feat: 内置微信连接器并完善 Agent 查询能力

package.json

@@ -25,9 +25,9 @@
     "test:skill-install": "node scripts/test-skill-install-instruction.cjs",
     "cp:env": "node scripts/ensure-env.cjs",
     "prepare:env": "node scripts/ensure-env.cjs",
-    "predev": "node scripts/ensure-env.cjs && node scripts/build-wechat-connector.cjs",
     "start": "electron-vite preview",
-    "dev": "electron-vite dev",
+    "dev": "node scripts/ensure-env.cjs && node scripts/build-wechat-connector.cjs && electron-vite dev",
+    "test:wechat-connector": "go -C services/wechat-connector test ./... && go -C services/wechat-connector vet ./...",
     "build:wechat-connector": "node scripts/build-wechat-connector.cjs",
     "build:wechat-connector:win": "node scripts/build-wechat-connector.cjs --platform win32 --arch x64,arm64",
     "build:wechat-connector:mac": "node scripts/build-wechat-connector.cjs --platform darwin --arch x64,arm64",
@@ -42,6 +42,7 @@
     "build:linux": "electron-vite build && electron-builder --config electron-builder.yml --linux"
   },
   "dependencies": {
+    "@koromix/koffi-win32-x64": "3.1.0",
     "@electron-toolkit/preload": "^3.0.2",
     "@electron-toolkit/utils": "^4.0.0",
     "fs-extra": "^11.3.2",
@@ -75,6 +76,16 @@
     "vite": "^7.2.6"
   },
   "pnpm": {
+    "supportedArchitectures": {
+      "os": [
+        "current",
+        "win32"
+      ],
+      "cpu": [
+        "current",
+        "x64"
+      ]
+    },
     "onlyBuiltDependencies": [
       "electron",
       "esbuild"

pnpm-lock.yaml

@@ -10,6 +10,7 @@ specifiers:
   '@electron-toolkit/preload': ^3.0.2
   '@electron-toolkit/tsconfig': ^2.0.0
   '@electron-toolkit/utils': ^4.0.0
+  '@koromix/koffi-win32-x64': 3.1.0
   '@rollup/rollup-darwin-arm64': ^4.62.2
   '@types/fs-extra': ^11.0.4
   '@types/node': ^22.19.1
@@ -38,6 +39,7 @@ specifiers:
 dependencies:
   '@electron-toolkit/preload': 3.0.2_electron@43.1.0
   '@electron-toolkit/utils': 4.0.0_electron@43.1.0
+  '@koromix/koffi-win32-x64': 3.1.0
   fs-extra: 11.3.2
   fzstd: 0.1.1
   koffi: 3.1.0
@@ -887,7 +889,6 @@ packages:
     cpu: [x64]
     os: [win32]
     dev: false
-    optional: true
 
   /@malept/cross-spawn-promise/2.0.0:
     resolution: {integrity: sha512-1DpKU0Z5ThltBwjNySMC14g0CkbyhCaz9FkhxqNsZI6uAPJXFS8cMXlBKo26FJ8ZuW6S9GCMcR9IO5k2X5/9Fg==}

scripts/after-pack.cjs

@@ -10,6 +10,23 @@ function setPlistValue(plistPath, key, value) {
 }
 
 exports.default = async function afterPack(context) {
+  if (context.electronPlatformName === 'win32') {
+    const koffiNative = path.join(
+      context.appOutDir,
+      'resources',
+      'app.asar.unpacked',
+      'node_modules',
+      '@koromix',
+      'koffi-win32-x64',
+      'win32_x64',
+      'koffi.node'
+    )
+    if (!existsSync(koffiNative)) {
+      throw new Error(`Missing Windows Koffi native module: ${koffiNative}`)
+    }
+    return
+  }
+
   if (context.electronPlatformName !== 'darwin') return
 
   const productName = context.packager.appInfo.productFilename

scripts/build-wechat-connector.cjs

@@ -4,9 +4,7 @@ const fs = require('node:fs')
 const path = require('node:path')
 
 const projectRoot = path.resolve(__dirname, '..')
-const sourceDir = process.env.WECHAT_CONNECTOR_SOURCE
-  ? path.resolve(process.env.WECHAT_CONNECTOR_SOURCE)
-  : path.join(projectRoot, 'services', 'wechat-connector')
+const sourceDir = path.join(projectRoot, 'services', 'wechat-connector')
 const outputRoot = path.join(projectRoot, 'resources', 'connectors', 'wechat')
 
 function normalizePlatform(value) {
@@ -22,32 +20,31 @@ function normalizeArch(value) {
   throw new Error(`Unsupported connector architecture: ${value}`)
 }
 
+function detectHostArch() {
+  if (process.platform !== 'darwin') return process.arch
+  try {
+    const arm64Supported = execFileSync('sysctl', ['-n', 'hw.optional.arm64'], {
+      encoding: 'utf8'
+    }).trim()
+    return arm64Supported === '1' ? 'arm64' : process.arch
+  } catch {
+    return process.arch
+  }
+}
+
 function parseTargets() {
   const platformArg = process.argv.indexOf('--platform')
   const archArg = process.argv.indexOf('--arch')
   const platforms = platformArg >= 0 ? process.argv[platformArg + 1].split(',') : [process.platform]
-  const arches = archArg >= 0 ? process.argv[archArg + 1].split(',') : [process.arch]
+  const arches = archArg >= 0 ? process.argv[archArg + 1].split(',') : [detectHostArch()]
   return platforms.flatMap((platform) =>
     arches.map((arch) => ({ goos: normalizePlatform(platform), goarch: normalizeArch(arch) }))
   )
 }
 
 if (!fs.existsSync(path.join(sourceDir, 'go.mod'))) {
-  const existingTargets = parseTargets().every((target) => {
-    const directoryName = `${target.goos === 'windows' ? 'win32' : target.goos}-${target.goarch === 'amd64' ? 'x64' : target.goarch}`
-    const executable = target.goos === 'windows' ? 'wechat-connector.exe' : 'wechat-connector'
-    return fs.existsSync(path.join(outputRoot, directoryName, executable))
-  })
-  if (existingTargets) {
-    console.log('[build-wechat-connector] source not configured; reusing existing binary')
-    process.exit(0)
+  throw new Error(`Repository-local WeChat connector source is missing: ${sourceDir}`)
 }
-  throw new Error(
-    'Wechat connector source is not included in this repository. Set WECHAT_CONNECTOR_SOURCE to a compatible connector checkout.'
-  )
-}
-
-fs.rmSync(outputRoot, { recursive: true, force: true })
 
 for (const target of parseTargets()) {
   const directoryName = `${target.goos === 'windows' ? 'win32' : target.goos}-${target.goarch === 'amd64' ? 'x64' : target.goarch}`
@@ -56,6 +53,7 @@ for (const target of parseTargets()) {
     outputDir,
     target.goos === 'windows' ? 'wechat-connector.exe' : 'wechat-connector'
   )
+  fs.rmSync(outputDir, { recursive: true, force: true })
   fs.mkdirSync(outputDir, { recursive: true })
   execFileSync('go', ['build', '-trimpath', '-o', outputPath, '.'], {
     cwd: sourceDir,

services/wechat-connector/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 fastclaw-ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

services/wechat-connector/README.md

@@ -0,0 +1,25 @@
+# WechatExplorer WeChat Connector
+
+This repository-local service provides the minimal WeChat bridge required by WechatExplorer:
+
+- QR-code login with a single persisted credential
+- account discovery
+- inbound long polling and authenticated webhook delivery
+- local HTTP health and send endpoints
+- text and local/remote media sending
+
+The executable is managed by the Electron main process. It is not a general-purpose agent runtime and does not load external AI command-line tools.
+
+## Commands
+
+```bash
+go run . login --json
+go run . accounts --json
+go run . start --foreground --api-addr 127.0.0.1:18011 --account-id <account-id>
+```
+
+Credential and synchronization state is stored under `~/.wechatexplorer/wechat-connector/accounts`. A successful login is written before the older credential and synchronization state are removed, so an incomplete login cannot destroy the last working credential.
+
+## Attribution
+
+Low-level protocol and media transport portions are distributed under the MIT license in [LICENSE](LICENSE). WechatExplorer-specific process management, webhook contract, product UI, and Agent Hub behavior live in the surrounding WechatExplorer project.

services/wechat-connector/api/server.go

@@ -0,0 +1,135 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/messaging"
+)
+
+// Server provides an HTTP API for sending messages.
+type Server struct {
+	clients []*ilink.Client
+	addr    string
+}
+
+// NewServer creates an API server.
+func NewServer(clients []*ilink.Client, addr string) *Server {
+	if addr == "" {
+		addr = "127.0.0.1:18011"
+	}
+	return &Server{clients: clients, addr: addr}
+}
+
+// SendRequest is the JSON body for POST /api/send.
+type SendRequest struct {
+	AccountID string `json:"account_id,omitempty"`
+	To        string `json:"to"`
+	Text      string `json:"text,omitempty"`
+	MediaURL  string `json:"media_url,omitempty"` // image/video/file URL
+}
+
+// Run starts the HTTP server. Blocks until ctx is cancelled.
+func (s *Server) Run(ctx context.Context) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/send", s.handleSend)
+	mux.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprintln(w, "ok")
+	})
+
+	srv := &http.Server{Addr: s.addr, Handler: mux}
+
+	go func() {
+		<-ctx.Done()
+		srv.Shutdown(context.Background())
+	}()
+
+	log.Printf("[api] listening on %s", s.addr)
+	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		return err
+	}
+	return nil
+}
+
+func (s *Server) handleSend(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var req SendRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "invalid JSON: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	if req.To == "" {
+		http.Error(w, `"to" is required`, http.StatusBadRequest)
+		return
+	}
+	if req.Text == "" && req.MediaURL == "" {
+		http.Error(w, `"text" or "media_url" is required`, http.StatusBadRequest)
+		return
+	}
+
+	if len(s.clients) == 0 {
+		http.Error(w, "no accounts configured", http.StatusServiceUnavailable)
+		return
+	}
+
+	client := s.clientForAccount(req.AccountID)
+	if client == nil {
+		http.Error(w, "requested account is not available", http.StatusNotFound)
+		return
+	}
+	ctx := r.Context()
+
+	// Send text if provided
+	if req.Text != "" {
+		if err := messaging.SendTextReply(ctx, client, req.To, req.Text, "", ""); err != nil {
+			log.Printf("[api] send text failed: %v", err)
+			http.Error(w, "send text failed: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+		log.Printf("[api] sent text to %s: %q", req.To, req.Text)
+
+		// Extract and send any markdown images embedded in text
+		for _, imgURL := range messaging.ExtractImageURLs(req.Text) {
+			if err := messaging.SendMediaFromURL(ctx, client, req.To, imgURL, ""); err != nil {
+				log.Printf("[api] send extracted image failed: %v", err)
+			} else {
+				log.Printf("[api] sent extracted image to %s: %s", req.To, imgURL)
+			}
+		}
+	}
+
+	// Send media if provided
+	if req.MediaURL != "" {
+		if err := messaging.SendMediaFromURL(ctx, client, req.To, req.MediaURL, ""); err != nil {
+			log.Printf("[api] send media failed: %v", err)
+			http.Error(w, "send media failed: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+		log.Printf("[api] sent media to %s: %s", req.To, req.MediaURL)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+}
+
+func (s *Server) clientForAccount(accountID string) *ilink.Client {
+	if accountID == "" {
+		return s.clients[0]
+	}
+	for _, client := range s.clients {
+		if client.BotID() == accountID {
+			return client
+		}
+	}
+	return nil
+}

