ylib-wecom-openclaw-plugin 2026.4.29

package/dist/src/endpoint-event-adapter.d.ts

@@ -0,0 +1,15 @@
+export declare type AdaptedEvent = {
+    parsed: boolean;
+    eventType: string;
+    subAgentStartLine?: string;
+    subAgentRunId?: string;
+    finalAnswerText?: string;
+    errorText?: string;
+    confirmationText?: string;
+    confirmationDedupKey?: string;
+    ignoreAsNoise?: boolean;
+};
+export declare function adaptEndpointEvent(params: {
+    rawText: string;
+    currentEventType?: string;
+}): AdaptedEvent;

package/dist/src/endpoint-event-adapter.js

@@ -0,0 +1,427 @@
+"use strict";
+exports.__esModule = true;
+exports.adaptEndpointEvent = void 0;
+function asObj(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function toText(value) {
+    if (value == null)
+        return "";
+    if (typeof value === "string")
+        return value.trim();
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return "";
+}
+function parseJsonObjectSafely(raw) {
+    try {
+        var parsed = JSON.parse(raw);
+        return asObj(parsed);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function parseEventContentObject(payload) {
+    var raw = payload.eventContent;
+    if (typeof raw === "string")
+        return parseJsonObjectSafely(raw);
+    return asObj(raw);
+}
+function getContentTypeFromObject(value) {
+    // Python IM 端点的 content_type 可能在 eventContent 或 data 内，并存在 snake/camel 两种写法。
+    return (toText(value === null || value === void 0 ? void 0 : value.content_type) || toText(value === null || value === void 0 ? void 0 : value.contentType)).toLowerCase();
+}
+function extractContentTextFromPayload(payload) {
+    var eventContentObj = parseEventContentObject(payload);
+    var rawEventContent = eventContentObj === null || eventContentObj === void 0 ? void 0 : eventContentObj.content;
+    if (typeof rawEventContent === "string")
+        return rawEventContent;
+    var fromEvent = toText(rawEventContent);
+    if (fromEvent)
+        return fromEvent;
+    var dataObj = asObj(payload.data);
+    var rawDataContent = dataObj === null || dataObj === void 0 ? void 0 : dataObj.content;
+    if (typeof rawDataContent === "string")
+        return rawDataContent;
+    return toText(rawDataContent);
+}
+function isFinalAnswerPayload(payload) {
+    // final_answer 只按结构化 content_type 判断，不用文本内容或 responseId 猜测。
+    var eventContentObj = parseEventContentObject(payload);
+    if (getContentTypeFromObject(eventContentObj) === "final_answer")
+        return true;
+    return getContentTypeFromObject(asObj(payload.data)) === "final_answer";
+}
+function extractFinalAnswerTextFromNestedMessage(item) {
+    var dataObj = asObj(item.data) || parseEventContentObject(item);
+    if (getContentTypeFromObject(dataObj) !== "final_answer")
+        return "";
+    var rawContent = dataObj === null || dataObj === void 0 ? void 0 : dataObj.content;
+    if (typeof rawContent === "string")
+        return rawContent;
+    return toText(rawContent);
+}
+function extractFinalAnswerTextFromUpsertRecord(payload) {
+    var _a;
+    // 前端同款流中 final_answer 可能只存在于 upsert_record 的嵌套 messages，
+    // monitor 开启“只显示结论”时需要这个字段补齐最终答案。
+    var eventContentObj = parseEventContentObject(payload);
+    var messageObj = asObj((_a = asObj(eventContentObj === null || eventContentObj === void 0 ? void 0 : eventContentObj.extParams)) === null || _a === void 0 ? void 0 : _a.message);
+    var externalObj = asObj(messageObj === null || messageObj === void 0 ? void 0 : messageObj.external);
