@invago/mixin 1.0.7 → 1.0.8

package/README.md

@@ -69,6 +69,7 @@ Edit your `openclaw.json` file manually and add both the channel configuration a
       "sessionId": "YOUR_SESSION_ID",
       "serverPublicKey": "YOUR_SERVER_PUBLIC_KEY_BASE64",
       "sessionPrivateKey": "YOUR_SESSION_PRIVATE_KEY_BASE64",
+      "dmPolicy": "pairing",
       "allowFrom": ["AUTHORIZED_USER_UUID"],
       "proxy": {
         "enabled": true,
@@ -93,9 +94,32 @@ Notes:
 
 - `channels.mixin` configures the channel itself.
 - `plugins.allow` and `plugins.entries.mixin.enabled` are also required so OpenClaw loads this plugin.
-- This plugin currently uses `allowFrom` as its sender allowlist. Do not assume other generic OpenClaw DM policy fields apply here unless the plugin explicitly supports them.
+- Mixin supports the standard OpenClaw direct-message policies. The recommended setting is `dmPolicy: "pairing"`.
+- `allowFrom` remains useful for pre-authorized users or manual overrides. Pairing approvals are stored in OpenClaw's pairing allowlist store.
 - If `proxy.url` already contains credentials, `proxy.username` and `proxy.password` can be omitted.
 
+## Pairing
+
+For private chats, the recommended mode is:
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "dmPolicy": "pairing"
+    }
+  }
+}
+```
+
+Behavior:
+
+- A new, unauthorized Mixin user gets an 8-character pairing code in the DM.
+- Approve that user with `openclaw pairing approve mixin <code>`.
+- Use `openclaw pairing list mixin` to inspect pending pairing requests.
+- Once approved, the user is added to OpenClaw's pairing allowlist store for the `mixin` channel.
+- `allowFrom` is still honored and can be used alongside pairing for users you want to pre-authorize.
+
 ## Avoid Cross-Channel Session Mixing
 
 Mixin group chats already stay isolated by channel, but direct-message sessions follow the OpenClaw `session.dmScope` policy. If you keep the default `main` scope, Mixin direct messages can share the same main session with other channels such as Feishu.
@@ -121,6 +145,7 @@ Use `per-account-channel-peer` instead if you run multiple Mixin accounts and wa
 | `sessionId` | Yes | - | Session UUID |
 | `serverPublicKey` | Yes | - | Server Public Key (Base64) |
 | `sessionPrivateKey` | Yes | - | Session Private Key (Ed25519 Base64) |
+| `dmPolicy` | No | `pairing` | Direct-message policy: `pairing`, `allowlist`, `open`, or `disabled` |
 | `allowFrom` | No | `[]` | Authorized user UUID whitelist |
 | `requireMentionInGroup` | No | `true` | Require trigger words in group chats |
 | `debug` | No | `false` | Debug mode |
@@ -163,6 +188,31 @@ Plugin-specific command:
 - Pending messages survive plugin restarts.
 - Inbound Blaze messages are acknowledged before dispatch so Mixin receives a read receipt as early as possible.
 
+## Media Support
+
+Current media behavior is split into outbound and inbound support:
+
+- OpenClaw native outbound media is enabled through the channel `sendMedia` path.
+- The plugin sends outbound audio as `PLAIN_AUDIO` when it can resolve the media as audio and detect duration.
+- If audio duration cannot be detected, the plugin falls back to regular file attachment sending.
+- Non-audio outbound media is sent as Mixin file attachments.
+- If OpenClaw sends both caption text and media, the plugin sends the text first and then the file.
+- Voice-bubble style outbound audio is currently intended for the explicit `mixin-audio` template path.
+- Inbound `PLAIN_DATA` and `PLAIN_AUDIO` messages are downloaded, saved locally, and attached to the OpenClaw inbound context through `MediaPath` / `MediaType`.
+- Group attachment messages are allowed through even when `requireMentionInGroup` is enabled.
+
+Current limits:
+
+- Outbound audio does not transcode automatically.
+- `mixin-audio` still requires a prepared local file, explicit `duration`, and optional `waveForm`.
+- OpenClaw native outbound audio depends on local `ffprobe` availability to detect duration.
+- OpenClaw native `sendMedia` still does not generate `waveForm`, so explicit `mixin-audio` remains the most deterministic path for polished voice-message output.
+- Whether the agent can summarize, transcribe, or reason over inbound files/audio depends on your OpenClaw media-understanding configuration.
+
+Manual test guide:
+
+- See [docs/media-testing.md](docs/media-testing.md) for ready-to-run prompts and expected results.
+
 ## Explicit Reply Templates
 
