@cxyhhhhh/openclaw-qqbot 2.0.0-dev.202607101321 → 2.0.0-dev.202607101939

package/dist/index.cjs

@@ -6,6 +6,9 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -31,6 +34,272 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  DEFAULT_ACCOUNT_ID: () => DEFAULT_ACCOUNT_ID,
+  applyQQBotAccountConfig: () => applyQQBotAccountConfig,
+  isGroupAllowed: () => isGroupAllowed,
+  listQQBotAccountIds: () => listQQBotAccountIds,
+  resolveDefaultQQBotAccountId: () => resolveDefaultQQBotAccountId,
+  resolveGroupAllowFrom: () => resolveGroupAllowFrom,
+  resolveGroupConfig: () => resolveGroupConfig,
+  resolveGroupConfigFromAccount: () => resolveGroupConfigFromAccount,
+  resolveGroupName: () => resolveGroupName,
+  resolveGroupPolicy: () => resolveGroupPolicy,
+  resolveGroupPrompt: () => resolveGroupPrompt,
+  resolveHistoryLimit: () => resolveHistoryLimit,
+  resolveIgnoreOtherMentions: () => resolveIgnoreOtherMentions,
+  resolveMentionPatterns: () => resolveMentionPatterns,
+  resolveProcessingTimeoutMs: () => resolveProcessingTimeoutMs,
+  resolveQQBotAccount: () => resolveQQBotAccount,
+  resolveRequireMention: () => resolveRequireMention,
+  resolveToolPolicy: () => resolveToolPolicy,
+  resolveUserAgentSuffix: () => resolveUserAgentSuffix
+});
+function resolveMentionPatterns(cfg, agentId) {
+  if (agentId) {
+    const agents = cfg.agents;
+    const entry = agents?.list?.find((a) => a.id?.trim().toLowerCase() === agentId.trim().toLowerCase());
+    const agentGroupChat = entry?.groupChat;
+    if (agentGroupChat && Object.hasOwn(agentGroupChat, "mentionPatterns")) {
+      return agentGroupChat.mentionPatterns ?? [];
+    }
+  }
+  const globalGroupChat = cfg?.messages?.groupChat;
+  if (globalGroupChat && typeof globalGroupChat === "object" && Object.hasOwn(globalGroupChat, "mentionPatterns")) {
+    return globalGroupChat.mentionPatterns ?? [];
+  }
+  return [];
+}
+function evaluateMatchedGroupAccessForPolicy(params) {
+  if (params.groupPolicy === "disabled") {
+    return { allowed: false, groupPolicy: params.groupPolicy, reason: "disabled" };
+  }
+  if (params.groupPolicy === "allowlist") {
+    if (params.requireMatchInput && !params.hasMatchInput) {
+      return { allowed: false, groupPolicy: params.groupPolicy, reason: "missing_match_input" };
+    }
+    if (!params.allowlistConfigured) {
+      return { allowed: false, groupPolicy: params.groupPolicy, reason: "empty_allowlist" };
+    }
+    if (!params.allowlistMatched) {
+      return { allowed: false, groupPolicy: params.groupPolicy, reason: "not_allowlisted" };
+    }
+  }
+  return { allowed: true, groupPolicy: params.groupPolicy, reason: "allowed" };
+}
+function resolveGroupPolicy(cfg, accountId) {
+  const account = resolveQQBotAccount(cfg, accountId);
+  return account.config?.groupPolicy ?? DEFAULT_GROUP_POLICY;
+}
+function resolveGroupAllowFrom(cfg, accountId) {
+  const account = resolveQQBotAccount(cfg, accountId);
+  return (account.config?.groupAllowFrom ?? []).map((id) => String(id).trim().toUpperCase());
+}
+function isGroupAllowed(cfg, groupOpenid, accountId) {
+  const account = resolveQQBotAccount(cfg, accountId);
+  const policy = account.config?.groupPolicy ?? DEFAULT_GROUP_POLICY;
+  const allowList = (account.config?.groupAllowFrom ?? []).map((id) => String(id).trim().toUpperCase());
+  const allowlistConfigured = allowList.length > 0;
+  const allowlistMatched = allowList.some((id) => id === "*" || id === groupOpenid.toUpperCase());
+  return evaluateMatchedGroupAccessForPolicy({
+    groupPolicy: policy,
+    allowlistConfigured,
+    allowlistMatched
+  }).allowed;
+}
+function resolveGroupConfigFromAccount(account, groupOpenid) {
+  const groups = account.config?.groups ?? {};
+  const wildcardCfg = groups["*"] ?? {};
+  const specificCfg = groups[groupOpenid] ?? {};
+  const accountDefaultRequireMention = account.config?.defaultRequireMention ?? DEFAULT_GROUP_CONFIG.requireMention;
+  return {
+    requireMention: specificCfg.requireMention ?? wildcardCfg.requireMention ?? accountDefaultRequireMention,
+    ignoreOtherMentions: specificCfg.ignoreOtherMentions ?? wildcardCfg.ignoreOtherMentions ?? DEFAULT_GROUP_CONFIG.ignoreOtherMentions,
+    toolPolicy: specificCfg.toolPolicy ?? wildcardCfg.toolPolicy ?? DEFAULT_GROUP_CONFIG.toolPolicy,
+    name: specificCfg.name ?? wildcardCfg.name ?? DEFAULT_GROUP_CONFIG.name,
+    prompt: specificCfg.prompt ?? wildcardCfg.prompt ?? DEFAULT_GROUP_PROMPT,
+    historyLimit: specificCfg.historyLimit ?? wildcardCfg.historyLimit ?? DEFAULT_GROUP_CONFIG.historyLimit
+  };
+}
+function resolveGroupConfig(cfg, groupOpenid, accountId) {
+  return resolveGroupConfigFromAccount(resolveQQBotAccount(cfg, accountId), groupOpenid);
+}
+function resolveHistoryLimit(cfg, groupOpenid, accountId) {
+  return Math.max(0, resolveGroupConfig(cfg, groupOpenid, accountId).historyLimit);
+}
+function resolveGroupPrompt(cfg, groupOpenid, accountId) {
+  return resolveGroupConfig(cfg, groupOpenid, accountId).prompt;
+}
+function resolveRequireMention(cfg, groupOpenid, accountId) {
+  return resolveGroupConfig(cfg, groupOpenid, accountId).requireMention;
+}
+function resolveIgnoreOtherMentions(cfg, groupOpenid, accountId) {
+  return resolveGroupConfig(cfg, groupOpenid, accountId).ignoreOtherMentions;
+}
+function resolveToolPolicy(cfg, groupOpenid, accountId) {
+  return resolveGroupConfig(cfg, groupOpenid, accountId).toolPolicy;
+}
+function resolveGroupName(cfg, groupOpenid, accountId) {
+  const name = resolveGroupConfig(cfg, groupOpenid, accountId).name;
+  return name || groupOpenid.slice(0, 8);
+}
+function normalizeAppId(raw) {
+  if (raw === null || raw === void 0) return "";
+  return String(raw).trim();
+}
+function listQQBotAccountIds(cfg) {
+  const ids = /* @__PURE__ */ new Set();
+  const qqbot = cfg.channels?.qqbot;
+  if (qqbot?.appId) {
+    ids.add(DEFAULT_ACCOUNT_ID);
+  }
+  if (qqbot?.accounts) {
+    for (const accountId of Object.keys(qqbot.accounts)) {
+      if (qqbot.accounts[accountId]?.appId) {
+        ids.add(accountId);
+      }
+    }
+  }
+  return Array.from(ids);
+}
+function resolveDefaultQQBotAccountId(cfg) {
+  const qqbot = cfg.channels?.qqbot;
+  if (qqbot?.appId) {
+    return DEFAULT_ACCOUNT_ID;
+  }
+  if (qqbot?.accounts) {
+    const ids = Object.keys(qqbot.accounts);
+    if (ids.length > 0) {
+      return ids[0];
+    }
+  }
+  return DEFAULT_ACCOUNT_ID;
+}
+function resolveUserAgentSuffix(cfg) {
+  const qqbot = cfg.channels?.qqbot;
+  return qqbot?.userAgentSuffix ? String(qqbot.userAgentSuffix).trim() : "";
+}
+function resolveProcessingTimeoutMs(accountConfig) {
+  if (accountConfig?.processingTimeoutMs !== void 0) {
+    return accountConfig.processingTimeoutMs;
+  }
+  const env = process.env.OPENCLAW_PROCESSING_TIMEOUT_MS;
+  if (env) {
+    const v = Number(env);
+    if (!Number.isNaN(v) && v >= 0) return v;
+  }
+  return DEFAULT_PROCESSING_TIMEOUT_MS;
+}
+function resolveQQBotAccount(cfg, accountId) {
+  const resolvedAccountId = accountId ?? resolveDefaultQQBotAccountId(cfg);
+  const qqbot = cfg.channels?.qqbot;
+  let accountConfig = {};
+  let appId = "";
+  let clientSecret = "";
+  let secretSource = "none";
+  if (resolvedAccountId === DEFAULT_ACCOUNT_ID) {
+    const { accounts: _accounts, ...topLevelConfig } = qqbot ?? {};
+    accountConfig = {
+      ...topLevelConfig,
+      markdownSupport: qqbot?.markdownSupport ?? true
+    };
+    appId = normalizeAppId(qqbot?.appId);
+  } else {
+    const account = qqbot?.accounts?.[resolvedAccountId];
+    accountConfig = account ?? {};
+    appId = normalizeAppId(account?.appId);
+  }
+  if (accountConfig.clientSecret) {
+    clientSecret = accountConfig.clientSecret;
+    secretSource = "config";
+  } else if (accountConfig.clientSecretFile) {
+    secretSource = "file";
+  } else if (process.env.QQBOT_CLIENT_SECRET && resolvedAccountId === DEFAULT_ACCOUNT_ID) {
+    clientSecret = process.env.QQBOT_CLIENT_SECRET;
+    secretSource = "env";
+  }
+  if (!appId && process.env.QQBOT_APP_ID && resolvedAccountId === DEFAULT_ACCOUNT_ID) {
+    appId = normalizeAppId(process.env.QQBOT_APP_ID);
+  }
+  return {
+    accountId: resolvedAccountId,
+    name: accountConfig.name,
+    enabled: accountConfig.enabled !== false,
+    appId,
+    clientSecret,
+    secretSource,
+    systemPrompt: accountConfig.systemPrompt,
+    markdownSupport: accountConfig.markdownSupport !== false,
+    userAgentSuffix: resolveUserAgentSuffix(cfg),
+    processingTimeoutMs: resolveProcessingTimeoutMs(accountConfig),
+    config: accountConfig
+  };
+}
+function applyQQBotAccountConfig(cfg, accountId, input) {
+  const next = { ...cfg };
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    const existingConfig = next.channels?.qqbot || {};
+    const allowFrom = existingConfig.allowFrom ?? ["*"];
+    next.channels = {
+      ...next.channels,
+      qqbot: {
+        ...next.channels?.qqbot || {},
+        enabled: true,
+        allowFrom,
+        ...input.appId ? { appId: input.appId } : {},
+        ...input.clientSecret ? { clientSecret: input.clientSecret } : input.clientSecretFile ? { clientSecretFile: input.clientSecretFile } : {},
+        ...input.name ? { name: input.name } : {}
+      }
+    };
+  } else {
+    const existingAccountConfig = next.channels?.qqbot?.accounts?.[accountId] || {};
+    const allowFrom = existingAccountConfig.allowFrom ?? ["*"];
+    next.channels = {
+      ...next.channels,
+      qqbot: {
+        ...next.channels?.qqbot || {},
+        enabled: true,
+        accounts: {
+          ...next.channels?.qqbot?.accounts || {},
+          [accountId]: {
+            ...next.channels?.qqbot?.accounts?.[accountId] || {},
+            enabled: true,
+            allowFrom,
+            ...input.appId ? { appId: input.appId } : {},
+            ...input.clientSecret ? { clientSecret: input.clientSecret } : input.clientSecretFile ? { clientSecretFile: input.clientSecretFile } : {},
+            ...input.name ? { name: input.name } : {}
+          }
+        }
+      }
+    };
+  }
+  return next;
+}
+var DEFAULT_ACCOUNT_ID, DEFAULT_GROUP_POLICY, DEFAULT_GROUP_HISTORY_LIMIT, DEFAULT_PROCESSING_TIMEOUT_MS, DEFAULT_GROUP_CONFIG, DEFAULT_GROUP_PROMPT;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    DEFAULT_ACCOUNT_ID = "default";
+    DEFAULT_GROUP_POLICY = "open";
+    DEFAULT_GROUP_HISTORY_LIMIT = 20;
+    DEFAULT_PROCESSING_TIMEOUT_MS = 0;
+    DEFAULT_GROUP_CONFIG = {
+      requireMention: true,
+      ignoreOtherMentions: false,
+      toolPolicy: "restricted",
+      name: "",
+      historyLimit: DEFAULT_GROUP_HISTORY_LIMIT
+    };
+    DEFAULT_GROUP_PROMPT = [
+      "\u82E5\u53D1\u9001\u8005\u4E3A\u673A\u5668\u4EBA\uFF0C\u4EC5\u5728\u5BF9\u65B9\u660E\u786E@\u4F60\u63D0\u95EE\u6216\u8BF7\u6C42\u534F\u52A9\u5177\u4F53\u4EFB\u52A1\u65F6\uFF0C\u4EE5\u7B80\u6D01\u660E\u4E86\u7684\u5185\u5BB9\u56DE\u590D\uFF0C",
+      "\u907F\u514D\u4E0E\u5176\u4ED6\u673A\u5668\u4EBA\u4EA7\u751F\u62A2\u7B54\u6216\u591A\u8F6E\u65E0\u610F\u4E49\u5BF9\u8BDD\u3002",
+      "\u5728\u7FA4\u804A\u4E2D\u4F18\u5148\u8BA9\u4EBA\u7C7B\u7528\u6237\u7684\u6D88\u606F\u5F97\u5230\u54CD\u5E94\uFF0C\u673A\u5668\u4EBA\u4E4B\u95F4\u4FDD\u6301\u534F\u4F5C\u800C\u975E\u7ADE\u4E89\uFF0C\u786E\u4FDD\u5BF9\u8BDD\u6709\u5E8F\u4E0D\u5237\u5C4F\u3002"
+    ].join("");
+  }
+});
+
 // node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants = __commonJS({
   "node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js"(exports2, module2) {
@@ -3710,16 +3979,248 @@ var require_websocket_server = __commonJS({
   }
 });
 
-// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js
-var require_QRMode = __commonJS({
-  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js"(exports2, module2) {
-    "use strict";
-    module2.exports = {
-      MODE_NUMBER: 1 << 0,
-      MODE_ALPHA_NUM: 1 << 1,
-      MODE_8BIT_BYTE: 1 << 2,
-      MODE_KANJI: 1 << 3
-    };
+// src/adapter/resolve.ts
+var resolve_exports = {};
+__export(resolve_exports, {
+  _resetAdaptersCache: () => _resetAdaptersCache,
+  getAdapters: () => getAdapters,
+  persistAuthConfig: () => persistAuthConfig,
+  resolveRuntimeAdapters: () => resolveRuntimeAdapters
+});
+function probeFunction(rt, paths) {
+  for (const path22 of paths) {
+    let target = rt;
+    let parent = rt;
+    for (let i = 0; i < path22.length; i++) {
+      parent = target;
+      target = target?.[path22[i]];
+      if (target === void 0 || target === null) break;
+    }
+    if (typeof target === "function") {
+      return target.bind(parent);
+    }
+  }
+  return null;
+}
+function resolveRuntimeAdapters(rt, log4) {
+  const version = rt.version ?? "unknown";
+  const inboundRun = probeFunction(rt, [
+    ["channel", "inbound", "run"],
+    // current (2026-05+)
+    ["channel", "turn", "run"]
+    // legacy (removed 2026-05-27)
+  ]);
+  const dispatchReply = probeFunction(rt, [
+    ["channel", "reply", "dispatchReplyWithBufferedBlockDispatcher"]
+  ]);
+  const resolveAgentRoute = probeFunction(rt, [
+    ["channel", "routing", "resolveAgentRoute"]
+  ]);
+  const rawBuildContext = probeFunction(rt, [
+    ["channel", "inbound", "buildContext"]
+  ]);
+  const rawFinalizeContext = !rawBuildContext ? probeFunction(rt, [["channel", "reply", "finalizeInboundContext"]]) : null;
+  const buildInboundContext = rawBuildContext ? (params) => rawBuildContext(params) : rawFinalizeContext ? (params) => {
+    const isCommand = params.access?.commands?.authorized ?? false;
+    const rawCtx = {
+      Body: params.message.body,
+      BodyForAgent: params.message.bodyForAgent,
+      RawBody: params.message.rawBody,
+      CommandBody: params.message.commandBody ?? params.message.rawBody,
+      CommandSource: isCommand ? "text" : void 0,
+      CommandTurn: params.command ?? void 0,
+      CommandAuthorized: isCommand,
+      From: params.from,
+      To: params.reply.to,
+      SessionKey: params.route.routeSessionKey,
+      AccountId: params.route.accountId ?? params.accountId,
+      ChatType: params.conversation.kind,
+      GroupSystemPrompt: params.conversation.label,
+      SenderId: params.sender.id,
+      SenderName: params.sender.name,
+      Provider: params.provider ?? params.channel,
+      Surface: params.surface ?? params.channel,
+      MessageSid: params.messageId,
+      Timestamp: params.timestamp ?? Date.now(),
+      OriginatingChannel: params.channel,
+      OriginatingTo: params.reply.originatingTo ?? params.reply.to,
+      ...params.extra
+    };
+    return rawFinalizeContext(rawCtx);
+  } : null;
+  const resolveStorePath = probeFunction(rt, [
+    ["channel", "session", "resolveStorePath"]
+  ]);
+  const recordInboundSession = probeFunction(rt, [
+    ["channel", "session", "recordInboundSession"]
+  ]);
+  const formatEnvelope = probeFunction(rt, [
+    ["channel", "reply", "formatAgentEnvelope"],
+    // current (2026-06+)
+    ["channel", "reply", "formatInboundEnvelope"]
+    // deprecated，低版本兼容
+  ]);
+  const resolveEnvelopeFormatOptions = probeFunction(rt, [
+    ["channel", "reply", "resolveEnvelopeFormatOptions"]
+  ]);
+  const chunkMarkdownText = probeFunction(rt, [
+    ["channel", "text", "chunkMarkdownText"]
+  ]);
+  const saveRemoteMedia = probeFunction(rt, [
+    ["channel", "media", "saveRemoteMedia"]
+  ]);
+  const getConfig = probeFunction(rt, [
+    ["config", "current"]
+  ]) ?? probeFunction(rt, [
+    ["getConfig"]
+  ]) ?? probeFunction(rt, [
+    ["config", "loadConfig"]
+  ]);
+  const rawMutateConfig = probeFunction(rt, [["config", "mutateConfigFile"]]);
+  const rawWriteConfig = probeFunction(rt, [["config", "writeConfigFile"]]);
+  const persistConfig = rawMutateConfig ? async (mutator) => {
+    await rawMutateConfig({
+      afterWrite: "hot-reload",
+      mutate: mutator
+    });
+  } : rawWriteConfig && getConfig ? async (mutator) => {
+    const current = JSON.parse(JSON.stringify(getConfig()));
+    mutator(current);
+    await rawWriteConfig(current);
+  } : null;
+  const resolved = [
+    inboundRun && "inboundRun",
+    dispatchReply && "dispatchReply",
+    resolveAgentRoute && "resolveAgentRoute",
+    buildInboundContext && "buildInboundContext",
+    resolveStorePath && "resolveStorePath",
+    recordInboundSession && "recordInboundSession",
+    formatEnvelope && "formatEnvelope",
+    chunkMarkdownText && "chunkMarkdownText",
+    saveRemoteMedia && "saveRemoteMedia",
+    getConfig && "getConfig",
+    persistConfig && `persistConfig(${rawMutateConfig ? "mutate" : "write"})`
+  ].filter(Boolean);
+  log4?.info(
+    `[qqbot:adapter] openclaw=${version} resolved ${resolved.length} adapters: ${resolved.join(", ")}`
+  );
+  return {
+    inboundRun,
+    dispatchReply,
+    resolveAgentRoute,
+    buildInboundContext,
+    resolveStorePath,
+    recordInboundSession,
+    formatEnvelope,
+    resolveEnvelopeFormatOptions,
+    chunkMarkdownText,
+    saveRemoteMedia,
+    getConfig,
+    persistConfig,
+    version
+  };
+}
+function getAdapters(rt, log4) {
+  const cached = _cachedRuntimeRef?.deref();
+  if (cached === rt && _cachedAdapters) {
+    return _cachedAdapters;
+  }
+  _cachedAdapters = resolveRuntimeAdapters(rt, log4);
+  _cachedRuntimeRef = new WeakRef(rt);
+  return _cachedAdapters;
+}
+async function persistAuthConfig(runtime2, cfg, afterWrite = "restart") {
+  const config = runtime2.config;
+  if (typeof config?.mutateConfigFile === "function") {
+    await config.mutateConfigFile({
+      mutate: () => cfg,
+      afterWrite
+    });
+    return;
+  }
+  if (typeof config?.writeConfigFile === "function") {
+    await config.writeConfigFile(cfg);
+    return;
+  }
+  if (typeof runtime2.writeConfigFile === "function") {
+    await runtime2.writeConfigFile(cfg);
+    return;
+  }
+  const { homedir: homedir5 } = await import("os");
+  const { join: join8 } = await import("path");
+  const { writeFileSync: writeFileSync5 } = await import("fs");
+  writeFileSync5(join8(homedir5(), ".openclaw", "openclaw.json"), JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+}
+function _resetAdaptersCache() {
+  _cachedAdapters = null;
+  _cachedRuntimeRef = null;
+}
+var _cachedAdapters, _cachedRuntimeRef;
+var init_resolve = __esm({
+  "src/adapter/resolve.ts"() {
+    "use strict";
+    _cachedAdapters = null;
+    _cachedRuntimeRef = null;
+  }
+});
+
+// src/adapter/setup.ts
+function loadSetup() {
+  if (_setup !== void 0) return _setup;
+  try {
+    _setup = req2("openclaw/plugin-sdk/setup");
+  } catch {
+    _setup = null;
+  }
+  return _setup;
+}
+function loadTools() {
+  if (_tools !== void 0) return _tools;
+  try {
+    _tools = req2("openclaw/plugin-sdk/setup-tools");
+  } catch {
+    _tools = null;
+  }
+  return _tools;
+}
+function createStandardChannelSetupStatus(...args) {
+  const mod = loadSetup();
+  if (mod) return mod.createStandardChannelSetupStatus(...args);
+  return {
+    channelLabel: args[0]?.channelLabel ?? "QQ Bot",
+    configuredLabel: "Configured",
+    unconfiguredLabel: "Not configured",
+    resolveConfigured: () => false
+  };
+}
+function setSetupChannelEnabled(...args) {
+  loadSetup()?.setSetupChannelEnabled?.(...args);
+}
+function formatDocsLink(...args) {
+  const mod = loadTools();
+  if (mod) return mod.formatDocsLink(...args);
+  return args[1] ? `${args[1]}: ${args[0]}` : args[0];
+}
+var import_node_module2, req2, _setup, _tools, DEFAULT_ACCOUNT_ID2;
+var init_setup = __esm({
+  "src/adapter/setup.ts"() {
+    "use strict";
+    import_node_module2 = require("module");
+    req2 = (0, import_node_module2.createRequire)(__filename);
+    DEFAULT_ACCOUNT_ID2 = "default";
+  }
+});
+
+// node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js
+var require_QRMode = __commonJS({
+  "node_modules/.pnpm/qrcode-terminal@0.12.0/node_modules/qrcode-terminal/vendor/QRCode/QRMode.js"(exports2, module2) {
+    "use strict";
+    module2.exports = {
+      MODE_NUMBER: 1 << 0,
+      MODE_ALPHA_NUM: 1 << 1,
+      MODE_8BIT_BYTE: 1 << 2,
+      MODE_KANJI: 1 << 3
+    };
   }
 });
 
@@ -4791,295 +5292,323 @@ var require_main = __commonJS({
   }
 });
 
