@botcord/daemon 0.2.51 → 0.2.53

package/src/__tests__/openclaw-discovery.test.ts

@@ -128,6 +128,41 @@ describe("discoverLocalOpenclawGateways", () => {
     ]);
   });
 
+  it("discovers QClaw's state config and referenced OpenClaw config", async () => {
+    const dir = tempDir();
+    const openclawConfig = path.join(dir, "openclaw.json");
+    writeFileSync(
+      openclawConfig,
+      JSON.stringify({
+        gateway: {
+          port: 28789,
+          bind: "loopback",
+          auth: { mode: "token", token: "qclaw-token" },
+        },
+      }),
+    );
+    writeFileSync(
+      path.join(dir, "qclaw.json"),
+      JSON.stringify({
+        configPath: openclawConfig,
+        port: 28789,
+      }),
+    );
+
+    const found = await discoverLocalOpenclawGateways({
+      searchPaths: [dir],
+      defaultPorts: [],
+    });
+
+    expect(found).toEqual([
+      expect.objectContaining({
+        url: "ws://127.0.0.1:28789",
+        token: "qclaw-token",
+        source: "config-file",
+      }),
+    ]);
+  });
+
   it("uses OPENCLAW_ACP_URL and token env vars", async () => {
     const found = await discoverLocalOpenclawGateways({
       searchPaths: [],
@@ -269,8 +304,8 @@ describe("discoverLocalOpenclawGateways", () => {
     ]);
   });
 
-  it("includes 16200 in default discovery ports", () => {
-    expect(defaultOpenclawDiscoveryPorts()).toEqual(expect.arrayContaining([18789, 16200]));
+  it("includes OpenClaw and QClaw ports in default discovery ports", () => {
+    expect(defaultOpenclawDiscoveryPorts()).toEqual(expect.arrayContaining([18789, 16200, 28789]));
   });
 
   it("adds default-port candidates only when the probe succeeds", async () => {

package/src/__tests__/provision.test.ts

@@ -27,6 +27,7 @@ vi.mock("../config.js", async () => {
 const {
   addAgentToConfig,
   adoptDiscoveredOpenclawAgents,
+  probeOpenclawAgents,
   removeAgentFromConfig,
   reloadConfig,
   setRoute,
@@ -34,6 +35,7 @@ const {
 } = await import("../provision.js");
 const { CONTROL_FRAME_TYPES } = await import("@botcord/protocol-core");
 import type { DaemonConfig } from "../config.js";
+import type { WsEndpointProbeFn } from "../provision.js";
 import type {
   GatewayChannelConfig,
   GatewayRoute,
@@ -1139,7 +1141,7 @@ describe("adoptDiscoveredOpenclawAgents", () => {
         openclawGateways: [{ name: "local", url: "ws://127.0.0.1:18789" }],
       };
       const register = vi.fn();
-      const probe = vi.fn<Parameters<typeof adoptDiscoveredOpenclawAgents>[0]["probe"]>(
+      const probe = vi.fn<WsEndpointProbeFn>(
         async () => ({ ok: true, agents: [{ id: "main" }] }),
       );
 
@@ -1224,6 +1226,70 @@ describe("adoptDiscoveredOpenclawAgents", () => {
   });
 });
 
