fix(weixin): streaming cursor, media uploads, markdown links, blank messages

[teknium1]

Summary

Four fixes for the Weixin/WeChat adapter, synthesized from the best aspects of ~25 community PRs.

1. Streaming cursor (▉) stuck permanently

WeChat doesn't support message editing, so the cursor appended during streaming can never be removed. Adds SUPPORTS_MESSAGE_EDITING = False to WeixinAdapter and checks it in gateway/run.py to suppress the cursor for non-editable platforms.

Fixes: #8307, #8326

2. Media upload failures (grey boxes, 404s)

Two bugs in _send_file():

• upload_full_url path used PUT → 404 on WeChat CDN. Now uses POST.
• aes_key was base64(raw_bytes) but the iLink API expects base64(hex_string) — images showed as grey boxes on the receiver side.

Also: unified both upload paths into _upload_ciphertext() (prefers upload_full_url), added send_video/send_voice methods, voice_item media builder for audio/.silk files, and video_md5 field.

Fixes: #8352, #7529

3. Markdown links stripped

WeChat can't render [text](url) markdown links. format_message() now converts them to text (url) plaintext. Links inside code blocks are preserved.

Fixes: #7617

4. Blank message prevention

Three layered guards:

1. _split_text_for_weixin_delivery('') → [] not ['']
2. send() filters empty/whitespace chunks before _send_text_chunk
3. _send_message() raises ValueError for empty text as safety net

Files changed

• gateway/platforms/weixin.py — all four fixes
• gateway/run.py — cursor suppression for non-editable platforms
• tests/gateway/test_weixin.py — 15 new tests (34 total, all pass)

Test plan

python -m pytest tests/gateway/test_weixin.py -v          # 34 passed
python -m pytest tests/gateway/test_stream_consumer.py -v # all pass
python -m pytest tests/gateway/test_wecom.py -v           # 40 pass (sibling adapter)

Community credit

Synthesized from: joei4cm (#8407), lyonDan (#8521), SKFDJKLDG (#8360), tomqiaozc (#7695), joshleeeeee (#8308), luoxiao6645 (#8525), longsizhuo (#7531), Astral-Yang (#8144), QingWei-Li (#8251)

Stale PRs to close after merge

The following PRs are either fully covered by this change or were fixing the same bugs:

• Streaming: fix(gateway): suppress partial streaming on non-editable platforms #8308, fix(weixin): prevent streaming cursor ▉ sticking and blank message displayed #8407, fix(gateway): avoid streaming cursor artifacts on no-edit platforms #8525
• Media upload: fix(gateway/weixin): correct aes_key encoding and upload_full_url CDN path #7531, fix(weixin): update parameter names for image and document senders #8144, fix(weixin): restore native media delivery #8251, fix: use POST for weixin upload_full_url CDN uploads #8360, fix(weixin): fix media upload failures for images, documents, and videos #8521
• Markdown links: fix(weixin): convert markdown links to plain text format #7695
• Message splitting (already addressed on main): feat(gateway): add merge_messages option for Weixin channel #7504, fix(weixin): send single message per response instead of splitting #7528, fix(weixin): re-pack message chunks to avoid flooding WeChat chat #7624, fix(weixin): avoid double-splitting when delivering messages #8069, fix: Fix the error of message segmentation when replying in WeChat, a… #8211, fix(weixin): Stop auto-splitting messages by newlines; match Telegram behavior #8329, feat(weixin): allow lightweight markdown formatting for improved message readability #5581
• Duplicate full-adapter PRs (adapter already on main): feat(gateway): Add WeChat platform adapter with long-poll architecture #5230, Add WeChat (Weixin) gateway support #6876, Add Weixin messaging platform integration #7199, feat(gateway): add WeChat QR setup flow #4175

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

342:+        aes_key_for_api = base64.b64encode(aes_key.hex().encode("ascii")).decode("ascii")
1575:+        expected_aes = base64.b64encode(fake_hex_key.encode("ascii")).decode("ascii")

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[longsizhuo]

Thanks for the consolidation, really clean way to handle the overlapping PRs.

Would it be possible to amend the merge commit with Co-authored-by trailers for the community contributors whose code was synthesized? GitHub only picks up contributor attribution from commit metadata, not from PR body text, so without the trailers none of us show up in the repo's contributor graph.

For my part:

Co-authored-by: longsizhuo <longsizhuo@gmail.com>

Totally understand if it's too much hassle to rewrite a merged commit though, just figured I'd ask. Thanks again!