@cxyhhhhh/dsh-qqbot 0.5.4-dev.202610292027 → 0.5.4-dev.202610301949

package/CHANGELOG.md

@@ -8,7 +8,12 @@
 
 ## [0.5.4] - 2026-10-28
 
-### ⚠️ 行为变更（安全默认，#83）
+### 新功能
+
+- **新增 `/bot-me` 指令**：查看发送者 OpenID（私聊为 user openid，群聊为群成员 openid 与群 openid），作为白名单配置的自助入口——用户拿 ID 交管理员加入名单即可。
+- **管理指令白名单鉴权**：`/preset`、`/model` 私聊/群聊均可用，但仅限白名单用户，非白名单成员不可切换 preset/模型（群聊中切换影响该群会话）；指令的私聊/群聊适用范围在 `/bot-help` 中标注。（#5）
+
+### ⚠️ 行为变更（安全默认）
 
 - **访问控制默认收紧**：私聊默认白名单且留空拒绝所有人（此前留空会静默放行）；群聊默认开放（有进群门槛与 @bot 双前置）。扫码绑定时私聊自动切白名单并重置为扫码用户（重绑即换人），绑定即授权。
 - **工作目录默认独立**：Agent 工作目录缺省为 `~/.dsh-qqbot/workspace`，不再跟随 DSH 进程目录；显式配置 `cwd` 可覆盖。
@@ -24,6 +29,11 @@
 - **会话事件读取修复**：`/tokens` 显示 0、`/export` 导出为空、审批按钮不回显被审批命令——均已修复。
 - **压缩修复**：`/compact` 误报「压缩能力不可用」或「当前无活跃会话」——均已修复；后者场景会自动从磁盘拉起会话再压缩。
 - **修复 link 安装后保存配置失败**：`dsh plugin add link:` 安装时界面保存一直报「无法定位 profile 目录」，现已修复；多 profile 共享源码时按当前进程的 profile 精确写入，仍失败时提示手动编辑 `cordis.patch.yml`。（#78）
+- **修复白名单默认值可被绕过**：完全省略 `access` 配置时私聊仍回落开放模式（外层默认值未随子字段更新），现已对齐白名单并加测试钉死。（#94）
+- **审批卡片防混淆与身份加固**：按钮绑定本次审批的唯一标识，旧卡片点击不再生效；白名单模式下点击者身份缺失同样拒绝。（#94）
+- **文件发送路径白名单解析符号链接**：按真实位置判定，root 内的符号链接指向外部时拒绝访问。（#94）
+- **图片附件按真实格式命名扩展名**：QQ 网关对图片统一标注 `image/png`（实际多为 GIF/JPEG），落盘文件名照搬导致按扩展名解码的读图工具失败；现按文件头（magic bytes）识别真实格式并校正扩展名，字节不变、不转码，识别不了的格式保持原行为。（#76）
+- **统一 workspace 路径解析**：新增插件目录单一事实源（`~/.dsh-qqbot`），workspace、media、模型偏好等子路径统一派生，未配置 `cwd` 时不再误用宿主进程目录（此前导致 workspace 内文件发送被误拒）；不存在的文件也改为报「文件不存在」而非误报路径不允许。
 
 ### 内部改进
 

package/CHANGELOG_EN.md

@@ -8,7 +8,12 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [0.5.4] - 2026-10-28
 
-### ⚠️ Behavior Changes (secure defaults, #83)
+### New Features
+
+- **New `/bot-me` command**: shows the sender's OpenIDs (user openid in DMs; group-member openid and group openid in groups) as a self-service entry for allowlist onboarding — users hand the IDs to an admin to be added to the lists.
+- **Admin command authorization**: `/preset` and `/model` work in both DMs and groups, but only allowlisted users may switch the preset or model (a group switch affects that group's session); each command's DM/group availability is shown in `/bot-help`. (#5)
+
+### ⚠️ Behavior Changes (secure defaults)
 
 - **Access control tightened by default**: DMs default to allowlist with an empty list rejecting everyone (previously empty lists silently allowed everyone); groups default to open (guarded by group membership and the @-mention gate). On QR binding, DMs switch to allowlist with the list reset to the scanning user (rebinding swaps the owner) — binding grants access.
 - **Isolated default workspace**: the agent working directory now defaults to `~/.dsh-qqbot/workspace` instead of following the DSH process directory; set `cwd` explicitly to override.
@@ -24,6 +29,11 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - **Fixed session-event reads**: `/tokens` showing 0, `/export` producing empty output, and approval buttons not echoing the gated command — all fixed.
 - **Fixed compaction**: `/compact` wrongly reporting the service as unavailable or "no active session" — fixed; in the latter case the session is revived from disk before compacting.
 - **Fixed config save failure with link installs**: saving from the settings UI kept reporting "profile directory not found" when installed via `dsh plugin add link:` — fixed. With multiple profiles sharing the same source, writes target the profile of the current process. Remaining failures point at manually editing `cordis.patch.yml`. (#78)
+- **Fixed allowlist default bypass**: omitting `access` entirely still fell back to open DMs (the outer schema default was not updated with the field defaults) — now aligned to allowlist and pinned by tests. (#94)
+- **Approval cards bound to their request and hardened**: buttons now carry the pending approval's unique nonce, so stale cards no longer settle; in allowlist mode a missing clicker identity is rejected too. (#94)
+- **File-send path allowlist resolves symlinks**: paths are judged by their real locations; a symlink inside an allowed root pointing outside is rejected. (#94)
+- **Image attachments named by their real format**: the QQ gateway labels all images `image/png` (most are actually GIF/JPEG), so saved files carried wrong extensions and extension-based image decoding failed; extensions are now corrected from the file header (magic bytes) — bytes unchanged, no transcoding, unknown formats keep the original behavior. (#76)
+- **Unified workspace path resolution**: introduced a single source of truth for the plugin data directory (`~/.dsh-qqbot`), from which the workspace, media, and model-preference paths are uniformly derived; without an explicit `cwd` the host process directory is no longer wrongly used (previously causing workspace file sends to be denied). Missing files now report "file not found" instead of a misleading path denial.
 