+    var messages = Array.isArray(externalObj === null || externalObj === void 0 ? void 0 : externalObj.messages) ? externalObj.messages : [];
+    // 从后往前取最新 final_answer，避免输出历史中间态。
+    for (var i = messages.length - 1; i >= 0; i -= 1) {
+        var item = asObj(messages[i]);
+        if (!item)
+            continue;
+        var text = extractFinalAnswerTextFromNestedMessage(item);
+        if (text)
+            return text;
+    }
+    return "";
+}
+function extractErrorTextFromPayload(payload) {
+    var _a, _b;
+    var eventContentObj = parseEventContentObject(payload);
+    var source = eventContentObj || payload;
+    var message = toText(source.msg) ||
+        toText(source.message) ||
+        toText(source.error) ||
+        toText((_a = asObj(source.error)) === null || _a === void 0 ? void 0 : _a.message);
+    var solution = toText((_b = asObj(source.extraInfo)) === null || _b === void 0 ? void 0 : _b.solution);
+    var code = toText(source.code);
+    var lines = [];
+    if (message)
+        lines.push(message);
+    if (solution && solution !== message)
+        lines.push(solution);
+    if (!lines.length && code)
+        lines.push("\u9519\u8BEF\u7801\uFF1A" + code);
+    return lines.join("\n").trim();
+}
+function resolveEventType(currentEventType, payload) {
+    var current = String(currentEventType || "").trim().toLowerCase();
+    var fromPayload = toText(payload.eventType).toLowerCase();
+    if ((!current || current === "message") && fromPayload)
+        return fromPayload;
+    return current || fromPayload;
+}
+function getResponseId(payload) {
+    return toText(payload.responseId) || toText(payload.response_id);
+}
+function getAgentRunId(payload) {
+    var fromRoot = toText(payload.agent_run_id) || toText(payload.agentRunId);
+    if (fromRoot)
+        return fromRoot;
+    var dataObj = asObj(payload.data);
+    var dataAgent = asObj(dataObj === null || dataObj === void 0 ? void 0 : dataObj.agent);
+    var fromData = toText(dataAgent === null || dataAgent === void 0 ? void 0 : dataAgent.agent_run_id) || toText(dataAgent === null || dataAgent === void 0 ? void 0 : dataAgent.agentRunId);
+    if (fromData)
+        return fromData;
+    var eventObj = parseEventContentObject(payload);
+    var eventAgent = asObj(eventObj === null || eventObj === void 0 ? void 0 : eventObj.agent);
+    return toText(eventAgent === null || eventAgent === void 0 ? void 0 : eventAgent.agent_run_id) || toText(eventAgent === null || eventAgent === void 0 ? void 0 : eventAgent.agentRunId);
+}
+function toReadableActionStatus(rawStatus) {
+    var status = toText(rawStatus).toLowerCase();
+    if (!status)
+        return "未知";
+    if (status === "running")
+        return "进行中";
+    if (status === "pending")
+        return "待确认";
+    if (status === "completed")
+        return "已完成";
+    if (status === "failed")
+        return "失败";
+    if (status === "cancelled")
+        return "已取消";
+    return status;
+}
+function toReadableConfirmationType(rawType) {
+    var type = toText(rawType).toLowerCase();
+    if (!type)
+        return "未知";
+    if (type === "single_choice" || type === "single-choice" || type === "radio")
+        return "单选";
+    if (type === "multiple_choice" ||
+        type === "multi_choice" ||
+        type === "multiple-choice" ||
+        type === "checkbox") {
+        return "多选";
+    }
+    return type;
+}
+function normalizeConfirmationStatus(rawStatus) {
+    return toText(rawStatus).toLowerCase();
+}
+function isPendingConfirmationStatus(rawStatus) {
