weflow-cli 1.5.0 → 1.6.1

package/dist/mcp-server/index.js

@@ -8,22 +8,63 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
-import { readFileSync, readdirSync, existsSync, statSync, writeFileSync, mkdirSync } from 'fs';
-import { join, resolve } from 'path';
-import { deflateSync } from 'zlib';
+import { readFileSync, readdirSync, existsSync, statSync } from 'fs';
+import { join } from 'path';
+import { isAllowedWeChatArticleUrl, safeChildPath, safeDate } from '../src/utils/mcpSecurity.js';
+import { resolvePackageRoot } from '../src/utils/packageRoot.js';
+import { chatService } from '../src/services/chatService.js';
+import { createWeFlowEnvelope } from '../src/services/messageContract.js';
 // ---- 微信公众号文章抓取 ----
+async function readResponseTextLimited(response, maximumBytes) {
+    const contentLength = Number(response.headers.get('content-length') || 0);
+    if (contentLength > maximumBytes)
+        throw new Error('RESPONSE_TOO_LARGE');
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > maximumBytes) {
+            await reader.cancel();
+            throw new Error('RESPONSE_TOO_LARGE');
+        }
+        chunks.push(value);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
 async function fetchWeChatArticle(url) {
-    const resp = await fetch(url, {
-        headers: {
-            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
-            'Accept': 'text/html,application/xhtml+xml',
-            'Accept-Language': 'zh-CN,zh;q=0.9',
-        },
-        redirect: 'follow',
-    });
+    let currentUrl = url;
+    let resp = null;
+    for (let redirectCount = 0; redirectCount <= 3; redirectCount++) {
+        if (!isAllowedWeChatArticleUrl(currentUrl))
+            throw new Error('URL_NOT_ALLOWED');
+        resp = await fetch(currentUrl, {
+            headers: {
+                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+                'Accept': 'text/html,application/xhtml+xml',
+                'Accept-Language': 'zh-CN,zh;q=0.9',
+            },
+            redirect: 'manual',
+            signal: AbortSignal.timeout(20_000),
+        });
+        if (resp.status < 300 || resp.status >= 400)
+            break;
+        const location = resp.headers.get('location');
+        if (!location)
+            throw new Error('REDIRECT_WITHOUT_LOCATION');
+        currentUrl = new URL(location, currentUrl).toString();
+        resp = null;
+    }
+    if (!resp)
+        throw new Error('TOO_MANY_REDIRECTS');
     if (!resp.ok)
         throw new Error(`HTTP ${resp.status}: ${resp.statusText}`);
-    const html = await resp.text();
+    const html = await readResponseTextLimited(resp, 5 * 1024 * 1024);
     // 提取 meta 信息
     const title = html.match(/<meta[^>]*property="og:title"[^>]*content="([^"]+)"/i)?.[1]
         || html.match(/<title>([^<]+)<\/title>/i)?.[1]?.trim()
@@ -94,75 +135,74 @@ function htmlToMarkdown(html) {
     return md;
 }
 import { formatWeChatArticle, listThemes } from '../src/services/wechat-formatter.js';
-// ---- 微信公众号 API 辅助 ----
-const WECHAT_APP_ID = process.env.WECHAT_APPID || '';
-const WECHAT_APP_SECRET = process.env.WECHAT_APPSECRET || '';
-let _tokenCache = null;
-async function getWeChatToken() {
-    if (_tokenCache && Date.now() < _tokenCache.expiresAt - 60000) {
-        return _tokenCache.token;
-    }
-    if (!WECHAT_APP_ID || !WECHAT_APP_SECRET) {
-        throw new Error('请设置环境变量 WECHAT_APPID 和 WECHAT_APPSECRET');
-    }
-    const resp = await fetch(`https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${WECHAT_APP_ID}&secret=${WECHAT_APP_SECRET}`);
-    const data = await resp.json();
-    if (data.errcode) {
-        throw new Error(`微信 Token 获取失败: ${data.errmsg} (${data.errcode})`);
+import { boundedToolInteger, MCP_READ_ONLY_TOOL_DEFS, executeTool } from '../src/services/assistantTools.js';
+import { AssistantMemory } from '../src/services/assistantMemory.js';
+// ---- 本地微信数据工具 (复用 assistant 工具层, 微信 bot / MCP server 同源) ----
+// MCP 无微信用户身份, 记忆固定挂 'mcp' 用户下; 与 assistant 守护进程共用同一持久化文件
+const mcpMemory = new AssistantMemory();
+const MCP_TOOL_CTX = { userId: 'mcp', memory: mcpMemory };
+/** assistant 工具 (OpenAI function 格式) → MCP 工具格式; get_stats 并入现有 wechat.get_stats */
+const ASSISTANT_TOOLS = MCP_READ_ONLY_TOOL_DEFS
+    .filter(t => t.function.name !== 'get_stats')