-// index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_ACCOUNT_ID: () => DEFAULT_ACCOUNT_ID,
-  MSG_TYPE_QUOTE: () => MSG_TYPE_QUOTE2,
-  MSG_TYPE_TEXT: () => MSG_TYPE_TEXT,
-  PersistedRefIndexStore: () => PersistedRefIndexStore,
-  QQBotGateway: () => QQBotGateway,
-  StreamContentType: () => StreamContentType2,
-  StreamInputMode: () => StreamInputMode2,
-  StreamInputState: () => StreamInputState2,
-  StreamingController: () => StreamingController,
-  applyQQBotAccountConfig: () => applyQQBotAccountConfig,
-  buildUserAgent: () => buildUserAgent,
-  default: () => index_default,
-  dispatchToOpenClaw: () => dispatchToOpenClaw,
-  flushAllRefIndexStores: () => flushAllRefIndexStores,
-  getBotForAccount: () => getBotForAccount,
-  getPersistedRefIndexStore: () => getPersistedRefIndexStore,
-  getQQBotRuntime: () => getQQBotRuntime,
-  isGroupAllowed: () => isGroupAllowed,
-  listQQBotAccountIds: () => listQQBotAccountIds,
-  parseTarget: () => parseTarget,
-  qqbotOnboardingAdapter: () => qqbotOnboardingAdapter,
-  qqbotPlugin: () => qqbotPlugin,
-  resolveDefaultQQBotAccountId: () => resolveDefaultQQBotAccountId,
-  resolveGroupAllowFrom: () => resolveGroupAllowFrom,
-  resolveGroupConfig: () => resolveGroupConfig,
-  resolveGroupConfigFromAccount: () => resolveGroupConfigFromAccount,
-  resolveGroupName: () => resolveGroupName,
-  resolveGroupPolicy: () => resolveGroupPolicy,
-  resolveGroupPrompt: () => resolveGroupPrompt,
-  resolveHistoryLimit: () => resolveHistoryLimit,
-  resolveIgnoreOtherMentions: () => resolveIgnoreOtherMentions,
-  resolveMentionPatterns: () => resolveMentionPatterns,
-  resolveProcessingTimeoutMs: () => resolveProcessingTimeoutMs,
-  resolveQQBotAccount: () => resolveQQBotAccount,
-  resolveRequireMention: () => resolveRequireMention,
-  resolveToolPolicy: () => resolveToolPolicy,
-  resolveUserAgentSuffix: () => resolveUserAgentSuffix,
-  sendMedia: () => sendMedia,
-  sendText: () => sendText,
-  setQQBotRuntime: () => setQQBotRuntime,
-  shouldUseStreaming: () => shouldUseStreaming,
-  tryGetBotForAccount: () => tryGetBotForAccount
-});
-module.exports = __toCommonJS(index_exports);
-var import_plugin_sdk = require("openclaw/plugin-sdk");
-
-// src/channel.ts
-var import_core = require("openclaw/plugin-sdk/core");
-
-// src/config.ts
-function resolveMentionPatterns(cfg, agentId) {
-  if (agentId) {
-    const agents = cfg.agents;
-    const entry = agents?.list?.find((a) => a.id?.trim().toLowerCase() === agentId.trim().toLowerCase());
-    const agentGroupChat = entry?.groupChat;
-    if (agentGroupChat && Object.hasOwn(agentGroupChat, "mentionPatterns")) {
-      return agentGroupChat.mentionPatterns ?? [];
-    }
-  }
-  const globalGroupChat = cfg?.messages?.groupChat;
-  if (globalGroupChat && typeof globalGroupChat === "object" && Object.hasOwn(globalGroupChat, "mentionPatterns")) {
-    return globalGroupChat.mentionPatterns ?? [];
-  }
-  return [];
-}
-var DEFAULT_ACCOUNT_ID = "default";
-function evaluateMatchedGroupAccessForPolicy(params) {
-  if (params.groupPolicy === "disabled") {
-    return { allowed: false, groupPolicy: params.groupPolicy, reason: "disabled" };
-  }
-  if (params.groupPolicy === "allowlist") {
-    if (params.requireMatchInput && !params.hasMatchInput) {
-      return { allowed: false, groupPolicy: params.groupPolicy, reason: "missing_match_input" };
-    }
-    if (!params.allowlistConfigured) {
-      return { allowed: false, groupPolicy: params.groupPolicy, reason: "empty_allowlist" };
-    }
-    if (!params.allowlistMatched) {
-      return { allowed: false, groupPolicy: params.groupPolicy, reason: "not_allowlisted" };
-    }
-  }
-  return { allowed: true, groupPolicy: params.groupPolicy, reason: "allowed" };
-}
-var DEFAULT_GROUP_POLICY = "open";
-var DEFAULT_GROUP_HISTORY_LIMIT = 20;
-var DEFAULT_PROCESSING_TIMEOUT_MS = 0;
-var DEFAULT_GROUP_CONFIG = {
-  requireMention: true,
-  ignoreOtherMentions: false,
-  toolPolicy: "restricted",
-  name: "",
-  historyLimit: DEFAULT_GROUP_HISTORY_LIMIT
-};
-var DEFAULT_GROUP_PROMPT = [
-  "\u82E5\u53D1\u9001\u8005\u4E3A\u673A\u5668\u4EBA\uFF0C\u4EC5\u5728\u5BF9\u65B9\u660E\u786E@\u4F60\u63D0\u95EE\u6216\u8BF7\u6C42\u534F\u52A9\u5177\u4F53\u4EFB\u52A1\u65F6\uFF0C\u4EE5\u7B80\u6D01\u660E\u4E86\u7684\u5185\u5BB9\u56DE\u590D\uFF0C",
-  "\u907F\u514D\u4E0E\u5176\u4ED6\u673A\u5668\u4EBA\u4EA7\u751F\u62A2\u7B54\u6216\u591A\u8F6E\u65E0\u610F\u4E49\u5BF9\u8BDD\u3002",
-  "\u5728\u7FA4\u804A\u4E2D\u4F18\u5148\u8BA9\u4EBA\u7C7B\u7528\u6237\u7684\u6D88\u606F\u5F97\u5230\u54CD\u5E94\uFF0C\u673A\u5668\u4EBA\u4E4B\u95F4\u4FDD\u6301\u534F\u4F5C\u800C\u975E\u7ADE\u4E89\uFF0C\u786E\u4FDD\u5BF9\u8BDD\u6709\u5E8F\u4E0D\u5237\u5C4F\u3002"
-].join("");
-function resolveGroupPolicy(cfg, accountId) {
-  const account = resolveQQBotAccount(cfg, accountId);
-  return account.config?.groupPolicy ?? DEFAULT_GROUP_POLICY;
+// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qqbot-session.js
+function d(t = "production") {
+  return E[t];
 }
-function resolveGroupAllowFrom(cfg, accountId) {
-  const account = resolveQQBotAccount(cfg, accountId);
-  return (account.config?.groupAllowFrom ?? []).map((id) => String(id).trim().toUpperCase());
+function l() {
+  return import_node_crypto.default.randomBytes(32).toString("base64");
 }
-function isGroupAllowed(cfg, groupOpenid, accountId) {
-  const account = resolveQQBotAccount(cfg, accountId);
-  const policy = account.config?.groupPolicy ?? DEFAULT_GROUP_POLICY;
-  const allowList = (account.config?.groupAllowFrom ?? []).map((id) => String(id).trim().toUpperCase());
-  const allowlistConfigured = allowList.length > 0;
-  const allowlistMatched = allowList.some((id) => id === "*" || id === groupOpenid.toUpperCase());
-  return evaluateMatchedGroupAccessForPolicy({
-    groupPolicy: policy,
-    allowlistConfigured,
-    allowlistMatched
-  }).allowed;
+function b(t, r) {
+  const a = Buffer.from(r, "base64"), n = Buffer.from(t, "base64"), e = n.subarray(0, 12), c = n.subarray(n.length - 16), s = n.subarray(12, n.length - 16), o = import_node_crypto.default.createDecipheriv("aes-256-gcm", a, e);
+  return o.setAuthTag(c), Buffer.concat([o.update(s), o.final()]).toString("utf8");
 }
-function resolveGroupConfigFromAccount(account, groupOpenid) {
-  const groups = account.config?.groups ?? {};
-  const wildcardCfg = groups["*"] ?? {};
-  const specificCfg = groups[groupOpenid] ?? {};
-  const accountDefaultRequireMention = account.config?.defaultRequireMention ?? DEFAULT_GROUP_CONFIG.requireMention;
-  return {
-    requireMention: specificCfg.requireMention ?? wildcardCfg.requireMention ?? accountDefaultRequireMention,
-    ignoreOtherMentions: specificCfg.ignoreOtherMentions ?? wildcardCfg.ignoreOtherMentions ?? DEFAULT_GROUP_CONFIG.ignoreOtherMentions,
-    toolPolicy: specificCfg.toolPolicy ?? wildcardCfg.toolPolicy ?? DEFAULT_GROUP_CONFIG.toolPolicy,
-    name: specificCfg.name ?? wildcardCfg.name ?? DEFAULT_GROUP_CONFIG.name,
-    prompt: specificCfg.prompt ?? wildcardCfg.prompt ?? DEFAULT_GROUP_PROMPT,
-    historyLimit: specificCfg.historyLimit ?? wildcardCfg.historyLimit ?? DEFAULT_GROUP_CONFIG.historyLimit
-  };
+function h(t, r, a) {
+  return new Promise((n, e) => {
+    const c = JSON.stringify(r), s = new URL(t), o = import_node_https.default.request({ hostname: s.hostname, path: s.pathname + s.search, method: "POST", timeout: a, headers: { "Content-Type": "application/json", Accept: "application/json", "Content-Length": Buffer.byteLength(c) } }, (i) => {
+      if (i.statusCode !== 200) {
+        i.resume(), e(new Error(`HTTP ${i.statusCode} from ${t}`));
+        return;
+      }
+      let f = "";
+      i.on("data", (p2) => {
+        f += p2;
+      }), i.on("end", () => {
+        try {
+          n(JSON.parse(f));
+        } catch (p2) {
+          e(p2);
+        }
+      });
+    });
+    o.on("error", e), o.on("timeout", () => {
+      o.destroy(), e(new Error(`timeout fetching ${t}`));
+    }), o.end(c);
+  });
 }
-function resolveGroupConfig(cfg, groupOpenid, accountId) {
-  return resolveGroupConfigFromAccount(resolveQQBotAccount(cfg, accountId), groupOpenid);
+async function y(t = "production", r = 1e4) {
+  const a = `https://${d(t)}/lite/create_bind_task`, n = l(), e = await h(a, { key: n }, r);
+  if (e.retcode !== 0) throw new Error(e.msg ?? "create_bind_task failed");
+  if (!e.data?.task_id) throw new Error("create_bind_task: missing task_id");
+  return { taskId: e.data.task_id, key: n };
 }
-function resolveHistoryLimit(cfg, groupOpenid, accountId) {
-  return Math.max(0, resolveGroupConfig(cfg, groupOpenid, accountId).historyLimit);
+async function g(t, r = "production", a = 1e4) {
+  const n = `https://${d(r)}/lite/poll_bind_result`, e = await h(n, { task_id: t }, a);
+  if (e.retcode !== 0) throw new Error(e.msg ?? "poll_bind_result failed");
+  return { status: e.data?.status ?? u.NONE, botAppId: String(e.data?.bot_appid ?? ""), botEncryptSecret: e.data?.bot_encrypt_secret ?? "", userOpenid: e.data?.user_openid || void 0 };
 }
-function resolveGroupPrompt(cfg, groupOpenid, accountId) {
-  return resolveGroupConfig(cfg, groupOpenid, accountId).prompt;
+function w(t, r = "") {
+  return `https://${d("production")}/qqbot/openclaw/connect.html?task_id=${encodeURIComponent(t)}&source=${encodeURIComponent(r)}&_wv=2`;
 }
-function resolveRequireMention(cfg, groupOpenid, accountId) {
-  return resolveGroupConfig(cfg, groupOpenid, accountId).requireMention;
+var import_node_crypto, import_node_https, E, u;
+var init_qqbot_session = __esm({
+  "node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qqbot-session.js"() {
+    "use strict";
+    import_node_crypto = __toESM(require("crypto"), 1);
+    import_node_https = __toESM(require("https"), 1);
+    E = { production: "q.qq.com", test: "test.q.qq.com" };
+    (function(t) {
+      t[t.NONE = 0] = "NONE", t[t.PENDING = 1] = "PENDING", t[t.COMPLETED = 2] = "COMPLETED", t[t.EXPIRED = 3] = "EXPIRED";
+    })(u || (u = {}));
+  }
+});
+
+// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qr-connect.js
+function F(r) {
+  return new Promise((o) => {
+    import_qrcode_terminal.default.generate(r, { small: true }, (e) => {
+      o(e);
+    });
+  });
 }
-function resolveIgnoreOtherMentions(cfg, groupOpenid, accountId) {
-  return resolveGroupConfig(cfg, groupOpenid, accountId).ignoreOtherMentions;
+function d2(r, o) {
+  return new Promise((e, t) => {
+    if (o?.aborted) {
+      t(new DOMException("Aborted", "AbortError"));
+      return;
+    }
+    const n = setTimeout(e, r);
+    o?.addEventListener("abort", () => {
+      clearTimeout(n), t(new DOMException("Aborted", "AbortError"));
+    }, { once: true });
+  });
 }
-function resolveToolPolicy(cfg, groupOpenid, accountId) {
-  return resolveGroupConfig(cfg, groupOpenid, accountId).toolPolicy;
+async function C(r, o, e) {
+  for (; !e?.aborted; ) {
+    let t;
+    try {
+      t = await g(r);
+    } catch {
+      await d2(p, e);
+      continue;
+    }
+    if (t.status === u.COMPLETED) {
+      const n = b(t.botEncryptSecret, o);
+      return { outcome: "scanned", appId: t.botAppId, appSecret: n, userOpenid: t.userOpenid };
+    }
+    if (t.status === u.EXPIRED) return { outcome: "expired" };
+    await d2(p, e);
+  }
+  throw new DOMException("Aborted", "AbortError");
 }
-function resolveGroupName(cfg, groupOpenid, accountId) {
-  const name = resolveGroupConfig(cfg, groupOpenid, accountId).name;
-  return name || groupOpenid.slice(0, 8);
+function l2(r, o) {
+  const e = new AbortController(), t = o?.signal ? AbortSignal.any([e.signal, o.signal]) : e.signal;
+  return (async () => {
+    const n = o?.displayQrCodeToConsole ?? true;
+    for (; ; ) {
+      if (t.aborted) throw new DOMException("Aborted", "AbortError");
+      let a;
+      try {
+        a = await y();
+      } catch (u2) {
+        throw new Error(`\u83B7\u53D6\u7ED1\u5B9A\u4EFB\u52A1\u5931\u8D25: ${u2 instanceof Error ? u2.message : String(u2)}`, { cause: u2 });
+      }
+      const i = w(a.taskId, o?.source);
+      if (n) {
+        const u2 = await F(i);
+        console.log(u2), console.log(`\u8BF7\u4F7F\u7528\u624B\u673A QQ \u626B\u63CF\u4E0A\u65B9\u4E8C\u7EF4\u7801\uFF0C\u5B8C\u6210\u673A\u5668\u4EBA\u7ED1\u5B9A\u3002
+`);
+      }
+      r.onQrDisplayed?.(i);
+      const s = await C(a.taskId, a.key, t);
+      if (s.outcome === "scanned") {
+        r.onSuccess([{ appId: s.appId, appSecret: s.appSecret, userOpenid: s.userOpenid }]);
+        return;
+      }
+      r.onQrExpired?.(), n && console.log(`\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F\uFF0C\u6B63\u5728\u5237\u65B0\u2026
+`);
+    }
+  })().catch((n) => {
+    if (n instanceof DOMException && n.name === "AbortError") {
+      r.onFailure(new Error("\u5DF2\u53D6\u6D88"));
+      return;
+    }
+    r.onFailure(n instanceof Error ? n : new Error(String(n)));
+  }), () => e.abort();
 }
-function normalizeAppId(raw) {
-  if (raw === null || raw === void 0) return "";
-  return String(raw).trim();
+function m2(r) {
+  return new Promise((o, e) => {
+    l2({ onSuccess: o, onFailure: e }, { ...r, displayQrCodeToConsole: true });
+  });
 }
-function listQQBotAccountIds(cfg) {
-  const ids = /* @__PURE__ */ new Set();
-  const qqbot = cfg.channels?.qqbot;
-  if (qqbot?.appId) {
-    ids.add(DEFAULT_ACCOUNT_ID);
+var import_qrcode_terminal, p;
+var init_qr_connect = __esm({
+  "node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qr-connect.js"() {
+    "use strict";
+    import_qrcode_terminal = __toESM(require_main(), 1);
+    init_qqbot_session();
+    p = 2e3;
   }
-  if (qqbot?.accounts) {
-    for (const accountId of Object.keys(qqbot.accounts)) {
-      if (qqbot.accounts[accountId]?.appId) {
-        ids.add(accountId);
-      }
-    }
+});
+
+// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/index.js
+var init_esm = __esm({
+  "node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/index.js"() {
+    "use strict";
+    init_qr_connect();
   }
-  return Array.from(ids);
+});
+
+// src/setup/account-key.ts
+var account_key_exports = {};
+__export(account_key_exports, {
+  resolveAccountKey: () => resolveAccountKey
+});
+function resolveAccountKey(cfg, appId, resolvedId) {
+  if (resolvedId) return resolvedId;
+  for (const id of listQQBotAccountIds(cfg)) {
+    if (resolveQQBotAccount(cfg, id).appId === appId) return id;
+  }
+  if (listQQBotAccountIds(cfg).length === 0) return "default";
+  return appId;
 }
-function resolveDefaultQQBotAccountId(cfg) {
-  const qqbot = cfg.channels?.qqbot;
-  if (qqbot?.appId) {
-    return DEFAULT_ACCOUNT_ID;
+var init_account_key = __esm({
+  "src/setup/account-key.ts"() {
+    "use strict";
+    init_config();
   }
-  if (qqbot?.accounts) {
-    const ids = Object.keys(qqbot.accounts);
-    if (ids.length > 0) {
-      return ids[0];
+});
+
+// src/setup/finalize.ts
+var finalize_exports = {};
+__export(finalize_exports, {
+  applyAccountDefaults: () => applyAccountDefaults,
+  finalizeQQBotSetup: () => finalizeQQBotSetup
+});
+function isConfigured(cfg, accountId) {
+  const account = resolveQQBotAccount(cfg, accountId);
+  return Boolean(account.appId && account.clientSecret);
+}
+async function linkViaQrCode(cfg, _accountId, prompter, rt) {
+  try {
+    const accounts = await m2({ source: "openclaw" });
+    if (accounts.length === 0) {
+      await prompter.note("\u672A\u83B7\u53D6\u5230\u4EFB\u4F55 QQ Bot \u8D26\u53F7\u4FE1\u606F\u3002", "QQ Bot");
+      return cfg;
+    }
+    let next = cfg;
+    for (const { appId, appSecret, userOpenid } of accounts) {
+      const key = resolveAccountKey(cfg, appId);
+      next = applyQQBotAccountConfig(next, key, { appId, clientSecret: appSecret });
+      next = applyAccountDefaults(next, key, userOpenid);
+      rt.log(`\u7ED1\u5B9A\u6210\u529F\uFF01\u8D26\u6237: ${key} (AppID: ${appId})`);
     }
+    return next;
+  } catch (err) {
+    rt.error(`QQ Bot \u7ED1\u5B9A\u5931\u8D25: ${String(err)}`);
+    await prompter.note(`\u7ED1\u5B9A\u5931\u8D25\uFF0C\u60A8\u53EF\u4EE5\u7A0D\u540E\u624B\u52A8\u914D\u7F6E\u3002
+\u6587\u6863: ${formatDocsLink("/channels/qqbot", "qqbot")}`, "QQ Bot");
+    return cfg;
   }
-  return DEFAULT_ACCOUNT_ID;
 }
-function resolveUserAgentSuffix(cfg) {
-  const qqbot = cfg.channels?.qqbot;
-  return qqbot?.userAgentSuffix ? String(qqbot.userAgentSuffix).trim() : "";
-}
-function resolveProcessingTimeoutMs(accountConfig) {
-  if (accountConfig?.processingTimeoutMs !== void 0) {
-    return accountConfig.processingTimeoutMs;
-  }
-  const env = process.env.OPENCLAW_PROCESSING_TIMEOUT_MS;
-  if (env) {
-    const v = Number(env);
-    if (!Number.isNaN(v) && v >= 0) return v;
-  }
-  return DEFAULT_PROCESSING_TIMEOUT_MS;
+async function linkViaManual(cfg, _accountId, prompter) {
+  const appIdInput = await prompter.text({ message: "\u8BF7\u8F93\u5165 QQ Bot AppID", validate: (v) => v.trim() ? void 0 : "AppID \u4E0D\u80FD\u4E3A\u7A7A" });
+  const secret = await prompter.text({ message: "\u8BF7\u8F93\u5165 QQ Bot AppSecret", validate: (v) => v.trim() ? void 0 : "AppSecret \u4E0D\u80FD\u4E3A\u7A7A" });
+  const appId = appIdInput.trim();
+  const key = resolveAccountKey(cfg, appId);
+  let next = applyQQBotAccountConfig(cfg, key, { appId, clientSecret: secret.trim() });
+  next = applyAccountDefaults(next, key);
+  await prompter.note("\u2714 QQ Bot \u914D\u7F6E\u5B8C\u6210\uFF01", "QQ Bot");
+  return next;
 }
-function resolveQQBotAccount(cfg, accountId) {
-  const resolvedAccountId = accountId ?? resolveDefaultQQBotAccountId(cfg);
-  const qqbot = cfg.channels?.qqbot;
-  let accountConfig = {};
-  let appId = "";
-  let clientSecret = "";
-  let secretSource = "none";
-  if (resolvedAccountId === DEFAULT_ACCOUNT_ID) {
-    const { accounts: _accounts, ...topLevelConfig } = qqbot ?? {};
-    accountConfig = {
-      ...topLevelConfig,
-      markdownSupport: qqbot?.markdownSupport ?? true
-    };
-    appId = normalizeAppId(qqbot?.appId);
-  } else {
-    const account = qqbot?.accounts?.[resolvedAccountId];
-    accountConfig = account ?? {};
-    appId = normalizeAppId(account?.appId);
-  }
-  if (accountConfig.clientSecret) {
-    clientSecret = accountConfig.clientSecret;
-    secretSource = "config";
-  } else if (accountConfig.clientSecretFile) {
-    secretSource = "file";
-  } else if (process.env.QQBOT_CLIENT_SECRET && resolvedAccountId === DEFAULT_ACCOUNT_ID) {
-    clientSecret = process.env.QQBOT_CLIENT_SECRET;
-    secretSource = "env";
-  }
-  if (!appId && process.env.QQBOT_APP_ID && resolvedAccountId === DEFAULT_ACCOUNT_ID) {
-    appId = normalizeAppId(process.env.QQBOT_APP_ID);
+async function finalizeQQBotSetup(params) {
+  const accountId = params.accountId.trim() || DEFAULT_ACCOUNT_ID2;
+  const configured = isConfigured(params.cfg, accountId);
+  const mode = await params.prompter.select({
+    message: configured ? "QQ \u5DF2\u7ED1\u5B9A\uFF0C\u9009\u62E9\u64CD\u4F5C" : "\u9009\u62E9 QQ \u7ED1\u5B9A\u65B9\u5F0F",
+    options: [
+      { value: "qr", label: "\u626B\u7801\u7ED1\u5B9A\uFF08\u63A8\u8350\uFF09", hint: "\u4F7F\u7528 QQ \u626B\u63CF\u4E8C\u7EF4\u7801\u81EA\u52A8\u5B8C\u6210\u7ED1\u5B9A" },
+      { value: "manual", label: "\u624B\u52A8\u8F93\u5165 QQ Bot AppID \u548C AppSecret", hint: "\u9700\u5230 QQ \u5F00\u653E\u5E73\u53F0 q.qq.com \u67E5\u770B" },
+      { value: "skip", label: configured ? "\u4FDD\u6301\u5F53\u524D\u914D\u7F6E" : "\u7A0D\u540E\u914D\u7F6E" }
+    ]
+  });
+  let next = params.cfg;
+  if (mode === "qr") {
+    next = await linkViaQrCode(next, accountId, params.prompter, params.runtime);
+  } else if (mode === "manual") {
+    next = await linkViaManual(next, accountId, params.prompter);
+  } else if (!configured) {
+    await params.prompter.note("\u60A8\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C\u4EE5\u4E0B\u547D\u4EE4\u91CD\u65B0\u914D\u7F6E\uFF1A\n  openclaw channels add", "QQ Bot");
   }
-  return {
-    accountId: resolvedAccountId,
-    name: accountConfig.name,
-    enabled: accountConfig.enabled !== false,
-    appId,
-    clientSecret,
-    secretSource,
-    systemPrompt: accountConfig.systemPrompt,
-    markdownSupport: accountConfig.markdownSupport !== false,
-    userAgentSuffix: resolveUserAgentSuffix(cfg),
-    processingTimeoutMs: resolveProcessingTimeoutMs(accountConfig),
-    config: accountConfig
-  };
+  return { cfg: next };
 }
-function applyQQBotAccountConfig(cfg, accountId, input) {
-  const next = { ...cfg };
-  if (accountId === DEFAULT_ACCOUNT_ID) {
-    const existingConfig = next.channels?.qqbot || {};
-    const allowFrom = existingConfig.allowFrom ?? ["*"];
-    next.channels = {
-      ...next.channels,
-      qqbot: {
-        ...next.channels?.qqbot || {},
-        enabled: true,
-        allowFrom,
-        ...input.appId ? { appId: input.appId } : {},
-        ...input.clientSecret ? { clientSecret: input.clientSecret } : input.clientSecretFile ? { clientSecretFile: input.clientSecretFile } : {},
-        ...input.name ? { name: input.name } : {}
-      }
-    };
+function applyAccountDefaults(cfg, accountId, userOpenid) {
+  const next = { ...cfg, channels: { ...cfg.channels } };
+  const qqbot = { ...next.channels?.qqbot ?? {} };
+  const defaults = { streaming: true, dmPolicy: "allowlist" };
+  if (userOpenid) defaults.allowFrom = [userOpenid];
+  if (accountId === DEFAULT_ACCOUNT_ID2) {
+    Object.assign(qqbot, defaults);
   } else {
-    const existingAccountConfig = next.channels?.qqbot?.accounts?.[accountId] || {};
-    const allowFrom = existingAccountConfig.allowFrom ?? ["*"];
-    next.channels = {
-      ...next.channels,
-      qqbot: {
-        ...next.channels?.qqbot || {},
-        enabled: true,
-        accounts: {
-          ...next.channels?.qqbot?.accounts || {},
-          [accountId]: {
-            ...next.channels?.qqbot?.accounts?.[accountId] || {},
-            enabled: true,
-            allowFrom,
-            ...input.appId ? { appId: input.appId } : {},
-            ...input.clientSecret ? { clientSecret: input.clientSecret } : input.clientSecretFile ? { clientSecretFile: input.clientSecretFile } : {},
-            ...input.name ? { name: input.name } : {}
-          }
-        }
-      }
-    };
+    const accounts = { ...qqbot.accounts ?? {} };
+    accounts[accountId] = { ...accounts[accountId] ?? {}, ...defaults };
+    qqbot.accounts = accounts;
   }
+  next.channels = { ...next.channels, qqbot };
   return next;
 }
+var init_finalize = __esm({
+  "src/setup/finalize.ts"() {
+    "use strict";
+    init_setup();
+    init_esm();
+    init_config();
+    init_account_key();
+  }
+});
+
+// index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_ACCOUNT_ID: () => DEFAULT_ACCOUNT_ID,
+  MSG_TYPE_QUOTE: () => MSG_TYPE_QUOTE2,
+  MSG_TYPE_TEXT: () => MSG_TYPE_TEXT,
+  PersistedRefIndexStore: () => PersistedRefIndexStore,
+  QQBotGateway: () => QQBotGateway,
+  StreamContentType: () => StreamContentType2,
+  StreamInputMode: () => StreamInputMode2,
+  StreamInputState: () => StreamInputState2,
+  StreamingController: () => StreamingController,
+  applyQQBotAccountConfig: () => applyQQBotAccountConfig,
+  buildUserAgent: () => buildUserAgent,
+  default: () => index_default,
+  dispatchToOpenClaw: () => dispatchToOpenClaw,
+  flushAllRefIndexStores: () => flushAllRefIndexStores,
+  getBotForAccount: () => getBotForAccount,
+  getPersistedRefIndexStore: () => getPersistedRefIndexStore,
+  getQQBotRuntime: () => getQQBotRuntime,
+  isGroupAllowed: () => isGroupAllowed,
+  listQQBotAccountIds: () => listQQBotAccountIds,
+  parseTarget: () => parseTarget,
+  qqbotOnboardingAdapter: () => qqbotOnboardingAdapter,
+  qqbotPlugin: () => qqbotPlugin,
+  resolveDefaultQQBotAccountId: () => resolveDefaultQQBotAccountId,
+  resolveGroupAllowFrom: () => resolveGroupAllowFrom,
+  resolveGroupConfig: () => resolveGroupConfig,
+  resolveGroupConfigFromAccount: () => resolveGroupConfigFromAccount,
+  resolveGroupName: () => resolveGroupName,
+  resolveGroupPolicy: () => resolveGroupPolicy,
+  resolveGroupPrompt: () => resolveGroupPrompt,
+  resolveHistoryLimit: () => resolveHistoryLimit,
+  resolveIgnoreOtherMentions: () => resolveIgnoreOtherMentions,
+  resolveMentionPatterns: () => resolveMentionPatterns,
+  resolveProcessingTimeoutMs: () => resolveProcessingTimeoutMs,
+  resolveQQBotAccount: () => resolveQQBotAccount,
+  resolveRequireMention: () => resolveRequireMention,
+  resolveToolPolicy: () => resolveToolPolicy,
+  resolveUserAgentSuffix: () => resolveUserAgentSuffix,
+  sendMedia: () => sendMedia,
+  sendText: () => sendText,
+  setQQBotRuntime: () => setQQBotRuntime,
+  shouldUseStreaming: () => shouldUseStreaming,
+  tryGetBotForAccount: () => tryGetBotForAccount
+});
+module.exports = __toCommonJS(index_exports);
+var import_plugin_sdk = require("openclaw/plugin-sdk");
+
+// src/channel.ts
+var import_core = require("openclaw/plugin-sdk/core");
+init_config();
 