 ### Internal
 

package/lib/commands/auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * 命令鉴权 — 挂到 SlashCommand.authorized 的白名单校验
+ *
+ * 名单语义与审批按钮校验（approval-channel）一致：c2cMode=allowlist 时发送者
+ * 必须在 c2cAllow；身份缺失同样拒绝（fail-closed）。open 模式放行。
+ */
+import type { SlashCommandHandlerContext } from '@tencent-connect/qqbot-nodejs';
+import type { Logger } from '../types.ts';
+/** 鉴权配置投影（结构化，便于单测） */
+export interface CommandAuthConfigLike {
+    access: {
+        c2cMode: 'open' | 'allowlist' | 'disabled';
+        c2cAllow: readonly string[];
+    };
+}
+/** 构造命令白名单鉴权回调 */
+export declare function commandAllowlistAuth(config: CommandAuthConfigLike, logger?: Logger): (ctx: SlashCommandHandlerContext) => boolean | string;
+//# sourceMappingURL=auth.d.ts.map

package/lib/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,uBAAuB;AACvB,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;QAC3C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7B,CAAC;CACH;AAID,kBAAkB;AAClB,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,qBAAqB,EAC7B,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,GAAG,EAAE,0BAA0B,KAAK,OAAO,GAAG,MAAM,CAUvD"}

package/lib/commands/auth.js

@@ -0,0 +1,15 @@
+const DENIED = '⚠️ 无权限执行此命令';
+/** 构造命令白名单鉴权回调 */
+export function commandAllowlistAuth(config, logger) {
+    return (ctx) => {
+        if (config.access.c2cMode !== 'allowlist')
+            return true;
+        const senderId = ctx.message.senderId;
+        if (!senderId || !config.access.c2cAllow.includes(senderId)) {
+            logger?.warn(`im-qqbot: command auth denied: sender=${senderId ?? '(missing)'}`);
+            return DENIED;
+        }
+        return true;
+    };
+}
+//# sourceMappingURL=auth.js.map

package/lib/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,GAAG,aAAa,CAAC;AAE7B,kBAAkB;AAClB,MAAM,UAAU,oBAAoB,CAClC,MAA6B,EAC7B,MAAe;IAEf,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,CAAC,yCAAyC,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC;YACjF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,2BAA2B;AAC3B,wBAAgB,WAAW,CACzB,EAAE,MAAM,EAAE,EAAE,WAAW,EACvB,WAAW,EAAE,MAAM,kBAAkB,EAAE,GACtC,kBAAkB,CAoCpB"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,2BAA2B;AAC3B,wBAAgB,WAAW,CACzB,EAAE,MAAM,EAAE,EAAE,WAAW,EACvB,WAAW,EAAE,MAAM,kBAAkB,EAAE,GACtC,kBAAkB,CAsCpB"}

package/{dist → lib}/commands/help.js

@@ -4,6 +4,7 @@ export function helpCommand({ config }, allCommands) {
     return {
         name: 'bot-help',
         category: 'qqbot',
+        scope: 'all',
         description: '查看所有指令',
         handler: async (cmdCtx) => {
             const agentCmds = [];
@@ -17,7 +18,8 @@ export function helpCommand({ config }, allCommands) {
                 const out = [];
                 for (const cmd of cmds) {
                     const name = Array.isArray(cmd.name) ? cmd.name[0] : cmd.name;
-                    out.push(`<qqbot-cmd-input text="/${name}" show="/${name}"/> ${cmd.description ?? ''}`);
+                    const scopeTag = cmd.scope === 'c2c' ? ' 💬私聊' : cmd.scope === 'group' ? ' 👥群聊' : '';
+                    out.push(`<qqbot-cmd-input text="/${name}" show="/${name}"/>${scopeTag} ${cmd.description ?? ''}`);
                 }
                 return out;
             };

