fix(wecom): support pic_url and fix AES key base64 padding for image …

[zogwei]

…decryption

WeCom AI Bot sends image URLs in the pic_url field (not url). Additionally, the aeskey is 43-character base64 without standard padding, causing base64.b64decode() to raise Incorrect padding.

Changes:

• Recognize pic_url in inbound media references
• Add _decode_wecom_aes_key() to handle unpadded base64
• Use the new decoder in _decrypt_file_bytes()
• Add _try_decrypt_variants() as fallback for different AES modes

What does this PR do?

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[alt-glitch]

Related to #11890, #11447, #11899, #10085 — all address WeCom AES key decoding/image handling. Check if #11899 already covers this fix.

[teknium1]

Thanks for investigating WeCom AI Bot image delivery. The unpadded-Base64 part is already present on current main: plugins/platforms/wecom/adapter.py:1069-1073 pads before decoding (commit 8f4c0bf0882c3c7258a65e3adade12d5b08068ea).

Problems

• gateway/platforms/wecom.py:748 adds a pic_url fallback only after a media reference exists. _extract_media() still only forwards nested image dictionaries (plugins/platforms/wecom/adapter.py:719-723), so a top-level AI Bot pic_url never reaches this code.
• The proposed variant fallback accepts any non-None candidate at gateway/platforms/wecom.py:770; its scorer can retain a score-zero plaintext. There is no regression coverage for rejecting incorrectly decrypted data.
• The PR changes only the former inline adapter and no tests. Current main moved the live implementation to plugins/platforms/wecom/adapter.py in 5600105478ffde29d7566b45421b100eaa29c4ef.

Suggested changes

• Port a focused top-level pic_url extraction path to the bundled adapter and add tests in tests/gateway/test_wecom.py covering URL/key propagation and decrypt/cache behavior.
• Reuse current padding logic; limit any additional key-format handling to documented formats with deterministic validation rather than AES-mode guessing.

Automated hermes-sweeper review.

[teknium1]

This fallback only helps if _extract_media() has already passed a media dictionary to _cache_media(). The PR does not add a reference for a top-level AI Bot pic_url, so that reported payload shape still never reaches this line. Construct the image reference in _extract_media() and cover it with a regression test.

[teknium1]

_try_decrypt_variants() can return its first score-zero candidate, so this accepts plaintext that was not positively validated. Avoid heuristic AES-mode fallback or require a deterministic format/padding validation before caching the result.