 // src/bot-instance.ts
 var import_node_os = __toESM(require("os"), 1);
@@ -5087,11 +5616,11 @@ var import_node_os = __toESM(require("os"), 1);
 // src/outbound/outbound-service.ts
 var path3 = __toESM(require("path"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/QQBot.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/QQBot.js
 var fs3 = __toESM(require("fs"), 1);
 var path = __toESM(require("path"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/types.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/types.js
 function resolvePolicy(ctx, path22, explicit, defaultValue) {
   if (explicit !== void 0 && explicit !== null) {
     return explicit;
@@ -5167,7 +5696,7 @@ function createMiddlewareContext(params) {
   return ctx;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/types.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/types.js
 var ApiError = class extends Error {
   httpStatus;
   path;
@@ -5200,7 +5729,7 @@ var StreamContentType = {
   MARKDOWN: "markdown"
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/format.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/format.js
 function formatErrorMessage(err) {
   if (err instanceof Error) {
     let formatted = err.message || err.name || "Error";
@@ -5247,7 +5776,7 @@ function formatFileSize(bytes) {
   return `${(bytes / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/api-client.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/api-client.js
 var DEFAULT_BASE_URL = "https://api.sgroup.qq.com";
 var DEFAULT_TIMEOUT_MS = 3e4;
 var FILE_UPLOAD_TIMEOUT_MS = 12e4;
@@ -5342,12 +5871,12 @@ var ApiClient = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media-chunked.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media-chunked.js
 var crypto = __toESM(require("crypto"), 1);
 var fs = __toESM(require("fs"), 1);
 var https = __toESM(require("https"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/retry.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/retry.js
 async function withRetry(fn, policy, persistentPolicy, logger) {
   let lastError = null;
   for (let attempt = 0; attempt <= policy.maxRetries; attempt++) {
@@ -5439,7 +5968,7 @@ function buildPartFinishPersistentPolicy(retryTimeoutMs, retryableCodes = PART_F
 var PART_FINISH_RETRYABLE_CODES = /* @__PURE__ */ new Set([40093001]);
 var UPLOAD_PREPARE_FALLBACK_CODE = 40093002;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/routes.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/routes.js
 function messagePath(scope, targetId) {
   return scope === "c2c" ? `/v2/users/${targetId}/messages` : `/v2/groups/${targetId}/messages`;
 }
@@ -5476,7 +6005,7 @@ function getNextMsgSeq(_msgId) {
   return (timePart ^ random) % 65536;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media-chunked.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media-chunked.js
 var UploadDailyLimitExceededError = class extends Error {
   filePath;
   fileSize;
@@ -5738,8 +6267,32 @@ function sleep2(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media.js
 var fs2 = __toESM(require("fs"), 1);
+
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/file-utils.js
+var MAX_UPLOAD_SIZE = 20 * 1024 * 1024;
+var CHUNKED_UPLOAD_MAX_SIZE = 100 * 1024 * 1024;
+var LARGE_FILE_THRESHOLD = 5 * 1024 * 1024;
+var MEDIA_FILE_TYPE_INFO = {
+  [MediaFileType.IMAGE]: { maxSize: 30 * 1024 * 1024, name: "image" },
+  [MediaFileType.VIDEO]: { maxSize: 100 * 1024 * 1024, name: "video" },
+  [MediaFileType.VOICE]: { maxSize: 20 * 1024 * 1024, name: "voice" },
+  [MediaFileType.FILE]: { maxSize: 100 * 1024 * 1024, name: "file" }
+};
+function sanitizeFileName(name) {
+  if (!name) {
+    return "file";
+  }
+  const cleaned = name.replace(/[\\/:*?"<>|]/g, "_").replace(/[\u0000-\u001f\u007f]/g, "").replace(/\s+/g, " ").trim();
+  return cleaned || "file";
+}
+
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/media.js
+var MAX_BASE64_CHECK_SIZE = Math.ceil(MAX_UPLOAD_SIZE * 1.4);
+function formatUploadSize() {
+  return formatFileSize(MAX_UPLOAD_SIZE);
+}
 var MediaApi = class {
   client;
   tokenManager;
@@ -5771,6 +6324,10 @@ var MediaApi = class {
       const buf = await fs2.promises.readFile(opts.localPath);
       fileData = buf.toString("base64");
     }
+    if (fileData && fileData.length > MAX_BASE64_CHECK_SIZE) {
+      const sizeMB = (fileData.length / (1024 * 1024)).toFixed(1);
+      throw new Error(`fileData too large (${sizeMB}MB decoded); QQ Bot single upload limit is ${formatUploadSize()}`);
+    }
     if (fileData && this.cache) {
       const hash = this.cache.computeHash(fileData);
       const cached = this.cache.get(hash, scope, targetId, fileType);
@@ -5819,7 +6376,7 @@ var MediaApi = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/messages.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/messages.js
 var MessageApi = class {
   client;
   tokenManager;
@@ -6007,7 +6564,7 @@ var MessageApi = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/token.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/api/token.js
 var DEFAULT_TOKEN_BASE_URL = "https://bots.qq.com";
 var TOKEN_PATH = "/app/getAppAccessToken";
 var TokenManager = class {
@@ -6194,7 +6751,7 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/codec.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/codec.js
 function decodeGatewayMessageData(data) {
   if (typeof data === "string") {
     return data;
@@ -6221,7 +6778,7 @@ function readOptionalMessageSceneExt(event) {
   return scene?.ext;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/constants.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/constants.js
 var INTENTS = {
   GUILDS: 1 << 0,
   GUILD_MEMBERS: 1 << 1,
@@ -6294,7 +6851,7 @@ var GatewayEvent = {
   MESSAGE_REACTION_REMOVE: "MESSAGE_REACTION_REMOVE"
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/event-dispatcher.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/event-dispatcher.js
 var REF_INDEX_KEY = "msg_idx";
 function parseRefIndices(ext, msgType, msgElements) {
   let refMsgIdx;
@@ -6435,7 +6992,7 @@ function dispatchEvent(eventType, data, _accountId, _log) {
   return { action: "raw", type: eventType, data };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/reconnect.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/reconnect.js
 var ReconnectState = class {
   accountId;
   log;
@@ -6546,7 +7103,7 @@ var ReconnectState = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/gateway-connection.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/gateway/gateway-connection.js
 var GatewayConnection = class {
   isAborted = false;
   currentWs = null;
@@ -6804,7 +7361,7 @@ function previewPayload(data) {
   }
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook-verify.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook-verify.js
 var crypto2 = __toESM(require("crypto"), 1);
 function deriveSeed(botSecret) {
   let seed = botSecret;
@@ -6856,7 +7413,7 @@ function signValidationResponse(params) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook-server-node.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook-server-node.js
 var http = __toESM(require("http"), 1);
 var NodeHttpWebhookServer = class {
   server = null;
@@ -6904,7 +7461,7 @@ var NodeHttpWebhookServer = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/transport/webhook.js
 var OP_DISPATCH = 0;
 var OP_HTTP_CALLBACK_ACK = 12;
 var OP_VALIDATION = 13;
@@ -7048,25 +7605,7 @@ function getHeader(headers, key) {
   return val;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/file-utils.js
-var MAX_UPLOAD_SIZE = 20 * 1024 * 1024;
-var CHUNKED_UPLOAD_MAX_SIZE = 100 * 1024 * 1024;
-var LARGE_FILE_THRESHOLD = 5 * 1024 * 1024;
-var MEDIA_FILE_TYPE_INFO = {
-  [MediaFileType.IMAGE]: { maxSize: 30 * 1024 * 1024, name: "image" },
-  [MediaFileType.VIDEO]: { maxSize: 100 * 1024 * 1024, name: "video" },
-  [MediaFileType.VOICE]: { maxSize: 20 * 1024 * 1024, name: "voice" },
-  [MediaFileType.FILE]: { maxSize: 100 * 1024 * 1024, name: "file" }
-};
-function sanitizeFileName(name) {
-  if (!name) {
-    return "file";
-  }
-  const cleaned = name.replace(/[\\/:*?"<>|]/g, "_").replace(/[\u0000-\u001f\u007f]/g, "").replace(/\s+/g, " ").trim();
-  return cleaned || "file";
-}
-
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/upload-cache.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/upload-cache.js
 var crypto3 = __toESM(require("crypto"), 1);
 var MAX_CACHE_SIZE = 500;
 function computeFileHash(data) {
@@ -7131,7 +7670,7 @@ var UploadCache = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/streaming.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/streaming.js
 var DEFAULT_THROTTLE_MS = 500;
 var MIN_THROTTLE_MS = 300;
 var MAX_FLUSH_RETRIES = 3;
@@ -7299,7 +7838,7 @@ var StreamSession = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/QQBot.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/QQBot.js
 var MsgType = {
   /** Plain text. */
   TEXT: 0,
@@ -7987,7 +8526,7 @@ var QQBot = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/message-filter.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/message-filter.js
 function messageFilter(options = {}) {
   const skipSelfEcho = options.skipSelfEcho ?? true;
   const dedupOpts = options.dedup !== false ? { windowMs: 5e3, maxSize: 1e3, ...options.dedup ?? {} } : null;
@@ -8025,7 +8564,7 @@ function messageFilter(options = {}) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/content-sanitizer.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/content-sanitizer.js
 function contentSanitizer(options = {}) {
   const { stripBotMention = true, stripAllMentions = false, collapseWhitespace = false, parseFaceTags: parseFaceTags2 = false, transform } = options;
   return async (ctx, next) => {
@@ -8120,7 +8659,7 @@ function faceToEmoji(id) {
   return map[id];
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/rate-limiter.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/rate-limiter.js
 var SlidingWindow = class {
   buckets = /* @__PURE__ */ new Map();
   max;
@@ -8174,7 +8713,7 @@ function rateLimiter(options = {}) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/concurrency-guard.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/concurrency-guard.js
 function concurrencyGuard(options = {}) {
   const strategy = options.strategy ?? "queue";
   const maxQueue = options.maxQueue ?? 3;
@@ -8409,7 +8948,7 @@ function concurrencyGuard(options = {}) {
   return guard;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/mention-gate.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/mention-gate.js
 function detectMentionInContent(content, appId) {
   if (!content || !appId)
     return false;
@@ -8465,7 +9004,7 @@ function mentionGate(options = {}) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/quote-ref.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/quote-ref.js
 var MemoryRefIndexStore = class {
   map = /* @__PURE__ */ new Map();
   maxSize;
@@ -8583,7 +9122,7 @@ function buildText(content, attachments) {
   return parts.join("\n") || "[empty message]";
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/envelope-formatter.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/envelope-formatter.js
 function envelopeFormatter(options = {}) {
   const { historyLimit = 5, includeQuote = true, includeSender = true, format } = options;
   return async (ctx, next) => {
@@ -8655,7 +9194,7 @@ ${parts.join("\n")}
   return sections.join("\n\n");
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/slash-command.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/slash-command.js
 function slashCommand(options = {}) {
   const prefixes = options.prefixes ?? ["/"];
   const catchErrors = options.catchErrors ?? true;
@@ -8718,8 +9257,9 @@ function slashCommand(options = {}) {
     }
     const cleaned = content.replace(/<@!?[^>]+>\s*/g, "").trim();
     if (ctx.message.kind === "group") {
-      const mentions = ctx.message.mentions;
-      if (!mentions?.some((m3) => m3.is_you)) {
+      const msg = ctx.message;
+      const wasMentioned = msg.rawEventType === "GROUP_AT_MESSAGE_CREATE" || msg.mentions?.some((m3) => m3.is_you);
+      if (!wasMentioned) {
         await next();
         return;
       }
@@ -8807,7 +9347,7 @@ async function sendCommandResult(ctx, result) {
   }
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/history-buffer.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/history-buffer.js
 var MemoryHistoryStore = class {
   buffers = /* @__PURE__ */ new Map();
   append(groupKey, entry, limit) {
@@ -8872,7 +9412,7 @@ function historyBuffer(options = {}) {
   return m3;
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/typing-indicator.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/typing-indicator.js
 var DEFAULT_DURATION_SEC = 60;
 var DEFAULT_KEEPALIVE_INTERVAL_MS = 5e4;
 function typingIndicator(options = {}) {
@@ -8909,7 +9449,7 @@ function typingIndicator(options = {}) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/error-handler.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/middleware/error-handler.js
 var DEFAULT_FORMAT = (err) => {
   if (err instanceof ApiError) {
     if (err.bizMessage)
@@ -8947,7 +9487,7 @@ function errorHandler(options = {}) {
   };
 }
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/storage/kv-store.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/storage/kv-store.js
 var import_node_fs = __toESM(require("fs"), 1);
 var import_node_path = __toESM(require("path"), 1);
 var FileKVStore = class {
@@ -9057,7 +9597,7 @@ var FileKVStore = class {
   }
 };
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/storage/session-adapter.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/storage/session-adapter.js
 function kvSessionPersistence(opts) {
   const prefix = opts.prefix ?? "qqbot:session:";
   const key = `${prefix}${opts.accountId}`;
@@ -9284,7 +9824,7 @@ var import_node_path2 = __toESM(require("path"), 1);
 var import_node_fs2 = __toESM(require("fs"), 1);
 var _cachedOpenclawVersion;
 function getPackageVersion() {
-  return true ? "2.0.0-dev.202607101321" : "unknown";
+  return true ? "2.0.0-dev.202607101939" : "unknown";
 }
 function getOpenclawVersion(runtimeVersion) {
   if (_cachedOpenclawVersion) return _cachedOpenclawVersion;
@@ -9615,856 +10155,485 @@ var PersistedRefIndexStore = class {
       import_node_fs3.default.renameSync(tmpPath, this.filePath);
       this.diskLineCount = lines.length;
     } catch (err) {
-      log.error(
-        `compactSync failed: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-  }
-  // ── 诊断 ──
-  /** 当前内存中的条目数 */
-  get size() {
-    return this.memory.size;
-  }
-  /** 是否已完成初始化（磁盘回放） */
-  get isInitialized() {
-    return this.initialized;
-  }
-  /** 诊断快照 */
-  stats() {
-    return {
-      memoryEntries: this.memory.size,
-      diskLines: this.diskLineCount,
-      maxEntries: this.maxEntries,
-      filePath: this.filePath
-    };
-  }
-  /**
-   * 强制将当前内存状态持久化到磁盘（进程退出前调用）
-   */
-  flush() {
-    this.compactSync();
-  }
-};
-var stores = /* @__PURE__ */ new Map();
-function getPersistedRefIndexStore(accountId) {
-  let store = stores.get(accountId);
-  if (!store) {
-    const filePath = import_node_path3.default.join(getQQBotDataDir("data", accountId), DEFAULT_FILENAME);
-    store = new PersistedRefIndexStore({ filePath });
-    stores.set(accountId, store);
-  }
-  return store;
-}
-function flushAllRefIndexStores() {
-  for (const store of stores.values()) {
-    store.flush();
-  }
-}
-
-// src/runtime.ts
-var runtime = null;
-var exitHooksInstalled = false;
-function setQQBotRuntime(next) {
-  runtime = next;
-  const version = getOpenclawVersion(next.version);
-  setOpenClawVersion(version);
-  installExitHooksOnce();
-}
-function installExitHooksOnce() {
-  if (exitHooksInstalled) return;
-  exitHooksInstalled = true;
-  const flush = () => {
-    try {
-      flushAllRefIndexStores();
-    } catch {
-    }
-  };
-  process.on("beforeExit", flush);
-  process.on("SIGINT", () => {
-    flush();
-    process.exit(0);
-  });
-  process.on("SIGTERM", () => {
-    flush();
-    process.exit(0);
-  });
-}
-function getQQBotRuntime() {
-  if (!runtime) throw new Error("QQBot runtime not initialized");
-  return runtime;
-}
-function tryGetQQBotRuntime() {
-  return runtime;
-}
-
-// src/adapter/resolve.ts
-function probeFunction(rt, paths) {
-  for (const path22 of paths) {
-    let target = rt;
-    let parent = rt;
-    for (let i = 0; i < path22.length; i++) {
-      parent = target;
-      target = target?.[path22[i]];
-      if (target === void 0 || target === null) break;
-    }
-    if (typeof target === "function") {
-      return target.bind(parent);
-    }
-  }
-  return null;
-}
-function resolveRuntimeAdapters(rt, log4) {
-  const version = rt.version ?? "unknown";
-  const inboundRun = probeFunction(rt, [
-    ["channel", "inbound", "run"],
-    // current (2026-05+)
-    ["channel", "turn", "run"]
-    // legacy (removed 2026-05-27)
-  ]);
-  const dispatchReply = probeFunction(rt, [
-    ["channel", "reply", "dispatchReplyWithBufferedBlockDispatcher"]
-  ]);
-  const resolveAgentRoute = probeFunction(rt, [
-    ["channel", "routing", "resolveAgentRoute"]
-  ]);
-  const rawBuildContext = probeFunction(rt, [
-    ["channel", "inbound", "buildContext"]
-  ]);
-  const rawFinalizeContext = !rawBuildContext ? probeFunction(rt, [["channel", "reply", "finalizeInboundContext"]]) : null;
-  const buildInboundContext = rawBuildContext ? (params) => rawBuildContext(params) : rawFinalizeContext ? (params) => {
-    const isCommand = params.access?.commands?.authorized ?? false;
-    const rawCtx = {
-      Body: params.message.body,
-      BodyForAgent: params.message.bodyForAgent,
-      RawBody: params.message.rawBody,
-      CommandBody: params.message.commandBody ?? params.message.rawBody,
-      CommandSource: isCommand ? "text" : void 0,
-      CommandTurn: params.command ?? void 0,
-      CommandAuthorized: isCommand,
-      From: params.from,
-      To: params.reply.to,
-      SessionKey: params.route.routeSessionKey,
-      AccountId: params.route.accountId ?? params.accountId,
-      ChatType: params.conversation.kind,
-      GroupSystemPrompt: params.conversation.label,
-      SenderId: params.sender.id,
-      SenderName: params.sender.name,
-      Provider: params.provider ?? params.channel,
-      Surface: params.surface ?? params.channel,
-      MessageSid: params.messageId,
-      Timestamp: params.timestamp ?? Date.now(),
-      OriginatingChannel: params.channel,
-      OriginatingTo: params.reply.originatingTo ?? params.reply.to,
-      ...params.extra
-    };
-    return rawFinalizeContext(rawCtx);
-  } : null;
-  const resolveStorePath = probeFunction(rt, [
-    ["channel", "session", "resolveStorePath"]
-  ]);
-  const recordInboundSession = probeFunction(rt, [
-    ["channel", "session", "recordInboundSession"]
-  ]);
-  const formatEnvelope = probeFunction(rt, [
-    ["channel", "reply", "formatAgentEnvelope"],
-    // current (2026-06+)
-    ["channel", "reply", "formatInboundEnvelope"]
-    // deprecated，低版本兼容
-  ]);
-  const resolveEnvelopeFormatOptions = probeFunction(rt, [
-    ["channel", "reply", "resolveEnvelopeFormatOptions"]
-  ]);
-  const chunkMarkdownText = probeFunction(rt, [
-    ["channel", "text", "chunkMarkdownText"]
-  ]);
-  const saveRemoteMedia = probeFunction(rt, [