package/lib/commands/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../src/commands/help.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzE,2BAA2B;AAC3B,MAAM,UAAU,WAAW,CACzB,EAAE,MAAM,EAAe,EACvB,WAAuC;IAEvC,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,SAAS,GAAyB,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAyB,EAAE,CAAC;YAC3C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,EAAE,CAAC;gBAChC,IAAI,GAAG,CAAC,MAAM;oBAAE,SAAS;gBACzB,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,IAA0B,EAAY,EAAE;gBACtD,MAAM,GAAG,GAAa,EAAE,CAAC;gBACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;oBAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtF,GAAG,CAAC,IAAI,CAAC,2BAA2B,IAAI,YAAY,IAAI,MAAM,QAAQ,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;YAEF,MAAM,KAAK,GAAa,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAEhD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,cAAc,EAAE,CAAC,CAAC;YACjD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQlE;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAkBxE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/commands/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQlE;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,WAAW,GAAG,kBAAkB,EAAE,CAmBxE"}

package/{dist → lib}/commands/index.js

@@ -3,7 +3,7 @@ import { modelCommand } from "./model.js";
 import { presetCommand } from "./preset.js";
 import { statusCommand } from "./status.js";
 import { helpCommand } from "./help.js";
-import { pingCommand, versionCommand, stopCommand } from "./misc.js";
+import { pingCommand, versionCommand, stopCommand, meCommand } from "./misc.js";
 /**
  * 构建标准命令列表
  */
@@ -18,6 +18,7 @@ export function buildCommandList(deps) {
         // QQBot 特有
         pingCommand(),
         versionCommand(deps),
+        meCommand(deps),
         statusCommand(deps),
     ];
     // help 需要访问完整列表（含自身），通过闭包惰性引用

package/lib/commands/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/commands/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEhF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAiB;IAChD,MAAM,QAAQ,GAAyB;QACrC,iBAAiB;QACjB,UAAU,CAAC,IAAI,CAAC;QAChB,cAAc,CAAC,IAAI,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC;QAClB,aAAa,CAAC,IAAI,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC;QACjB,WAAW;QACX,WAAW,EAAE;QACb,cAAc,CAAC,IAAI,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC;QACf,aAAa,CAAC,IAAI,CAAC;KACpB,CAAC;IAEF,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/{dist → lib}/commands/misc.d.ts

@@ -1,7 +1,7 @@
 /**
  * 杂项命令
  *
- * - /bot-ping /bot-version：QQBot 插件特有（连通性测试、版本信息）
+ * - /bot-ping /bot-version /bot-me：QQBot 插件特有（连通性测试、版本、身份）
  * - /stop：中止当前生成（对应底层 agent cancel，通用能力）
  */
 import type { CommandDeps, CategorizedCommand } from './types.ts';
@@ -9,6 +9,13 @@ import type { CommandDeps, CategorizedCommand } from './types.ts';
 export declare function pingCommand(): CategorizedCommand;
 /** /bot-version — 查看版本信息 */
 export declare function versionCommand({ manager }: CommandDeps): CategorizedCommand;
+/**
+ * /bot-me — 查看发送者身份标识
+ *
+ * 私聊返回 user openid、群聊返回群成员 openid 与群 openid
+ * （分别对应 access.c2cAllow / groupAllow 的名单 key）。
+ */
+export declare function meCommand({ config }: CommandDeps): CategorizedCommand;
 /** /stop — 中止当前生成（隐藏） */
 export declare function stopCommand({ manager }: CommandDeps): CategorizedCommand;
 //# sourceMappingURL=misc.d.ts.map

package/lib/commands/misc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../src/commands/misc.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,wCAAwC;AACxC,wBAAgB,WAAW,IAAI,kBAAkB,CA8BhD;AAED,4BAA4B;AAC5B,wBAAgB,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAY3E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAgBrE;AAED,yBAAyB;AACzB,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAqBxE"}

package/{dist → lib}/commands/misc.js

@@ -1,9 +1,10 @@
-import { getScopePeer, PLUGIN_VERSION } from "../shared/index.js";
+import { getScopePeer, PLUGIN_VERSION, sendMarkdownChunked } from "../shared/index.js";
 /** /bot-ping — 测试当前 dsh 与 QQ 连接的网络延迟 */
 export function pingCommand() {
     return {
         name: 'bot-ping',
         category: 'qqbot',
+        scope: 'all',
         description: '测试当前 dsh 与 QQ 连接的网络延迟',
         usage: [
             '/bot-ping',
@@ -35,6 +36,7 @@ export function versionCommand({ manager }) {
     return {
         name: 'bot-version',
         category: 'qqbot',
+        scope: 'all',
         description: '查看版本信息',
         handler: () => {
             const current = manager.getEffectiveModel('c2c', '');
@@ -43,11 +45,35 @@ export function versionCommand({ manager }) {
         },
     };
 }
+/**
+ * /bot-me — 查看发送者身份标识
+ *
+ * 私聊返回 user openid、群聊返回群成员 openid 与群 openid
+ * （分别对应 access.c2cAllow / groupAllow 的名单 key）。
+ */
+export function meCommand({ config }) {
+    return {
+        name: 'bot-me',
+        category: 'qqbot',
+        scope: 'all',
+        description: '查看你的 OpenID',
+        handler: async (cmdCtx) => {
+            const senderId = cmdCtx.message.senderId ?? 'unknown';
+            const lines = [`🆔 你的 OpenID：**${senderId}**`];
+            if (cmdCtx.message.groupOpenid) {
+                lines.push(`👥 本群 OpenID：**${cmdCtx.message.groupOpenid}**`);
+            }
+            await sendMarkdownChunked(cmdCtx, lines.join('\n'), config.textChunkLimit);
+            return { kind: 'noop' };
+        },
+    };
+}
 /** /stop — 中止当前生成（隐藏） */
 export function stopCommand({ manager }) {
     return {
         name: 'stop',
         category: 'agent',
+        scope: 'all',
         description: '中止当前生成',
         hidden: true,
         handler: (cmdCtx) => {