+    .map(t => ({
+    name: `wechat.${t.function.name}`,
+    description: t.function.description,
+    inputSchema: t.function.parameters,
+}));
+const PKG_ROOT = resolvePackageRoot(import.meta.url);
+const BIZ_DAILY = join(PKG_ROOT, 'output', 'biz-daily');
+const VAULT_WIKI = join(PKG_ROOT, 'output', 'wechat-vault', 'Wiki', 'Concepts');
+const VAULT_INDEX = join(PKG_ROOT, 'output', 'wechat-vault', 'Wiki', '00-Overview.md');
+const REVIEWS = join(PKG_ROOT, 'output', 'reviews', 'Daily');
+const MCP_MESSAGE_LIMIT_DEFAULT = 100;
+const MCP_MESSAGE_LIMIT_MAX = 1000;
+function parseMessageDate(value, label) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    const date = safeDate(value);
+    if (!date)
+        throw new Error(`${label} 必须是有效的 YYYY-MM-DD 日期`);
+    const [year, month, day] = date.split('-').map(Number);
+    const start = new Date(year, month - 1, day);
+    if (start.getFullYear() !== year || start.getMonth() !== month - 1 || start.getDate() !== day) {
+        throw new Error(`${label} 必须是有效的日历日期`);
     }
-    _tokenCache = {
-        token: data.access_token,
-        expiresAt: Date.now() + (data.expires_in - 60) * 1000,
-    };
-    return _tokenCache.token;
+    return Math.floor(start.getTime() / 1000);
 }
-async function uploadWeChatImage(token, filePath) {
-    const buf = readFileSync(filePath);
-    const boundary = `----WeFlow${Date.now()}`;
-    const filename = filePath.replace(/^.*[\\/]/, '');
-    const ext = filename.split('.').pop()?.toLowerCase() || 'png';
-    const mimeType = ext === 'jpg' || ext === 'jpeg' ? 'image/jpeg' : 'image/png';
-    const header = [
-        `--${boundary}`,
-        `Content-Disposition: form-data; name="media"; filename="${filename}"`,
-        `Content-Type: ${mimeType}`,
-        '', '',
-    ].join('\r\n');
-    const trailer = `\r\n--${boundary}--\r\n`;
-    const headerBytes = new TextEncoder().encode(header);
-    const trailerBytes = new TextEncoder().encode(trailer);
-    const body = new Uint8Array(headerBytes.length + buf.length + trailerBytes.length);
-    body.set(headerBytes, 0);
-    body.set(buf, headerBytes.length);
-    body.set(trailerBytes, headerBytes.length + buf.length);
-    const resp = await fetch(`https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=${token}&type=image`, {
-        method: 'POST',
-        headers: { 'Content-Type': `multipart/form-data; boundary=${boundary}` },
-        body,
-    });
-    const data = await resp.json();
-    if (data.errcode) {
-        throw new Error(`上传封面图失败: ${data.errmsg} (${data.errcode})`);
-    }
-    return data.media_id;
+async function resolveMcpTalker(input) {
+    const contact = String(input || '').trim();
+    if (!contact)
+        throw new Error('contact 不能为空');
+    if (contact.startsWith('wxid_') || contact.includes('@chatroom') || contact.includes('@openim'))
+        return contact;
+    const sessions = await chatService.listSessions(contact, 20);
+    const exact = sessions.filter(session => session.username === contact || session.displayName === contact);
+    if (exact.length === 1)
+        return exact[0].username;
+    if (exact.length > 1 || sessions.length > 1)
+        throw new Error('contact 匹配到多个会话，请使用会话 ID');
+    if (sessions.length === 1)
+        return sessions[0].username;
+    throw new Error('未找到对应会话，请使用会话 ID 或准确的会话名称');
 }
-async function createWeChatDraft(token, articles) {
-    const resp = await fetch(`https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${token}`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ articles }),
-    });
-    const data = await resp.json();
-    if (data.errcode) {
-        throw new Error(`创建草稿失败: ${data.errmsg} (${data.errcode})`);
+async function exportMessagesForMcp(args) {
+    const limit = args.limit === undefined ? MCP_MESSAGE_LIMIT_DEFAULT : Number(args.limit);
+    if (!Number.isInteger(limit) || limit < 1 || limit > MCP_MESSAGE_LIMIT_MAX) {
+        throw new Error(`limit 必须是 1-${MCP_MESSAGE_LIMIT_MAX} 的整数`);
     }
-    return data.media_id;
+    const from = parseMessageDate(args.from, 'from');
+    const toStart = parseMessageDate(args.to, 'to');
+    const to = toStart === undefined ? undefined : toStart + 24 * 60 * 60 - 1;
+    if (from !== undefined && to !== undefined && from > to)