-    ["channel", "media", "saveRemoteMedia"]
-  ]);
-  const getConfig = probeFunction(rt, [
-    ["config", "current"]
-  ]) ?? probeFunction(rt, [
-    ["getConfig"]
-  ]) ?? probeFunction(rt, [
-    ["config", "loadConfig"]
-  ]);
-  const rawMutateConfig = probeFunction(rt, [["config", "mutateConfigFile"]]);
-  const rawWriteConfig = probeFunction(rt, [["config", "writeConfigFile"]]);
-  const persistConfig = rawMutateConfig ? async (mutator) => {
-    await rawMutateConfig({
-      afterWrite: "hot-reload",
-      mutate: mutator
-    });
-  } : rawWriteConfig && getConfig ? async (mutator) => {
-    const current = JSON.parse(JSON.stringify(getConfig()));
-    mutator(current);
-    await rawWriteConfig(current);
-  } : null;
-  const resolved = [
-    inboundRun && "inboundRun",
-    dispatchReply && "dispatchReply",
-    resolveAgentRoute && "resolveAgentRoute",
-    buildInboundContext && "buildInboundContext",
-    resolveStorePath && "resolveStorePath",
-    recordInboundSession && "recordInboundSession",
-    formatEnvelope && "formatEnvelope",
-    chunkMarkdownText && "chunkMarkdownText",
-    saveRemoteMedia && "saveRemoteMedia",
-    getConfig && "getConfig",
-    persistConfig && `persistConfig(${rawMutateConfig ? "mutate" : "write"})`
-  ].filter(Boolean);
-  log4?.info(
-    `[qqbot:adapter] openclaw=${version} resolved ${resolved.length} adapters: ${resolved.join(", ")}`
-  );
-  return {
-    inboundRun,
-    dispatchReply,
-    resolveAgentRoute,
-    buildInboundContext,
-    resolveStorePath,
-    recordInboundSession,
-    formatEnvelope,
-    resolveEnvelopeFormatOptions,
-    chunkMarkdownText,
-    saveRemoteMedia,
-    getConfig,
-    persistConfig,
-    version
-  };
-}
-var _cachedAdapters = null;
-var _cachedRuntimeRef = null;
-function getAdapters(rt, log4) {
-  const cached = _cachedRuntimeRef?.deref();
-  if (cached === rt && _cachedAdapters) {
-    return _cachedAdapters;
-  }
-  _cachedAdapters = resolveRuntimeAdapters(rt, log4);
-  _cachedRuntimeRef = new WeakRef(rt);
-  return _cachedAdapters;
-}
-
-// src/outbound/media-send.ts
-var path8 = __toESM(require("path"), 1);
-var fs9 = __toESM(require("fs"), 1);
-var os4 = __toESM(require("os"), 1);
-
-// src/adapter/workspace.ts
-var import_node_module = require("module");
-var req = (0, import_node_module.createRequire)(__filename);
-var health = null;
-function resolveAgentWorkspace(cfg, agentId) {
-  if (!health) {
-    try {
-      health = req("openclaw/plugin-sdk/health");
-    } catch {
-      health = null;
-    }
-  }
-  if (health) {
-    return health.resolveAgentWorkspaceDir(cfg, agentId ?? health.resolveDefaultAgentId(cfg));
-  }
-  return getQQBotMediaDir();
-}
-
-// src/utils/ssrf-guard.ts
-var import_node_net = __toESM(require("net"), 1);
-var import_promises = __toESM(require("dns/promises"), 1);
-var RESERVED_V4_PREFIXES = [
-  "127.",
-  // loopback
-  "10.",
-  // class-A private
-  "192.168.",
-  // class-C private
-  "169.254."
-  // link-local / cloud metadata
-];
-var PRIVATE_172_RE = /^172\.(1[6-9]|2\d|3[01])\./;
-function isReservedAddr(ip) {
-  if (ip === "0.0.0.0") return true;
-  for (const pfx of RESERVED_V4_PREFIXES) {
-    if (ip.startsWith(pfx)) return true;
-  }
-  if (PRIVATE_172_RE.test(ip)) return true;
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  if (lower.startsWith("fe80:")) return true;
-  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
-  return false;
-}
-var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
-var QQ_TRUSTED_DOMAINS = /* @__PURE__ */ new Set([
-  // QQ Bot API
-  "api.sgroup.qq.com",
-  "sandbox.api.sgroup.qq.com",
-  // QQ Bot Token
-  "bots.qq.com",
-  // QQ 多媒体上传/下载
-  "multimedia.nt.qq.com.cn",
-  "multimedia.nt.qq.com",
-  // QQ 群文件
-  "grouppro.grouppro.qq.com"
-]);
-function isQQTrustedDomain(hostname) {
-  if (QQ_TRUSTED_DOMAINS.has(hostname)) return true;
-  const dot = hostname.indexOf(".");
-  if (dot > 0) {
-    const parent = hostname.slice(dot + 1);
-    return QQ_TRUSTED_DOMAINS.has(parent);
-  }
-  return false;
-}
-async function validateRemoteUrl(raw) {
-  const url = new URL(raw);
-  if (!ALLOWED_SCHEMES.has(url.protocol)) {
-    throw new Error(
-      `\u4E0D\u652F\u6301\u7684\u534F\u8BAE "${url.protocol}"\uFF0C\u4EC5\u5141\u8BB8 http/https\uFF08URL: ${raw}\uFF09`
-    );
-  }
-  const host = url.hostname.replace(/^\[|\]$/g, "");
-  if (isQQTrustedDomain(host)) return;
-  if (import_node_net.default.isIP(host)) {
-    assertPublicAddr(host, raw);
-    return;
-  }
-  try {
-    const ips = await import_promises.default.resolve(host);
-    for (const ip of ips) {
-      assertPublicAddr(ip, raw, host);
-    }
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("\u5185\u7F51")) throw err;
-    console.warn(`[url-check] DNS \u89E3\u6790 "${host}" \u5931\u8D25: ${err}`);
-  }
-}
-function assertPublicAddr(ip, originalUrl, domain) {
-  if (!isReservedAddr(ip)) return;
-  const target = domain ? `\u57DF\u540D "${domain}" \u89E3\u6790\u5230\u5185\u7F51\u5730\u5740 "${ip}"` : `\u5185\u7F51\u5730\u5740 "${ip}"`;
-  throw new Error(
-    `\u7981\u6B62\u8BBF\u95EE${target}\uFF0C\u5DF2\u62E6\u622A\u6F5C\u5728\u7684 SSRF \u8BF7\u6C42\uFF08URL: ${originalUrl}\uFF09`
-  );
-}
-
-// src/outbound/local-file-router.ts
-var path7 = __toESM(require("path"), 1);
-var fs8 = __toESM(require("fs"), 1);
-var os3 = __toESM(require("os"), 1);
-function normalizePath(p2) {
-  let result = p2;
-  if (result.startsWith("file://")) {
-    result = result.slice("file://".length);
-    if (/^\/[a-zA-Z]:[\\/]/.test(result)) {
-      result = result.slice(1);
-    }
-  }
-  try {
-    result = decodeURIComponent(result);
-  } catch {
-  }
-  if (result === "~" || result.startsWith("~/") || result.startsWith("~\\")) {
-    result = result.replace(/^~/, os3.homedir());
-  }
-  return result;
-}
-function isLocalFilePath(source) {
-  if (!source) return false;
-  if (source.startsWith("http://") || source.startsWith("https://")) return false;
-  if (source.startsWith("data:")) return false;
-  if (source.startsWith("file://")) return true;
-  if (source === "~" || source.startsWith("~/") || source.startsWith("~\\")) return true;
-  if (source.startsWith("/")) return true;
-  if (/^[a-zA-Z]:[\\/]/.test(source)) return true;
-  if (source.startsWith("\\\\")) return true;
-  if (source.startsWith("./") || source.startsWith("../")) return true;
-  if (source.startsWith(".\\") || source.startsWith("..\\")) return true;
-  return false;
-}
-function isDataUrl(source) {
-  return source.startsWith("data:");
-}
-var IMAGE_EXTS = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".svg", ".ico"]);
-var VOICE_EXTS = /* @__PURE__ */ new Set([".wav", ".mp3", ".silk", ".amr", ".ogg", ".flac", ".aac", ".m4a"]);
-var VIDEO_EXTS = /* @__PURE__ */ new Set([".mp4", ".avi", ".mov", ".mkv", ".webm", ".flv", ".wmv"]);
-function inferMediaKind(filePath) {
-  const ext = path7.extname(filePath).toLowerCase();
-  if (IMAGE_EXTS.has(ext)) return "image";
-  if (VOICE_EXTS.has(ext)) return "voice";
-  if (VIDEO_EXTS.has(ext)) return "video";
-  return "file";
-}
-function inferMediaKindFromMime(mime) {
-  const lower = mime.toLowerCase();
-  if (lower.startsWith("image/")) return "image";
-  if (lower.startsWith("audio/") || lower === "voice") return "voice";
-  if (lower.startsWith("video/")) return "video";
-  return "file";
-}
-function isPathInAllowedRoots(absPath, allowedRoots) {
-  if (!allowedRoots.length) return false;
-  try {
-    const real = fs8.realpathSync(absPath);
-    return allowedRoots.some((root) => {
-      try {
-        const rootReal = fs8.existsSync(root) ? fs8.realpathSync(root) : root;
-        return real.startsWith(rootReal + path7.sep) || real === rootReal;
-      } catch {
-        return false;
-      }
-    });
-  } catch {
-    return false;
-  }
-}
-
-// src/outbound/media-send.ts
-function resolveTempRoots() {
-  const roots = /* @__PURE__ */ new Set();
-  try {
-    const tmp = os4.tmpdir();
-    roots.add(fs9.existsSync(tmp) ? fs9.realpathSync(tmp) : tmp);
-  } catch {
-  }
-  if (process.platform !== "win32") {
-    try {
-      roots.add(fs9.realpathSync("/tmp"));
-    } catch {
-    }
-  }
-  return [...roots];
-}
-var ALLOWED_MEDIA_ROOTS = [
-  path8.join(os4.homedir(), ".openclaw", "media"),
-  path8.join(os4.homedir(), ".openclaw", "workspace"),
-  // 框架 outbound 目录（saveMediaBuffer 写入）
-  path8.join(os4.homedir(), ".openclaw", "outbound"),
-  // TTS 语音临时目录（deliver-pipeline 已通过 isTtsPathSafe 预检）
-  ...resolveTempRoots()
-];
-var MAX_DATA_URL_BYTES = 10 * 1024 * 1024;
-async function sendMedia2(params) {
-  const { source, accountId, log: log4 } = params;
-  const mlog = log4?.child("media");
-  if (!source) {
-    mlog?.error("source is empty");
-    return { error: "sendMedia: source is required" };
-  }
-  const wsDir = resolveWorkspaceFromAgent(params.agentId);
-  mlog?.debug(`resolveMediaPath source=${source} agentId=${params.agentId ?? "none"} workspaceDir=${wsDir ?? "none"}`);
-  const resolved = await resolveMediaPath(source, mlog, wsDir);
-  if (!resolved.ok) {
-    mlog?.error(`resolveMediaPath failed: ${resolved.error}`);
-    return { error: resolved.error };
-  }
-  const kind = params.mediaKind ?? (params.mimeType ? inferMediaKindFromMime(params.mimeType) : void 0) ?? inferMediaKind(resolved.path);
-  const gw = getGateway(accountId);
-  if (!gw) {
-    return { error: `Bot "${accountId}" not running` };
-  }
-  const target = parseTarget(params.to);
-  switch (kind) {
-    case "voice":
-      return sendVoiceMedia(gw, target, resolved.path, params);
-    case "video":
-      return sendVideoMedia(gw, target, resolved.path, params);
-    case "file":
-      return sendFileMedia(gw, target, resolved.path, params);
-    case "image":
-    default:
-      return sendImageMedia(gw, target, resolved.path, params);
-  }
-}
-async function resolveMediaPath(source, log4, workspaceDir) {
-  const normalized = normalizePath(source);
-  if (isDataUrl(normalized)) {
-    if (normalized.length > MAX_DATA_URL_BYTES) {
-      const sizeMB = (normalized.length / (1024 * 1024)).toFixed(1);
-      return { ok: false, error: `Data URL \u8FC7\u5927\uFF08${sizeMB}MB\uFF0C\u6700\u5927 10MB\uFF09` };
-    }
-    return { ok: true, path: normalized, isLocal: false };
-  }
-  if (normalized.startsWith("http://") || normalized.startsWith("https://")) {
-    try {
-      await validateRemoteUrl(normalized);
-    } catch (err) {
-      log4?.warn(`SSRF blocked for media URL: ${normalized}`);
-      return { ok: false, error: `\u5A92\u4F53 URL \u88AB SSRF \u9632\u62A4\u62E6\u622A: ${err instanceof Error ? err.message : String(err)}` };
+      log.error(
+        `compactSync failed: ${err instanceof Error ? err.message : String(err)}`
+      );
     }
-    return { ok: true, path: normalized, isLocal: false };
   }
-  if (!isLocalFilePath(normalized)) {
-    const resolved2 = resolveWorkingFile(normalized, workspaceDir);
-    if (resolved2) {
-      return { ok: true, path: resolved2, isLocal: true };
-    }
-    return { ok: true, path: normalized, isLocal: false };
+  // ── 诊断 ──
+  /** 当前内存中的条目数 */
+  get size() {
+    return this.memory.size;
   }
-  const resolved = path8.resolve(normalized);
-  if (!fs9.existsSync(resolved)) {
-    return { ok: false, error: `File not found: ${resolved}` };
+  /** 是否已完成初始化（磁盘回放） */
+  get isInitialized() {
+    return this.initialized;
   }
-  let real;
-  try {
-    real = fs9.realpathSync(resolved);
-  } catch {
-    return { ok: false, error: `Cannot resolve path: ${resolved}` };
+  /** 诊断快照 */
+  stats() {
+    return {
+      memoryEntries: this.memory.size,
+      diskLines: this.diskLineCount,
+      maxEntries: this.maxEntries,
+      filePath: this.filePath
+    };
   }
-  const allowed = isPathInAllowedRoots(real, ALLOWED_MEDIA_ROOTS);
-  if (!allowed) {
-    log4?.warn(`path blocked \u2014 not in allowed directory: ${real}`);
-    return { ok: false, error: `\u6587\u4EF6\u8DEF\u5F84\u4E0D\u5728\u5141\u8BB8\u7684\u76EE\u5F55\u4E2D` };
+  /**
+   * 强制将当前内存状态持久化到磁盘（进程退出前调用）
+   */
+  flush() {
+    this.compactSync();
   }
-  return { ok: true, path: real, isLocal: true };
-}
-function resolveWorkspaceFromAgent(agentId) {
-  const cfg = resolveConfigViaAdapter();
-  if (!cfg) return void 0;
-  return resolveAgentWorkspace(cfg, agentId);
-}
-function resolveConfigViaAdapter() {
-  try {
-    const rt = tryGetQQBotRuntime();
-    if (!rt) return void 0;
-    return getAdapters(rt).getConfig?.();
-  } catch {
-    return void 0;
+};
+var stores = /* @__PURE__ */ new Map();
+function getPersistedRefIndexStore(accountId) {
+  let store = stores.get(accountId);
+  if (!store) {
+    const filePath = import_node_path3.default.join(getQQBotDataDir("data", accountId), DEFAULT_FILENAME);
+    store = new PersistedRefIndexStore({ filePath });
+    stores.set(accountId, store);
   }
+  return store;
 }
-function resolveWorkingFile(name, workspaceDir) {
-  for (const p2 of [path8.resolve(name), workspaceDir ? path8.join(workspaceDir, name) : null]) {
-    if (p2 && fs9.existsSync(p2)) return p2;
+function flushAllRefIndexStores() {
+  for (const store of stores.values()) {
+    store.flush();
   }
-  return null;
 }
-async function sendImageMedia(gw, target, source, params) {
-  try {
-    const result = await gw.sendMedia(target, source, {
-      text: params.text,
-      msgId: params.replyToId
-    });
-    return { messageId: result.id };
-  } catch (err) {
-    return { error: formatErr(err) };
-  }
+
+// src/runtime.ts
+var runtime = null;
+var exitHooksInstalled = false;
+function setQQBotRuntime(next) {
+  runtime = next;
+  const version = getOpenclawVersion(next.version);
+  setOpenClawVersion(version);
+  installExitHooksOnce();
 }
-async function sendVoiceMedia(gw, target, source, params) {
-  const voiceSource = resolveVoiceSource2(source);
-  try {
-    const result = await gw.sendVoice(target, voiceSource, {
-      msgId: params.replyToId
-    });
-    return { messageId: result.id };
-  } catch (err) {
-    params.log?.child("media")?.warn(`sendVoice failed (${formatErr(err)}), falling back to sendFile`);
+function installExitHooksOnce() {
+  if (exitHooksInstalled) return;
+  exitHooksInstalled = true;
+  const flush = () => {
     try {
-      const fileName = path8.basename(source);
-      const fallback = await gw.sendFile(target, source, {
-        text: params.text,
-        msgId: params.replyToId,
-        fileName
-      });
-      return { messageId: fallback.id, fallback: true };
-    } catch (fallbackErr) {
-      return { error: `voice: ${formatErr(err)} | fallback file: ${formatErr(fallbackErr)}` };
+      flushAllRefIndexStores();
+    } catch {
+    }
+  };
+  process.on("beforeExit", flush);
+  process.on("SIGINT", () => {
+    flush();
+    process.exit(0);
+  });
+  process.on("SIGTERM", () => {
+    flush();
+    process.exit(0);
+  });
+}
+function getQQBotRuntime() {
+  if (!runtime) throw new Error("QQBot runtime not initialized");
+  return runtime;
+}
+function tryGetQQBotRuntime() {
+  return runtime;
+}
+
+// src/channel.ts
+init_resolve();
+
+// src/outbound/media-send.ts
+var path8 = __toESM(require("path"), 1);
+var fs9 = __toESM(require("fs"), 1);
+var os4 = __toESM(require("os"), 1);
+
+// src/adapter/workspace.ts
+var import_node_module = require("module");
+var req = (0, import_node_module.createRequire)(__filename);
+var health = null;
+function resolveAgentWorkspace(cfg, agentId) {
+  if (!health) {
+    try {
+      health = req("openclaw/plugin-sdk/health");
+    } catch {
+      health = null;
     }
   }
+  if (health) {
+    return health.resolveAgentWorkspaceDir(cfg, agentId ?? health.resolveDefaultAgentId(cfg));
+  }
+  return getQQBotMediaDir();
 }
-async function sendVideoMedia(gw, target, source, params) {
-  try {
-    const result = await gw.sendVideo(target, source, {
-      text: params.text,
-      msgId: params.replyToId
-    });
-    return { messageId: result.id };
-  } catch (err) {
-    return { error: formatErr(err) };
+
+// src/outbound/media-send.ts
+init_resolve();
+
+// src/utils/ssrf-guard.ts
+var import_node_net = __toESM(require("net"), 1);
+var import_promises = __toESM(require("dns/promises"), 1);
+var RESERVED_V4_PREFIXES = [
+  "127.",
+  // loopback
+  "10.",
+  // class-A private
+  "192.168.",
+  // class-C private
+  "169.254."
+  // link-local / cloud metadata
+];
+var PRIVATE_172_RE = /^172\.(1[6-9]|2\d|3[01])\./;
+function isReservedAddr(ip) {
+  if (ip === "0.0.0.0") return true;
+  for (const pfx of RESERVED_V4_PREFIXES) {
+    if (ip.startsWith(pfx)) return true;
   }
+  if (PRIVATE_172_RE.test(ip)) return true;
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fe80:")) return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  return false;
 }
-async function sendFileMedia(gw, target, source, params) {
-  try {
-    const fileName = path8.basename(source);
-    const result = await gw.sendFile(target, source, {
-      text: params.text,
-      msgId: params.replyToId,
-      fileName
-    });
-    return { messageId: result.id };
-  } catch (err) {
-    return { error: formatErr(err) };
+var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var QQ_TRUSTED_DOMAINS = /* @__PURE__ */ new Set([
+  // QQ Bot API
+  "api.sgroup.qq.com",
+  "sandbox.api.sgroup.qq.com",
+  // QQ Bot Token
+  "bots.qq.com",
+  // QQ 多媒体上传/下载
+  "multimedia.nt.qq.com.cn",
+  "multimedia.nt.qq.com",
+  // QQ 群文件
+  "grouppro.grouppro.qq.com"
+]);
+function isQQTrustedDomain(hostname) {
+  if (QQ_TRUSTED_DOMAINS.has(hostname)) return true;
+  const dot = hostname.indexOf(".");
+  if (dot > 0) {
+    const parent = hostname.slice(dot + 1);
+    return QQ_TRUSTED_DOMAINS.has(parent);
   }
+  return false;
 }
-function resolveVoiceSource2(source) {
-  if (source.startsWith("http://") || source.startsWith("https://")) {
-    return { url: source };
+async function validateRemoteUrl(raw) {
+  const url = new URL(raw);
+  if (!ALLOWED_SCHEMES.has(url.protocol)) {
+    throw new Error(
+      `\u4E0D\u652F\u6301\u7684\u534F\u8BAE "${url.protocol}"\uFF0C\u4EC5\u5141\u8BB8 http/https\uFF08URL: ${raw}\uFF09`
+    );
   }
-  if (source.startsWith("data:") || !source.startsWith("/") && !source.startsWith("./") && !source.startsWith("../") && !source.startsWith("~")) {
-    const commaIdx = source.indexOf(",");
-    return { base64: commaIdx > 0 ? source.slice(commaIdx + 1) : source };
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  if (isQQTrustedDomain(host)) return;
+  if (import_node_net.default.isIP(host)) {
+    assertPublicAddr(host, raw);
+    return;
+  }
+  try {
+    const ips = await import_promises.default.resolve(host);
+    for (const ip of ips) {
+      assertPublicAddr(ip, raw, host);
+    }
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("\u5185\u7F51")) throw err;
+    console.warn(`[url-check] DNS \u89E3\u6790 "${host}" \u5931\u8D25: ${err}`);
   }
-  return { localPath: source };
 }
-function formatErr(err) {
-  if (err instanceof Error) return err.message;
-  return String(err);
+function assertPublicAddr(ip, originalUrl, domain) {
+  if (!isReservedAddr(ip)) return;
+  const target = domain ? `\u57DF\u540D "${domain}" \u89E3\u6790\u5230\u5185\u7F51\u5730\u5740 "${ip}"` : `\u5185\u7F51\u5730\u5740 "${ip}"`;
+  throw new Error(
+    `\u7981\u6B62\u8BBF\u95EE${target}\uFF0C\u5DF2\u62E6\u622A\u6F5C\u5728\u7684 SSRF \u8BF7\u6C42\uFF08URL: ${originalUrl}\uFF09`
+  );
 }
 
