fix(wecom): pad base64 aeskey before decoding in media decrypt

[cocoyingrui]

Problem

WeCom AI Bot WebSocket (aibot_msg_callback) delivers inbound image/file messages with an aeskey field that is base64-encoded but omits trailing = padding — for example:

+bTGvcNgTiGO/w6rwhrgQYvfBP43z0+pkpBish3+i0U   (43 chars, needs 1 pad)
ylMgROx2SpyfFWBujd3cBFN/nEAjoEzRqvwT2djNp6Q   (43 chars, needs 1 pad)

base64.b64decode() raises Incorrect padding when the input length is not a multiple of 4, causing _decrypt_file_bytes to fail silently. The image/file downloads successfully but is never cached, so _extract_media returns an empty list and the message is dropped as "Empty WeCom message skipped".

Root Cause

_decrypt_file_bytes in gateway/platforms/wecom.py calls base64.b64decode(aes_key) without padding normalization.

Fix

Add standard base64 padding before decoding:

# Before
key = base64.b64decode(aes_key)

# After
padded_key = aes_key + "=" * (4 - len(aes_key) % 4) if len(aes_key) % 4 else aes_key
key = base64.b64decode(padded_key)

Testing

Tested with WeCom AI Bot in production:

• Before: all inbound image messages fail with "Failed to decrypt image: Incorrect padding"
• After: images download, decrypt, cache, and reach the agent successfully

OpenClaw's wecom-openclaw-plugin handles the same aeskey format via wsClient.downloadFile(url, aeskey) which pads internally — confirming this is the expected format from WeCom's API.

Affected Versions

v0.10.0, v0.11.0 (and likely all versions since WeCom media decrypt was added)

[alt-glitch]

Likely duplicate of #14580 — same root cause: WeCom aeskey missing base64 padding causes in . See also #11890, #11899.

[teknium1]

Thanks for the focused WeCom media-decryption fix. This is already implemented on current main; this is an automated hermes-sweeper review.

• Commit 8f4c0bf0882c3c7258a65e3adade12d5b08068ea (fix(wecom): pad base64 AES key before decode) added the same Base64-padding behavior before decoding.
• Current main retains the exact guarantee at plugins/platforms/wecom/adapter.py:1069-1071: aes_key is padded to a multiple of four before base64.b64decode.
• The original target was migrated from gateway/platforms/wecom.py to the bundled plugin by 5600105478ffde29d7566b45421b100eaa29c4ef.
• The fix is included in release tag v2026.5.7. The duplicate discussion on Fix WeCom media decryption for unpadded aeskey #14580 reached the same verified result.