services/wechat-connector/api/server_test.go

@@ -0,0 +1,20 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+)
+
+func TestClientForAccountSelectsMatchingBot(t *testing.T) {
+	oldClient := ilink.NewClient(&ilink.Credentials{ILinkBotID: "bot-old"})
+	newClient := ilink.NewClient(&ilink.Credentials{ILinkBotID: "bot-new"})
+	server := NewServer([]*ilink.Client{oldClient, newClient}, "")
+
+	if got := server.clientForAccount("bot-new"); got != newClient {
+		t.Fatal("clientForAccount did not select the requested account")
+	}
+	if got := server.clientForAccount("missing"); got != nil {
+		t.Fatal("clientForAccount should reject an unknown account")
+	}
+}

services/wechat-connector/go.mod

@@ -0,0 +1,8 @@
+module github.com/Wxw-Gu/WechatExplorer/services/wechat-connector
+
+go 1.23.0
+
+require (
+	github.com/google/uuid v1.6.0
+	rsc.io/qr v0.2.0
+)

services/wechat-connector/go.sum

@@ -0,0 +1,4 @@
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
+rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs=

services/wechat-connector/ilink/auth.go

@@ -0,0 +1,197 @@
+package ilink
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const (
+	qrCodeURL       = "https://ilinkai.weixin.qq.com/ilink/bot/get_bot_qrcode?bot_type=3"
+	qrStatusURL     = "https://ilinkai.weixin.qq.com/ilink/bot/get_qrcode_status?qrcode="
+	statusWait      = "wait"
+	statusScanned   = "scaned"
+	statusConfirmed = "confirmed"
+	statusExpired   = "expired"
+)
+
+// FetchQRCode retrieves a new QR code for login.
+func FetchQRCode(ctx context.Context) (*QRCodeResponse, error) {
+	c := NewUnauthenticatedClient()
+	var resp QRCodeResponse
+	if err := c.doGet(ctx, qrCodeURL, &resp); err != nil {
+		return nil, fmt.Errorf("fetch QR code: %w", err)
+	}
+	return &resp, nil
+}
+
+// PollQRStatus polls for QR code scan status until confirmed or expired.
+// It calls onStatus for each status change so the caller can display progress.
+func PollQRStatus(ctx context.Context, qrcode string, onStatus func(status string)) (*Credentials, error) {
+	c := NewUnauthenticatedClient()
+	url := qrStatusURL + qrcode
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		default:
+		}
+
+		pollCtx, cancel := context.WithTimeout(ctx, 40*time.Second)
+		var resp QRStatusResponse
+		err := c.doGet(pollCtx, url, &resp)
+		cancel()
+
+		if err != nil {
+			// Timeout is normal for long-poll, retry
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			continue
+		}
+
+		if onStatus != nil {
+			onStatus(resp.Status)
+		}
+
+		switch resp.Status {
+		case statusConfirmed:
+			creds := &Credentials{
+				BotToken:    resp.BotToken,
+				ILinkBotID:  resp.ILinkBotID,
+				BaseURL:     resp.BaseURL,
+				ILinkUserID: resp.ILinkUserID,
+			}
+			return creds, nil
+		case statusExpired:
+			return nil, fmt.Errorf("QR code expired")
+		case statusWait, statusScanned:
+			// Continue polling
+		default:
+			// Unknown status, continue
+		}
+	}
+}
+
+// AccountsDir returns the directory where account credentials are stored.
+func AccountsDir() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(home, ".wechatexplorer", "wechat-connector", "accounts"), nil
+}
+
+// NormalizeAccountID converts raw bot ID to filesystem-safe format.
+func NormalizeAccountID(raw string) string {
+	s := raw
+	for _, ch := range []string{"@", ".", ":"} {
+		s = filepath.Clean(s)
+		s = replaceAll(s, ch, "-")
+	}
+	return s
+}
+
+func replaceAll(s, old, new string) string {
+	for {
+		i := indexOf(s, old)
+		if i < 0 {
+			return s
+		}
+		s = s[:i] + new + s[i+len(old):]
+	}
+}
+
+func indexOf(s, sub string) int {
+	for i := range s {
+		if i+len(sub) <= len(s) && s[i:i+len(sub)] == sub {
+			return i
+		}
+	}
+	return -1
+}
+
+// SaveCredentials saves the latest credentials and removes older accounts.
+// The new credential is written first so a failed login never destroys the
+// previously working credential.
+func SaveCredentials(creds *Credentials) error {
+	dir, err := AccountsDir()
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("create accounts dir: %w", err)
+	}
+
+	id := NormalizeAccountID(creds.ILinkBotID)
+	path := filepath.Join(dir, id+".json")
+
+	data, err := json.MarshalIndent(creds, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal credentials: %w", err)
+	}
+
+	if err := os.WriteFile(path, data, 0o600); err != nil {
+		return fmt.Errorf("write credentials: %w", err)
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return fmt.Errorf("prune old credentials: %w", err)
+	}
+	keepPrefix := id + "."
+	for _, entry := range entries {
+		if entry.IsDir() || strings.HasPrefix(entry.Name(), keepPrefix) {
+			continue
+		}
+		if filepath.Ext(entry.Name()) != ".json" {
+			continue
+		}
+		if err := os.Remove(filepath.Join(dir, entry.Name())); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("remove old credential %s: %w", entry.Name(), err)
+		}
+	}
+	return nil
+}
+
+// LoadAllCredentials loads all saved account credentials.
+func LoadAllCredentials() ([]*Credentials, error) {
+	dir, err := AccountsDir()
+	if err != nil {
+		return nil, err
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("read accounts dir: %w", err)
+	}
+
+	var result []*Credentials
+	for _, e := range entries {
+		if e.IsDir() || filepath.Ext(e.Name()) != ".json" {
+			continue
+		}
+		data, err := os.ReadFile(filepath.Join(dir, e.Name()))
+		if err != nil {
+			continue
+		}
+		var creds Credentials
+		if json.Unmarshal(data, &creds) == nil && creds.BotToken != "" {
+			result = append(result, &creds)
+		}
+	}
+	return result, nil
+}
+
+// CredentialsPath returns the path for display purposes.
+func CredentialsPath() (string, error) {
+	return AccountsDir()
+}

services/wechat-connector/ilink/auth_test.go

@@ -0,0 +1,36 @@
+package ilink
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestSaveCredentialsKeepsOnlyLatestAccount(t *testing.T) {
+	t.Setenv("HOME", t.TempDir())
+	old := &Credentials{ILinkBotID: "bot-old@im.bot", BotToken: "old-token"}
+	latest := &Credentials{ILinkBotID: "bot-new@im.bot", BotToken: "new-token"}
+	if err := SaveCredentials(old); err != nil {
+		t.Fatal(err)
+	}
+	dir, err := AccountsDir()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, NormalizeAccountID(old.ILinkBotID)+".sync.json"), []byte(`{}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := SaveCredentials(latest); err != nil {
+		t.Fatal(err)
+	}
+	accounts, err := LoadAllCredentials()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(accounts) != 1 || accounts[0].ILinkBotID != latest.ILinkBotID {
+		t.Fatalf("accounts = %#v", accounts)
+	}
+	if _, err := os.Stat(filepath.Join(dir, NormalizeAccountID(old.ILinkBotID)+".sync.json")); !os.IsNotExist(err) {
+		t.Fatalf("old sync state still exists: %v", err)
+	}
+}