+    return normalizeConfirmationStatus(rawStatus) === "pending";
+}
+function buildReadableConfirmationRequests(metadata) {
+    var lines = [];
+    var requestsRaw = metadata === null || metadata === void 0 ? void 0 : metadata.requests;
+    if (!Array.isArray(requestsRaw) || requestsRaw.length === 0)
+        return lines;
+    lines.push("确认请求列表：", "");
+    requestsRaw.forEach(function (requestItem, index) {
+        var request = asObj(requestItem);
+        if (!request)
+            return;
+        var type = toText(request.type);
+        var title = toText(request.title) || "\u786E\u8BA4\u8BF7\u6C42 " + (index + 1);
+        var question = toText(request.question);
+        lines.push("\u95EE\u9898 " + (index + 1) + "\uFF1A" + title, "");
+        if (type)
+            lines.push("\u7C7B\u578B\uFF1A" + toReadableConfirmationType(type), "");
+        if (question)
+            lines.push("\u95EE\u9898\u5185\u5BB9\uFF1A" + question, "");
+        var optionsRaw = request.options;
+        if (Array.isArray(optionsRaw) && optionsRaw.length > 0) {
+            lines.push("选项：", "");
+            optionsRaw.forEach(function (optionItem, optionIndex) {
+                var option = asObj(optionItem);
+                var optionLabel = toText(option === null || option === void 0 ? void 0 : option.label) || toText(option === null || option === void 0 ? void 0 : option.value) || toText(optionItem);
+                lines.push(optionIndex + 1 + ". " + (optionLabel || "\u9009\u9879" + (optionIndex + 1)));
+            });
+        }
+        else {
+            lines.push("选项：无");
+        }
+        lines.push("");
+    });
+    return lines;
+}
+function extractConfirmationActionPlainText(payload, eventType) {
+    var _a;
+    if (eventType !== "action")
+        return null;
+    var actionPayload = (_a = parseEventContentObject(payload)) !== null && _a !== void 0 ? _a : payload;
+    var toolName = toText(actionPayload.toolName).toLowerCase();
+    var actionType = toText(actionPayload.actionType).toLowerCase();
+    if (toolName !== "request_confirmation" && actionType !== "request_confirmation")
+        return null;
+    if (!isPendingConfirmationStatus(actionPayload.status))
+        return null;
+    var title = toText(actionPayload.title);
+    var description = toText(actionPayload.description);
+    var toolCallId = toText(actionPayload.toolCallId);
+    var responseId = getResponseId(payload);
+    var requestId = toText(payload.requestId);
+    var metadata = asObj(actionPayload.metadata);
+    var lines = ["【用户确认请求】", "", "\u72B6\u6001\uFF1A" + toReadableActionStatus(actionPayload.status), ""];
+    if (title)
+        lines.push("\u6807\u9898\uFF1A" + title);
+    if (description)
+        lines.push("\u8BF4\u660E\uFF1A" + description);
+    if (toolCallId || responseId || requestId)
+        lines.push("");
+    var reqLines = buildReadableConfirmationRequests(metadata);
+    if (reqLines.length > 0)
+        lines.push.apply(lines, reqLines);
+    return lines.join("\n").trim();
+}
+function extractConfirmationRequestPlainText(payload, eventType) {
+    var _a;
+    if (eventType !== "confirmation_request")
+        return null;
+    var eventContent = (_a = parseEventContentObject(payload)) !== null && _a !== void 0 ? _a : asObj(payload);
+    if (!eventContent || !isPendingConfirmationStatus(eventContent.status))
+        return null;
+    var requests = Array.isArray(eventContent.requests) ? eventContent.requests : [];
+    var responseId = getResponseId(payload);
+    var requestId = toText(payload.requestId);