+        throw new Error('from 不能晚于 to');
+    const talker = await resolveMcpTalker(args.contact);
+    const messages = await chatService.getMessagesInRange(talker, limit, from, to);
+    return JSON.stringify(createWeFlowEnvelope(messages, new Date().toISOString(), {
+        requestedFrom: from,
+        requestedTo: to,
+        requestedLimit: limit,
+    }), null, 2);
 }
-const PKG_ROOT = resolve(join(import.meta.dirname || '.', '..'));
-const BIZ_DAILY = join(PKG_ROOT, 'output', 'biz-daily');
-const VAULT_WIKI = join(PKG_ROOT, 'output', 'wechat-vault', 'Wiki', 'Concepts');
-const VAULT_INDEX = join(PKG_ROOT, 'output', 'wechat-vault', 'Wiki', '00-Overview.md');
-const REVIEWS = join(PKG_ROOT, 'output', 'reviews', 'Daily');
 function parseFrontmatter(text) {
     if (!text.startsWith('---'))
         return {};
@@ -229,70 +269,12 @@ function searchArticles(args) {
     if (args.date) {
         articles = articles.filter(a => a.dateDir === args.date);
     }
-    const limit = Number(args.limit) || 20;
+    const limit = boundedToolInteger(args.limit, 20, 100);
     const top = articles.slice(0, limit);
     if (!top.length)
         return '未找到匹配文章';
     return top.map(a => `- [${a.date}] **${a.title || '(无标题)'}** — ${a.source || ''} [${a.topic || ''}] [${(a.tags || []).join(', ')}]\n  ${(a.description || '').slice(0, 120)}`).join('\n\n');
 }
-/** 自动生成封面图（纯色主题渐变 PNG，无外部依赖） */
-function generateCoverImage(title, theme) {
-    const colors = {
-        warm: [230, 126, 34],
-        default: [52, 152, 219],
-        minimal: [51, 51, 51],
-        green: [39, 174, 96],
-    };
-    const [r, g, b] = colors[theme] || colors.default;
-    const w = 900, h = 500;
-    function crc32(buf) {
-        let c = 0xffffffff;
-        for (let i = 0; i < buf.length; i++) {
-            c ^= buf[i];
-            for (let j = 0; j < 8; j++)
-                c = (c >>> 1) ^ (c & 1 ? 0xedb88320 : 0);
-        }
-        return (c ^ 0xffffffff) >>> 0;
-    }
-    function chunk(type, data) {
-        const head = Buffer.alloc(8);
-        head.writeUInt32BE(data.length, 0);
-        head.write(type, 4);
-        const crcBuf = Buffer.alloc(4);
-        crcBuf.writeUInt32BE(crc32(Buffer.concat([head.slice(4, 8), data])), 0);
-        return Buffer.concat([head, data, crcBuf]);
-    }
-    const signature = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
-    const ihdr = Buffer.alloc(13);
-    ihdr.writeUInt32BE(w, 0);
-    ihdr.writeUInt32BE(h, 4);
-    ihdr[8] = 8;
-    ihdr[9] = 2;
-    const raw = Buffer.alloc(h * (1 + w * 3));
-    for (let y = 0; y < h; y++) {
-        const offset = y * (1 + w * 3);
-        raw[offset] = 0;
-        for (let x = 0; x < w; x++) {
-            const px = offset + 1 + x * 3;
-            const darken = 0.9 + 0.1 * (y / h);
-            raw[px] = Math.floor(r * darken);
-            raw[px + 1] = Math.floor(g * darken);
-            raw[px + 2] = Math.floor(b * darken);
-        }
-    }
-    const png = Buffer.concat([
-        signature,
-        chunk('IHDR', ihdr),
-        chunk('IDAT', deflateSync(raw)),
-        chunk('IEND', Buffer.alloc(0)),
-    ]);
-    const tmpDir = join(PKG_ROOT, 'output', '.tmp');
-    if (!existsSync(tmpDir))
-        mkdirSync(tmpDir, { recursive: true });
-    const path = join(tmpDir, `cover-${Date.now()}.png`);
-    writeFileSync(path, png);
-    return path;
-}
 async function main() {
     const server = new Server({ name: 'weflow-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
@@ -348,7 +330,7 @@ async function main() {
             },
             {
                 name: 'wechat.get_stats',
-                description: '知识库统计概览',
+                description: '统计概览: 知识库文章/概念页 + 本地微信数据(会话数/收藏总数)',
                 inputSchema: { type: 'object', properties: {} },
             },
             {
@@ -363,22 +345,6 @@ async function main() {
                     required: ['content'],
                 },
             },
-            {
-                name: 'wechat.publish_article',
-                description: '排版并发布 Markdown 文章到微信公众号草稿箱。需要设置环境变量 WECHAT_APPID 和 WECHAT_APPSECRET',
-                inputSchema: {
-                    type: 'object',
-                    properties: {
-                        title: { type: 'string', description: '文章标题（≤64字符）' },
