersion: '', dbPath3x: '', ntDbPath: '', ntKey: '', ntSalt: '', contactDbPath: '', contactKey: '', contactSalt: '', wechatOcToken: '', wechatOcAccountId: '', wechatOcBaseUrl: '', wechatOcSyncBuf: '', wechatOcContextTokens: '', wechatMediaDownload: 'false', whitelist: [], blacklist: [], whitelistEntries: [], blacklistEntries: [], vaultRepo: '', aiEngine: 'deepseek', wereadApiKey: '', deepseekApiKey: '', typesafeApiKey: '', dashscopeApiKey: '', judgeProvider: 'native', openrouterApiKey: '', openrouterJudgeModel: '', judgeLocalUrl: '', snsDbPath: '', snsKey: '', snsSalt: '', favDbPath: '', favKey: '', favPassphrase: '', emoticonSeed: '', assistantPrivacy: 'strict', localModel: '', aiBaseUrl: '', aiModel: '', assistantWhitelist: '', assistantGroupWhitelist: '', assistantGroupRequireMention: 'true', assistantFastRoute: 'off', assistantPanelUser: '', quickReplyContacts: '', skillDirs: '', skillDisabled: '', dailySources: '', dailySourceCategories: '', dailyExcludeTopics: '', dailyAiEnabled: 'true', dailyMailTo: '' }
     // clear 意图是全量重置: 所有字段标记为脏, 覆盖磁盘上的全部旧值
     this.dirty = new Set(Object.keys(this.config) as (keyof CliConfig)[])
     this.save()