feat(weixin): add image sending support via CDN upload

packages/channels/weixin/src/WeixinAdapter.ts

@@ -17,7 +17,7 @@
 import { loadAccount, DEFAULT_BASE_URL } from './accounts.js';
 import { startPollLoop, getContextToken } from './monitor.js';
 import type { CdnRef, FileCdnRef } from './monitor.js';
-import { sendText } from './send.js';
+import { sendText, sendImage } from './send.js';
 import { downloadAndDecrypt } from './media.js';
 import { getConfig, sendTyping } from './api.js';
 import { TypingStatus } from './types.js';
@@ -43,6 +43,22 @@
   }
 
   async connect(): Promise<void> {
+    // Default channel instructions: tell the AI it can send images via WeChat
+    if (!this.config.instructions) {
+      this.config.instructions = [
+        '## WeChat Channel Capabilities',
+        '',
+        'You are communicating with users through WeChat. You CAN send images to the user.',
+        'To send an image, include it in your response using this EXACT format:',
+        '[IMAGE: 图片文件的完整绝对路径]',
+        '',
+        'Example: 如果你想发送 /tmp/cat.png 给用户, 在回复中写 [IMAGE: /tmp/cat.png]',
+        'This marker will be automatically removed from the text and the image will be uploaded and sent.',
+        'You can include multiple [IMAGE: ...] markers in one response.',
+        '',
+        'Users can also send you images, which you can see and analyze.',
+      ].join('\n');
+    }
     const account = loadAccount();
     if (!account) {
       throw new Error(
@@ -153,18 +169,72 @@
       }
     }
 
+    // Always remind the AI about image-sending capability on every message
+    const IMAGE_INSTRUCTION =
+      '[WeChat Channel] 你可以通过微信发送图片。在回复中使用 [IMAGE: 文件绝对路径] 发送图片，例如 [IMAGE: /tmp/cat.png]。标记会被自动移除。';
+    envelope.text = `${IMAGE_INSTRUCTION}\n\n${envelope.text}`;
+
     await super.handleInbound(envelope);
   }
 
-  async sendMessage(chatId: string, text: string): Promise<void> {
+  async sendMessage(
+    chatId: string,
+    text: string,
+    imagePaths?: string[],
+  ): Promise<void> {
     const contextToken = getContextToken(chatId) || '';
-    await sendText({
-      to: chatId,
-      text,
-      baseUrl: this.baseUrl,
-      token: this.token,
-      contextToken,
+
+    // Parse [IMAGE: /path/to/file.png] markers from text
+    const imageRegex = /\[IMAGE:\s*([^\]]+)\]/gi;
+    const parsedImages: string[] = [];
+    let cleanedText = text.replace(imageRegex, (_, path: string) => {
+      parsedImages.push(path.trim());
+      return '';
     });
+
+    // Merge with any imagePaths from the ACP pipeline
+    const allImages = [...(imagePaths || []), ...parsedImages];
+
+    // Clean up double blank lines left by removed markers
+    cleanedText = cleanedText.replace(/\n{3,}/g, '\n\n').trim();
+
+    // Send text first if non-empty
+    if (cleanedText) {
+      await sendText({
+        to: chatId,
+        text: cleanedText,
+        baseUrl: this.baseUrl,
+        token: this.token,
+        contextToken,
+      });
+    }
+
+    // Send images
+    if (allImages.length) {
+      for (const imagePath of allImages) {
+        try {
+          await sendImage({
+            to: chatId,
+            imagePath,
+            baseUrl: this.baseUrl,
+            token: this.token,
+            contextToken,
+          });
+        } catch (err) {
+          const errMsg = err instanceof Error ? err.message : String(err);
+          process.stderr.write(
+            `[Weixin:${this.name}] Failed to send image ${imagePath}: ${errMsg}\n`,
+          );
+          await sendText({
+            to: chatId,
+            text: `图片发送失败: ${errMsg}`,
+            baseUrl: this.baseUrl,
+            token: this.token,
+            contextToken,
+          });
+        }
+      }
+    }
   }
 