-                        content: { type: 'string', description: 'Markdown 格式的文章内容' },
-                        author: { type: 'string', description: '作者名（≤8字符），默认 "AI Assistant"' },
-                        theme: { type: 'string', description: '排版主题: default | warm | minimal | green，默认 default' },
-                        cover_image: { type: 'string', description: '封面图本地路径（可选）' },
-                        preview_only: { type: 'boolean', description: '仅排版预览不发布草稿，默认 false' },
-                    },
-                    required: ['title', 'content'],
-                },
-            },
             {
                 name: 'wechat.list_themes',
                 description: '列出微信公众号排版可用的所有主题',
@@ -407,6 +373,22 @@ async function main() {
                     required: ['url'],
                 },
             },
+            {
+                name: 'wechat.export_messages',
+                description: '以 weflow-message/v1 JSON 返回指定会话的本地消息。只读，不返回数据库路径、密钥或配置。',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        contact: { type: 'string', description: '会话 ID，或唯一匹配的会话名称' },
+                        limit: { type: 'number', description: '返回上限，默认 100，最大 1000' },
+                        from: { type: 'string', description: '起始日期 YYYY-MM-DD（含当天）' },
+                        to: { type: 'string', description: '结束日期 YYYY-MM-DD（含当天）' },
+                    },
+                    required: ['contact'],
+                },
+            },
+            // ---- 本地微信数据 (与 weflow-cli assistant / 微信 bot 共享工具层) ----
+            ...ASSISTANT_TOOLS,
         ],
     }));
     server.setRequestHandler(CallToolRequestSchema, async (request) => {
@@ -417,9 +399,11 @@ async function main() {
                     return { content: [{ type: 'text', text: searchArticles(args) }] };
                 case 'wechat.get_daily': {
                     const dates = existsSync(BIZ_DAILY) ? readdirSync(BIZ_DAILY).sort().reverse() : [];
-                    const date = String(args.date || dates[0] || '');
-                    const readme = join(BIZ_DAILY, date, 'README.md');
-                    if (!existsSync(readme))
+                    if (args.date && !safeDate(args.date))
+                        return { content: [{ type: 'text', text: '日期无效，请使用 YYYY-MM-DD' }] };
+                    const date = safeDate(args.date) || dates.find(d => /^\d{4}-\d{2}-\d{2}$/.test(d)) || '';
+                    const readme = safeChildPath(BIZ_DAILY, join(date, 'README.md'));
+                    if (!readme || !existsSync(readme))
                         return { content: [{ type: 'text', text: `未找到 ${date} 的日报` }] };
                     return { content: [{ type: 'text', text: readFileSync(readme, 'utf-8') }] };
                 }
@@ -430,9 +414,12 @@ async function main() {
                 }
                 case 'wechat.get_concept': {
                     const name = String(args.name);
+                    if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+                        return { content: [{ type: 'text', text: '概念名无效' }] };
+                    }
                     for (const ext of ['', '.md']) {
-                        const path = join(VAULT_WIKI, name + ext);
-                        if (existsSync(path)) {
+                        const path = safeChildPath(VAULT_WIKI, name + ext);
+                        if (path && existsSync(path)) {
                             return { content: [{ type: 'text', text: readFileSync(path, 'utf-8') }] };
                         }
                     }
@@ -440,7 +427,9 @@ async function main() {
                     if (existsSync(VAULT_WIKI)) {
                         for (const f of readdirSync(VAULT_WIKI)) {
                             if (f.includes(name)) {
-                                return { content: [{ type: 'text', text: readFileSync(join(VAULT_WIKI, f), 'utf-8') }] };
+                                const path = safeChildPath(VAULT_WIKI, f);
+                                if (path)
+                                    return { content: [{ type: 'text', text: readFileSync(path, 'utf-8') }] };
                             }
                         }
                     }
@@ -451,7 +440,7 @@ async function main() {
                     const date = String(args.date || '');
                     let path;
                     if (date) {