package/lib/commands/misc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"misc.js","sourceRoot":"","sources":["../../src/commands/misc.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvF,wCAAwC;AACxC,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,uBAAuB;QACpC,KAAK,EAAE;YACL,WAAW;YACX,EAAE;YACF,2BAA2B;YAC3B,kBAAkB;SACnB,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;YACjC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACpD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,GAAG,SAAS,CAAC;YAChC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC;YAC9C,MAAM,aAAa,GAAG,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;YAC3C,OAAO;gBACL,SAAS;gBACT,SAAS,OAAO,IAAI;gBACpB,aAAa,UAAU,IAAI;gBAC3B,aAAa,aAAa,IAAI;aAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,cAAc,CAAC,EAAE,OAAO,EAAe;IACrD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5E,OAAO,cAAc,cAAc,aAAa,SAAS,EAAE,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,EAAe;IAC/C,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,aAAa;QAC1B,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;YACtD,MAAM,KAAK,GAAG,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAe;IAClD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvD,4CAA4C;YAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC9D,OAAO,YAAY,CAAC;YACtB,CAAC;YAED,gDAAgD;YAChD,6BAA6B;YAC7B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACtC,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/commands/model.d.ts

@@ -0,0 +1,6 @@
+/**
+ * 模型命令：/model — 查看或切换模型
+ */
+import type { CommandDeps, CategorizedCommand } from './types.ts';
+export declare function modelCommand({ manager, config, logger }: CommandDeps): CategorizedCommand;
+//# sourceMappingURL=model.d.ts.map

package/lib/commands/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/commands/model.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIlE,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAoEzF"}

package/{dist → lib}/commands/model.js

@@ -1,8 +1,12 @@
+import { commandAllowlistAuth } from "./auth.js";
 import { getScopePeer, sendMarkdownChunked } from "../shared/index.js";
-export function modelCommand({ manager, config }) {
+export function modelCommand({ manager, config, logger }) {
     return {
         name: 'model',
         category: 'agent',
+        // 管理类指令：私聊/群聊均可用，但仅限白名单用户（与 /preset 同构）
+        scope: 'all',
+        authorized: commandAllowlistAuth(config, logger),
         description: '查看或切换模型（用法: /model [provider/model]）',
         handler: async (cmdCtx) => {
             const { scope, peerId } = getScopePeer(cmdCtx);

package/lib/commands/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../src/commands/model.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAe;IACnE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,wCAAwC;QACxC,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC;QAChD,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAEhD,2BAA2B;YAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAEnD,iDAAiD;gBACjD,IAAI,cAAc,GAAG,QAAQ,CAAC;gBAC9B,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC9F,cAAc,GAAG,OAAO,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC3E,CAAC;gBAED,MAAM,KAAK,GAAa;oBACtB,aAAa;oBACb,EAAE;oBACF,aAAa,cAAc,EAAE;iBAC9B,CAAC;gBAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;oBAClC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;wBACvB,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;wBAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;wBACrD,KAAK,CAAC,IAAI,CAAC,iCAAiC,SAAS,kBAAkB,WAAW,KAAK,CAAC,CAAC;oBAC3F,CAAC;gBACH,CAAC;gBAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;gBAEhD,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;YACnC,CAAC;YAED,uBAAuB;YACvB,IAAI,QAAgB,CAAC;YACrB,IAAI,KAAa,CAAC;YAElB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9B,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1B,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,+BAA+B;gBAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACzD,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,mBAAmB,CAAC;gBACpD,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YAED,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxB,OAAO,2EAA2E,CAAC;YACrF,CAAC;YAED,MAAM,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,YAAY,QAAQ,IAAI,KAAK,iBAAiB,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/preset.d.ts