+describe("probeOpenclawAgents local profiles", () => {
+  it("enriches loopback QClaw gateways from ~/.qclaw/openclaw.json", async () => {
+    await withSandboxHome(async ({ tmp, fs, path: nodePath }) => {
+      const { WebSocketServer } = await import("ws");
+      const qclawDir = nodePath.join(tmp, ".qclaw");
+      fs.mkdirSync(qclawDir, { recursive: true });
+
+      const wss = new WebSocketServer({ host: "127.0.0.1", port: 0 });
+      await new Promise<void>((resolve) => wss.once("listening", resolve));
+      const address = wss.address();
+      if (typeof address === "string" || address === null) {
+        throw new Error("expected tcp websocket address");
+      }
+
+      fs.writeFileSync(
+        nodePath.join(qclawDir, "openclaw.json"),
+        JSON.stringify({
+          agents: {
+            defaults: {
+              workspace: nodePath.join(qclawDir, "workspace"),
+              model: { primary: "qclaw/modelroute" },
+            },
+            list: [{ id: "main", name: "QClaw" }],
+          },
+          gateway: {
+            port: address.port,
+            auth: { mode: "token", token: "qclaw-token" },
+          },
+        }),
+      );
+
+      wss.on("connection", (ws) => {
+        ws.send(JSON.stringify({ type: "event", event: "connect.challenge", payload: { nonce: "n" } }));
+        ws.on("message", (raw) => {
+          const msg = JSON.parse(raw.toString("utf8"));
+          if (msg.method === "connect") {
+            ws.send(
+              JSON.stringify({
+                type: "res",
+                id: msg.id,
+                ok: true,
+                payload: { type: "hello-ok", server: { version: "2026.4.21" } },
+              }),
+            );
+          }
+        });
+      });
+
+      try {
+        const res = await probeOpenclawAgents({
+          url: `ws://127.0.0.1:${address.port}`,
+          token: "qclaw-token",
+        });
+
+        expect(res.ok).toBe(true);
+        expect(res.version).toBe("2026.4.21");
+        expect(res.agents).toEqual([{ id: "main", name: "QClaw" }]);
+      } finally {
+        await new Promise<void>((resolve) => wss.close(() => resolve()));
+      }
+    });
+  });
+});
+
 // ---------------------------------------------------------------------------
 // revoke_agent — new flag semantics (plan §11.3)
 // ---------------------------------------------------------------------------

package/src/__tests__/start-auth.test.ts

@@ -14,14 +14,14 @@ const existingAuth: UserAuthRecord = {
 };
 
 describe("resolveStartAuthAction", () => {
-  it("reuses existing auth even when a one-time install token is present", () => {
+  it("redeems an install token even when existing auth is available", () => {
     expect(
       resolveStartAuthAction({
         existing: existingAuth,
         relogin: false,
         installToken: "dit_expired",
       }),
-    ).toBe("reuse-existing");
+    ).toBe("install-token");
   });
 
   it("redeems an install token when no existing auth is available", () => {

package/src/__tests__/turn-text.test.ts

@@ -116,6 +116,8 @@ describe("composeBotCordUserTurn", () => {
     );
     expect(out).toContain("third-party gateway chat");
     expect(out).toContain("Reply normally in your final assistant message");
+    expect(out).toContain("conversation_id: telegram:user:7904063707");
+    expect(out).toContain("channel: gw_telegram_123");
     expect(out).not.toContain("Plain text output WILL NOT be sent");
     expect(out).not.toContain("botcord_send");
   });
@@ -219,6 +221,7 @@ describe("composeBotCordUserTurn", () => {
       }),
     );
     expect(out).toContain("[BotCord Messages (2 new)]");
+    expect(out).toContain("conversation_id: rm_team");
     expect(out).toContain("room: Ouraca");
     expect(out).toContain("mentioned: true");
     expect(out).toContain('<agent-message sender="ag_alice" sender_kind="agent">');

package/src/__tests__/wechat-channel.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -20,6 +20,7 @@ const SILENT_LOG: GatewayLogger = {
 interface StubResponse {
   status?: number;
   body: unknown;
+  headers?: Record<string, string>;
 }
 
