fix(wecom): normalize aeskey decoding and vision temperature

[mc436572]

Normalize WeCom aeskey before decode so 43-character unpadded base64 keys decrypt reliably, preventing media extraction failures that break image analysis. Set vision temperature to 1 for providers that reject other values.

Made-with: Cursor

What does this PR do?

Related Issue

Fixes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

How to Test

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform:

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[mc436572]

Additional validation details for reviewers:

• WeCom inbound image payload in our case contains aeskey + url (no base64 body).
• Before this fix, decrypt sometimes failed with:
  Incorrect padding (aeskey often appears in unpadded base64 form, e.g. length 43).
• After decrypt failure, media extraction became empty, and downstream vision failed with:
  Invalid image source. Provide an HTTP/HTTPS URL or a valid local file path.

After this PR:

• WeCom image decrypt/cache succeeds for the above payload pattern.
• Vision can read the image normally.
• Telegram image path still works (regression check).

[alt-glitch]

WeCom aeskey fix overlaps with #14580, #14888, and #11899 — all address the same unpadded base64 aeskey decryption issue (#11890). The vision temperature change appears to be a separate concern bundled in.

[teknium1]

Thanks for isolating the WeCom media-decryption failure. The standard unpadded-key path is already fixed on current main: plugins/platforms/wecom/adapter.py:1069-1073 restores padding before decoding, via 8f4c0bf08 (released in v2026.5.7). The remaining URL-safe fallback is still useful, but needs a narrow salvage.

Problems

• gateway/platforms/wecom.py was moved to plugins/platforms/wecom/adapter.py by 560010547; the PR target no longer exists on current main.
• The vision hunk would replace the configurable auxiliary.vision.temperature resolution at tools/vision_tools.py:1229-1245 with a global hardcoded value. Current coverage verifies configured 1.0 reaches the LLM in tests/tools/test_vision_tools.py:426-453.
• The diff adds no tests for URL-safe unpadded keys; current WeCom coverage uses standard base64 at tests/gateway/test_wecom.py:381-394.

Suggested changes

• Port only the URL-safe decode fallback to plugins/platforms/wecom/adapter.py:_decrypt_file_bytes and retain the existing padding behavior.
• Add standard- and URL-safe-unpadded decrypt/media-cache regression tests in tests/gateway/test_wecom.py.

Automated hermes-sweeper review.

[teknium1]

Current main resolves auxiliary.vision.temperature before this call (tools/vision_tools.py:1229-1245) and tests a configured value of 1.0. Please drop this hardcoded default so providers/users that require a different value retain their configuration.