+    var lines = ["【用户确认请求】", "\u72B6\u6001\uFF1A" + toReadableActionStatus(eventContent.status), ""];
+    if (responseId || requestId)
+        lines.push("");
+    var reqLines = buildReadableConfirmationRequests({ requests: requests });
+    if (reqLines.length > 0)
+        lines.push.apply(lines, reqLines);
+    lines.push("\u786E\u8BA4\u95EE\u9898\u6570\uFF1A" + requests.length);
+    return lines.join("\n").trim();
+}
+function isLikelyConfirmationPayload(payload) {
+    if (!isPendingConfirmationStatus(payload.status))
+        return false;
+    var merged = (toText(payload.title) + "\n" + toText(payload.content)).trim();
+    return merged.includes("确认") && merged.includes("选项");
+}
+function buildConfirmationSummaryFromLooseText(text) {
+    var _a;
+    var normalized = String(text || "").replace(/\r/g, "\n").trim();
+    if (!normalized)
+        return null;
+    var question = normalized;
+    var optionsPart = "";
+    var optionAnchor = normalized.match(/选项(?:分别)?(?:为|是)\s*[:：]\s*([\s\S]+)/) ||
+        normalized.match(/选项\s*[:：]\s*([\s\S]+)/);
+    if (optionAnchor) {
+        optionsPart = String(optionAnchor[1] || "").trim();
+        question = normalized.slice(0, (_a = optionAnchor.index) !== null && _a !== void 0 ? _a : normalized.length).trim();
+    }
+    var rawOptions = optionsPart
+        ? optionsPart
+            .split(/[、,，;；\n]+/)
+            .map(function (item) { return item.trim(); })
+            .filter(Boolean)
+        : [];
+    var uniqueOptions = Array.from(new Set(rawOptions));
+    var choiceType = /多选/.test(normalized) || /multiple/.test(normalized.toLowerCase()) ? "多选" : "单选";
+    var lines = ["【用户确认请求】", "状态：待确认", "", "确认请求列表：", ""];
+    lines.push("\u95EE\u9898 1\uFF1A" + (question || "确认请求"));
+    lines.push("\u7C7B\u578B\uFF1A" + choiceType);
+    if (question)
+        lines.push("\u95EE\u9898\u5185\u5BB9\uFF1A" + question);
+    if (uniqueOptions.length > 0) {
+        lines.push("选项：");
+        uniqueOptions.forEach(function (opt, idx) { return lines.push(idx + 1 + ". " + opt); });
+    }
+    else {
+        lines.push("选项：无");
+    }
+    lines.push("", "确认问题数：1");
+    return lines.join("\n").trim();
+}
+function extractConfirmationDedupKey(payload, eventType) {
+    var _a, _b;
+    var responseId = getResponseId(payload);
+    if (!responseId)
+        return null;
+    if (eventType === "confirmation_request") {
+        var eventContent = (_a = parseEventContentObject(payload)) !== null && _a !== void 0 ? _a : payload;
+        if (!isPendingConfirmationStatus(eventContent.status))
+            return null;
+        return "confirmation_request:" + responseId;
+    }
+    if (eventType === "action") {
+        var actionPayload = (_b = parseEventContentObject(payload)) !== null && _b !== void 0 ? _b : payload;
+        var toolName = toText(actionPayload.toolName).toLowerCase();
+        var actionType = toText(actionPayload.actionType).toLowerCase();
+        if (!isPendingConfirmationStatus(actionPayload.status))
+            return null;
+        if (toolName === "request_confirmation" || actionType === "request_confirmation") {
+            return "action_confirmation:" + responseId;
+        }
+        return null;
+    }
+    if ((eventType === "title" || eventType === "tool_wait") && isLikelyConfirmationPayload(payload)) {
+        return "loose_confirmation:" + responseId;
+    }
+    return null;
+}
+function hasEventMarkers(payload) {
+    return Boolean(toText(payload.eventType) ||
+        toText(payload.type) ||
