Fix AES key decoding issue with WeCom API response

[wenjon]

…ring (missing the = padding character). Directly using base64.b64decode() will result in an 'Incorrect padding' error, preventing the image from being decrypted

What does this PR do?

Fix the issue where Hermes cannot decrypt images sent via WeCom (企业微信). WeCom returns aeskey as Base64-encoded but missing padding (43 chars instead of 44), causing base64.b64decode() to throw Incorrect padding error. The exception is caught and the image is skipped, making Hermes reply “没有看到图片”.

Related Issue

Fixes #

Type of Change

• [ x] 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

gateway/platforms/wecom.py - _decrypt_file_bytes function (~line 1018)

Before

key_bytes = base64.b64decode(aeskey)

After

key_bytes = base64.b64decode(aeskey + '=' * (-len(aeskey) % 4))

How to Test

1. Start Hermes and connect to WeCom WebSocket
2. Send an image to Hermes via WeCom
3. Verify the log shows Decrypted image ok, decrypted_len=xxxx and the image is successfully sent to the LLM

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• [x ] I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I’ve considered cross-platform impact (Windows, macOS) — N/A (base64 padding fix works cross-platform)
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

Failed to decrypt image from URL: Incorrect padding
Empty WeCom message skipped
issue Screenshot

fixed Screenshot

[alt-glitch]

Duplicate of #14580 — same root cause (WeCom aeskey missing base64 padding). Multiple prior PRs exist: #14580, #14888, #18654 (closed). See also issue #11890.

[alt-glitch]

Duplicate of #14580.

[teknium1]

This looks implemented on main now.

Automated hermes-sweeper review evidence:

• gateway/platforms/wecom.py:1045 on origin/main now pads unpadded WeCom Base64 aeskey values before decode: aes_key = aes_key + '=' * ((4 - len(aes_key) % 4) % 4).
• The proving commit is 8f4c0bf0882c3c7258a65e3adade12d5b08068ea (fix(wecom): pad base64 AES key before decode).
• That commit is contained in origin/main and in release tag v2026.5.7.
• This also matches the maintainer discussion here noting the same duplicate/root cause as Fix WeCom media decryption for unpadded aeskey #14580.

Thanks for the report and patch; the same fix has already landed.