@@ -4,5 +4,5 @@
  * 无参数列出可用 preset（可点击切换），有参数切换，reset/default 重置为默认。
  */
 import type { CommandDeps, CategorizedCommand } from './types.ts';
-export declare function presetCommand({ manager, config }: CommandDeps): CategorizedCommand;
+export declare function presetCommand({ manager, config, logger }: CommandDeps): CategorizedCommand;
 //# sourceMappingURL=preset.d.ts.map

package/lib/commands/preset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset.d.ts","sourceRoot":"","sources":["../../src/commands/preset.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAIlE,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,GAAG,kBAAkB,CA2D1F"}

package/{dist → lib}/commands/preset.js

@@ -1,8 +1,12 @@
+import { commandAllowlistAuth } from "./auth.js";
 import { getScopePeer, sendMarkdownChunked } from "../shared/index.js";
-export function presetCommand({ manager, config }) {
+export function presetCommand({ manager, config, logger }) {
     return {
         name: 'preset',
         category: 'agent',
+        // 管理类指令：私聊/群聊均可用，但仅限白名单用户（复用审批的名单语义）
+        scope: 'all',
+        authorized: commandAllowlistAuth(config, logger),
         description: '查看或切换 agent preset（用法: /preset [id]）',
         handler: async (cmdCtx) => {
             const { scope, peerId } = getScopePeer(cmdCtx);

package/lib/commands/preset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preset.js","sourceRoot":"","sources":["../../src/commands/preset.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEvE,MAAM,UAAU,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAe;IACpE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO;QACjB,qCAAqC;QACrC,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC;QAChD,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAEhD,uBAAuB;YACvB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,uBAAuB,CAAC;gBACjC,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAEnF,MAAM,KAAK,GAAa,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,EAAE,mBAAmB,OAAO,KAAK,CAAC,CAAC;gBACpF,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,4CAA4C,CAAC,CAAC;gBAE7D,MAAM,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC;YACnC,CAAC;YAED,sCAAsC;YACtC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC;YACxD,CAAC;YAED,eAAe;YACf,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;oBACvB,KAAK,aAAa;wBAChB,OAAO,0CAA0C,CAAC;oBACpD,KAAK,gBAAgB;wBACnB,OAAO,cAAc,IAAI,EAAE,CAAC;oBAC9B,KAAK,QAAQ;wBACX,OAAO,UAAU,IAAI,UAAU,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;oBAC7D;wBACE,OAAO,SAAS,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,OAAO,iBAAiB,IAAI,sCAAsC,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAWvE;AAED,0BAA0B;AAC1B,wBAAgB,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CA8B3E"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,oCAAoC;AACpC,wBAAgB,UAAU,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAYvE;AAED,0BAA0B;AAC1B,wBAAgB,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CA+B3E"}

package/{dist → lib}/commands/session.js

@@ -4,6 +4,7 @@ export function newCommand({ manager }) {
     return {
         name: ['new', 'reset', 'clear'],
         category: 'agent',
+        scope: 'all',
         description: '开始新会话（清空上下文）',
         handler: (cmdCtx) => {
             const { scope, peerId } = getScopePeer(cmdCtx);
@@ -17,6 +18,7 @@ export function compactCommand({ manager }) {
     return {
         name: 'compact',
         category: 'agent',
+        scope: 'all',
         description: '压缩会话历史（摘要替换旧记录，保留上下文）',
         handler: async (cmdCtx) => {
             const { scope, peerId } = getScopePeer(cmdCtx);

package/lib/commands/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/commands/session.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,oCAAoC;AACpC,MAAM,UAAU,UAAU,CAAC,EAAE,OAAO,EAAe;IACjD,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,UAAU,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,cAAc,CAAC,EAAE,OAAO,EAAe;IACrD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,uBAAuB;QACpC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE;gBACnD,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE;aAC/D,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,UAAU,CAAC;gBACzC,OAAO,SAAS,OAAO,CAAC,QAAQ,YAAY,OAAO,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC;YAC5E,CAAC;YAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,KAAK,YAAY;oBACf,OAAO,SAAS,CAAC;gBACnB,KAAK,MAAM;oBACT,OAAO,YAAY,CAAC;gBACtB,KAAK,aAAa;oBAChB,OAAO,+CAA+C,CAAC;gBACzD;oBACE,OAAO,SAAS,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,6BAA6B;AAC7B,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAoB1E"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlE,6BAA6B;AAC7B,wBAAgB,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,GAAG,kBAAkB,CAqB1E"}

package/{dist → lib}/commands/status.js

@@ -4,6 +4,7 @@ export function statusCommand({ manager }) {
     return {
         name: 'bot-status',
         category: 'qqbot',
+        scope: 'all',
         description: '查看当前会话状态',
         handler: (cmdCtx) => {
             const { scope, peerId } = getScopePeer(cmdCtx);

package/lib/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEtE,6BAA6B;AAC7B,MAAM,UAAU,aAAa,CAAC,EAAE,OAAO,EAAe;IACpD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/E,OAAO;gBACL,SAAS;gBACT,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC9D,OAAO,SAAS,EAAE;gBAClB,WAAW,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE;gBACjC,QAAQ,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE;gBAClC,SAAS,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;aACnD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/{dist → lib}/commands/types.d.ts