-// src/adapter/setup.ts
-var import_node_module2 = require("module");
-var req2 = (0, import_node_module2.createRequire)(__filename);
-var _setup;
-var _tools;
-function loadSetup() {
-  if (_setup !== void 0) return _setup;
-  try {
-    _setup = req2("openclaw/plugin-sdk/setup");
-  } catch {
-    _setup = null;
+// src/outbound/local-file-router.ts
+var path7 = __toESM(require("path"), 1);
+var fs8 = __toESM(require("fs"), 1);
+var os3 = __toESM(require("os"), 1);
+function normalizePath(p2) {
+  let result = p2;
+  if (result.startsWith("file://")) {
+    result = result.slice("file://".length);
+    if (/^\/[a-zA-Z]:[\\/]/.test(result)) {
+      result = result.slice(1);
+    }
   }
-  return _setup;
-}
-function loadTools() {
-  if (_tools !== void 0) return _tools;
   try {
-    _tools = req2("openclaw/plugin-sdk/setup-tools");
+    result = decodeURIComponent(result);
   } catch {
-    _tools = null;
   }
-  return _tools;
-}
-var DEFAULT_ACCOUNT_ID2 = "default";
-function createStandardChannelSetupStatus(...args) {
-  const mod = loadSetup();
-  if (mod) return mod.createStandardChannelSetupStatus(...args);
-  return {
-    channelLabel: args[0]?.channelLabel ?? "QQ Bot",
-    configuredLabel: "Configured",
-    unconfiguredLabel: "Not configured",
-    resolveConfigured: () => false
-  };
-}
-function setSetupChannelEnabled(...args) {
-  loadSetup()?.setSetupChannelEnabled?.(...args);
+  if (result === "~" || result.startsWith("~/") || result.startsWith("~\\")) {
+    result = result.replace(/^~/, os3.homedir());
+  }
+  return result;
 }
-function formatDocsLink(...args) {
-  const mod = loadTools();
-  if (mod) return mod.formatDocsLink(...args);
-  return args[1] ? `${args[1]}: ${args[0]}` : args[0];
+function isLocalFilePath(source) {
+  if (!source) return false;
+  if (source.startsWith("http://") || source.startsWith("https://")) return false;
+  if (source.startsWith("data:")) return false;
+  if (source.startsWith("file://")) return true;
+  if (source === "~" || source.startsWith("~/") || source.startsWith("~\\")) return true;
+  if (source.startsWith("/")) return true;
+  if (/^[a-zA-Z]:[\\/]/.test(source)) return true;
+  if (source.startsWith("\\\\")) return true;
+  if (source.startsWith("./") || source.startsWith("../")) return true;
+  if (source.startsWith(".\\") || source.startsWith("..\\")) return true;
+  return false;
 }
-
-// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qr-connect.js
-var import_qrcode_terminal = __toESM(require_main(), 1);
-
-// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qqbot-session.js
-var import_node_crypto = __toESM(require("crypto"), 1);
-var import_node_https = __toESM(require("https"), 1);
-var E = { production: "q.qq.com", test: "test.q.qq.com" };
-function d(t = "production") {
-  return E[t];
+function isDataUrl(source) {
+  return source.startsWith("data:");
 }
-function l() {
-  return import_node_crypto.default.randomBytes(32).toString("base64");
+var IMAGE_EXTS = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png", ".gif", ".webp", ".bmp", ".svg", ".ico"]);
+var VOICE_EXTS = /* @__PURE__ */ new Set([".wav", ".mp3", ".silk", ".amr", ".ogg", ".flac", ".aac", ".m4a"]);
+var VIDEO_EXTS = /* @__PURE__ */ new Set([".mp4", ".avi", ".mov", ".mkv", ".webm", ".flv", ".wmv"]);
+function inferMediaKind(filePath) {
+  const ext = path7.extname(filePath).toLowerCase();
+  if (IMAGE_EXTS.has(ext)) return "image";
+  if (VOICE_EXTS.has(ext)) return "voice";
+  if (VIDEO_EXTS.has(ext)) return "video";
+  return "file";
 }
-var u;
-(function(t) {
-  t[t.NONE = 0] = "NONE", t[t.PENDING = 1] = "PENDING", t[t.COMPLETED = 2] = "COMPLETED", t[t.EXPIRED = 3] = "EXPIRED";
-})(u || (u = {}));
-function b(t, r) {
-  const a = Buffer.from(r, "base64"), n = Buffer.from(t, "base64"), e = n.subarray(0, 12), c = n.subarray(n.length - 16), s = n.subarray(12, n.length - 16), o = import_node_crypto.default.createDecipheriv("aes-256-gcm", a, e);
-  return o.setAuthTag(c), Buffer.concat([o.update(s), o.final()]).toString("utf8");
+function inferMediaKindFromMime(mime) {
+  const lower = mime.toLowerCase();
+  if (lower.startsWith("image/")) return "image";
+  if (lower.startsWith("audio/") || lower === "voice") return "voice";
+  if (lower.startsWith("video/")) return "video";
+  return "file";
 }
-function h(t, r, a) {
-  return new Promise((n, e) => {
-    const c = JSON.stringify(r), s = new URL(t), o = import_node_https.default.request({ hostname: s.hostname, path: s.pathname + s.search, method: "POST", timeout: a, headers: { "Content-Type": "application/json", Accept: "application/json", "Content-Length": Buffer.byteLength(c) } }, (i) => {
-      if (i.statusCode !== 200) {
-        i.resume(), e(new Error(`HTTP ${i.statusCode} from ${t}`));
-        return;
+function isPathInAllowedRoots(absPath, allowedRoots) {
+  if (!allowedRoots.length) return false;
+  try {
+    const real = fs8.realpathSync(absPath);
+    return allowedRoots.some((root) => {
+      try {
+        const rootReal = fs8.existsSync(root) ? fs8.realpathSync(root) : root;
+        return real.startsWith(rootReal + path7.sep) || real === rootReal;
+      } catch {
+        return false;
       }
-      let f = "";
-      i.on("data", (p2) => {
-        f += p2;
-      }), i.on("end", () => {
-        try {
-          n(JSON.parse(f));
-        } catch (p2) {
-          e(p2);
-        }
-      });
     });
-    o.on("error", e), o.on("timeout", () => {
-      o.destroy(), e(new Error(`timeout fetching ${t}`));
-    }), o.end(c);
-  });
-}
-async function y(t = "production", r = 1e4) {
-  const a = `https://${d(t)}/lite/create_bind_task`, n = l(), e = await h(a, { key: n }, r);
-  if (e.retcode !== 0) throw new Error(e.msg ?? "create_bind_task failed");
-  if (!e.data?.task_id) throw new Error("create_bind_task: missing task_id");
-  return { taskId: e.data.task_id, key: n };
-}
-async function g(t, r = "production", a = 1e4) {
-  const n = `https://${d(r)}/lite/poll_bind_result`, e = await h(n, { task_id: t }, a);
-  if (e.retcode !== 0) throw new Error(e.msg ?? "poll_bind_result failed");
-  return { status: e.data?.status ?? u.NONE, botAppId: String(e.data?.bot_appid ?? ""), botEncryptSecret: e.data?.bot_encrypt_secret ?? "", userOpenid: e.data?.user_openid || void 0 };
-}
-function w(t, r = "") {
-  return `https://${d("production")}/qqbot/openclaw/connect.html?task_id=${encodeURIComponent(t)}&source=${encodeURIComponent(r)}&_wv=2`;
+  } catch {
+    return false;
+  }
 }
 