services/wechat-connector/ilink/client.go

@@ -0,0 +1,218 @@
+package ilink
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+)
+
+const (
+	defaultBaseURL  = "https://ilinkai.weixin.qq.com"
+	longPollTimeout = 35 * time.Second
+	sendTimeout     = 15 * time.Second
+)
+
+// Client is an iLink HTTP API client.
+type Client struct {
+	baseURL    string
+	botToken   string
+	botID      string
+	httpClient *http.Client
+	wechatUIN  string
+}
+
+// NewClient creates a new iLink API client.
+func NewClient(creds *Credentials) *Client {
+	baseURL := creds.BaseURL
+	if baseURL == "" {
+		baseURL = defaultBaseURL
+	}
+	return &Client{
+		baseURL:    baseURL,
+		botToken:   creds.BotToken,
+		botID:      creds.ILinkBotID,
+		httpClient: &http.Client{},
+		wechatUIN:  generateWechatUIN(),
+	}
+}
+
+// NewUnauthenticatedClient creates a client without credentials for login flow.
+func NewUnauthenticatedClient() *Client {
+	return &Client{
+		baseURL:    defaultBaseURL,
+		httpClient: &http.Client{Timeout: 40 * time.Second},
+		wechatUIN:  generateWechatUIN(),
+	}
+}
+
+// BotID returns the bot's user ID.
+func (c *Client) BotID() string {
+	return c.botID
+}
+
+// GetUpdates performs a long-poll for new messages.
+func (c *Client) GetUpdates(ctx context.Context, buf string) (*GetUpdatesResponse, error) {
+	reqBody := GetUpdatesRequest{
+		GetUpdatesBuf: buf,
+		BaseInfo:      BaseInfo{ChannelVersion: "1.0.0"},
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, longPollTimeout+5*time.Second)
+	defer cancel()
+
+	var resp GetUpdatesResponse
+	if err := c.doPost(ctx, "/ilink/bot/getupdates", reqBody, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// SendMessage sends a message through iLink.
+func (c *Client) SendMessage(ctx context.Context, msg *SendMessageRequest) (*SendMessageResponse, error) {
+	ctx, cancel := context.WithTimeout(ctx, sendTimeout)
+	defer cancel()
+
+	var resp SendMessageResponse
+	if err := c.doPost(ctx, "/ilink/bot/sendmessage", msg, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// GetConfig fetches bot config for a user (includes typing_ticket).
+func (c *Client) GetConfig(ctx context.Context, userID, contextToken string) (*GetConfigResponse, error) {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	req := GetConfigRequest{
+		ILinkUserID:  userID,
+		ContextToken: contextToken,
+		BaseInfo:     BaseInfo{},
+	}
+
+	var resp GetConfigResponse
+	if err := c.doPost(ctx, "/ilink/bot/getconfig", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// SendTyping sends a typing indicator to a user.
+func (c *Client) SendTyping(ctx context.Context, userID, typingTicket string, status int) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	req := SendTypingRequest{
+		ILinkUserID:  userID,
+		TypingTicket: typingTicket,
+		Status:       status,
+		BaseInfo:     BaseInfo{},
+	}
+
+	var resp SendTypingResponse
+	if err := c.doPost(ctx, "/ilink/bot/sendtyping", req, &resp); err != nil {
+		return err
+	}
+	if resp.Ret != 0 {
+		return fmt.Errorf("sendtyping failed: ret=%d errmsg=%s", resp.Ret, resp.ErrMsg)
+	}
+	return nil
+}
+
+// GetUploadURL gets a pre-signed CDN upload URL for media files.
+func (c *Client) GetUploadURL(ctx context.Context, req *GetUploadURLRequest) (*GetUploadURLResponse, error) {
+	ctx, cancel := context.WithTimeout(ctx, sendTimeout)
+	defer cancel()
+
+	var resp GetUploadURLResponse
+	if err := c.doPost(ctx, "/ilink/bot/getuploadurl", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+// BaseURL returns the base URL for CDN operations.
+func (c *Client) BaseURL() string {
+	return c.baseURL
+}
+
+func (c *Client) doPost(ctx context.Context, path string, body interface{}, result interface{}) error {
+	data, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("marshal request: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, bytes.NewReader(data))
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+	c.setHeaders(req)
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	if err := json.Unmarshal(respBody, result); err != nil {
+		return fmt.Errorf("unmarshal response: %w", err)
+	}
+	return nil
+}
+
+func (c *Client) doGet(ctx context.Context, url string, result interface{}) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	respBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("read response: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(respBody))
+	}
+
+	if err := json.Unmarshal(respBody, result); err != nil {
+		return fmt.Errorf("unmarshal response: %w", err)
+	}
+	return nil
+}
+
+func (c *Client) setHeaders(req *http.Request) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("AuthorizationType", "ilink_bot_token")
+	req.Header.Set("Authorization", "Bearer "+c.botToken)
+	req.Header.Set("X-WECHAT-UIN", c.wechatUIN)
+}
+
+func generateWechatUIN() string {
+	var n uint32
+	_ = binary.Read(rand.Reader, binary.LittleEndian, &n)
+	s := fmt.Sprintf("%d", n)
+	return base64.StdEncoding.EncodeToString([]byte(s))
+}

services/wechat-connector/ilink/monitor.go

@@ -0,0 +1,181 @@
+package ilink
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+const (
+	maxConsecutiveFailures = 5
+	initialBackoff         = 3 * time.Second
+	maxBackoff             = 60 * time.Second
+	sessionExpiredBackoff  = 5 * time.Second
+	errCodeSessionExpired  = -14
+)
+
+// MessageHandler is called for each received message.
+type MessageHandler func(ctx context.Context, client *Client, msg WeixinMessage)
+
+// Monitor manages the long-poll loop for receiving messages.
+type Monitor struct {
+	client        *Client
+	handler       MessageHandler
+	getUpdatesBuf string
+	bufPath       string
+	failures      int
+	lastActivity  time.Time
+}
+
+// NewMonitor creates a new long-poll monitor.
+func NewMonitor(client *Client, handler MessageHandler) (*Monitor, error) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return nil, err
+	}
+	accountID := NormalizeAccountID(client.BotID())
+	bufPath := filepath.Join(home, ".wechatexplorer", "wechat-connector", "accounts", accountID+".sync.json")
+
+	m := &Monitor{
+		client:       client,
+		handler:      handler,
+		bufPath:      bufPath,
+		lastActivity: time.Now(),
+	}
+	m.loadBuf()
+	return m, nil
+}
+
+// Run starts the long-poll loop. It blocks until ctx is cancelled.
+// Automatically recovers from errors with exponential backoff.
+func (m *Monitor) Run(ctx context.Context) error {
+	log.Println("[monitor] starting long-poll loop")
+
+	for {
+		select {
+		case <-ctx.Done():
+			log.Println("[monitor] shutting down")
+			return ctx.Err()
+		default:
+		}
+
+		resp, err := m.client.GetUpdates(ctx, m.getUpdatesBuf)
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			m.failures++
+			backoff := m.calcBackoff()
+			log.Printf("[monitor] GetUpdates error (%d/%d, backoff=%s): %v",
+				m.failures, maxConsecutiveFailures, backoff, err)
+			if m.failures == maxConsecutiveFailures {
+				log.Printf("[monitor] WARNING: %d consecutive failures; reconnect from WechatExplorer if this persists.", maxConsecutiveFailures)
+			}
+			select {
+			case <-time.After(backoff):
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+			continue
+		}
+
+		// Reset failure counter on any successful response
+		m.failures = 0
+		m.lastActivity = time.Now()
+
+		// Session expired — reset sync buf and reconnect silently
+		if resp.ErrCode == errCodeSessionExpired {
+			if m.getUpdatesBuf != "" {
+				log.Printf("[monitor] session expired, resetting sync buf")
+				m.getUpdatesBuf = ""
+				m.saveBuf()
+			} else {
+				// Sync buf already empty but still getting session expired:
+				// the bot token itself has expired. The user needs to re-login.
+				log.Printf("[monitor] WARNING: WeChat session expired and cannot be auto-recovered; reconnect from WechatExplorer.")
+			}
+			select {
+			case <-time.After(sessionExpiredBackoff):
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+			continue
+		}
+
+		// Other server errors
+		if resp.Ret != 0 && resp.ErrCode != 0 {
+			log.Printf("[monitor] server error: ret=%d errcode=%d errmsg=%s", resp.Ret, resp.ErrCode, resp.ErrMsg)
+			continue
+		}
+
+		// Update buf for next poll
+		if resp.GetUpdatesBuf != "" {
+			m.getUpdatesBuf = resp.GetUpdatesBuf
+			m.saveBuf()
+		}
+
+		// Process messages concurrently — don't block the poll loop
+		for _, msg := range resp.Msgs {
+			go m.handler(ctx, m.client, msg)
+		}
+	}
+}
+
+// calcBackoff returns an exponential backoff duration capped at maxBackoff.
+func (m *Monitor) calcBackoff() time.Duration {
+	d := initialBackoff
+	for i := 1; i < m.failures; i++ {
+		d *= 2
+		if d > maxBackoff {
+			return maxBackoff
+		}
+	}
+	return d
+}
+
+type syncData struct {
+	GetUpdatesBuf string `json:"get_updates_buf"`
+}
+
+func (m *Monitor) loadBuf() {
+	data, err := os.ReadFile(m.bufPath)
+	if err != nil {
+		return
+	}
+	var s syncData
+	if json.Unmarshal(data, &s) == nil && s.GetUpdatesBuf != "" {
+		m.getUpdatesBuf = s.GetUpdatesBuf
+		log.Printf("[monitor] loaded sync buf from %s", m.bufPath)
+	}
+}
+
+func (m *Monitor) saveBuf() {
+	dir := filepath.Dir(m.bufPath)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		log.Printf("[monitor] failed to create buf dir: %v", err)
+		return
+	}
+	data, _ := json.Marshal(syncData{GetUpdatesBuf: m.getUpdatesBuf})
+	if err := os.WriteFile(m.bufPath, data, 0o600); err != nil {
+		log.Printf("[monitor] failed to save buf: %v", err)
+	}
+}
+
+// FormatMessageSummary returns a short description of a message for logging.
+func FormatMessageSummary(msg WeixinMessage) string {
+	text := ""
+	for _, item := range msg.ItemList {
+		if item.Type == ItemTypeText && item.TextItem != nil {
+			text = item.TextItem.Text
+			break
+		}
+	}
+	if len(text) > 50 {
+		text = text[:50] + "..."
+	}
+	return fmt.Sprintf("from=%s type=%d state=%d text=%q", msg.FromUserID, msg.MessageType, msg.MessageState, text)
+}