@@ -6,9 +6,11 @@
 import type { SlashCommand } from '@tencent-connect/qqbot-nodejs';
 import type { SessionManager } from '../session/index.ts';
 import type { ImQQBotConfig } from '../config.ts';
+import type { Logger } from '../types.ts';
 export interface CommandDeps {
     manager: SessionManager;
     config: ImQQBotConfig;
+    logger?: Logger;
 }
 /** 命令分类：agent = 底层 agent 通用能力，qqbot = 插件特有 */
 export type CommandCategory = 'agent' | 'qqbot';

package/lib/commands/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhD,gDAAgD;AAChD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,EAAE,eAAe,CAAC;CAC3B"}

package/{dist → lib}/config.js

@@ -27,7 +27,7 @@ export const ConfigSchema = Schema.object({
     askTimeoutMs: Schema.number().default(5 * 60 * 1000).description('待答问题超时(ms)，超时自动拒绝并提示'),
     historyLimit: Schema.number().default(10).description('群历史缓冲条数'),
     access: AccessControlSchema.default({
-        c2cMode: 'open',
+        c2cMode: 'allowlist',
         c2cAllow: [],
         groupMode: 'open',
         groupAllow: [],

package/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,MAAM,MAAM,0BAA0B,CAAC;AAkG9C,2CAA2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC5E,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC;IACpH,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC;IACpF,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC;IACxH,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC;IAChD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,0DAA0D,CAAC;IAC5F,cAAc,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;IAC1E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC7D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC9D,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC;IACtE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC;IAC1E,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;IACrF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;IAC7D,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,wBAAwB,CAAC;IAClG,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC;IACxF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC;IAChE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC;QAClC,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,EAAE;KACf,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC;IACpF,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC;QAChF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC;QAChE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC;KACxE,CAAC,CAAC,OAAO,CAAC;QACT,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC;QACzF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC;QAC/F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,wBAAwB,CAAC;QACxE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC;QACnG,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;QACzE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC;QACnE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;KACrE,CAAC,CAAC,OAAO,CAAC;QACT,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,EAAE;QACT,aAAa,EAAE,gCAAgC;QAC/C,QAAQ,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,iDAAiD,CAAC;QAC5G,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC;QAC/E,kBAAkB,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC;QAC5F,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC;KACjE,CAAC,CAAC,OAAO,CAAC;QACT,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,EAAE;QACd,kBAAkB,EAAE,IAAI;QACxB,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC;CACzB,CAAC,CAAC"}

package/{dist → lib}/features/approval-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-channel.d.ts","sourceRoot":"","sources":["../../src/features/approval-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAMlE,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAExF,uDAAuD;AACvD,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX;;;;WAIG;QACH,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,IAAI,SAAS,oBAAoB,EAAE,CAAA;SAAE,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAC;IAC1E,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAC;CAC3F;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrG;AAED,+BAA+B;AAC/B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;QAC3C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7B,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,EAAE,CACA,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,EACxC,OAAO,CAAC,EAAE,YAAY,GACrB,MAAM,OAAO,CAAC;CAClB;AA4CD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAGjD,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,MAAM;IAQhB;;;;;;;;;OASG;IACI,OAAO,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI;IAYjD,wCAAwC;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQ9C,sDAAsD;IAC/C,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO;IA4B1D,wCAAwC;YAC1B,IAAI;IAkClB,OAAO,CAAC,WAAW;CAKpB"}
+{"version":3,"file":"approval-channel.d.ts","sourceRoot":"","sources":["../../src/features/approval-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAMlE,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAExF,uDAAuD;AACvD,UAAU,oBAAoB;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX;;;;WAIG;QACH,OAAO,CAAC,EAAE;YAAE,cAAc,CAAC,IAAI,SAAS,oBAAoB,EAAE,CAAA;SAAE,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAID,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAC;IAC1E,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAC;CAC3F;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrG;AAED,+BAA+B;AAC/B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;QAC3C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7B,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,EAAE,CACA,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,EACxC,OAAO,CAAC,EAAE,YAAY,GACrB,MAAM,OAAO,CAAC;CAClB;AA8CD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAGjD,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,MAAM;IAQhB;;;;;;;;;OASG;IACI,OAAO,CAAC,GAAG,EAAE,sBAAsB,GAAG,IAAI;IAYjD,wCAAwC;IACjC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAQ9C,sDAAsD;IAC/C,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO;IAkC1D,wCAAwC;YAC1B,IAAI;IAmClB,OAAO,CAAC,WAAW;CAKpB"}