+        payload.eventContent !== undefined ||
+        payload.responseId !== undefined ||
+        payload.response_id !== undefined ||
+        payload.agent_run_id !== undefined ||
+        payload.agentRunId !== undefined);
+}
+function adaptEndpointEvent(params) {
+    var rawText = String(params.rawText || "");
+    var parsed = parseJsonObjectSafely(rawText.trim());
+    if (!parsed || !hasEventMarkers(parsed)) {
+        return { parsed: false, eventType: "" };
+    }
+    var eventType = resolveEventType(params.currentEventType || "", parsed);
+    var payloadEventType = toText(parsed.eventType).toLowerCase();
+    var explicitType = toText(parsed.type).toLowerCase();
+    // call_sub_agent 是子代理边界的起点，返回提示文本和 run_id 给调用方做去重与后续过滤。
+    if (eventType === "call_sub_agent" ||
+        payloadEventType === "call_sub_agent" ||
+        explicitType === "call_sub_agent") {
+        var dataObj = asObj(parsed.data) || parseEventContentObject(parsed);
+        var agentObj = asObj(dataObj === null || dataObj === void 0 ? void 0 : dataObj.agent);
+        var agentName = toText(agentObj === null || agentObj === void 0 ? void 0 : agentObj.name) || toText(agentObj === null || agentObj === void 0 ? void 0 : agentObj.agent_id) || toText(parsed.name) || "未知子代理";
+        var agentRunId_1 = toText(agentObj === null || agentObj === void 0 ? void 0 : agentObj.agent_run_id) || getAgentRunId(parsed);
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentStartLine: "\n\u8C03\u7528 sub agent\uFF1A" + agentName + "\n\n",
+            subAgentRunId: agentRunId_1 || undefined
+        };
+    }
+    var agentRunId = getAgentRunId(parsed);
+    if (eventType === "content" && isFinalAnswerPayload(parsed)) {
+        // content 事件携带 final_answer 时，adapter 只提取语义化文本，不直接决定是否输出。
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            finalAnswerText: extractContentTextFromPayload(parsed)
+        };
+    }
+    if (eventType === "upsert_record") {
+        // upsert_record 自身不应作为普通文本透出，只在其中补取 final_answer。
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            finalAnswerText: extractFinalAnswerTextFromUpsertRecord(parsed),
+            ignoreAsNoise: true
+        };
+    }
+    if (eventType === "error") {
+        // error 必须语义化透出，调用方会保证它不受 sub-agent 隐藏和 final-only 限制。
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            errorText: extractErrorTextFromPayload(parsed)
+        };
+    }
+    var dedupKey = extractConfirmationDedupKey(parsed, eventType);
+    var actionText = extractConfirmationActionPlainText(parsed, eventType);
+    if (actionText) {
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            confirmationText: actionText,
+            confirmationDedupKey: dedupKey || undefined
+        };
+    }
+    var requestText = extractConfirmationRequestPlainText(parsed, eventType);
+    if (requestText) {
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            confirmationText: requestText,
+            confirmationDedupKey: dedupKey || undefined
+        };
+    }
+    if ((eventType === "title" || eventType === "tool_wait") && isLikelyConfirmationPayload(parsed)) {
+        var eventContent = parseEventContentObject(parsed);
+        var looseText = toText(parsed.content) || toText(parsed.title) || toText(eventContent) || "";
+        var summary = buildConfirmationSummaryFromLooseText(looseText);
+        if (summary) {
+            return {
+                parsed: true,
+                eventType: eventType,
+                subAgentRunId: agentRunId || undefined,