services/wechat-connector/ilink/types.go

@@ -0,0 +1,219 @@
+package ilink
+
+// Message types
+const (
+	MessageTypeNone = 0
+	MessageTypeUser = 1
+	MessageTypeBot  = 2
+)
+
+// Message states
+const (
+	MessageStateNew        = 0
+	MessageStateGenerating = 1
+	MessageStateFinish     = 2
+)
+
+// Item types
+const (
+	ItemTypeNone  = 0
+	ItemTypeText  = 1
+	ItemTypeImage = 2
+	ItemTypeVoice = 3
+	ItemTypeFile  = 4
+	ItemTypeVideo = 5
+)
+
+// QRCodeResponse is the response from get_bot_qrcode.
+type QRCodeResponse struct {
+	QRCode           string `json:"qrcode"`
+	QRCodeImgContent string `json:"qrcode_img_content"`
+}
+
+// QRStatusResponse is the response from get_qrcode_status.
+type QRStatusResponse struct {
+	Status      string `json:"status"`
+	BotToken    string `json:"bot_token"`
+	ILinkBotID  string `json:"ilink_bot_id"`
+	BaseURL     string `json:"baseurl"`
+	ILinkUserID string `json:"ilink_user_id"`
+}
+
+// Credentials stores login session data.
+type Credentials struct {
+	BotToken    string `json:"bot_token"`
+	ILinkBotID  string `json:"ilink_bot_id"`
+	BaseURL     string `json:"baseurl"`
+	ILinkUserID string `json:"ilink_user_id"`
+}
+
+// BaseInfo is included in request bodies.
+type BaseInfo struct {
+	ChannelVersion string `json:"channel_version,omitempty"`
+}
+
+// GetUpdatesRequest is the body for getupdates.
+type GetUpdatesRequest struct {
+	GetUpdatesBuf string   `json:"get_updates_buf"`
+	BaseInfo      BaseInfo `json:"base_info"`
+}
+
+// GetUpdatesResponse is the response from getupdates.
+type GetUpdatesResponse struct {
+	Ret                  int             `json:"ret"`
+	ErrCode              int             `json:"errcode,omitempty"`
+	ErrMsg               string          `json:"errmsg,omitempty"`
+	Msgs                 []WeixinMessage `json:"msgs"`
+	GetUpdatesBuf        string          `json:"get_updates_buf"`
+	LongPollingTimeoutMs int             `json:"longpolling_timeout_ms,omitempty"`
+}
+
+// WeixinMessage represents a message from WeChat.
+type WeixinMessage struct {
+	Seq          int           `json:"seq,omitempty"`
+	MessageID    int64         `json:"message_id,omitempty"`
+	FromUserID   string        `json:"from_user_id"`
+	ToUserID     string        `json:"to_user_id"`
+	MessageType  int           `json:"message_type"`
+	MessageState int           `json:"message_state"`
+	ItemList     []MessageItem `json:"item_list"`
+	ContextToken string        `json:"context_token"`
+}
+
+// MessageItem is a single item in a message.
+type MessageItem struct {
+	Type      int        `json:"type"`
+	TextItem  *TextItem  `json:"text_item,omitempty"`
+	ImageItem *ImageItem `json:"image_item,omitempty"`
+	VoiceItem *VoiceItem `json:"voice_item,omitempty"`
+	VideoItem *VideoItem `json:"video_item,omitempty"`
+	FileItem  *FileItem  `json:"file_item,omitempty"`
+}
+
+// CDN media type constants.
+const (
+	CDNMediaTypeImage = 1
+	CDNMediaTypeVideo = 2
+	CDNMediaTypeFile  = 3
+)
+
+// GetUploadURLRequest is the body for getuploadurl.
+type GetUploadURLRequest struct {
+	FileKey     string   `json:"filekey"`
+	MediaType   int      `json:"media_type"`
+	ToUserID    string   `json:"to_user_id"`
+	RawSize     int      `json:"rawsize"`
+	RawFileMD5  string   `json:"rawfilemd5"`
+	FileSize    int      `json:"filesize"`
+	NoNeedThumb bool     `json:"no_need_thumb"`
+	AESKey      string   `json:"aeskey"`
+	BaseInfo    BaseInfo `json:"base_info"`
+}
+
+// GetUploadURLResponse is the response from getuploadurl.
+type GetUploadURLResponse struct {
+	Ret           int    `json:"ret"`
+	ErrMsg        string `json:"errmsg,omitempty"`
+	UploadParam   string `json:"upload_param"`
+	UploadFullURL string `json:"upload_full_url,omitempty"`
+}
+
+// TextItem holds text content.
+type TextItem struct {
+	Text string `json:"text"`
+}
+
+// MediaInfo holds CDN media reference for uploaded files.
+type MediaInfo struct {
+	EncryptQueryParam string `json:"encrypt_query_param"`
+	AESKey            string `json:"aes_key"`      // base64-encoded
+	EncryptType       int    `json:"encrypt_type"` // 1 = AES-128-ECB
+}
+
+// VoiceItem holds voice content.
+type VoiceItem struct {
+	Media         *MediaInfo `json:"media,omitempty"`
+	VoiceSize     int        `json:"voice_size,omitempty"`
+	EncodeType    int        `json:"encode_type,omitempty"` // 1=pcm 2=adpcm 3=feature 4=speex 5=amr 6=silk 7=mp3
+	BitsPerSample int        `json:"bits_per_sample,omitempty"`
+	SampleRate    int        `json:"sample_rate,omitempty"` // Hz
+	Playtime      int        `json:"playtime,omitempty"`    // duration in milliseconds
+	Text          string     `json:"text,omitempty"`        // speech-to-text transcription from WeChat
+}
+
+// ImageItem holds image content.
+type ImageItem struct {
+	URL     string     `json:"url,omitempty"`
+	Media   *MediaInfo `json:"media,omitempty"`
+	MidSize int        `json:"mid_size,omitempty"` // ciphertext size
+}
+
+// VideoItem holds video content.
+type VideoItem struct {
+	Media     *MediaInfo `json:"media,omitempty"`
+	VideoSize int        `json:"video_size,omitempty"`
+}
+
+// FileItem holds file content.
+type FileItem struct {
+	Media    *MediaInfo `json:"media,omitempty"`
+	FileName string     `json:"file_name,omitempty"`
+	Len      string     `json:"len,omitempty"` // plaintext size as string
+}
+
+// SendMessageRequest is the body for sendmessage.
+type SendMessageRequest struct {
+	Msg      SendMsg  `json:"msg"`
+	BaseInfo BaseInfo `json:"base_info"`
+}
+
+// SendMsg is the message payload for sending.
+type SendMsg struct {
+	FromUserID   string        `json:"from_user_id"`
+	ToUserID     string        `json:"to_user_id"`
+	ClientID     string        `json:"client_id"`
+	MessageType  int           `json:"message_type"`
+	MessageState int           `json:"message_state"`
+	ItemList     []MessageItem `json:"item_list"`
+	ContextToken string        `json:"context_token"`
+}
+
+// SendMessageResponse is the response from sendmessage.
+type SendMessageResponse struct {
+	Ret    int    `json:"ret"`
+	ErrMsg string `json:"errmsg,omitempty"`
+}
+
+// Typing status constants.
+const (
+	TypingStatusTyping = 1
+	TypingStatusCancel = 2
+)
+
+// GetConfigRequest is the body for getconfig.
+type GetConfigRequest struct {
+	ILinkUserID  string   `json:"ilink_user_id"`
+	ContextToken string   `json:"context_token,omitempty"`
+	BaseInfo     BaseInfo `json:"base_info"`
+}
+
+// GetConfigResponse is the response from getconfig.
+type GetConfigResponse struct {
+	Ret          int    `json:"ret"`
+	ErrMsg       string `json:"errmsg,omitempty"`
+	TypingTicket string `json:"typing_ticket,omitempty"`
+}
+
+// SendTypingRequest is the body for sendtyping.
+type SendTypingRequest struct {
+	ILinkUserID  string   `json:"ilink_user_id"`
+	TypingTicket string   `json:"typing_ticket"`
+	Status       int      `json:"status"`
+	BaseInfo     BaseInfo `json:"base_info"`
+}
+
+// SendTypingResponse is the response from sendtyping.
+type SendTypingResponse struct {
+	Ret    int    `json:"ret"`
+	ErrMsg string `json:"errmsg,omitempty"`
+}