package/{dist → lib}/features/approval-channel.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { decodeButtonData } from "./button-utils.js";
 import { buildApprovalKeyboard, buildApprovalText } from "./approval-renderer.js";
 const COMMAND_CLIP = 500;
@@ -99,11 +100,16 @@ export class ApprovalChannel {
         const button = decodeButtonData(data);
         if (!button || button.t !== 'approval')
             return false;
-        // 白名单模式下审批只认名单内用户（群成员标识或私聊 openid，可混存名单）
+        // nonce 必须匹配 pending：旧卡片/其它会话的卡片点击不 settle（#94-3）
+        if (button.n !== entry.nonce) {
+            this.logger.warn(`im-qqbot: approval button nonce mismatch: key=${record.sessionKey}`);
+            return false;
+        }
+        // 白名单模式下审批只认名单内用户；点击者身份缺失同样拒绝（fail-closed，#94-3）
         const clicker = event.group_member_openid ?? event.user_openid;
-        if (clicker && this.config.access.c2cMode === 'allowlist'
-            && !this.config.access.c2cAllow.includes(clicker)) {
-            this.logger.warn(`im-qqbot: approval button rejected (clicker not allowlisted): user=${clicker} key=${record.sessionKey}`);
+        if (this.config.access.c2cMode === 'allowlist'
+            && (!clicker || !this.config.access.c2cAllow.includes(clicker))) {
+            this.logger.warn(`im-qqbot: approval button rejected (clicker not allowlisted): user=${clicker ?? '(missing)'} key=${record.sessionKey}`);
             return false;
         }
         this.pending.delete(record.sessionKey);
@@ -118,8 +124,9 @@ export class ApprovalChannel {
         if (request.signal?.aborted)
             return 'cancelled';
         const command = commandOf(request);
+        const nonce = randomUUID().slice(0, 8);
         try {
-            await this.sender.sendMarkdown(record.replyTarget, buildApprovalText(request, command), { keyboard: buildApprovalKeyboard() });
+            await this.sender.sendMarkdown(record.replyTarget, buildApprovalText(request, command), { keyboard: buildApprovalKeyboard(nonce) });
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
@@ -127,7 +134,7 @@ export class ApprovalChannel {
             return 'unavailable'; // 无法呈现审批，fail-closed
         }
         return new Promise((resolve) => {
-            const entry = { record, request, resolve };
+            const entry = { record, request, resolve, nonce };
             if (request.signal) {
                 const onAbort = () => {
                     if (this.pending.get(key) !== entry)

package/lib/features/approval-channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-channel.js","sourceRoot":"","sources":["../../src/features/approval-channel.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AA2ElF,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAoB;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,kDAAkD;IAClD,2BAA2B;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1D,MAAM,GAAG,GAAG,IAAI,EAAE,SAAS,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;gBAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,OAAO,OAAO,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC;IAC7E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,eAAe;IACT,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,OAAO,CAA6B;IACpC,MAAM,CAA4B;IAClC,MAAM,CAAS;IACf,MAAM,CAA4B;IAEnD,YACE,OAAmC,EACnC,MAAiC,EACjC,MAAiC,EACjC,MAAc;QAEd,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACI,OAAO,CAAC,GAA2B;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,GAAY,EAAE,IAAa,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,GAAsB,CAAC;YACvC,MAAM,MAAM,GAAG,IAAsC,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,MAAM,EAAE,CAAC;QAClB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IAC9D,CAAC;IAED,wCAAwC;IACjC,aAAa,CAAC,UAAkB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAED,sDAAsD;IAC/C,iBAAiB,CAAC,KAAuB;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,KAAK,GAAc,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QAErD,kDAAkD;QAClD,IAAI,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iDAAiD;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,WAAW,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW;eACzC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sEAAsE,OAAO,IAAI,WAAW,QAAQ,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1I,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wCAAwC;IAChC,KAAK,CAAC,IAAI,CAAC,MAAiC,EAAE,OAAwB;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,uCAAuC;QACvC,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,WAAW,CAAC;QAEhD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAC5B,MAAM,CAAC,WAAW,EAClB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EACnC,EAAE,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAC3C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YACvE,OAAO,aAAa,CAAC,CAAC,qBAAqB;QAC7C,CAAC;QAED,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAoB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,GAAS,EAAE;oBACzB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;wBAAE,OAAO;oBAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACzB,OAAO,CAAC,WAAW,CAAC,CAAC;gBACvB,CAAC,CAAC;gBACF,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF"}

package/{dist → lib}/features/approval-renderer.d.ts

@@ -8,11 +8,11 @@ import type { ApprovalRequest } from './approval-channel.ts';
 /** 把审批请求渲染成 QQ 文本（含被 gate 的命令回显） */
 export declare function buildApprovalText(request: ApprovalRequest, command?: string): string;
 /**
- * 构建审批键盘：两按钮（允许一次 / 拒绝）。
+ * 构建审批键盘：两按钮（允许一次 / 拒绝），button_data 携带本审批的 nonce。
  *
  * dsh 审批协议 outcome 是闭合集合（allowed-once/rejected/cancelled/unavailable），
  * 无 allow-always，因此只提供两个按钮；`group_id` 相同实现单选互斥变灰。
- * button_data 编码 `{"t":"approval","d":"allow"|"deny"}`，由分发器解码。
+ * nonce 与 pending 匹配，旧卡片/其它会话卡片点击不 settle（#94-3）。
  */
-export declare function buildApprovalKeyboard(): InlineKeyboard;
+export declare function buildApprovalKeyboard(nonce: string): InlineKeyboard;
 //# sourceMappingURL=approval-renderer.d.ts.map

package/{dist → lib}/features/approval-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-renderer.d.ts","sourceRoot":"","sources":["../../src/features/approval-renderer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,oCAAoC;AACpC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBpF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAwBtD"}
+{"version":3,"file":"approval-renderer.d.ts","sourceRoot":"","sources":["../../src/features/approval-renderer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,oCAAoC;AACpC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBpF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAwBnE"}