-// node_modules/.pnpm/@tencent-connect+qqbot-connector@1.2.0/node_modules/@tencent-connect/qqbot-connector/dist/esm/qr-connect.js
-var p = 2e3;
-function F(r) {
-  return new Promise((o) => {
-    import_qrcode_terminal.default.generate(r, { small: true }, (e) => {
-      o(e);
-    });
-  });
-}
-function d2(r, o) {
-  return new Promise((e, t) => {
-    if (o?.aborted) {
-      t(new DOMException("Aborted", "AbortError"));
-      return;
+// src/outbound/media-send.ts
+function resolveTempRoots() {
+  const roots = /* @__PURE__ */ new Set();
+  try {
+    const tmp = os4.tmpdir();
+    roots.add(fs9.existsSync(tmp) ? fs9.realpathSync(tmp) : tmp);
+  } catch {
+  }
+  if (process.platform !== "win32") {
+    try {
+      roots.add(fs9.realpathSync("/tmp"));
+    } catch {
     }
-    const n = setTimeout(e, r);
-    o?.addEventListener("abort", () => {
-      clearTimeout(n), t(new DOMException("Aborted", "AbortError"));
-    }, { once: true });
-  });
+  }
+  return [...roots];
 }
-async function C(r, o, e) {
-  for (; !e?.aborted; ) {
-    let t;
+function buildDynamicAllowedRoots(workspaceDir) {
+  const home = os4.homedir();
+  const derivedBase = workspaceDir ? path8.dirname(workspaceDir) : path8.join(home, ".openclaw");
+  const roots = [];
+  const added = /* @__PURE__ */ new Set();
+  const addRoot = (p2) => {
     try {
-      t = await g(r);
+      const real = fs9.existsSync(p2) ? fs9.realpathSync(p2) : p2;
+      if (!added.has(real)) {
+        added.add(real);
+        roots.push(real);
+      }
     } catch {
-      await d2(p, e);
-      continue;
-    }
-    if (t.status === u.COMPLETED) {
-      const n = b(t.botEncryptSecret, o);
-      return { outcome: "scanned", appId: t.botAppId, appSecret: n, userOpenid: t.userOpenid };
     }
-    if (t.status === u.EXPIRED) return { outcome: "expired" };
-    await d2(p, e);
+  };
+  const knownBases = [path8.join(home, ".openclaw"), path8.join(home, ".openclaw-dev")];
+  if (workspaceDir) {
+    addRoot(path8.join(derivedBase, "media"));
+    addRoot(path8.join(derivedBase, "workspace"));
+    addRoot(path8.join(derivedBase, "outbound"));
+    addRoot(workspaceDir);
   }
-  throw new DOMException("Aborted", "AbortError");
+  for (const base of knownBases) {
+    addRoot(path8.join(base, "media"));
+    addRoot(path8.join(base, "workspace"));
+    addRoot(path8.join(base, "outbound"));
+  }
+  for (const t of resolveTempRoots()) addRoot(t);
+  return roots;
 }
-function l2(r, o) {
-  const e = new AbortController(), t = o?.signal ? AbortSignal.any([e.signal, o.signal]) : e.signal;
-  return (async () => {
-    const n = o?.displayQrCodeToConsole ?? true;
-    for (; ; ) {
-      if (t.aborted) throw new DOMException("Aborted", "AbortError");
-      let a;
-      try {
-        a = await y();
-      } catch (u2) {
-        throw new Error(`\u83B7\u53D6\u7ED1\u5B9A\u4EFB\u52A1\u5931\u8D25: ${u2 instanceof Error ? u2.message : String(u2)}`, { cause: u2 });
-      }
-      const i = w(a.taskId, o?.source);
-      if (n) {
-        const u2 = await F(i);
-        console.log(u2), console.log(`\u8BF7\u4F7F\u7528\u624B\u673A QQ \u626B\u63CF\u4E0A\u65B9\u4E8C\u7EF4\u7801\uFF0C\u5B8C\u6210\u673A\u5668\u4EBA\u7ED1\u5B9A\u3002
-`);
-      }
-      r.onQrDisplayed?.(i);
-      const s = await C(a.taskId, a.key, t);
-      if (s.outcome === "scanned") {
-        r.onSuccess([{ appId: s.appId, appSecret: s.appSecret, userOpenid: s.userOpenid }]);
-        return;
-      }
-      r.onQrExpired?.(), n && console.log(`\u4E8C\u7EF4\u7801\u5DF2\u8FC7\u671F\uFF0C\u6B63\u5728\u5237\u65B0\u2026
-`);
+var MAX_DATA_URL_BYTES = 10 * 1024 * 1024;
+async function sendMedia2(params) {
+  const { source, accountId, log: log4 } = params;
+  const mlog = log4?.child("media");
+  if (!source) {
+    mlog?.error("source is empty");
+    return { error: "sendMedia: source is required" };
+  }
+  const wsDir = resolveWorkspaceFromAgent(params.agentId);
+  mlog?.debug(`resolveMediaPath source=${source} agentId=${params.agentId ?? "none"} workspaceDir=${wsDir ?? "none"}`);
+  const resolved = await resolveMediaPath(source, mlog, wsDir);
+  if (!resolved.ok) {
+    mlog?.error(`resolveMediaPath failed: ${resolved.error}`);
+    return { error: resolved.error };
+  }
+  const kind = params.mediaKind ?? (params.mimeType ? inferMediaKindFromMime(params.mimeType) : void 0) ?? inferMediaKind(resolved.path);
+  const gw = getGateway(accountId);
+  if (!gw) {
+    return { error: `Bot "${accountId}" not running` };
+  }
+  const target = parseTarget(params.to);
+  switch (kind) {
+    case "voice":
+      return sendVoiceMedia(gw, target, resolved.path, params);
+    case "video":
+      return sendVideoMedia(gw, target, resolved.path, params);
+    case "file":
+      return sendFileMedia(gw, target, resolved.path, params);
+    case "image":
+    default:
+      return sendImageMedia(gw, target, resolved.path, params);
+  }
+}
+async function resolveMediaPath(source, log4, workspaceDir) {
+  const normalized = normalizePath(source);
+  if (isDataUrl(normalized)) {
+    if (normalized.length > MAX_DATA_URL_BYTES) {
+      const sizeMB = (normalized.length / (1024 * 1024)).toFixed(1);
+      return { ok: false, error: `Data URL \u8FC7\u5927\uFF08${sizeMB}MB\uFF0C\u6700\u5927 10MB\uFF09` };
+    }
+    return { ok: true, path: normalized, isLocal: false };
+  }
+  if (normalized.startsWith("http://") || normalized.startsWith("https://")) {
+    try {
+      await validateRemoteUrl(normalized);
+    } catch (err) {
+      log4?.warn(`SSRF blocked for media URL: ${normalized}`);
+      return { ok: false, error: `\u5A92\u4F53 URL \u88AB SSRF \u9632\u62A4\u62E6\u622A: ${err instanceof Error ? err.message : String(err)}` };
     }
-  })().catch((n) => {
-    if (n instanceof DOMException && n.name === "AbortError") {
-      r.onFailure(new Error("\u5DF2\u53D6\u6D88"));
-      return;
+    return { ok: true, path: normalized, isLocal: false };
+  }
+  if (!isLocalFilePath(normalized)) {
+    const resolved2 = resolveWorkingFile(normalized, workspaceDir);
+    if (resolved2) {
+      return { ok: true, path: resolved2, isLocal: true };
     }
-    r.onFailure(n instanceof Error ? n : new Error(String(n)));
-  }), () => e.abort();
+    return { ok: true, path: normalized, isLocal: false };
+  }
+  const resolved = path8.resolve(normalized);
+  if (!fs9.existsSync(resolved)) {
+    return { ok: false, error: `File not found: ${resolved}` };
+  }
+  let real;
+  try {
+    real = fs9.realpathSync(resolved);
+  } catch {
+    return { ok: false, error: `Cannot resolve path: ${resolved}` };
+  }
+  const dynamicRoots = buildDynamicAllowedRoots(workspaceDir);
+  const allowed = isPathInAllowedRoots(real, dynamicRoots);
+  if (!allowed) {
+    log4?.warn(`path blocked \u2014 not in allowed directory: ${real}`);
+    return { ok: false, error: `\u6587\u4EF6\u8DEF\u5F84\u4E0D\u5728\u5141\u8BB8\u7684\u76EE\u5F55\u4E2D` };
+  }
+  return { ok: true, path: real, isLocal: true };
 }
-function m2(r) {
-  return new Promise((o, e) => {
-    l2({ onSuccess: o, onFailure: e }, { ...r, displayQrCodeToConsole: true });
-  });
+function resolveWorkspaceFromAgent(agentId) {
+  const cfg = resolveConfigViaAdapter();
+  if (!cfg) return void 0;
+  return resolveAgentWorkspace(cfg, agentId);
 }
-
-// src/setup/finalize.ts
-function isConfigured(cfg, accountId) {
-  const account = resolveQQBotAccount(cfg, accountId);
-  return Boolean(account.appId && account.clientSecret);
+function resolveConfigViaAdapter() {
+  try {
+    const rt = tryGetQQBotRuntime();
+    if (!rt) return void 0;
+    return getAdapters(rt).getConfig?.();
+  } catch {
+    return void 0;
+  }
+}
+function resolveWorkingFile(name, workspaceDir) {
+  for (const p2 of [path8.resolve(name), workspaceDir ? path8.join(workspaceDir, name) : null]) {
+    if (p2 && fs9.existsSync(p2)) return p2;
+  }
+  return null;
 }
-async function linkViaQrCode(cfg, accountId, prompter, rt) {
+async function sendImageMedia(gw, target, source, params) {
   try {
-    const accounts = await m2({ source: "openclaw" });
-    if (accounts.length === 0) {
-      await prompter.note("\u672A\u83B7\u53D6\u5230\u4EFB\u4F55 QQ Bot \u8D26\u53F7\u4FE1\u606F\u3002", "QQ Bot");
-      return cfg;
-    }
-    let next = cfg;
-    for (const { appId, appSecret, userOpenid } of accounts) {
-      next = applyQQBotAccountConfig(next, appId, { appId, clientSecret: appSecret });
-      next = applyAccountDefaults(next, appId, userOpenid);
-    }
-    if (accounts.length === 1) {
-      rt.log(`\u2714 QQ Bot \u7ED1\u5B9A\u6210\u529F\uFF01(AppID: ${accounts[0].appId})`);
-    } else {
-      rt.log(`\u2714 ${accounts.length} \u4E2A QQ Bot \u7ED1\u5B9A\u6210\u529F\uFF01(AppID: ${accounts.map((a) => a.appId).join(", ")})`);
-    }
-    return next;
+    const result = await gw.sendMedia(target, source, {
+      text: params.text,
+      msgId: params.replyToId
+    });
+    return { messageId: result.id };
   } catch (err) {
-    rt.error(`QQ Bot \u7ED1\u5B9A\u5931\u8D25: ${String(err)}`);
-    await prompter.note(`\u7ED1\u5B9A\u5931\u8D25\uFF0C\u60A8\u53EF\u4EE5\u7A0D\u540E\u624B\u52A8\u914D\u7F6E\u3002
-\u6587\u6863: ${formatDocsLink("/channels/qqbot", "qqbot")}`, "QQ Bot");
-    return cfg;
+    return { error: formatErr(err) };
   }
 }
-async function linkViaManual(cfg, prompter) {
-  const appId = await prompter.text({ message: "\u8BF7\u8F93\u5165 QQ Bot AppID", validate: (v) => v.trim() ? void 0 : "AppID \u4E0D\u80FD\u4E3A\u7A7A" });
-  const secret = await prompter.text({ message: "\u8BF7\u8F93\u5165 QQ Bot AppSecret", validate: (v) => v.trim() ? void 0 : "AppSecret \u4E0D\u80FD\u4E3A\u7A7A" });
-  let next = applyQQBotAccountConfig(cfg, appId.trim(), { appId: appId.trim(), clientSecret: secret.trim() });
-  next = applyAccountDefaults(next, appId.trim());
-  await prompter.note("\u2714 QQ Bot \u914D\u7F6E\u5B8C\u6210\uFF01", "QQ Bot");
-  return next;
+async function sendVoiceMedia(gw, target, source, params) {
+  const voiceSource = resolveVoiceSource2(source);
+  try {
+    const result = await gw.sendVoice(target, voiceSource, {
+      msgId: params.replyToId
+    });
+    return { messageId: result.id };
+  } catch (err) {
+    params.log?.child("media")?.warn(`sendVoice failed (${formatErr(err)}), falling back to sendFile`);
+    try {
+      const fileName = path8.basename(source);
+      const fallback = await gw.sendFile(target, source, {
+        text: params.text,
+        msgId: params.replyToId,
+        fileName
+      });
+      return { messageId: fallback.id, fallback: true };
+    } catch (fallbackErr) {
+      return { error: `voice: ${formatErr(err)} | fallback file: ${formatErr(fallbackErr)}` };
+    }
+  }
 }
-async function finalizeQQBotSetup(params) {
-  const accountId = params.accountId.trim() || DEFAULT_ACCOUNT_ID2;
-  const configured = isConfigured(params.cfg, accountId);
-  const mode = await params.prompter.select({
-    message: configured ? "QQ \u5DF2\u7ED1\u5B9A\uFF0C\u9009\u62E9\u64CD\u4F5C" : "\u9009\u62E9 QQ \u7ED1\u5B9A\u65B9\u5F0F",
-    options: [
-      { value: "qr", label: "\u626B\u7801\u7ED1\u5B9A\uFF08\u63A8\u8350\uFF09", hint: "\u4F7F\u7528 QQ \u626B\u63CF\u4E8C\u7EF4\u7801\u81EA\u52A8\u5B8C\u6210\u7ED1\u5B9A" },
-      { value: "manual", label: "\u624B\u52A8\u8F93\u5165 QQ Bot AppID \u548C AppSecret", hint: "\u9700\u5230 QQ \u5F00\u653E\u5E73\u53F0 q.qq.com \u67E5\u770B" },
-      { value: "skip", label: configured ? "\u4FDD\u6301\u5F53\u524D\u914D\u7F6E" : "\u7A0D\u540E\u914D\u7F6E" }
-    ]
-  });
-  let next = params.cfg;
-  if (mode === "qr") {
-    next = await linkViaQrCode(next, accountId, params.prompter, params.runtime);
-  } else if (mode === "manual") {
-    next = await linkViaManual(next, params.prompter);
-  } else if (!configured) {
-    await params.prompter.note("\u60A8\u53EF\u4EE5\u7A0D\u540E\u8FD0\u884C\u4EE5\u4E0B\u547D\u4EE4\u91CD\u65B0\u914D\u7F6E\uFF1A\n  openclaw channels add", "QQ Bot");
+async function sendVideoMedia(gw, target, source, params) {
+  try {
+    const result = await gw.sendVideo(target, source, {
+      text: params.text,
+      msgId: params.replyToId
+    });
+    return { messageId: result.id };
+  } catch (err) {
+    return { error: formatErr(err) };
   }
-  return { cfg: next };
 }
-function applyAccountDefaults(cfg, accountId, userOpenid) {
-  const next = { ...cfg, channels: { ...cfg.channels } };
-  const qqbot = { ...next.channels?.qqbot ?? {} };
-  const defaults = { streaming: true, dmPolicy: "allowlist" };
-  if (userOpenid) defaults.allowFrom = [userOpenid];
-  if (accountId === DEFAULT_ACCOUNT_ID2) {
-    Object.assign(qqbot, defaults);
-  } else {
-    const accounts = { ...qqbot.accounts ?? {} };
-    accounts[accountId] = { ...accounts[accountId] ?? {}, ...defaults };
-    qqbot.accounts = accounts;
+async function sendFileMedia(gw, target, source, params) {
+  try {
+    const fileName = path8.basename(source);
+    const result = await gw.sendFile(target, source, {
+      text: params.text,
+      msgId: params.replyToId,
+      fileName
+    });
+    return { messageId: result.id };
+  } catch (err) {
+    return { error: formatErr(err) };
   }
-  next.channels = { ...next.channels, qqbot };
-  return next;
+}
+function resolveVoiceSource2(source) {
+  if (source.startsWith("http://") || source.startsWith("https://")) {
+    return { url: source };
+  }
+  if (source.startsWith("data:") || !source.startsWith("/") && !source.startsWith("./") && !source.startsWith("../") && !source.startsWith("~")) {
+    const commaIdx = source.indexOf(",");
+    return { base64: commaIdx > 0 ? source.slice(commaIdx + 1) : source };
+  }
+  return { localPath: source };
+}
+function formatErr(err) {
+  if (err instanceof Error) return err.message;
+  return String(err);
 }
 