-                        path = join(REVIEWS, `Daily-${date}.md`);
+                        path = safeDate(date) ? join(REVIEWS, `Daily-${date}.md`) : '';
                     }
                     else {
                         path = files.length ? join(REVIEWS, files[0]) : '';
@@ -489,72 +478,6 @@ async function main() {
                             }]
                     };
                 }
-                case 'wechat.publish_article': {
-                    const title = String(args.title || '').slice(0, 64);
-                    const content = String(args.content || '');
-                    const author = String(args.author || 'AI Assistant').slice(0, 8);
-                    const theme = String(args.theme || 'default');
-                    const coverImage = args.cover_image ? String(args.cover_image) : '';
-                    const previewOnly = args.preview_only === true || args.preview_only === 'true';
-                    if (!title || !content) {
-                        return { content: [{ type: 'text', text: '错误: title 和 content 不能为空' }] };
-                    }
-                    // 1. 排版
-                    const html = formatWeChatArticle(content, { theme: theme });
-                    const wordCount = html.replace(/<[^>]*>/g, '').replace(/\s+/g, '').length;
-                    if (previewOnly) {
-                        return {
-                            content: [{
-                                    type: 'text',
-                                    text: [
-                                        `[仅预览] 标题: ${title}`,
-                                        `作者: ${author} | 主题: ${theme} | 字数: ${wordCount}`,
-                                        `---`,
-                                        html,
-                                    ].join('\n')
-                                }]
-                        };
-                    }
-                    // 2. 发布到草稿箱
-                    try {
-                        const token = await getWeChatToken();
-                        // 上传封面图（如果提供，否则自动生成）
-                        let thumbMediaId = '';
-                        if (coverImage && existsSync(coverImage)) {
-                            thumbMediaId = await uploadWeChatImage(token, coverImage);
-                        }
-                        else {
-                            // 自动生成封面图
-                            const autoCover = generateCoverImage(title, theme);
-                            thumbMediaId = await uploadWeChatImage(token, autoCover);
-                        }
-                        // 创建草稿
-                        const mediaId = await createWeChatDraft(token, [{
-                                title,
-                                author,
-                                digest: html.replace(/<[^>]*>/g, '').replace(/\s+/g, ' ').slice(0, 120),
-                                content: html,
-                                thumb_media_id: thumbMediaId || undefined,
-                            }]);
-                        return {
-                            content: [{
-                                    type: 'text',
-                                    text: [
-                                        `✅ 已发布到公众号草稿箱`,
-                                        `media_id: ${mediaId}`,
-                                        `标题: ${title}`,
-                                        `作者: ${author} | 主题: ${theme} | 字数: ${wordCount}`,
-                                        `封面图: ${thumbMediaId ? '已上传' : '未提供（使用默认）'}`,
-                                        '',
-                                        `请登录 mp.weixin.qq.com 草稿箱查看和正式发布。`,
-                                    ].join('\n')
-                                }]
-                        };
-                    }
-                    catch (e) {
-                        return { content: [{ type: 'text', text: `发布失败: ${e.message}\n\n——以下为排版预览——\n\n${html}` }] };
-                    }
-                }
                 case 'wechat.get_stats': {
                     const articles = scanArticles();
                     const dates = [...new Set(articles.map(a => a.dateDir))].sort();
@@ -570,13 +493,22 @@ async function main() {
                         if (m)
                             stats += `- 概念页: ${m[1]} 个\n`;