services/wechat-connector/main.go

@@ -0,0 +1,200 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"os/signal"
+	"strings"
+	"sync"
+	"syscall"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/api"
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/messaging"
+	"rsc.io/qr"
+)
+
+type loginEvent struct {
+	Status        string `json:"status"`
+	QRCodeDataURL string `json:"qr_code_data_url,omitempty"`
+	AccountID     string `json:"account_id,omitempty"`
+	WeChatUserID  string `json:"wechat_user_id,omitempty"`
+}
+
+type accountSummary struct {
+	AccountID    string `json:"account_id"`
+	WeChatUserID string `json:"wechat_user_id"`
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		fatal(errors.New("expected one of: login, accounts, start"))
+	}
+	var err error
+	switch os.Args[1] {
+	case "login":
+		err = runLogin(os.Args[2:])
+	case "accounts":
+		err = runAccounts(os.Args[2:])
+	case "start":
+		err = runStart(os.Args[2:])
+	default:
+		err = fmt.Errorf("unknown command %q", os.Args[1])
+	}
+	if err != nil {
+		fatal(err)
+	}
+}
+
+func fatal(err error) {
+	fmt.Fprintln(os.Stderr, err)
+	os.Exit(1)
+}
+
+func signalContext() (context.Context, context.CancelFunc) {
+	return signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+}
+
+func runLogin(args []string) error {
+	flags := flag.NewFlagSet("login", flag.ContinueOnError)
+	jsonOutput := flags.Bool("json", false, "emit JSON Lines events")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	ctx, cancel := signalContext()
+	defer cancel()
+	creds, err := login(ctx, *jsonOutput)
+	if err != nil {
+		return err
+	}
+	if !*jsonOutput {
+		fmt.Printf("WeChat account %s connected.\n", creds.ILinkBotID)
+	}
+	return nil
+}
+
+func login(ctx context.Context, jsonOutput bool) (*ilink.Credentials, error) {
+	qrResponse, err := ilink.FetchQRCode(ctx)
+	if err != nil {
+		return nil, err
+	}
+	code, err := qr.Encode(qrResponse.QRCodeImgContent, qr.L)
+	if err != nil {
+		return nil, fmt.Errorf("encode QR image: %w", err)
+	}
+	emit := func(event loginEvent) {
+		if jsonOutput {
+			_ = json.NewEncoder(os.Stdout).Encode(event)
+		}
+	}
+	emit(loginEvent{Status: "qrcode", QRCodeDataURL: "data:image/png;base64," + base64.StdEncoding.EncodeToString(code.PNG())})
+	lastStatus := ""
+	creds, err := ilink.PollQRStatus(ctx, qrResponse.QRCode, func(status string) {
+		if status != lastStatus {
+			lastStatus = status
+			emit(loginEvent{Status: status})
+		}
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := ilink.SaveCredentials(creds); err != nil {
+		return nil, fmt.Errorf("save credentials: %w", err)
+	}
+	emit(loginEvent{Status: "active", AccountID: creds.ILinkBotID, WeChatUserID: creds.ILinkUserID})
+	return creds, nil
+}
+
+func runAccounts(args []string) error {
+	flags := flag.NewFlagSet("accounts", flag.ContinueOnError)
+	jsonOutput := flags.Bool("json", false, "print JSON")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	accounts, err := ilink.LoadAllCredentials()
+	if err != nil {
+		return err
+	}
+	items := make([]accountSummary, 0, len(accounts))
+	for _, account := range accounts {
+		items = append(items, accountSummary{AccountID: account.ILinkBotID, WeChatUserID: account.ILinkUserID})
+	}
+	if *jsonOutput {
+		return json.NewEncoder(os.Stdout).Encode(map[string]any{"accounts": items})
+	}
+	for _, item := range items {
+		fmt.Printf("%s\t%s\n", item.AccountID, item.WeChatUserID)
+	}
+	return nil
+}
+
+func runStart(args []string) error {
+	flags := flag.NewFlagSet("start", flag.ContinueOnError)
+	_ = flags.Bool("foreground", false, "kept for host compatibility")
+	apiAddr := flags.String("api-addr", "127.0.0.1:18011", "local send API address")
+	accountID := flags.String("account-id", "", "account to start")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	accounts, err := ilink.LoadAllCredentials()
+	if err != nil {
+		return err
+	}
+	if len(accounts) == 0 {
+		return errors.New("no connected WeChat account; scan a QR code first")
+	}
+	selected := accounts[len(accounts)-1]
+	if *accountID != "" {
+		selected = nil
+		for _, account := range accounts {
+			if account.ILinkBotID == *accountID {
+				selected = account
+				break
+			}
+		}
+		if selected == nil {
+			return fmt.Errorf("account %q not found", *accountID)
+		}
+	}
+
+	ctx, cancel := signalContext()
+	defer cancel()
+	client := ilink.NewClient(selected)
+	server := api.NewServer([]*ilink.Client{client}, *apiAddr)
+	webhookURL := strings.TrimSpace(os.Getenv("WECHAT_CONNECTOR_INBOUND_WEBHOOK_URL"))
+	webhook := messaging.NewInboundWebhook(webhookURL, os.Getenv("WECHAT_CONNECTOR_INBOUND_WEBHOOK_TOKEN"))
+
+	monitor, err := ilink.NewMonitor(client, func(messageContext context.Context, source *ilink.Client, message ilink.WeixinMessage) {
+		if webhookURL != "" {
+			webhook.Dispatch(messageContext, source, message)
+		}
+	})
+	if err != nil {
+		return err
+	}
+
+	var wait sync.WaitGroup
+	wait.Add(2)
+	go func() {
+		defer wait.Done()
+		if err := server.Run(ctx); err != nil && ctx.Err() == nil {
+			log.Printf("[api] stopped: %v", err)
+			cancel()
+		}
+	}()
+	go func() {
+		defer wait.Done()
+		if err := monitor.Run(ctx); err != nil && ctx.Err() == nil {
+			log.Printf("[monitor] stopped: %v", err)
+			cancel()
+		}
+	}()
+	wait.Wait()
+	return nil
+}

services/wechat-connector/messaging/cdn.go

@@ -0,0 +1,232 @@
+package messaging
+
+import (
+	"bytes"
+	"context"
+	"crypto/aes"
+	"crypto/md5"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+)
+
+const cdnBaseURL = "https://novac2c.cdn.weixin.qq.com/c2c"
+
+// UploadedFile holds the result of a CDN upload.
+type UploadedFile struct {
+	DownloadParam string // encrypted query param for download
+	AESKeyHex     string // hex-encoded AES key
+	FileSize      int    // plaintext size
+	CipherSize    int    // ciphertext size
+}
+
+// UploadFileToCDN encrypts and uploads a file to the WeChat CDN.
+func UploadFileToCDN(ctx context.Context, client *ilink.Client, data []byte, toUserID string, mediaType int) (*UploadedFile, error) {
+	// Generate random filekey and AES key
+	filekey := make([]byte, 16)
+	aeskey := make([]byte, 16)
+	if _, err := rand.Read(filekey); err != nil {
+		return nil, fmt.Errorf("generate filekey: %w", err)
+	}
+	if _, err := rand.Read(aeskey); err != nil {
+		return nil, fmt.Errorf("generate aeskey: %w", err)
+	}
+
+	filekeyHex := hex.EncodeToString(filekey)
+	aeskeyHex := hex.EncodeToString(aeskey)
+
+	// Calculate MD5 of plaintext
+	hash := md5.Sum(data)
+	rawMD5 := hex.EncodeToString(hash[:])
+
+	// Calculate ciphertext size (PKCS7 padding)
+	cipherSize := aesECBPaddedSize(len(data))
+
+	// Get upload URL from iLink API
+	uploadReq := &ilink.GetUploadURLRequest{
+		FileKey:     filekeyHex,
+		MediaType:   mediaType,
+		ToUserID:    toUserID,
+		RawSize:     len(data),
+		RawFileMD5:  rawMD5,
+		FileSize:    cipherSize,
+		NoNeedThumb: true,
+		AESKey:      aeskeyHex,
+		BaseInfo:    ilink.BaseInfo{},
+	}
+
+	uploadResp, err := client.GetUploadURL(ctx, uploadReq)
+	if err != nil {
+		return nil, fmt.Errorf("get upload URL: %w", err)
+	}
+	if uploadResp.Ret != 0 {
+		return nil, fmt.Errorf("get upload URL failed: ret=%d errmsg=%s", uploadResp.Ret, uploadResp.ErrMsg)
+	}
+
+	// Encrypt data with AES-128-ECB
+	encrypted, err := encryptAESECB(data, aeskey)
+	if err != nil {
+		return nil, fmt.Errorf("encrypt: %w", err)
+	}
+
+	// Upload to CDN: prefer server-provided full URL, fall back to param-based construction
+	cdnURL := strings.TrimSpace(uploadResp.UploadFullURL)
+	if cdnURL == "" {
+		if uploadResp.UploadParam == "" {
+			return nil, fmt.Errorf("getuploadurl returned no upload URL (need upload_full_url or upload_param)")
+		}
+		cdnURL = fmt.Sprintf("%s/upload?encrypted_query_param=%s&filekey=%s",
+			cdnBaseURL, url.QueryEscape(uploadResp.UploadParam), url.QueryEscape(filekeyHex))
+	}
+
+	downloadParam, err := uploadToCDN(ctx, encrypted, cdnURL)
+	if err != nil {
+		return nil, fmt.Errorf("CDN upload: %w", err)
+	}
+
+	return &UploadedFile{
+		DownloadParam: downloadParam,
+		AESKeyHex:     aeskeyHex,
+		FileSize:      len(data),
+		CipherSize:    cipherSize,
+	}, nil
+}
+
+// AESKeyToBase64 converts a hex AES key to base64 format for message items.
+func AESKeyToBase64(hexKey string) string {
+	return base64.StdEncoding.EncodeToString([]byte(hexKey))
+}
+
+// DownloadFileFromCDN downloads and decrypts a file from the WeChat CDN.
+func DownloadFileFromCDN(ctx context.Context, encryptQueryParam, aesKeyBase64 string) ([]byte, error) {
+	// Decode AES key: base64 -> hex string -> raw bytes
+	aesKeyHexBytes, err := base64.StdEncoding.DecodeString(aesKeyBase64)
+	if err != nil {
+		return nil, fmt.Errorf("decode AES key base64: %w", err)
+	}
+	aesKey, err := hex.DecodeString(string(aesKeyHexBytes))
+	if err != nil {
+		return nil, fmt.Errorf("decode AES key hex: %w", err)
+	}
+
+	// Download encrypted data from CDN
+	downloadURL := fmt.Sprintf("%s/download?encrypted_query_param=%s",
+		cdnBaseURL, url.QueryEscape(encryptQueryParam))
+
+	reqCtx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, downloadURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("create download request: %w", err)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("download from CDN: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("CDN download HTTP %d: %s", resp.StatusCode, string(body))
+	}
+
+	encrypted, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read CDN response: %w", err)
+	}
+
+	// Decrypt AES-128-ECB
+	return decryptAESECB(encrypted, aesKey)
+}
+
+// decryptAESECB decrypts data encrypted with AES-128-ECB and removes PKCS7 padding.
+func decryptAESECB(ciphertext, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(ciphertext)%aes.BlockSize != 0 {
+		return nil, fmt.Errorf("ciphertext is not a multiple of block size")
+	}
+
+	plaintext := make([]byte, len(ciphertext))
+	for i := 0; i < len(ciphertext); i += aes.BlockSize {
+		block.Decrypt(plaintext[i:i+aes.BlockSize], ciphertext[i:i+aes.BlockSize])
+	}
+
+	// Remove PKCS7 padding
+	if len(plaintext) == 0 {
+		return plaintext, nil
+	}
+	padLen := int(plaintext[len(plaintext)-1])
+	if padLen > aes.BlockSize || padLen == 0 {
+		return nil, fmt.Errorf("invalid PKCS7 padding")
+	}
+	return plaintext[:len(plaintext)-padLen], nil
+}
+
+func uploadToCDN(ctx context.Context, encrypted []byte, cdnURL string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, cdnURL, bytes.NewReader(encrypted))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/octet-stream")
+
+	client := &http.Client{Timeout: 60 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("CDN upload HTTP %d: %s", resp.StatusCode, string(body))
+	}
+
+	downloadParam := resp.Header.Get("X-Encrypted-Param")
+	if downloadParam == "" {
+		return "", fmt.Errorf("CDN upload: missing X-Encrypted-Param header")
+	}
+
+	return downloadParam, nil
+}
+
+// encryptAESECB encrypts data using AES-128-ECB with PKCS7 padding.
+func encryptAESECB(plaintext, key []byte) ([]byte, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+
+	// PKCS7 padding
+	padLen := aes.BlockSize - (len(plaintext) % aes.BlockSize)
+	padded := make([]byte, len(plaintext)+padLen)
+	copy(padded, plaintext)
+	for i := len(plaintext); i < len(padded); i++ {
+		padded[i] = byte(padLen)
+	}
+
+	// ECB mode: encrypt each block independently
+	encrypted := make([]byte, len(padded))
+	for i := 0; i < len(padded); i += aes.BlockSize {
+		block.Encrypt(encrypted[i:i+aes.BlockSize], padded[i:i+aes.BlockSize])
+	}
+
+	return encrypted, nil
+}
+
+func aesECBPaddedSize(plaintextSize int) int {
+	return (plaintextSize/aes.BlockSize + 1) * aes.BlockSize
+}