 /**
@@ -35,16 +36,20 @@ function buildFetchStub(
       body: Record<string, unknown> | null,
     ) => StubResponse | Promise<StubResponse>;
   }>,
-  calls: Array<{ url: string; body: Record<string, unknown> | null }>,
+  calls: Array<{ url: string; body: any }>,
 ): FetchLike {
   const counters = new Map<string, number>();
   return async (url, init) => {
-    let parsed: Record<string, unknown> | null = null;
+    let parsed: Record<string, unknown> | Uint8Array | null = null;
     if (init?.body) {
-      try {
-        parsed = JSON.parse(init.body as string) as Record<string, unknown>;
-      } catch {
-        parsed = null;
+      if (typeof init.body === "string") {
+        try {
+          parsed = JSON.parse(init.body) as Record<string, unknown>;
+        } catch {
+          parsed = null;
+        }
+      } else if (init.body instanceof Uint8Array) {
+        parsed = init.body;
       }
     }
     calls.push({ url, body: parsed });
@@ -59,11 +64,21 @@ function buildFetchStub(
         return {
           status,
           ok: status >= 200 && status < 300,
+          headers: {
+            get(name: string) {
+              return resp.headers?.[name] ?? resp.headers?.[name.toLowerCase()] ?? null;
+            },
+          },
           text: async () => text,
         };
       }
     }
-    return { status: 404, ok: false, text: async () => "" };
+    return {
+      status: 404,
+      ok: false,
+      headers: { get: () => null },
+      text: async () => "",
+    };
   };
 }
 
@@ -409,6 +424,109 @@ describe("wechat channel adapter", () => {
     expect(calls.find((c) => c.url.includes("sendmessage"))).toBeUndefined();
   });
 
+  it("send() uploads local file attachments to WeChat CDN and sends a file_item", async () => {
+    const filePath = path.join(tmp, "report.pdf");
+    writeFileSync(filePath, "plain file bytes");
+    const calls: Array<{ url: string; body: any }> = [];
+    const fetchImpl = buildFetchStub(
+      [
+        {
+          match: "getupdates",
+          respond: (idx) => {
+            if (idx === 0) {
+              return {
+                body: {
+                  ret: 0,
+                  get_updates_buf: "c",
+                  msgs: [
+                    {
+                      message_type: 1,
+                      from_user_id: "alice@im.wechat",
+                      context_token: "ctx-file",
+                      item_list: [{ type: 1, text_item: { text: "send file" } }],
+                    },
+                  ],
+                },
+              };
+            }
+            return { body: { ret: 0, get_updates_buf: "c", msgs: [] } };
+          },
+        },
+        {
+          match: "getuploadurl",
+          respond: () => ({
+            body: {
+              ret: 0,
+              upload_full_url: "https://cdn.test/upload/report",
+            },
+          }),
+        },
+        {
+          match: "cdn.test/upload",
+          respond: () => ({
+            body: "",
+            headers: { "x-encrypted-param": "encrypted-download-token" },
+          }),
+        },
+        { match: "sendmessage", respond: () => ({ body: { ret: 0 } }) },
+      ],
+      calls,
+    );
+    const adapter = createWechatChannel({
+      id: "gw_wx_file",
+      accountId: "ag_test",
+      botToken: "tok",
+      stateFile: path.join(tmp, "state.json"),
+      fetchImpl,
+      stateDebounceMs: 0,
+      allowedSenderIds: ["alice@im.wechat"],
+    });
+    const h = startAdapter(adapter, { stopAfterEnvelopes: 1 });
+    await h.pollDone;
+    const traceId = h.envelopes[0]!.message.trace!.id;
+
+    await adapter.send({
+      log: SILENT_LOG,
+      message: {
+        channel: "gw_wx_file",
+        accountId: "ag_test",
+        conversationId: "wechat:user:alice@im.wechat",
+        text: "",
+        traceId,
+        attachments: [
+          {
+            filePath,
+            filename: "report.pdf",
+            contentType: "application/pdf",
+            kind: "file",
+          },
+        ],
+      },
+    });
+
+    const uploadRequest = calls.find((c) => c.url.includes("getuploadurl"))!;
+    expect(uploadRequest.body!.media_type).toBe(3);
+    expect(uploadRequest.body!.rawsize).toBe("plain file bytes".length);
+    expect(uploadRequest.body!.filesize).toBeGreaterThan("plain file bytes".length);
+
+    const cdnCall = calls.find((c) => c.url.includes("cdn.test/upload"))!;
+    expect(cdnCall.body).toBeInstanceOf(Uint8Array);
+    expect(Buffer.from(cdnCall.body as Uint8Array).toString("utf8")).not.toContain(
+      "plain file bytes",
+    );
+
+    const sendCall = calls.find((c) => c.url.includes("sendmessage"))!;
+    const msg = sendCall.body!.msg as Record<string, unknown>;
+    const item = (msg.item_list as Array<Record<string, unknown>>)[0]!;
+    expect(item.type).toBe(4);
+    const fileItem = item.file_item as Record<string, unknown>;
+    expect(fileItem.file_name).toBe("report.pdf");
+    expect(fileItem.len).toBe("plain file bytes".length);
+    expect((fileItem.media as Record<string, unknown>).encrypt_query_param).toBe(
+      "encrypted-download-token",
+    );
+  });
+
   it("send() splits long replies into chunks <= splitAt, preferring newline boundaries", async () => {
     const calls: Array<{ url: string; body: Record<string, unknown> | null }> = [];
     const fetchImpl = buildFetchStub(