 When you want deterministic Mixin output instead of heuristic auto-selection, have the agent reply with exactly one fenced template block.
@@ -214,11 +264,39 @@ Card:
 ```
 ```
 
+File:
+
+```text
+```mixin-file
+{
+  "filePath": "/absolute/path/to/report.pdf",
+  "fileName": "report.pdf",
+  "mimeType": "application/pdf"
+}
+```
+```
+
+Audio:
+
+```text
+```mixin-audio
+{
+  "filePath": "/absolute/path/to/voice.ogg",
+  "mimeType": "audio/ogg",
+  "duration": 12,
+  "waveForm": "AAMMQQ=="
+}
+```
+```
+
 Rules:
 
 - Explicit templates take priority over automatic detection.
 - Replies containing tables or fenced code blocks are sent as `mixin-post` by default.
 - `mixin-buttons` and `mixin-card` accept JSON only.
+- `mixin-file` and `mixin-audio` also accept JSON only.
+- `mixin-audio` requires `duration` in seconds. `waveForm` is optional.
+- `mixin-file` and `mixin-audio` require absolute local file paths on the machine where OpenClaw runs.
 - Button and card links must use `http://` or `https://`.
 - Mixin clients may require your target domains to be present in the bot app's `Resource Patterns` allowlist.
 
@@ -235,6 +313,7 @@ Rules:
           "sessionId": "...",
           "serverPublicKey": "...",
           "sessionPrivateKey": "...",
+          "dmPolicy": "pairing",
           "allowFrom": ["..."]
         },
         "bot2": {
@@ -260,14 +339,14 @@ Rules:
 |---------|---------------|
 | Plugin not loaded | Run `openclaw plugins list` and `openclaw plugins info mixin` |
 | Channel not starting | Verify `channels.mixin` exists and credentials are complete |
-| Not receiving messages | Check `allowFrom`, trigger words, and Blaze connectivity |
+| Not receiving messages | Check pairing approval or `allowFrom`, trigger words, and Blaze connectivity |
 | Messages not sending | Check proxy reachability, outbox backlog, and `/mixin-outbox` output |
 | Repeated inbound pushes | Check Blaze connectivity and confirm ACK logs/behavior |
 
 ## Security Notes
 
 - Keep `sessionPrivateKey` private.
-- Use `allowFrom` in production.
+- Use `dmPolicy: "pairing"` or a strict `allowFrom` list in production.
 - Outbox files contain pending message bodies, so do not expose the `data/` directory.
 
 ## Links

package/README.zh-CN.md

@@ -70,6 +70,7 @@ openclaw plugins install .
       "sessionId": "你的 Session ID",
       "serverPublicKey": "服务端公钥 Base64",
       "sessionPrivateKey": "会话私钥 Base64",
+      "dmPolicy": "pairing",
       "allowFrom": ["授权用户 UUID"],
       "proxy": {
         "enabled": true,
@@ -94,9 +95,32 @@ openclaw plugins install .
 
 - `channels.mixin` 负责配置这个频道本身。
 - `plugins.allow` 和 `plugins.entries.mixin.enabled` 也需要配置，否则 OpenClaw 不会加载这个插件。
-- 当前插件使用 `allowFrom` 作为发送者白名单，不要直接套用其他 OpenClaw 通用 DM 策略字段，除非插件明确支持。
+- Mixin 现在支持 OpenClaw 官方的私聊 `dmPolicy`，推荐使用 `dmPolicy: "pairing"`。
+- `allowFrom` 仍然保留，适合预授权用户或人工补充白名单；配对批准结果会写入 OpenClaw 的 pairing allowlist store。
 - 如果 `proxy.url` 已经包含认证信息，可以不再填写 `proxy.username` 和 `proxy.password`。
 
+## 配对模式
+
+私聊推荐配置：
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "dmPolicy": "pairing"
+    }
+  }
+}
+```
+
+行为说明：
+
+- 未授权的私聊用户会先收到一个 8 位配对码。
+- 管理员使用 `openclaw pairing approve mixin <code>` 完成批准。
+- 使用 `openclaw pairing list mixin` 查看待批准的配对请求。
+- 批准后，该用户会被加入 OpenClaw 的 `mixin` pairing allowlist store。
+- `allowFrom` 仍然生效，可以和 pairing 一起使用。
+
 ## 避免跨通道串会话
 