+                confirmationText: summary,
+                confirmationDedupKey: dedupKey || undefined
+            };
+        }
+    }
+    if (eventType &&
+        eventType !== "message" &&
+        eventType !== "content" &&
+        eventType !== "resource" &&
+        eventType !== "error") {
+        return {
+            parsed: true,
+            eventType: eventType,
+            subAgentRunId: agentRunId || undefined,
+            ignoreAsNoise: true
+        };
+    }
+    return { parsed: true, eventType: eventType, subAgentRunId: agentRunId || undefined };
+}
+exports.adaptEndpointEvent = adaptEndpointEvent;

package/dist/src/group-policy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * 企业微信群组访问控制模块
+ *
+ * 负责群组策略检查（groupPolicy、群组白名单、群内发送者白名单）
+ */
+import type { OpenClawConfig } from "ylib-openclaw/plugin-sdk";
+import type { RuntimeEnv } from "ylib-openclaw/plugin-sdk";
+import type { ResolvedWeComAccount } from "./utils.js";
+/**
+ * 群组策略检查结果
+ */
+export interface GroupPolicyCheckResult {
+    /** 是否允许继续处理消息 */
+    allowed: boolean;
+}
+/**
+ * 检查群组策略访问控制
+ * @returns 检查结果，包含是否允许继续处理
+ */
+export declare function checkGroupPolicy(params: {
+    chatId: string;
+    senderId: string;
+    account: ResolvedWeComAccount;
+    config: OpenClawConfig;
+    runtime: RuntimeEnv;
+}): GroupPolicyCheckResult;
+/**
+ * 检查发送者是否在允许列表中（通用）
+ */
+export declare function isSenderAllowed(senderId: string, allowFrom: string[]): boolean;

package/dist/src/group-policy.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * 企业微信群组访问控制模块
+ *
+ * 负责群组策略检查（groupPolicy、群组白名单、群内发送者白名单）
+ */
+exports.__esModule = true;
+exports.isSenderAllowed = exports.checkGroupPolicy = void 0;
+var const_js_1 = require("./const.js");
+// ============================================================================
+// 内部辅助函数
+// ============================================================================
+/**
+ * 解析企业微信群组配置
+ */
+function resolveWeComGroupConfig(params) {
+    var _a, _b, _c;
+    var groups = (_b = (_a = params.cfg) === null || _a === void 0 ? void 0 : _a.groups) !== null && _b !== void 0 ? _b : {};
+    var wildcard = groups["*"];
+    var groupId = (_c = params.groupId) === null || _c === void 0 ? void 0 : _c.trim();
+    if (!groupId) {
+        return undefined;
+    }
+    var direct = groups[groupId];
+    if (direct) {
+        return direct;
+    }
+    var lowered = groupId.toLowerCase();
+    var matchKey = Object.keys(groups).find(function (key) { return key.toLowerCase() === lowered; });
+    if (matchKey) {
+        return groups[matchKey];
+    }
+    return wildcard;
+}
+/**
+ * 检查群组是否在允许列表中
+ */
+function isWeComGroupAllowed(params) {
+    var groupPolicy = params.groupPolicy;
+    if (groupPolicy === "disabled") {
+        return false;
+    }
+    if (groupPolicy === "open") {
+        return true;
+    }
+    // allowlist 模式：检查群组是否在允许列表中
+    var normalizedAllowFrom = params.allowFrom.map(function (entry) {
+        return String(entry).replace(new RegExp("^" + const_js_1.CHANNEL_ID + ":", "i"), "").trim();
+    });
+    if (normalizedAllowFrom.includes("*")) {
+        return true;
+    }
+    var normalizedGroupId = params.groupId.trim();
+    return normalizedAllowFrom.some(function (entry) { return entry === normalizedGroupId || entry.toLowerCase() === normalizedGroupId.toLowerCase(); });
+}
+/**
+ * 检查群组内发送者是否在允许列表中
+ */
+function isGroupSenderAllowed(params) {
+    var _a;
+    var senderId = params.senderId, groupId = params.groupId, wecomConfig = params.wecomConfig;