package/src/gateway/channels/http-types.ts

@@ -12,11 +12,12 @@ export type FetchLike = (
   init?: {
     method?: string;
     headers?: Record<string, string>;
-    body?: string;
+    body?: BodyInit | Uint8Array | string;
     signal?: AbortSignal;
   },
 ) => Promise<{
   status?: number;
   ok?: boolean;
+  headers?: { get(name: string): string | null };
   text(): Promise<string>;
 }>;

package/src/gateway/channels/wechat.ts

@@ -1,3 +1,11 @@
+import { basename } from "node:path";
+import { readFile } from "node:fs/promises";
+import {
+  createCipheriv,
+  createHash,
+  randomBytes,
+  randomUUID,
+} from "node:crypto";
 import type {
   ChannelAdapter,
   ChannelSendContext,
@@ -8,15 +16,16 @@ import type {
   ChannelTypingContext,
   GatewayInboundEnvelope,
   GatewayInboundMessage,
+  GatewayOutboundAttachment,
 } from "../types.js";
 import { sanitizeUntrustedContent } from "./sanitize.js";
 import { GatewayStateStore } from "./state-store.js";
 import { loadGatewaySecret } from "./secret-store.js";
 import { splitText } from "./text-split.js";
 import { wechatHeaders, WECHAT_BASE_INFO, type FetchLike } from "./wechat-http.js";
-import { randomUUID } from "node:crypto";
 
 const DEFAULT_BASE_URL = "https://ilinkai.weixin.qq.com";
+const DEFAULT_CDN_BASE_URL = "https://novac2c.cdn.weixin.qq.com/c2c";
 
 /**
  * Replace every occurrence of `token` in `input` with `"[REDACTED]"`.
@@ -92,6 +101,11 @@ interface WechatGenericResp {
   [k: string]: unknown;
 }
 
+interface WechatUploadUrlResp extends WechatGenericResp {
+  upload_param?: string;
+  upload_full_url?: string;
+}
+
 interface TraceContext {
   contextToken: string;
   fromUserId: string;
@@ -231,6 +245,142 @@ export function createWechatChannel(opts: WechatChannelOptions): ChannelAdapter
     }
   }
 