 Mixin 群聊本身会按频道隔离，但私聊会话是否独立，取决于 OpenClaw 的 `session.dmScope` 配置。如果保持默认的 `main`，Mixin 私聊可能会和飞书等其它通道共用同一个主会话。
@@ -122,6 +146,7 @@ Mixin 群聊本身会按频道隔离，但私聊会话是否独立，取决于 O
 | `sessionId` | 是 | - | 会话 UUID |
 | `serverPublicKey` | 是 | - | 服务端公钥 Base64 |
 | `sessionPrivateKey` | 是 | - | 会话私钥 Ed25519 Base64 |
+| `dmPolicy` | 否 | `pairing` | 私聊策略：`pairing`、`allowlist`、`open`、`disabled` |
 | `allowFrom` | 否 | `[]` | 授权用户 UUID 白名单 |
 | `requireMentionInGroup` | 否 | `true` | 群聊是否要求触发词 |
 | `debug` | 否 | `false` | 调试模式 |
@@ -164,6 +189,31 @@ openclaw status
 - 插件重启后，未完成的消息仍会继续补发。
 - 入站 Blaze 消息会在分发前尽快 ACK，尽量减少 Mixin 的重复推送。
 
+## 媒体支持现状
+
+当前媒体能力分为发送侧和接收侧：
+
+- OpenClaw 原生媒体发送已经接入频道 `sendMedia`。
+- 当插件能把媒体识别为音频并成功拿到时长时，会优先按 `PLAIN_AUDIO` 发送。
+- 如果拿不到音频时长，会平稳降级为普通文件附件发送。
+- 非音频媒体会按 Mixin 文件附件发送。
+- 如果 OpenClaw 同时给出文本和媒体，插件会先发文本，再发文件。
+- 语音气泡式发送目前仍更适合走显式 `mixin-audio` 模板。
+- 入站 `PLAIN_DATA` 和 `PLAIN_AUDIO` 会被下载到本地，并通过 `MediaPath` / `MediaType` 挂到 OpenClaw 入站上下文。
+- 即使启用了 `requireMentionInGroup`，群里的附件消息也不会再因为缺少文本触发词被直接过滤。
+
+当前边界：
+
+- 发送语音时不做自动转码。
+- `mixin-audio` 仍要求你提供已经准备好的本地文件，并显式给出 `duration`，`waveForm` 可选。
+- OpenClaw 原生音频发送依赖本机可用的 `ffprobe` 来提取时长。
+- OpenClaw 原生 `sendMedia` 仍不会自动生成 `waveForm`，所以如果你想更稳定地控制语音消息效果，显式 `mixin-audio` 仍然是最稳妥的路径。
+- 是否能自动总结文件、转写语音，取决于你的 OpenClaw 媒体理解配置是否开启。
+
+联调手册：
+
+- 见 [docs/media-testing.zh-CN.md](docs/media-testing.zh-CN.md)。
+
 ## 显式回复模板
 
 如果你希望 Mixin 回复严格按指定形式发送，而不是依赖自动判断，可以让 agent 只输出一个 fenced code block 模板。
@@ -215,11 +265,39 @@ openclaw status
 ```
 ```
 
+文件：
+
+```text
+```mixin-file
+{
+  "filePath": "/absolute/path/to/report.pdf",
+  "fileName": "report.pdf",
+  "mimeType": "application/pdf"
+}
+```
+```
+
+语音：
+
+```text
+```mixin-audio
+{
+  "filePath": "/absolute/path/to/voice.ogg",
+  "mimeType": "audio/ogg",
+  "duration": 12,
+  "waveForm": "AAMMQQ=="
+}
+```
+```
+
 规则：
 
 - 显式模板优先级高于自动识别。
 - 回复里只要出现表格或 fenced code block，默认就会走 `mixin-post` 长文。
 - `mixin-buttons` 和 `mixin-card` 只接受 JSON。
+- `mixin-file` 和 `mixin-audio` 也只接受 JSON。
+- `mixin-file` 和 `mixin-audio` 里的 `filePath` 必须是 OpenClaw 所在机器上的绝对路径。
+- `mixin-audio` 里的 `duration` 必填，单位为秒，`waveForm` 可选。
 - 按钮和卡片链接必须使用 `http://` 或 `https://`。
 - Mixin 客户端可能要求目标域名已加入机器人应用的 `Resource Patterns` 白名单。
 