services/wechat-connector/messaging/inbound_webhook.go

@@ -0,0 +1,121 @@
+package messaging
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+)
+
+const (
+	webhookAttempts = 3
+	webhookTimeout  = 5 * time.Second
+)
+
+type InboundWebhook struct {
+	url    string
+	token  string
+	client *http.Client
+}
+
+type inboundWebhookPayload struct {
+	AccountID   string               `json:"account_id"`
+	FromUserID  string               `json:"from_user_id"`
+	MessageID   int64                `json:"message_id"`
+	MessageType int                  `json:"message_type"`
+	Items       []inboundWebhookItem `json:"items"`
+	ReceivedAt  time.Time            `json:"received_at"`
+}
+
+type inboundWebhookItem struct {
+	Type int    `json:"type"`
+	Text string `json:"text,omitempty"`
+}
+
+func NewInboundWebhook(url, token string) *InboundWebhook {
+	return &InboundWebhook{
+		url:    strings.TrimSpace(url),
+		token:  token,
+		client: &http.Client{Timeout: webhookTimeout},
+	}
+}
+
+// Dispatch is intentionally non-blocking so webhook failures never stall iLink polling.
+func (w *InboundWebhook) Dispatch(ctx context.Context, client *ilink.Client, msg ilink.WeixinMessage) {
+	payload := normalizeInboundMessage(client.BotID(), msg)
+	go func() {
+		if err := w.deliver(ctx, payload); err != nil {
+			log.Printf("[webhook] inbound delivery failed for message %d: %v", msg.MessageID, err)
+		}
+	}()
+}
+
+func (w *InboundWebhook) deliver(ctx context.Context, payload inboundWebhookPayload) error {
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("encode payload: %w", err)
+	}
+	var lastErr error
+	for attempt := 1; attempt <= webhookAttempts; attempt++ {
+		if attempt > 1 {
+			timer := time.NewTimer(time.Duration(attempt-1) * time.Second)
+			select {
+			case <-ctx.Done():
+				timer.Stop()
+				return ctx.Err()
+			case <-timer.C:
+			}
+		}
+		req, reqErr := http.NewRequestWithContext(ctx, http.MethodPost, w.url, bytes.NewReader(body))
+		if reqErr != nil {
+			return fmt.Errorf("create request: %w", reqErr)
+		}
+		req.Header.Set("Content-Type", "application/json")
+		if w.token != "" {
+			req.Header.Set("Authorization", "Bearer "+w.token)
+		}
+		resp, doErr := w.client.Do(req)
+		if doErr != nil {
+			lastErr = doErr
+			continue
+		}
+		responseBody, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		resp.Body.Close()
+		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+			return nil
+		}
+		lastErr = fmt.Errorf("status %s: %s", resp.Status, strings.TrimSpace(string(responseBody)))
+		if resp.StatusCode >= 400 && resp.StatusCode < 500 {
+			break
+		}
+	}
+	return lastErr
+}
+
+func normalizeInboundMessage(accountID string, msg ilink.WeixinMessage) inboundWebhookPayload {
+	items := make([]inboundWebhookItem, 0, len(msg.ItemList))
+	for _, item := range msg.ItemList {
+		normalized := inboundWebhookItem{Type: item.Type}
+		if item.TextItem != nil {
+			normalized.Text = item.TextItem.Text
+		} else if item.VoiceItem != nil {
+			normalized.Text = item.VoiceItem.Text
+		}
+		items = append(items, normalized)
+	}
+	return inboundWebhookPayload{
+		AccountID:   accountID,
+		FromUserID:  msg.FromUserID,
+		MessageID:   msg.MessageID,
+		MessageType: msg.MessageType,
+		Items:       items,
+		ReceivedAt:  time.Now().UTC(),
+	}
+}

services/wechat-connector/messaging/inbound_webhook_test.go

@@ -0,0 +1,75 @@
+package messaging
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+)
+
+func TestInboundWebhookDeliversNormalizedPayload(t *testing.T) {
+	var got inboundWebhookPayload
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "Bearer secret" {
+			t.Errorf("authorization = %q", r.Header.Get("Authorization"))
+		}
+		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
+			t.Errorf("decode: %v", err)
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	webhook := NewInboundWebhook(server.URL, "secret")
+	err := webhook.deliver(context.Background(), normalizeInboundMessage("bot-new", ilink.WeixinMessage{
+		MessageID: 7, FromUserID: "user-1", MessageType: ilink.MessageTypeUser,
+		ItemList: []ilink.MessageItem{{Type: ilink.ItemTypeText, TextItem: &ilink.TextItem{Text: "最近5条消息"}}},
+	}))
+	if err != nil {
+		t.Fatalf("deliver: %v", err)
+	}
+	if got.AccountID != "bot-new" || got.MessageID != 7 || len(got.Items) != 1 || got.Items[0].Text != "最近5条消息" {
+		t.Fatalf("payload = %#v", got)
+	}
+}
+
+func TestInboundWebhookRetriesServerErrors(t *testing.T) {
+	var calls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		if calls.Add(1) < 3 {
+			http.Error(w, "temporary", http.StatusServiceUnavailable)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	webhook := NewInboundWebhook(server.URL, "")
+	if err := webhook.deliver(context.Background(), inboundWebhookPayload{}); err != nil {
+		t.Fatalf("deliver: %v", err)
+	}
+	if calls.Load() != 3 {
+		t.Fatalf("calls = %d, want 3", calls.Load())
+	}
+}
+
+func TestInboundWebhookDoesNotRetryClientErrors(t *testing.T) {
+	var calls atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		calls.Add(1)
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+	}))
+	defer server.Close()
+
+	webhook := NewInboundWebhook(server.URL, "")
+	if err := webhook.deliver(context.Background(), inboundWebhookPayload{}); err == nil {
+		t.Fatal("deliver error = nil")
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("calls = %d, want 1", calls.Load())
+	}
+}

services/wechat-connector/messaging/markdown.go

@@ -0,0 +1,103 @@
+package messaging
+
+import (
+	"regexp"
+	"strings"
+)
+
+var (
+	// Code blocks: strip fences, keep code content
+	reCodeBlock = regexp.MustCompile("(?s)```[^\n]*\n?(.*?)```")
+	// Inline code: strip backticks, keep content
+	reInlineCode = regexp.MustCompile("`([^`]+)`")
+	// Images: remove entirely
+	reImage = regexp.MustCompile(`!\[[^\]]*\]\([^)]*\)`)
+	// Links: keep display text only
+	reLink = regexp.MustCompile(`\[([^\]]+)\]\([^)]*\)`)
+	// Table separator rows: remove
+	reTableSep = regexp.MustCompile(`(?m)^\|[\s:|\-]+\|$`)
+	// Table rows: convert pipe-delimited to space-delimited
+	reTableRow = regexp.MustCompile(`(?m)^\|(.+)\|$`)
+	// Headers: remove # prefix
+	reHeader = regexp.MustCompile(`(?m)^#{1,6}\s+`)
+	// Bold: **text** or __text__
+	reBold = regexp.MustCompile(`\*\*(.+?)\*\*|__(.+?)__`)
+	// Italic: *text* or _text_
+	reItalic = regexp.MustCompile(`(?:^|[^*])\*([^*]+)\*(?:[^*]|$)|(?:^|[^_])_([^_]+)_(?:[^_]|$)`)
+	// Strikethrough: ~~text~~
+	reStrike = regexp.MustCompile(`~~(.+?)~~`)
+	// Blockquote: > prefix
+	reBlockquote = regexp.MustCompile(`(?m)^>\s?`)
+	// Horizontal rule
+	reHR = regexp.MustCompile(`(?m)^[-*_]{3,}\s*$`)
+	// Unordered list markers: -, *, +
+	reUL = regexp.MustCompile(`(?m)^(\s*)[-*+]\s+`)
+)
+
+// MarkdownToPlainText converts markdown to readable plain text for WeChat.
+func MarkdownToPlainText(text string) string {
+	result := text
+
+	// Code blocks: strip fences, keep code content
+	result = reCodeBlock.ReplaceAllStringFunc(result, func(match string) string {
+		parts := reCodeBlock.FindStringSubmatch(match)
+		if len(parts) > 1 {
+			return strings.TrimSpace(parts[1])
+		}
+		return match
+	})
+
+	// Images: remove entirely
+	result = reImage.ReplaceAllString(result, "")
+
+	// Links: keep display text only
+	result = reLink.ReplaceAllString(result, "$1")
+
+	// Table separator rows: remove
+	result = reTableSep.ReplaceAllString(result, "")
+
+	// Table rows: pipe-delimited to space-delimited
+	result = reTableRow.ReplaceAllStringFunc(result, func(match string) string {
+		parts := reTableRow.FindStringSubmatch(match)
+		if len(parts) > 1 {
+			cells := strings.Split(parts[1], "|")
+			for i := range cells {
+				cells[i] = strings.TrimSpace(cells[i])
+			}
+			return strings.Join(cells, "  ")
+		}
+		return match
+	})
+
+	// Headers: remove # prefix
+	result = reHeader.ReplaceAllString(result, "")
+
+	// Bold
+	result = reBold.ReplaceAllStringFunc(result, func(match string) string {
+		parts := reBold.FindStringSubmatch(match)
+		if parts[1] != "" {
+			return parts[1]
+		}
+		return parts[2]
+	})
+
+	// Strikethrough
+	result = reStrike.ReplaceAllString(result, "$1")
+
+	// Blockquote
+	result = reBlockquote.ReplaceAllString(result, "")
+
+	// Horizontal rule -> empty line
+	result = reHR.ReplaceAllString(result, "")
+
+	// Unordered list: replace markers with "• "
+	result = reUL.ReplaceAllString(result, "${1}• ")
+
+	// Inline code: strip backticks (do after code blocks)
+	result = reInlineCode.ReplaceAllString(result, "$1")
+
+	// Clean up excessive blank lines
+	result = regexp.MustCompile(`\n{3,}`).ReplaceAllString(result, "\n\n")
+
+	return strings.TrimSpace(result)
+}