+    var groupConfig = resolveWeComGroupConfig({
+        cfg: wecomConfig,
+        groupId: groupId
+    });
+    var perGroupSenderAllowFrom = ((_a = groupConfig === null || groupConfig === void 0 ? void 0 : groupConfig.allowFrom) !== null && _a !== void 0 ? _a : []).map(function (v) { return String(v); });
+    if (perGroupSenderAllowFrom.length === 0) {
+        return true;
+    }
+    if (perGroupSenderAllowFrom.includes("*")) {
+        return true;
+    }
+    return perGroupSenderAllowFrom.some(function (entry) {
+        var normalized = entry.replace(new RegExp("^" + const_js_1.CHANNEL_ID + ":", "i"), "").trim();
+        return normalized === senderId || normalized === "user:" + senderId;
+    });
+}
+// ============================================================================
+// 公开 API
+// ============================================================================
+/**
+ * 检查群组策略访问控制
+ * @returns 检查结果，包含是否允许继续处理
+ */
+function checkGroupPolicy(params) {
+    var _a, _b, _c, _d;
+    var chatId = params.chatId, senderId = params.senderId, account = params.account, runtime = params.runtime;
+    // 使用 account.config（已经过多账号合并），而非顶层 config.channels.wecom
+    // 避免多账户模式下 groupAllowFrom / groups 等字段取不到账号级配置
+    var wecomConfig = account.config;
+    var groupPolicy = (_a = wecomConfig.groupPolicy) !== null && _a !== void 0 ? _a : "open";
+    var groupAllowFrom = (_b = wecomConfig.groupAllowFrom) !== null && _b !== void 0 ? _b : [];
+    var groupAllowed = isWeComGroupAllowed({
+        groupPolicy: groupPolicy,
+        allowFrom: groupAllowFrom,
+        groupId: chatId
+    });
+    if (!groupAllowed) {
+        (_c = runtime.log) === null || _c === void 0 ? void 0 : _c.call(runtime, "[WeCom] Group " + chatId + " not allowed (groupPolicy=" + groupPolicy + ")");
+        return { allowed: false };
+    }
+    var senderAllowed = isGroupSenderAllowed({
+        senderId: senderId,
+        groupId: chatId,
+        wecomConfig: wecomConfig
+    });
+    if (!senderAllowed) {
+        (_d = runtime.log) === null || _d === void 0 ? void 0 : _d.call(runtime, "[WeCom] Sender " + senderId + " not in group " + chatId + " sender allowlist");
+        return { allowed: false };
+    }
+    return { allowed: true };
+}
+exports.checkGroupPolicy = checkGroupPolicy;
+/**
+ * 检查发送者是否在允许列表中（通用）
+ */
+function isSenderAllowed(senderId, allowFrom) {
+    if (allowFrom.includes("*")) {
+        return true;
+    }
+    return allowFrom.some(function (entry) {
+        var normalized = entry.replace(new RegExp("^" + const_js_1.CHANNEL_ID + ":", "i"), "").trim();
+        return normalized === senderId || normalized === "user:" + senderId;
+    });
+}
+exports.isSenderAllowed = isSenderAllowed;

package/dist/src/http.d.ts

@@ -0,0 +1,27 @@
+/// <reference types="node" />
+/**
+ * **WecomHttpOptions (HTTP 选项)**
+ *
+ * @property proxyUrl 代理服务器地址
+ * @property timeoutMs 请求超时时间 (毫秒)
+ * @property signal AbortSignal 信号
+ */
+export declare type WecomHttpOptions = {
+    proxyUrl?: string;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+};
+/**
+ * **wecomFetch (统一 HTTP 请求)**
+ *
+ * 基于 `undici` 的 fetch 封装，自动处理 ProxyAgent 和 Timeout。
+ * 所有对企业微信 API 的调用都应经过此函数。
+ */
+export declare function wecomFetch(input: string | URL, init?: RequestInit, opts?: WecomHttpOptions): Promise<Response>;
+/**
+ * **readResponseBodyAsBuffer (读取响应 Body)**
+ *
+ * 将 Response Body 读取为 Buffer，支持最大字节限制以防止内存溢出。
+ * 适用于下载媒体文件等场景。
+ */
+export declare function readResponseBodyAsBuffer(res: Response, maxBytes?: number): Promise<Buffer>;