@@ -236,6 +314,7 @@ openclaw status
           "sessionId": "...",
           "serverPublicKey": "...",
           "sessionPrivateKey": "...",
+          "dmPolicy": "pairing",
           "allowFrom": ["..."]
         },
         "bot2": {
@@ -270,14 +349,14 @@ openclaw status
 | 插件未加载 | 运行 `openclaw plugins list` 和 `openclaw plugins info mixin` |
 | 频道未启动 | 检查 `channels.mixin` 是否存在，凭证是否完整 |
 | 插件未启用 | 检查 `plugins.allow` 和 `plugins.entries.mixin.enabled` |
-| 收不到消息 | 检查 `allowFrom`、触发词和 Blaze 连通性 |
+| 收不到消息 | 检查 pairing 是否已批准或 `allowFrom` 是否包含该用户，同时检查触发词和 Blaze 连通性 |
 | 消息发不出去 | 检查代理是否可达、outbox 堆积情况和 `/mixin-outbox` 输出 |
 | 入站消息重复推送 | 检查 Blaze 连通性，并确认 ACK 是否正常发送 |
 
 ## 安全提示
 
 - 妥善保管 `sessionPrivateKey`
-- 生产环境务必配置 `allowFrom`
+- 生产环境建议使用 `dmPolicy: "pairing"` 或严格的 `allowFrom`
 - outbox 文件会保存待发送消息正文，不要暴露 `data/` 目录
 
 ## 相关链接

package/package.json

@@ -1 +1 @@
-{"name":"@invago/mixin","version":"1.0.7","description":"Mixin Messenger channel plugin for OpenClaw","type":"module","main":"index.ts","scripts":{"dev":"nodemon --exec \"node --import jiti/register index.ts\" --ext ts","lint":"eslint src/**/*.ts index.ts","typecheck":"tsc --noEmit"},"peerDependencies":{"openclaw":">=2026.2.0"},"dependencies":{"@mixin.dev/mixin-node-sdk":"^7.4.1","@noble/curves":"^2.0.1","@noble/hashes":"^2.0.1","axios":"^1.6.0","express":"^5.2.1","proxy-agent":"^6.5.0","ws":"^8.18.3","zod":"^4.3.6"},"devDependencies":{"@eslint/js":"^10.0.1","@types/node":"^20.0.0","eslint":"^10.0.3","globals":"^17.4.0","jiti":"^1.21.0","nodemon":"^3.0.0","typescript":"^5.3.0","typescript-eslint":"^8.56.1"},"keywords":["openclaw","mixin","messenger","plugin","channel"],"author":"invagao","license":"MIT","repository":{"type":"git","url":"git+https://github.com/invago/mixinclaw.git"},"openclaw":{"extensions":["./index.ts"],"channel":{"id":"mixin","label":"Mixin Messenger","selectionLabel":"Mixin Messenger (Blaze WebSocket)","docsPath":"/channels/mixin","order":70,"aliases":["mixin-messenger","mixin"],"quickstartAllowFrom":true},"install":{"npmSpec":"@invago/mixin","localPath":"extensions/mixin"}}}
+{"name":"@invago/mixin","version":"1.0.8","description":"Mixin Messenger channel plugin for OpenClaw","type":"module","main":"index.ts","scripts":{"dev":"nodemon --exec \"node --import jiti/register index.ts\" --ext ts","lint":"eslint src/**/*.ts index.ts","typecheck":"tsc --noEmit"},"peerDependencies":{"openclaw":">=2026.2.0"},"dependencies":{"@mixin.dev/mixin-node-sdk":"^7.4.1","@noble/curves":"^2.0.1","@noble/hashes":"^2.0.1","axios":"^1.6.0","express":"^5.2.1","proxy-agent":"^6.5.0","ws":"^8.18.3","zod":"^4.3.6"},"devDependencies":{"@eslint/js":"^10.0.1","@types/node":"^20.0.0","eslint":"^10.0.3","globals":"^17.4.0","jiti":"^1.21.0","nodemon":"^3.0.0","typescript":"^5.3.0","typescript-eslint":"^8.56.1"},"keywords":["openclaw","mixin","messenger","plugin","channel"],"author":"invagao","license":"MIT","repository":{"type":"git","url":"git+https://github.com/invago/mixinclaw.git"},"openclaw":{"extensions":["./index.ts"],"channel":{"id":"mixin","label":"Mixin Messenger","selectionLabel":"Mixin Messenger (Blaze WebSocket)","docsPath":"/channels/mixin","order":70,"aliases":["mixin-messenger","mixin"],"quickstartAllowFrom":true},"install":{"npmSpec":"@invago/mixin","localPath":"extensions/mixin"}}}