services/wechat-connector/messaging/media.go

@@ -0,0 +1,221 @@
+package messaging
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"mime"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+)
+
+// reMarkdownImage matches markdown image syntax: ![alt](url)
+var reMarkdownImage = regexp.MustCompile(`!\[[^\]]*\]\(([^)]+)\)`)
+
+// ExtractImageURLs extracts image URLs from markdown text.
+func ExtractImageURLs(text string) []string {
+	matches := reMarkdownImage.FindAllStringSubmatch(text, -1)
+	var urls []string
+	for _, m := range matches {
+		url := strings.TrimSpace(m[1])
+		if strings.HasPrefix(url, "http://") || strings.HasPrefix(url, "https://") {
+			urls = append(urls, url)
+		}
+	}
+	return urls
+}
+
+// SendMediaFromURL sends a local file or downloads from a URL and sends it as a media message.
+func SendMediaFromURL(ctx context.Context, client *ilink.Client, toUserID, mediaURL, contextToken string) error {
+	// Check if it's a local file
+	if _, err := os.Stat(mediaURL); err == nil {
+		return SendMediaFromPath(ctx, client, toUserID, mediaURL, contextToken)
+	}
+	// Must be a valid HTTP URL to download
+	if !strings.HasPrefix(mediaURL, "http://") && !strings.HasPrefix(mediaURL, "https://") {
+		return fmt.Errorf("unsupported media path (not a local file and not an HTTP URL): %s", mediaURL)
+	}
+	data, contentType, err := downloadFile(ctx, mediaURL)
+	if err != nil {
+		return fmt.Errorf("download %s: %w", mediaURL, err)
+	}
+
+	return sendMediaData(ctx, client, toUserID, filenameFromURL(mediaURL), mediaURL, data, contentType, contextToken)
+}
+
+// SendMediaFromPath reads a local file and sends it as a media message.
+func SendMediaFromPath(ctx context.Context, client *ilink.Client, toUserID, path, contextToken string) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", path, err)
+	}
+
+	return sendMediaData(ctx, client, toUserID, filepath.Base(path), path, data, inferContentType(path), contextToken)
+}
+
+func sendMediaData(ctx context.Context, client *ilink.Client, toUserID, fileName, source string, data []byte, contentType, contextToken string) error {
+	if fileName == "" {
+		fileName = "file"
+	}
+
+	cdnMediaType, itemType := classifyMedia(contentType, source)
+
+	log.Printf("[media] uploading %s (%s, %d bytes) for %s", source, contentType, len(data), toUserID)
+
+	uploaded, err := UploadFileToCDN(ctx, client, data, toUserID, cdnMediaType)
+	if err != nil {
+		return fmt.Errorf("upload to CDN: %w", err)
+	}
+
+	media := &ilink.MediaInfo{
+		EncryptQueryParam: uploaded.DownloadParam,
+		AESKey:            AESKeyToBase64(uploaded.AESKeyHex),
+		EncryptType:       1,
+	}
+
+	var item ilink.MessageItem
+	switch itemType {
+	case ilink.ItemTypeImage:
+		item = ilink.MessageItem{
+			Type: ilink.ItemTypeImage,
+			ImageItem: &ilink.ImageItem{
+				Media:   media,
+				MidSize: uploaded.CipherSize,
+			},
+		}
+	case ilink.ItemTypeVideo:
+		item = ilink.MessageItem{
+			Type: ilink.ItemTypeVideo,
+			VideoItem: &ilink.VideoItem{
+				Media:     media,
+				VideoSize: uploaded.CipherSize,
+			},
+		}
+	default:
+		item = ilink.MessageItem{
+			Type: ilink.ItemTypeFile,
+			FileItem: &ilink.FileItem{
+				Media:    media,
+				FileName: fileName,
+				Len:      fmt.Sprintf("%d", uploaded.FileSize),
+			},
+		}
+	}
+
+	req := &ilink.SendMessageRequest{
+		Msg: ilink.SendMsg{
+			FromUserID:   client.BotID(),
+			ToUserID:     toUserID,
+			ClientID:     NewClientID(),
+			MessageType:  ilink.MessageTypeBot,
+			MessageState: ilink.MessageStateFinish,
+			ItemList:     []ilink.MessageItem{item},
+			ContextToken: contextToken,
+		},
+		BaseInfo: ilink.BaseInfo{},
+	}
+
+	resp, err := client.SendMessage(ctx, req)
+	if err != nil {
+		return fmt.Errorf("send media message: %w", err)
+	}
+	if resp.Ret != 0 {
+		return fmt.Errorf("send media failed: ret=%d errmsg=%s", resp.Ret, resp.ErrMsg)
+	}
+
+	log.Printf("[media] sent %s to %s from %s", contentType, toUserID, source)
+	return nil
+}
+
+func downloadFile(ctx context.Context, url string) ([]byte, string, error) {
+	ctx, cancel := context.WithTimeout(ctx, 60*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, "", err
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, "", fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, "", err
+	}
+
+	contentType := resp.Header.Get("Content-Type")
+	if contentType == "" {
+		contentType = inferContentType(url)
+	}
+
+	return data, contentType, nil
+}
+
+func classifyMedia(contentType, url string) (cdnMediaType int, itemType int) {
+	ct := strings.ToLower(contentType)
+
+	if strings.HasPrefix(ct, "image/") || isImageExt(url) {
+		return ilink.CDNMediaTypeImage, ilink.ItemTypeImage
+	}
+	if strings.HasPrefix(ct, "video/") || isVideoExt(url) {
+		return ilink.CDNMediaTypeVideo, ilink.ItemTypeVideo
+	}
+	return ilink.CDNMediaTypeFile, ilink.ItemTypeFile
+}
+
+func isImageExt(url string) bool {
+	ext := strings.ToLower(filepath.Ext(stripQuery(url)))
+	switch ext {
+	case ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp":
+		return true
+	}
+	return false
+}
+
+func isVideoExt(url string) bool {
+	ext := strings.ToLower(filepath.Ext(stripQuery(url)))
+	switch ext {
+	case ".mp4", ".mov", ".webm", ".mkv", ".avi":
+		return true
+	}
+	return false
+}
+
+func inferContentType(url string) string {
+	ext := filepath.Ext(stripQuery(url))
+	if ct := mime.TypeByExtension(ext); ct != "" {
+		return ct
+	}
+	return "application/octet-stream"
+}
+
+func filenameFromURL(rawURL string) string {
+	u := stripQuery(rawURL)
+	name := filepath.Base(u)
+	if name == "" || name == "." || name == "/" {
+		return "file"
+	}
+	return name
+}
+
+func stripQuery(rawURL string) string {
+	if i := strings.IndexByte(rawURL, '?'); i >= 0 {
+		return rawURL[:i]
+	}
+	return rawURL
+}

services/wechat-connector/messaging/media_test.go

@@ -0,0 +1,73 @@
+package messaging
+
+import "testing"
+
+func TestExtractImageURLs(t *testing.T) {
+	text := "check ![img](https://example.com/a.png) and ![](https://example.com/b.jpg)"
+	urls := ExtractImageURLs(text)
+	if len(urls) != 2 {
+		t.Fatalf("expected 2 urls, got %d", len(urls))
+	}
+	if urls[0] != "https://example.com/a.png" {
+		t.Errorf("urls[0] = %q", urls[0])
+	}
+	if urls[1] != "https://example.com/b.jpg" {
+		t.Errorf("urls[1] = %q", urls[1])
+	}
+}
+
+func TestExtractImageURLs_NoImages(t *testing.T) {
+	urls := ExtractImageURLs("just plain text")
+	if len(urls) != 0 {
+		t.Errorf("expected 0 urls, got %d", len(urls))
+	}
+}
+
+func TestExtractImageURLs_RelativeURL(t *testing.T) {
+	text := "![img](./local.png)"
+	urls := ExtractImageURLs(text)
+	if len(urls) != 0 {
+		t.Errorf("expected 0 urls for relative path, got %d", len(urls))
+	}
+}
+
+func TestFilenameFromURL(t *testing.T) {
+	tests := []struct {
+		url  string
+		want string
+	}{
+		{"https://example.com/photo.png", "photo.png"},
+		{"https://example.com/path/to/report.pdf", "report.pdf"},
+		{"https://example.com/file", "file"},
+	}
+	for _, tt := range tests {
+		got := filenameFromURL(tt.url)
+		if got != tt.want {
+			t.Errorf("filenameFromURL(%q) = %q, want %q", tt.url, got, tt.want)
+		}
+	}
+}
+
+func TestFilenameFromURL_WithQuery(t *testing.T) {
+	got := filenameFromURL("https://example.com/photo.png?token=abc")
+	if got != "photo.png" {
+		t.Errorf("got %q, want %q", got, "photo.png")
+	}
+}
+
+func TestStripQuery(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+	}{
+		{"https://example.com/a?b=c", "https://example.com/a"},
+		{"https://example.com/a", "https://example.com/a"},
+		{"https://example.com/?x=1&y=2", "https://example.com/"},
+	}
+	for _, tt := range tests {
+		got := stripQuery(tt.input)
+		if got != tt.want {
+			t.Errorf("stripQuery(%q) = %q, want %q", tt.input, got, tt.want)
+		}
+	}
+}