   disconnect(): void {

packages/channels/weixin/src/api.ts

@@ -141,3 +141,101 @@ export async function sendTyping(
   const body: SendTypingReq = { ...req, base_info: baseInfo() };
   return post<SendTypingResp>(baseUrl, '/ilink/bot/sendtyping', body, token);
 }
+
+interface GetUploadUrlReq {
+  filekey: string;
+  media_type: number;
+  to_user_id: string;
+  rawsize: number;
+  rawfilemd5: string;
+  filesize: number;
+  no_need_thumb: boolean;
+  aeskey: string;
+  base_info: BaseInfo;
+}
+
+interface GetUploadUrlResp {
+  ret?: number;
+  errmsg?: string;
+  upload_full_url?: string;
+  upload_param?: string;
+  thumb_upload_param?: string;
+}
+
+/**
+ * Request an upload URL and CDN credentials for media.
+ * @param aeskeyHex 16-byte AES key as 32-char hex string (e.g. "00112233445566778899aabbccddeeff")
+ * @returns Either the full CDN upload URL or the upload_param string
+ */
+export async function getUploadUrl(
+  baseUrl: string,
+  token: string,
+  toUserId: string,
+  filekey: string,
+  rawsize: number,
+  rawfilemd5: string,
+  encryptedSize: number,
+  aeskeyHex: string,
+): Promise<string> {
+  const body: GetUploadUrlReq = {
+    filekey,
+    media_type: 1,
+    to_user_id: toUserId,
+    rawsize,
+    rawfilemd5,
+    filesize: encryptedSize,
+    no_need_thumb: true,
+    aeskey: aeskeyHex,
+    base_info: baseInfo(),
+  };
+  const resp = await post<GetUploadUrlResp>(
+    baseUrl,
+    '/ilink/bot/getuploadurl',
+    body,
+    token,
+  );
+
+  // upload_full_url: CDN upload URL with all params embedded
+  if (resp.upload_full_url) {
+    return resp.upload_full_url;
+  }
+
+  // upload_param: CDN upload params only (must construct URL with filekey)
+  if (resp.upload_param) {
+    return resp.upload_param;
+  }
+
+  throw new Error(
+    `getuploadurl failed: ret=${resp.ret} errmsg=${resp.errmsg || '(none)'}`,
+  );
+}
+
+/** Upload encrypted media to CDN.
+ *  If urlOrParam is a full URL, use it directly.
+ *  If it's just a param, construct the URL. */
+export async function uploadToCdn(
+  urlOrParam: string,
+  filekey: string,
+  encryptedData: Buffer,
+): Promise<string> {
+  const url = urlOrParam.startsWith('http')
+    ? urlOrParam
+    : `https://novac2c.cdn.weixin.qq.com/c2c/upload?encrypted_query_param=${encodeURIComponent(urlOrParam)}&filekey=${encodeURIComponent(filekey)}`;
+
+  const resp = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/octet-stream' },
+    body: encryptedData,
+  });
+  if (!resp.ok) {
+    throw new Error(`CDN upload failed: HTTP ${resp.status}`);
+  }
+  // Extract x-encrypted-param from response header
+  const encryptParam = resp.headers.get('x-encrypted-param');
+  if (!encryptParam) {
+    throw new Error(
+      'CDN upload succeeded but missing x-encrypted-param header',
+    );
+  }
+  return encryptParam;
+}

packages/channels/weixin/src/media.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import { createDecipheriv, createCipheriv } from 'node:crypto';
+import { encryptAesEcb, computeMd5 } from './media.js';
 
 /**
  * Test the AES key parsing and decryption logic used in media.ts.
@@ -89,3 +90,53 @@ describe('Weixin media crypto', () => {
     });
   });
 });
+
+describe('encryptAesEcb', () => {
+  it('encrypts data deterministically', () => {
+    const key = Buffer.alloc(16, 0xab);
+    const plaintext = Buffer.from('test data for encryption');
+    const ciphertext1 = encryptAesEcb(plaintext, key);
+    const ciphertext2 = encryptAesEcb(plaintext, key);
+    expect(ciphertext1).toEqual(ciphertext2);
+  });
+
+  it('encrypts then decrypts round-trip', () => {
+    const key = Buffer.alloc(16, 0x42);
+    const plaintext = Buffer.from('Hello, WeChat media upload!');
+
+    const ciphertext = encryptAesEcb(plaintext, key);
+    const decipher = createDecipheriv('aes-128-ecb', key, null);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    expect(decrypted.toString()).toBe(plaintext.toString());
+  });
+
+  it('handles empty plaintext', () => {
+    const key = Buffer.alloc(16, 0x01);
+    const ciphertext = encryptAesEcb(Buffer.alloc(0), key);
+    // ECB with empty input produces empty output (no padding block needed
+    // when input is exactly 0 bytes — behavior varies by implementation)
+    // At minimum the result should be decryptable
+    const decipher = createDecipheriv('aes-128-ecb', key, null);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final(),
+    ]);
+    expect(decrypted.length).toBe(0);
+  });
+});
+
+describe('computeMd5', () => {
+  it('computes expected MD5', () => {
+    const data = Buffer.from('hello world');
+    expect(computeMd5(data)).toBe('5eb63bbbe01eeed093cb22bb8f5acdc3');
+  });
+
+  it('computes MD5 of empty buffer', () => {
+    expect(computeMd5(Buffer.alloc(0))).toBe(
+      'd41d8cd98f00b204e9800998ecf8427e',
+    );
+  });
+});

packages/channels/weixin/src/media.ts

@@ -3,7 +3,7 @@
  * Ported from cc-weixin/plugins/weixin/src/media.ts (download path only).
  */
 
-import { createDecipheriv } from 'node:crypto';
+import { createCipheriv, createDecipheriv, createHash } from 'node:crypto';
 
 const CDN_BASE_URL = 'https://novac2c.cdn.weixin.qq.com/c2c';
 
@@ -22,7 +22,7 @@ function decryptAesEcb(ciphertext: Buffer, key: Buffer): Buffer {
  *   - base64(raw 16 bytes) → images
  *   - base64(hex string of 16 bytes) → file/voice/video
  */
-function parseAesKey(aesKeyBase64: string): Buffer {
+export function parseAesKey(aesKeyBase64: string): Buffer {
   const decoded = Buffer.from(aesKeyBase64, 'base64');
   if (decoded.length === 16) {
     return decoded;
@@ -54,3 +54,14 @@ export async function downloadAndDecrypt(
   const keyBuf = parseAesKey(aesKey);
   return decryptAesEcb(ciphertext, keyBuf);
 }
+
+/** AES-128-ECB encryption for CDN upload. */
+export function encryptAesEcb(plaintext: Buffer, key: Buffer): Buffer {
+  const cipher = createCipheriv('aes-128-ecb', key, null);
+  return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+}
+
+/** Compute MD5 hash of a buffer, returning hex string. */
+export function computeMd5(data: Buffer): string {
+  return createHash('md5').update(data).digest('hex');
+}