+  function cdnUploadUrl(resp: WechatUploadUrlResp): string | null {
+    if (typeof resp.upload_full_url === "string" && resp.upload_full_url.length > 0) {
+      return resp.upload_full_url;
+    }
+    if (typeof resp.upload_param === "string" && resp.upload_param.length > 0) {
+      return `${DEFAULT_CDN_BASE_URL}/upload?encrypted_query_param=${encodeURIComponent(
+        resp.upload_param,
+      )}`;
+    }
+    return null;
+  }
+
+  async function uploadEncryptedMedia(
+    trace: TraceContext,
+    attachment: GatewayOutboundAttachment,
+  ): Promise<Record<string, unknown>> {
+    const raw =
+      attachment.data ??
+      (attachment.filePath ? await readFile(attachment.filePath) : undefined);
+    if (!raw || raw.length === 0) {
+      throw new Error("wechat media upload requires non-empty attachment data or filePath");
+    }
+    const data = Buffer.from(raw);
+    const filename =
+      attachment.filename ??
+      (attachment.filePath ? basename(attachment.filePath) : "attachment");
+    const kind = attachment.kind ?? kindFromContentType(attachment.contentType);
+    const mediaType = kind === "image" ? 1 : kind === "video" ? 2 : 3;
+    const itemType = kind === "image" ? 2 : kind === "video" ? 5 : 4;
+    const aesKey = randomBytes(16);
+    const aesKeyHex = aesKey.toString("hex");
+    const encrypted = encryptAes128Ecb(data, aesKey);
+    const filekey = `botcord-${randomUUID()}`;
+    const uploadResp = await callApi<WechatUploadUrlResp>(
+      "ilink/bot/getuploadurl",
+      {
+        filekey,
+        media_type: mediaType,
+        to_user_id: trace.fromUserId,
+        rawsize: data.length,
+        rawfilemd5: md5Hex(data),
+        filesize: encrypted.length,
+        aeskey: aesKeyHex,
+        no_need_thumb: true,
+      },
+      15_000,
+    );
+    if (uploadResp.ret !== 0 && uploadResp.ret !== undefined) {
+      throw new Error(redactSecret(`wechat getuploadurl failed: ret=${uploadResp.ret}`, botToken));
+    }
+    const uploadUrl = cdnUploadUrl(uploadResp);
+    if (!uploadUrl) throw new Error("wechat getuploadurl returned no upload URL");
+
+    const uploadResult = await fetchImpl(uploadUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/octet-stream" },
+      body: encrypted,
+      signal: AbortSignal.timeout(30_000),
+    });
+    const encryptedParam =
+      uploadResult.headers?.get("x-encrypted-param") ??
+      uploadResult.headers?.get("X-Encrypted-Param") ??
+      (await readEncryptedParamFromBody(uploadResult));
+    if (!encryptedParam) {
+      throw new Error("wechat CDN upload returned no x-encrypted-param");
+    }
+
+    const media = {
+      encrypt_query_param: encryptedParam,
+      aes_key: Buffer.from(aesKeyHex, "utf8").toString("base64"),
+    };
+    if (itemType === 2) {
+      return {
+        type: itemType,
+        image_item: {
+          media,
+          aeskey: aesKeyHex,
+          mid_size: data.length,
+        },
+      };
+    }
+    if (itemType === 5) {
+      return {
+        type: itemType,
+        video_item: {
+          media,
+          video_size: data.length,
+          file_name: filename,
+        },
+      };
+    }
+    return {
+      type: itemType,
+      file_item: {
+        media,
+        file_name: filename,
+        md5: md5Hex(data),
+        len: data.length,
+      },
+    };
+  }
+
+  async function readEncryptedParamFromBody(
+    resp: Awaited<ReturnType<FetchLike>>,
+  ): Promise<string | null> {
+    const raw = await resp.text().catch(() => "");
+    if (!raw) return null;
+    try {
+      const json = JSON.parse(raw) as Record<string, unknown>;
+      const v = json.encrypted_query_param ?? json.encrypt_query_param ?? json.upload_param;
+      return typeof v === "string" && v.length > 0 ? v : null;
+    } catch {
+      return null;
+    }
+  }
+
+  async function sendItems(trace: TraceContext, items: Record<string, unknown>[]): Promise<string> {
+    const clientId = `botcord-${randomUUID()}`;
+    const body = {
+      msg: {
+        from_user_id: "",
+        to_user_id: trace.fromUserId,
+        client_id: clientId,
+        message_type: 2, // BOT → user
+        message_state: 2, // FINISH
+        context_token: trace.contextToken,
+        item_list: items,
+      },
+    };
+    const resp = await callApi<WechatGenericResp>("ilink/bot/sendmessage", body, 15_000);
+    if (resp.ret !== 0 && resp.ret !== undefined) {
+      throw new Error(redactSecret(`wechat sendmessage failed: ret=${resp.ret}`, botToken));
+    }
+    return clientId;
+  }
+
   function extractText(msg: WechatInboundMsg): string {
     const parts: string[] = [];
     for (const item of msg.item_list ?? []) {
@@ -495,27 +645,22 @@ export function createWechatChannel(opts: WechatChannelOptions): ChannelAdapter
         );
       }
 