services/wechat-connector/messaging/sender.go

@@ -0,0 +1,86 @@
+package messaging
+
+import (
+	"context"
+	"fmt"
+	"log"
+
+	"github.com/Wxw-Gu/WechatExplorer/services/wechat-connector/ilink"
+	"github.com/google/uuid"
+)
+
+// NewClientID generates a new unique client ID for message correlation.
+func NewClientID() string {
+	return uuid.New().String()
+}
+
+// SendTypingState sends a typing indicator to a user via the iLink sendtyping API.
+// It first fetches a typing_ticket via getconfig, then sends the typing status.
+func SendTypingState(ctx context.Context, client *ilink.Client, userID, contextToken string) error {
+	// Get typing ticket
+	configResp, err := client.GetConfig(ctx, userID, contextToken)
+	if err != nil {
+		return fmt.Errorf("get config for typing: %w", err)
+	}
+	if configResp.TypingTicket == "" {
+		return fmt.Errorf("no typing_ticket returned from getconfig")
+	}
+
+	// Send typing
+	if err := client.SendTyping(ctx, userID, configResp.TypingTicket, ilink.TypingStatusTyping); err != nil {
+		return fmt.Errorf("send typing: %w", err)
+	}
+
+	log.Printf("[sender] sent typing indicator to %s", userID)
+	return nil
+}
+
+// SendTextReply sends a text reply to a user through the iLink API.
+// If clientID is empty, a new one is generated.
+func SendTextReply(ctx context.Context, client *ilink.Client, toUserID, text, contextToken, clientID string) error {
+	if clientID == "" {
+		clientID = NewClientID()
+	}
+
+	// Convert markdown to plain text for WeChat display
+	plainText := MarkdownToPlainText(text)
+
+	req := &ilink.SendMessageRequest{
+		Msg: ilink.SendMsg{
+			FromUserID:   client.BotID(),
+			ToUserID:     toUserID,
+			ClientID:     clientID,
+			MessageType:  ilink.MessageTypeBot,
+			MessageState: ilink.MessageStateFinish,
+			ItemList: []ilink.MessageItem{
+				{
+					Type: ilink.ItemTypeText,
+					TextItem: &ilink.TextItem{
+						Text: plainText,
+					},
+				},
+			},
+			ContextToken: contextToken,
+		},
+		BaseInfo: ilink.BaseInfo{},
+	}
+
+	resp, err := client.SendMessage(ctx, req)
+	if err != nil {
+		return fmt.Errorf("send message: %w", err)
+	}
+
+	if resp.Ret != 0 {
+		return fmt.Errorf("send message failed: ret=%d errmsg=%s", resp.Ret, resp.ErrMsg)
+	}
+
+	log.Printf("[sender] sent reply to %s: %q", toUserID, truncate(text, 50))
+	return nil
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n] + "..."
+}

src/main/services/agent-hub-service.ts

@@ -14,7 +14,7 @@ import type {
 } from '../../shared/agent-hub'
 import type { AppSettings } from './settings-store'
 import { generateAgentGroupReport } from './agent-group-report-service'
-import { isReady, listRecentChat } from './chat-service'
+import { isReady, listMessages, listRecentChat, resolveMd5 } from './chat-service'
 
 const execFileAsync = promisify(execFile)
 const HEALTH_INTERVAL_MS = 5_000
@@ -36,6 +36,11 @@ interface GroupReportIntent {
   range: 'today' | 'yesterday' | '7days'
 }
 
+interface ContactChatIntent {
+  contact: string
+  limit: number
+}
+
 function resolveBundledBinary(
   resourceSegments: string[],
   executable: string,
@@ -323,6 +328,13 @@ class AgentHubService {
       return this.sendHubJson(response, 202, { status: 'generating' })
     }
 
+    const contactChatIntent = this.matchContactChatIntent(text)
+    if (contactChatIntent) {
+      if (messageId) this.processedMessages.set(messageId, Date.now())
+      await this.replyContactChat(inbound, contactChatIntent)
+      return this.sendHubJson(response, 200, { status: 'ok' })
+    }
+
     const limit = this.matchRecentChatIntent(text)
     if (limit === null) {
       this.addLog('agent-hub', 'info', '消息已忽略：没有匹配到支持的意图')
@@ -348,6 +360,50 @@ class AgentHubService {
     this.sendHubJson(response, 200, { status: 'ok' })
   }
 
+  private async replyContactChat(
+    inbound: InboundMessage,
+    intent: ContactChatIntent
+  ): Promise<void> {
+    if (!isReady()) {
+      await this.sendConnector(inbound, 'WechatExplorer 本地数据库尚未连接，请连接后再试。')
+      return
+    }
+
+    const contact = resolveMd5(intent.contact)
+    if (!contact || contact.type !== 'user') {
+      this.addLog('agent-hub', 'info', `没有匹配到联系人：${intent.contact}`)
+      await this.sendConnector(inbound, `没有找到联系人“${intent.contact}”。`)
+      return
+    }
+
+    this.addLog(
+      'agent-hub',
+      'info',
+      `匹配联系人聊天查询：${contact.m_nsNickName}（最近 ${intent.limit} 条）`
+    )
+    const messages = listMessages(contact.md5, undefined, undefined, { limit: intent.limit })
+    const recent = messages.slice(-intent.limit)
+    const lines = recent.map((message) => {
+      const speaker = message.isSender ? '我' : contact.m_nsNickName
+      const content = this.describeChatMessage(message.content, message.type)
+      return `${speaker}：${content}`
+    })
+    const reply = lines.length
+      ? `我和${contact.m_nsNickName}最近聊了这些：\n${lines.join('\n')}`
+      : `暂时没有找到和${contact.m_nsNickName}的聊天记录。`
+    await this.sendConnector(inbound, reply)
+    this.addLog('agent-hub', 'info', `联系人聊天回复已发送（${recent.length} 条）`)
+  }
+
+  private describeChatMessage(content: string, type: string): string {
+    const normalized = String(content || '')
+      .replace(/\s+/g, ' ')
+      .trim()
+    if (normalized) return normalized.length > 100 ? `${normalized.slice(0, 100)}…` : normalized
+    const label = String(type || '消息').replace(/^普通文本$/, '消息')
+    return `[${label}]`
+  }
+
   private async generateAndSendReport(
     inbound: InboundMessage,
     intent: GroupReportIntent
@@ -394,6 +450,24 @@ class AgentHubService {
     return Math.max(1, Math.min(20, limit))
   }
 
+  private matchContactChatIntent(text: string): ContactChatIntent | null {
+    const normalized = text.replace(/\s+/g, '').replace(/[，。！？?：:]/g, '')
+    if (!normalized.includes('最近') || !/(聊|消息|会话)/.test(normalized)) return null
+
+    const patterns = [
+      /(?:看一下|看看|查一下|查询)?我和(.+?)最近(?:\d{1,2}条)?(?:聊了什么|聊什么|的聊天|的消息|聊天|消息)/,
+      /(?:看一下|看看|查一下|查询)?(?:我)?最近(?:\d{1,2}条)?和(.+?)(?:聊了什么|聊什么|的聊天|的消息|聊天|消息)/,
+      /(?:看一下|看看|查一下|查询)?和(.+?)最近(?:\d{1,2}条)?(?:聊了什么|聊什么|的聊天|的消息|聊天|消息)/
+    ]
+    const contact = patterns
+      .map((pattern) => normalized.match(pattern)?.[1]?.trim())
+      .find((value): value is string => Boolean(value))
+    if (!contact) return null
+
+    const limit = Number(normalized.match(/最近(\d{1,2})条/)?.[1] || 10)
+    return { contact, limit: Math.max(1, Math.min(20, limit)) }
+  }
+
   private matchGroupReportIntent(text: string): GroupReportIntent | null {
     const normalized = text.trim()
     if (!normalized.includes('群') || !/(总结|日报|报告)/.test(normalized)) return null

src/renderer/src/features/agent-hub/AgentHubWorkspace.tsx

@@ -241,7 +241,11 @@ export function AgentHubWorkspace(): React.ReactElement {
               <option value="agent-hub">Agent Hub</option>
               <option value="wechat-connector">微信连接器</option>
             </select>
-            <button type="button" onClick={() => void copyLogs()} disabled={visibleLogs.length === 0}>
+            <button
+              type="button"
+              onClick={() => void copyLogs()}
+              disabled={visibleLogs.length === 0}
+            >
               复制日志
             </button>
             <button type="button" onClick={() => void clearLogs()}>
@@ -251,7 +255,9 @@ export function AgentHubWorkspace(): React.ReactElement {
         </div>
         <div className="agent-hub-log-body" ref={logBodyRef}>
           {visibleLogs.length === 0 ? (
-            <div className="agent-hub-log-empty">暂无运行日志。收到消息后，这里会显示处理到哪一步。</div>
+            <div className="agent-hub-log-empty">
+              暂无运行日志。收到消息后，这里会显示处理到哪一步。
+            </div>
           ) : (
             visibleLogs.map((entry) => (
               <div className={`agent-hub-log-line ${entry.level}`} key={entry.id}>

src/renderer/src/utils/group-report-facts.ts

@@ -10,12 +10,32 @@ import {
   ReportVoiceHighlight,
   ReportVoiceLeaderboardItem
 } from '../../../shared/group-report'
+import type {
+  ImageAnalysisRequest,
+  ImageAnalysisResponse,
+  ImageCandidate,
+  ImageCandidateQuery
+} from '../../../shared/image-insight'
+
+interface ReportImageReadResult {
+  success: boolean
+  data?: string
+  error?: string
+}
 
 declare const window: {
   api: {
-    imageListCandidates: (...args: unknown[]) => Promise<any>
-    imageAnalyze: (...args: unknown[]) => Promise<any>
-    getImage: (...args: unknown[]) => Promise<any>
+    imageListCandidates: (query: ImageCandidateQuery) => Promise<{
+      success: boolean
+      candidates: ImageCandidate[]
+      error?: string
+    }>
+    imageAnalyze: (request: ImageAnalysisRequest) => Promise<ImageAnalysisResponse>
+    getImage: (
+      imageMd5?: string,
+      imageDatNameOrThumb?: string | boolean,
+      sessionId?: string
+    ) => Promise<ReportImageReadResult>
   }
 }