                     }
+                    // 追加本地微信数据统计 (会话/收藏; 数据库未配置时返回提示)
+                    const chatStats = await executeTool('get_stats', {}, MCP_TOOL_CTX);
+                    stats += `\n## 本地微信数据\n\n${chatStats}\n`;
                     return { content: [{ type: 'text', text: stats }] };
                 }
                 case 'wechat.search_public': {
                     const keyword = String(args.keyword || '').trim();
                     if (!keyword)
                         return { content: [{ type: 'text', text: '错误: keyword 不能为空' }] };
-                    const limit = Number(args.limit) || 10;
+                    let limit = 10;
+                    try {
+                        limit = boundedToolInteger(args.limit, 10, 20);
+                    }
+                    catch {
+                        return { content: [{ type: 'text', text: '错误: limit 必须是 1-20 的整数' }] };
+                    }
                     try {
                         // 使用搜狗微信搜索
                         const resp = await fetch(`https://weixin.sogou.com/weixin?type=2&query=${encodeURIComponent(keyword)}`, {
@@ -586,8 +518,9 @@ async function main() {
                                 'Accept': 'text/html',
                                 'Accept-Language': 'zh-CN,zh;q=0.9',
                             },
+                            signal: AbortSignal.timeout(20_000),
                         });
-                        const html = await resp.text();
+                        const html = await readResponseTextLimited(resp, 2 * 1024 * 1024);
                         // 从搜狗结果中提取标题、公众号名、摘要
                         // 搜狗将结果放在 li 标签中，每篇文章包含标题链接 + 摘要
                         const items = [];
@@ -645,16 +578,16 @@ async function main() {
                                 }]
                         };
                     }
-                    catch (e) {
-                        return { content: [{ type: 'text', text: `搜索失败: ${e.message}` }] };
+                    catch {
+                        return { content: [{ type: 'text', text: '搜索失败，请检查网络连接后重试' }] };
                     }
                 }
                 case 'wechat.fetch_article': {
                     const url = String(args.url || '').trim();
                     if (!url)
                         return { content: [{ type: 'text', text: '错误: url 不能为空' }] };
-                    if (!url.includes('mp.weixin.qq.com')) {
-                        return { content: [{ type: 'text', text: '错误: 仅支持微信公众号文章链接 (mp.weixin.qq.com)' }] };
+                    if (!isAllowedWeChatArticleUrl(url)) {
+                        return { content: [{ type: 'text', text: '错误: 仅支持 HTTPS 微信公众号文章链接 (mp.weixin.qq.com)' }] };
                     }
                     try {
                         const article = await fetchWeChatArticle(url);
@@ -671,16 +604,25 @@ async function main() {
                                 }]
                         };
                     }
-                    catch (e) {
-                        return { content: [{ type: 'text', text: `抓取失败: ${e.message}\n\n提示: 部分文章需要微信客户端环境才能访问，可尝试在微信中打开后复制链接。` }] };
+                    catch {
+                        return { content: [{ type: 'text', text: '抓取失败，请检查链接和网络连接。部分文章需要微信客户端环境才能访问。' }] };
                     }
                 }
-                default:
+                case 'wechat.export_messages': {
+                    return { content: [{ type: 'text', text: await exportMessagesForMcp(args) }] };
+                }
+                default: {
+                    // assistant 工具层统一分发 (wechat.list_sessions / wechat.get_messages / ...)
+                    if (name.startsWith('wechat.')) {
+                        const text = await executeTool(name.slice('wechat.'.length), args, MCP_TOOL_CTX);
+                        return { content: [{ type: 'text', text }] };
+                    }
                     return { content: [{ type: 'text', text: `未知工具: ${name}` }] };
+                }
             }
         }
-        catch (e) {
-            return { content: [{ type: 'text', text: `错误: ${e.message}` }] };
+        catch {
+            return { content: [{ type: 'text', text: '工具执行失败，请检查输入、本地配置或运行状态' }] };
         }
     });
     const transport = new StdioServerTransport();