-      const chunks = splitText(message.text, splitAt);
+      const chunks = message.text.length > 0 ? splitText(message.text, splitAt) : [];
       let lastClientId: string | null = null;
       for (const chunk of chunks) {
-        const clientId = `botcord-${randomUUID()}`;
-        const body = {
-          msg: {
-            from_user_id: "",
-            to_user_id: trace.fromUserId,
-            client_id: clientId,
-            message_type: 2, // BOT → user
-            message_state: 2, // FINISH
-            context_token: trace.contextToken,
-            item_list: [{ type: 1, text_item: { text: chunk } }],
-          },
-        };
-        const resp = await callApi<WechatGenericResp>("ilink/bot/sendmessage", body, 15_000);
-        if (resp.ret !== 0 && resp.ret !== undefined) {
-          log.warn("wechat sendmessage non-zero ret", { ret: resp.ret });
-          throw new Error(redactSecret(`wechat sendmessage failed: ret=${resp.ret}`, botToken));
+        lastClientId = await sendItems(trace, [{ type: 1, text_item: { text: chunk } }]);
+      }
+      for (const attachment of message.attachments ?? []) {
+        try {
+          const item = await uploadEncryptedMedia(trace, attachment);
+          lastClientId = await sendItems(trace, [item]);
+        } catch (err) {
+          log.warn("wechat media send failed", {
+            err: redactSecret(String(err), botToken),
+            filename: attachment.filename ?? attachment.filePath ?? "attachment",
+          });
+          throw err;
         }
-        lastClientId = clientId;
       }
       const sendAt = Date.now();
       statusSnapshot = { ...statusSnapshot, lastSendAt: sendAt };
@@ -553,6 +698,22 @@ export function createWechatChannel(opts: WechatChannelOptions): ChannelAdapter
   return adapter;
 }
 
+function md5Hex(data: Buffer): string {
+  return createHash("md5").update(data).digest("hex");
+}
+
+function encryptAes128Ecb(data: Buffer, key: Buffer): Buffer {
+  const cipher = createCipheriv("aes-128-ecb", key, null);
+  cipher.setAutoPadding(true);
+  return Buffer.concat([cipher.update(data), cipher.final()]);
+}
+
+function kindFromContentType(contentType: string | undefined): "image" | "file" | "video" {
+  if (contentType?.startsWith("image/")) return "image";
+  if (contentType?.startsWith("video/")) return "video";
+  return "file";
+}
+
 function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve) => {
     if (signal?.aborted) {

package/src/gateway/types.ts

@@ -172,12 +172,23 @@ export type OutboundObserver = (
 ) => Promise<void> | void;
 
 /** Outbound reply payload passed to `ChannelAdapter.send()`. */
+export interface GatewayOutboundAttachment {
+  /** Local daemon-readable file path. */
+  filePath?: string;
+  /** In-memory bytes, primarily for tests and in-process tool callers. */
+  data?: Uint8Array;
+  filename?: string;
+  contentType?: string;
+  kind?: "image" | "file" | "video";
+}
+
 export interface GatewayOutboundMessage {
   channel: string;
   accountId: string;
   conversationId: string;
   threadId?: string | null;
   text: string;
+  attachments?: GatewayOutboundAttachment[];
   replyTo?: string | null;
   traceId?: string | null;
 }