 // src/setup/surface.ts
+init_setup();
+init_config();
+init_finalize();
 var CHANNEL = "qqbot";
 var qqbotSetupWizard = {
   channel: CHANNEL,
@@ -10481,6 +10650,14 @@ var qqbotSetupWizard = {
       return Boolean(account.appId && account.clientSecret);
     })
   }),
+  // 未配置时默认使用 default 账号，有账户时框架会提示选择
+  resolveAccountIdForConfigure: async ({ cfg, shouldPromptAccountIds, accountOverride, defaultAccountId }) => {
+    if (accountOverride) return accountOverride;
+    const ids = listQQBotAccountIds(cfg);
+    if (ids.length === 0) return "default";
+    if (!shouldPromptAccountIds) return ids[0];
+    return defaultAccountId || resolveDefaultQQBotAccountId(cfg);
+  },
   credentials: [],
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   finalize: (async ({ cfg, accountId, prompter, runtime: runtime2 }) => finalizeQQBotSetup({ cfg, accountId, prompter, runtime: runtime2 })),
@@ -10490,6 +10667,118 @@ var qqbotSetupWizard = {
   }
 };
 
+// src/setup/login.ts
+init_esm();
+var pendingSessions = /* @__PURE__ */ new Map();
+function startQrLogin(accountId, source = "openclaw") {
+  const key = accountId ?? "default";
+  pendingSessions.get(key)?.dispose();
+  pendingSessions.delete(key);
+  return new Promise((resolve2) => {
+    let credentialsResolve;
+    let credentialsReject;
+    const credentialsPromise = new Promise((res, rej) => {
+      credentialsResolve = res;
+      credentialsReject = rej;
+    });
+    const dispose = l2(
+      {
+        onQrDisplayed(url) {
+          resolve2({
+            qrDataUrl: url,
+            message: "\u8BF7\u4F7F\u7528\u624B\u673A QQ \u626B\u63CF\u4E8C\u7EF4\u7801\u5B8C\u6210\u7ED1\u5B9A"
+          });
+        },
+        onSuccess: (creds) => credentialsResolve(creds),
+        onFailure: (err) => credentialsReject(err)
+      },
+      { displayQrCodeToConsole: true, source }
+    );
+    pendingSessions.set(key, { dispose, credentialsPromise });
+  });
+}
+async function waitQrLogin(accountId) {
+  const key = accountId ?? "default";
+  const session = pendingSessions.get(key);
+  if (!session) {
+    return { connected: false, message: "\u6CA1\u6709\u6B63\u5728\u8FDB\u884C\u7684\u767B\u5F55\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u8FD0\u884C login \u547D\u4EE4\u3002" };
+  }
+  try {
+    const credentials = await session.credentialsPromise;
+    pendingSessions.delete(key);
+    if (credentials.length === 0) {
+      return { connected: false, message: "\u672A\u83B7\u53D6\u5230 QQ Bot \u51ED\u636E\u3002" };
+    }
+    return {
+      connected: true,
+      message: `\u7ED1\u5B9A\u6210\u529F\uFF01AppID: ${credentials.map((c) => c.appId).join(", ")}`,
+      credentials
+    };
+  } catch (err) {
+    pendingSessions.delete(key);
+    return {
+      connected: false,
+      message: `\u7ED1\u5B9A\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+function parseChannelInput(channelInput) {
+  if (!channelInput) return null;
+  const parts = channelInput.trim().split(":");
+  if (parts.length === 2 && parts[0] && parts[1]) {
+    return { appId: parts[0], clientSecret: parts[1] };
+  }
+  return null;
+}
+async function qqbotLogin({
+  cfg,
+  accountId,
+  channelInput,
+  verbose,
+  ...rest
+}) {
+  const { applyQQBotAccountConfig: applyQQBotAccountConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  const { persistAuthConfig: persistAuthConfig2 } = await Promise.resolve().then(() => (init_resolve(), resolve_exports));
+  const { applyAccountDefaults: applyAccountDefaults2 } = await Promise.resolve().then(() => (init_finalize(), finalize_exports));
+  const { resolveAccountKey: resolveAccountKey2 } = await Promise.resolve().then(() => (init_account_key(), account_key_exports));
+  const runtime2 = rest;
+  const resolvedId = accountId ? accountId.trim().toLowerCase() : null;
+  const parsed = parseChannelInput(channelInput);
+  if (parsed) {
+    const key = resolveAccountKey2(cfg, parsed.appId, resolvedId);
+    const result2 = applyQQBotAccountConfig2(cfg, key, {
+      appId: parsed.appId,
+      clientSecret: parsed.clientSecret
+    });
+    Object.assign(cfg, result2);
+    const withDefaults = applyAccountDefaults2(cfg, key);
+    Object.assign(cfg, withDefaults);
+    await persistAuthConfig2(runtime2, cfg, "restart");
+    if (verbose) console.log(`QQ Bot \u5DF2\u914D\u7F6E (${key}) AppID: ${parsed.appId}`);
+    return;
+  }
+  const { qrDataUrl, message } = await startQrLogin(resolvedId || "pending");
+  console.log(`
+${message}`);
+  if (qrDataUrl) console.log(`QR \u94FE\u63A5: ${qrDataUrl}`);
+  const result = await waitQrLogin(resolvedId || "pending");
+  if (!result.connected || !result.credentials) {
+    throw new Error(result.message);
+  }
+  for (const cred of result.credentials) {
+    const key = resolveAccountKey2(cfg, cred.appId, resolvedId);
+    const next = applyQQBotAccountConfig2(cfg, key, {
+      appId: cred.appId,
+      clientSecret: cred.appSecret
+    });
+    Object.assign(cfg, next);
+    const withDefaults = applyAccountDefaults2(cfg, key, cred.userOpenid);
+    Object.assign(cfg, withDefaults);
+  }
+  await persistAuthConfig2(runtime2, cfg, "restart");
+  console.log(`QQ Bot \u767B\u5F55\u6210\u529F\uFF01`);
+}
+
 // src/outbound/sanitize.ts
 var INTERNAL_TAGS = [
   // 框架脚手架标签
@@ -10515,6 +10804,10 @@ function sanitizeQQBotText(text) {
   return result.trim();
 }
 
+// src/gateway/lifecycle.ts
+init_config();
+init_resolve();
+
 // src/gateway/qqbot-gateway.ts
 var import_node_os4 = __toESM(require("os"), 1);
 
@@ -10751,6 +11044,7 @@ function botMe() {
 }
 
 // src/commands/config-util.ts
+init_resolve();
 function checkCommandAuth(ctx) {
   const p2 = ctx.state.policy;
   const mode = p2?.c2cMode ?? "allowlist";
@@ -10998,6 +11292,7 @@ var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_path5 = __toESM(require("path"), 1);
 var import_node_os3 = __toESM(require("os"), 1);
 var import_node_crypto2 = __toESM(require("crypto"), 1);
+init_resolve();
 var MAX_LINES_PER_FILE = 1e3;
 var MAX_FILES = 4;
 var LOG_KEYWORDS = ["gateway", "openclaw", "clawdbot", "moltbot"];
@@ -11202,6 +11497,7 @@ function botLogs(runtime2) {
 }
 
 // src/commands/bot-approve.ts
+init_resolve();
 var PRESETS = {
   on: { security: "allowlist", ask: "on-miss", desc: "\u5F00\u542F\u5BA1\u6279\uFF08\u767D\u540D\u5355\u6A21\u5F0F\uFF09" },
   off: { security: "full", ask: "off", desc: "\u5173\u95ED\u5BA1\u6279" },
@@ -11505,10 +11801,10 @@ function buildCommandList(account, opts) {
 // src/middleware/attachment.ts
 var path17 = __toESM(require("path"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/reply-limiter.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/reply-limiter.js
 var DEFAULT_TTL_MS = 60 * 60 * 1e3;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/media-tags.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/media-tags.js
 var VALID_TAGS = ["qqimg", "qqvoice", "qqvideo", "qqfile", "qqmedia"];
 var TAG_ALIASES = {
   qq_img: "qqimg",
@@ -11557,30 +11853,30 @@ var SELF_CLOSING_TAG_REGEX = new RegExp("`?" + LEFT_BRACKET + "\\s*(" + TAG_NAME
 var FUZZY_MEDIA_TAG_REGEX = new RegExp("`?" + LEFT_BRACKET + "\\s*(" + TAG_NAME_PATTERN + ")\\s*" + RIGHT_BRACKET + `["']?\\s*([^<\uFF1C<\uFF1E>"'\`]+?)\\s*["']?` + LEFT_BRACKET + "\\s*/?\\s*(?:" + TAG_NAME_PATTERN + ")\\s*" + RIGHT_BRACKET + "`?", "gi");
 var MULTILINE_TAG_CLEANUP = new RegExp("(" + LEFT_BRACKET + "\\s*(?:" + TAG_NAME_PATTERN + ")\\s*" + RIGHT_BRACKET + ")([\\s\\S]*?)(" + LEFT_BRACKET + "\\s*/?\\s*(?:" + TAG_NAME_PATTERN + ")\\s*" + RIGHT_BRACKET + ")", "gi");
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/ref-index-store.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/ref-index-store.js
 var import_node_fs6 = __toESM(require("fs"), 1);
 var DEFAULT_TTL_MS2 = 7 * 24 * 60 * 60 * 1e3;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/session-store.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/session-store.js
 var import_node_fs7 = __toESM(require("fs"), 1);
 var import_node_path7 = __toESM(require("path"), 1);
 var DEFAULT_EXPIRE_MS = 5 * 60 * 1e3;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/text-parsing.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/text-parsing.js
 var MAX_FACE_EXT_BYTES = 64 * 1024;
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/media-source.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/media-source.js
 var fs14 = __toESM(require("fs"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/image-size.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/image-size.js
 var import_node_buffer = require("buffer");
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/ffmpeg.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/ffmpeg.js
 var import_node_child_process = require("child_process");
 var fs15 = __toESM(require("fs"), 1);
 var path13 = __toESM(require("path"), 1);
 
-// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101142/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/audio.js
+// node_modules/.pnpm/@cxyhhhhh+qqbot-nodejs@1.0.2-dev.202607101530/node_modules/@cxyhhhhh/qqbot-nodejs/dist/protocol/utils/audio.js
 var import_node_child_process2 = require("child_process");
 var fs16 = __toESM(require("fs"), 1);
 var path14 = __toESM(require("path"), 1);
@@ -11854,6 +12150,7 @@ async function downloadViaFetch(opts) {
 }
 
 // src/middleware/attachment.ts
+init_resolve();
 function attachmentProcessor(opts) {
   return async (ctx, next) => {
     const msg = ctx.message;
@@ -12057,6 +12354,7 @@ async function downloadMediaFile(url, filename, log4) {
 }
 
 // src/dispatch/body-assembler.ts
+init_resolve();
 var QUOTE_BEGIN = "[Quoted message begins]";
 var QUOTE_END = "[Quoted message ends]";
 var REF_BEGIN = "[Reference message begins]";
@@ -12219,7 +12517,7 @@ function isNonEmpty(x) {
 }
 function buildAgentBody(input) {
   const { userContent, base, isGroup, wasMentioned, history } = input;
-  if (userContent.startsWith("/")) {
+  if (userContent.trim().startsWith("/")) {
     return userContent;
   }
   if (isGroup && wasMentioned && history && history.length > 0) {
@@ -12260,6 +12558,7 @@ function normalizeTimestamp(ts) {
 }
 
 // src/middleware/policy-injector.ts
+init_config();
 function createPolicyInjector(account) {
   return async (ctx, next) => {
     const msg = ctx.message;
@@ -12386,6 +12685,25 @@ async function checkPairingMode(ctx, next, opts) {
   }
 }
 
+// src/utils/mention.ts
+function stripMentionText(text, mentions) {
+  if (!text || !mentions?.length) return text;
+  let cleaned = text;
+  for (const m3 of mentions) {
+    const openid = m3.member_openid ?? m3.id ?? m3.user_openid;
+    if (!openid) continue;
+    if (m3.is_you) {
+      cleaned = cleaned.replace(new RegExp(`<@!?${openid}>`, "g"), "").trim();
+    } else {
+      const displayName = m3.nickname ?? m3.username;
+      if (displayName) {
+        cleaned = cleaned.replace(new RegExp(`<@!?${openid}>`, "g"), `@${displayName}`);
+      }
+    }
+  }
+  return cleaned;
+}
+
 // src/gateway/middleware-setup.ts
 function setupMiddlewares(bot, account, opts) {
   bot.use(errorHandler());
@@ -12404,8 +12722,13 @@ function setupMiddlewares(bot, account, opts) {
     getRuntime: opts.getRuntime
   }));
   bot.use(mentionGate());
-  bot.use(contentSanitizer({ parseFaceTags: true }));
+  bot.use(contentSanitizer({
+    parseFaceTags: true,
+    transform: (content, ctx) => stripMentionText(content, ctx.message.mentions)
+  }));
   bot.use(rateLimiter());
+  const slash = slashCommand({ commands: buildCommandList(account, { getRuntime: opts.getRuntime }) });
+  bot.use(slash.middleware);
   bot.use(concurrencyGuard({
     strategy: "merge",
     maxQueue: 50,
@@ -12438,8 +12761,6 @@ function setupMiddlewares(bot, account, opts) {
       return assembled.agentBody;
     }
   }));
-  const slash = slashCommand({ commands: buildCommandList(account, { getRuntime: opts.getRuntime }) });
-  bot.use(slash.middleware);
 }
 
 // src/dispatch/envelope-builder.ts
@@ -12908,6 +13229,7 @@ function shouldUseStreaming(account, targetScope) {
 }
 
 // src/dispatch/dispatch.ts
+init_resolve();
 async function dispatchToOpenClaw(ctx, msg, account, runtime2, log4) {
   const dlog = log4?.child("dispatch");
   const adapters = getAdapters(runtime2, dlog);
@@ -13469,6 +13791,7 @@ function getApprovalHandler(accountId) {
 // src/features/proactive.ts
 var fs19 = __toESM(require("fs"), 1);
 var path20 = __toESM(require("path"), 1);
+init_config();
 var log2 = createPluginLogger({ prefix: "[proactive]" });
 var STORAGE_DIR = getQQBotDataDir("data");
 var KNOWN_USERS_FILE = path20.join(STORAGE_DIR, "known-users.json");
@@ -13575,6 +13898,8 @@ function getCachedMsgId(scope, targetId) {
 }
 
 // src/gateway/event-handlers.ts
+init_resolve();
+init_config();
 async function handleMessage(ctx, msg, account, runtime2, log4) {
   const hlog = log4.child("handle");
   const scope = msg.replyTarget.scope;
@@ -14419,10 +14744,6 @@ var approvalStubs = {
     buildPendingPayload: () => null,
     buildResolvedPayload: () => null
   },
-  auth: {
-    authorizeActorAction: () => ({ authorized: true }),
-    getActionAvailabilityState: () => ({ kind: "enabled" })
-  },
   approvals: {
     delivery: {
       hasConfiguredDmRoute: () => true,
@@ -14436,6 +14757,7 @@ var approvalStubs = {
 };
 
 // src/features/onboarding.ts
+init_config();
 var qqbotOnboardingAdapter = {
   getStatus: (ctx) => {
     const cfg = ctx.config;
@@ -14455,25 +14777,6 @@ var qqbotOnboardingAdapter = {
   }
 };
 
-// src/utils/mention.ts
-function stripMentionText(text, mentions) {
-  if (!text || !mentions?.length) return text;
-  let cleaned = text;
-  for (const m3 of mentions) {
-    const openid = m3.member_openid ?? m3.id ?? m3.user_openid;
-    if (!openid) continue;
-    if (m3.is_you) {
-      cleaned = cleaned.replace(new RegExp(`<@!?${openid}>`, "g"), "").trim();
-    } else {
-      const displayName = m3.nickname ?? m3.username;
-      if (displayName) {
-        cleaned = cleaned.replace(new RegExp(`<@!?${openid}>`, "g"), `@${displayName}`);
-      }
-    }
-  }
-  return cleaned;
-}
-
 // src/channel.ts
 var TEXT_CHUNK_LIMIT2 = 5e3;
 var GFM_TABLE_DATA_RE = /^\|.+\|.*\|/;
@@ -14498,6 +14801,7 @@ var qqbotPlugin = {
     threads: false,
     blockStreaming: false
   },
+  gatewayMethods: ["web.login.start", "web.login.wait"],
   reload: { configPrefixes: ["channels.qqbot"] },
   // ── 群消息策略 ──
   groups: {
@@ -14676,7 +14980,19 @@ ${line}` : line;
         log: ctx.log
       });
     },
-    logoutAccount: (params) => logoutAndClearCredentials(params)
+    logoutAccount: (params) => logoutAndClearCredentials(params),
+    loginWithQrStart: async ({ accountId }) => startQrLogin(accountId),
+    loginWithQrWait: async ({ accountId }) => {
+      const result = await waitQrLogin(accountId);
+      return { connected: result.connected, message: result.message };
+    }
+  },
+  // ── 登录认证 ──
+  auth: {
+    login: qqbotLogin,
+    // 审批权限（从 approvalStubs 迁移）
+    authorizeActorAction: () => ({ authorized: true }),
+    getActionAvailabilityState: () => ({ kind: "enabled" })
   },
   // ── 状态 ──
   status: {
@@ -14740,6 +15056,7 @@ function createOutLog(accountId) {
 }
 
 // src/tools/platform.ts
+init_config();
 var PlatformApiSchema = {
   type: "object",
   properties: {
@@ -15049,7 +15366,7 @@ function registerRemindTool(api) {
 }
 
 // src/adapter/contract.ts
-var log3 = createPluginLogger({ prefix: "[contract]", forceConsole: true });
+var log3 = createPluginLogger({ prefix: "[contract]", forceConsole: false });
 var REQUIRED = [
   {
     name: "channel.reply.dispatchReplyWithBufferedBlockDispatcher",
@@ -15109,6 +15426,7 @@ var StreamContentType2 = {
 };
 
 // index.ts
+init_config();
 var registered = false;
 var plugin = {
   id: "openclaw-qqbot",