package/{dist → lib}/features/approval-renderer.js

@@ -18,13 +18,13 @@ export function buildApprovalText(request, command) {
     return lines.join('\n');
 }
 /**
- * 构建审批键盘：两按钮（允许一次 / 拒绝）。
+ * 构建审批键盘：两按钮（允许一次 / 拒绝），button_data 携带本审批的 nonce。
  *
  * dsh 审批协议 outcome 是闭合集合（allowed-once/rejected/cancelled/unavailable），
  * 无 allow-always，因此只提供两个按钮；`group_id` 相同实现单选互斥变灰。
- * button_data 编码 `{"t":"approval","d":"allow"|"deny"}`，由分发器解码。
+ * nonce 与 pending 匹配，旧卡片/其它会话卡片点击不 settle（#94-3）。
  */
-export function buildApprovalKeyboard() {
+export function buildApprovalKeyboard(nonce) {
     const allow = {
         id: 'approval-allow',
         render_data: { label: '✅ 允许一次', visited_label: '✓ 已允许', style: 1 },
@@ -32,7 +32,7 @@ export function buildApprovalKeyboard() {
             type: 1,
             permission: { type: 2 },
             click_limit: 1,
-            data: encodeButtonData({ t: 'approval', d: 'allow' }),
+            data: encodeButtonData({ t: 'approval', d: 'allow', n: nonce }),
         },
         group_id: 'approval',
     };
@@ -43,7 +43,7 @@ export function buildApprovalKeyboard() {
             type: 1,
             permission: { type: 2 },
             click_limit: 1,
-            data: encodeButtonData({ t: 'approval', d: 'deny' }),
+            data: encodeButtonData({ t: 'approval', d: 'deny', n: nonce }),
         },
         group_id: 'approval',
     };

package/lib/features/approval-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-renderer.js","sourceRoot":"","sources":["../../src/features/approval-renderer.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,oCAAoC;AACpC,MAAM,UAAU,iBAAiB,CAAC,OAAwB,EAAE,OAAgB;IAC1E,MAAM,KAAK,GAAa,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC5C,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG;QACZ,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;QAClE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;YACvB,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;SAChE;QACD,QAAQ,EAAE,UAAU;KACrB,CAAC;IACF,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;QAChE,MAAM,EAAE;YACN,IAAI,EAAE,CAAC;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;YACvB,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;SAC/D;QACD,QAAQ,EAAE,UAAU;KACrB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7D,CAAC"}

package/{dist → lib}/features/button-utils.d.ts

@@ -18,10 +18,11 @@ export interface QuestionButtonData {
     q: string;
     i: number;
 }
-/** 审批按钮：d=决策 */
+/** 审批按钮：d=决策，n=本审批的 nonce（与 pending 匹配，防旧卡片混淆 #94-3） */
 export interface ApprovalButtonData {
     t: 'approval';
     d: 'allow' | 'deny';
+    n?: string;
 }
 export type ButtonData = QuestionButtonData | ApprovalButtonData;
 /** 编码 button_data（JSON 字符串） */

package/{dist → lib}/features/button-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"button-utils.d.ts","sourceRoot":"","sources":["../../src/features/button-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,+BAA+B;AAC/B,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,wBAAwB;AACxB,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG5D;AAID,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,UAAU,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,gBAAgB;AAChB,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,UAAU,CAAC;IACd,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEjE,+BAA+B;AAC/B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAEzD;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAUpE;AAED,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"button-utils.d.ts","sourceRoot":"","sources":["../../src/features/button-utils.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,+BAA+B;AAC/B,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC,wBAAwB;AACxB,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG5D;AAID,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,UAAU,CAAC;IACd,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,UAAU,CAAC;IACd,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACpB,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,UAAU,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEjE,+BAA+B;AAC/B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAEzD;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAUpE;AAED,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/{dist → lib}/features/button-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"button-utils.js","sourceRoot":"","sources":["../../src/features/button-utils.ts"],"names":[],"mappings":"AASA,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,+BAA+B;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,wBAAwB;AACxB,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAmBD,+BAA+B;AAC/B,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YAC1G,OAAO,MAAoB,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"button-utils.js","sourceRoot":"","sources":["../../src/features/button-utils.ts"],"names":[],"mappings":"AASA,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,+BAA+B;AAC/B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,wBAAwB;AACxB,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAoBD,+BAA+B;AAC/B,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,UAAU,IAAI,MAAM,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YAC1G,OAAO,MAAoB,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/{dist → lib}/gateway/middleware-setup.js

@@ -52,7 +52,7 @@ export function setupMiddlewares(bot, config, manager, logger) {
         // 关闭 autoHelp：help 命令由 qqbot 注册为 /bot-help，
         // 避免 SDK 再自动注册一个无前缀的 /help 造成重复
         autoHelp: false,
-        commands: buildCommandList({ manager, config }),
+        commands: buildCommandList({ manager, config, logger }),
     });
     bot.use(slash.middleware);
     // 8.5. 待答问题截获（在 concurrencyGuard 之前，答案消息不排队直接作答）