package/src/channel.ts

@@ -1,16 +1,21 @@
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk";
-import type { ChannelGatewayContext, OpenClawConfig } from "openclaw/plugin-sdk";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { buildChannelConfigSchema, formatPairingApproveHint } from "openclaw/plugin-sdk";
+import type { ChannelGatewayContext, OpenClawConfig, ReplyPayload } from "openclaw/plugin-sdk";
 import { runBlazeLoop } from "./blaze-service.js";
 import { MixinConfigSchema } from "./config-schema.js";
 import { describeAccount, isConfigured, listAccountIds, resolveAccount } from "./config.js";
 import { handleMixinMessage, type MixinInboundMessage } from "./inbound-handler.js";
-import { sendTextMessage, startSendWorker } from "./send-service.js";
+import { getMixinRuntime } from "./runtime.js";
+import { sendAudioMessage, sendFileMessage, sendTextMessage, startSendWorker } from "./send-service.js";
 
 type ResolvedMixinAccount = ReturnType<typeof resolveAccount>;
 
 const BASE_DELAY = 1000;
 const MAX_DELAY = 3000;
 const MULTIPLIER = 1.5;
+const MEDIA_MAX_BYTES = 30 * 1024 * 1024;
+const execFileAsync = promisify(execFile);
 
 async function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -23,6 +28,113 @@ function maskKey(key: string): string {
   return key.slice(0, 4) + "****" + key.slice(-4);
 }
 
+async function resolveAudioDurationSeconds(filePath: string): Promise<number | null> {
+  try {
+    const { stdout } = await execFileAsync(
+      process.platform === "win32" ? "ffprobe.exe" : "ffprobe",
+      [
+        "-v",
+        "error",
+        "-show_entries",
+        "format=duration",
+        "-of",
+        "default=noprint_wrappers=1:nokey=1",
+        filePath,
+      ],
+      { timeout: 15_000, windowsHide: true },
+    );
+    const seconds = Number.parseFloat(stdout.trim());
+    if (!Number.isFinite(seconds) || seconds <= 0) {
+      return null;
+    }
+    return Math.max(1, Math.ceil(seconds));
+  } catch {
+    return null;
+  }
+}
+
+function resolvePayloadMediaUrls(payload: ReplyPayload): string[] {
+  if (payload.mediaUrls && payload.mediaUrls.length > 0) {
+    return payload.mediaUrls;
+  }
+  return payload.mediaUrl ? [payload.mediaUrl] : [];
+}
+
+async function deliverOutboundMixinPayload(params: {
+  cfg: OpenClawConfig;
+  to: string;
+  text?: string;
+  mediaUrls?: string[];
+  mediaLocalRoots?: readonly string[];
+  accountId?: string | null;
+}): Promise<{ channel: "mixin"; messageId: string }> {
+  const accountId = params.accountId ?? "default";
+  let lastMessageId = params.to;
+
+  if (params.text?.trim()) {
+    const textResult = await sendTextMessage(params.cfg, accountId, params.to, undefined, params.text);
+    if (!textResult.ok) {
+      throw new Error(textResult.error ?? "mixin outbound text send failed");
+    }
+    lastMessageId = textResult.messageId ?? lastMessageId;
+  }
+
+  const runtime = getMixinRuntime();
+  for (const mediaUrl of params.mediaUrls ?? []) {
+    const loaded = await runtime.media.loadWebMedia(mediaUrl, {
+      maxBytes: MEDIA_MAX_BYTES,
+      localRoots: params.mediaLocalRoots,
+    });
+    const saved = await runtime.channel.media.saveMediaBuffer(
+      loaded.buffer,
+      loaded.contentType,
+      "mixin",
+      MEDIA_MAX_BYTES,
+      loaded.fileName,
+    );
+
+    if (loaded.kind === "audio") {
+      const duration = await resolveAudioDurationSeconds(saved.path);
+      if (duration !== null) {
+        const audioResult = await sendAudioMessage(
+          params.cfg,
+          accountId,
+          params.to,
+          undefined,
+          {
+            filePath: saved.path,
+            mimeType: saved.contentType ?? loaded.contentType,
+            duration,
+          },
+        );
+        if (!audioResult.ok) {
+          throw new Error(audioResult.error ?? "mixin outbound audio send failed");
+        }
+        lastMessageId = audioResult.messageId ?? lastMessageId;
+        continue;
+      }
+    }
+
+    const fileResult = await sendFileMessage(
+      params.cfg,
+      accountId,
+      params.to,
+      undefined,
+      {
+        filePath: saved.path,
+        fileName: loaded.fileName,
+        mimeType: saved.contentType ?? loaded.contentType,
+      },
+    );
+    if (!fileResult.ok) {
+      throw new Error(fileResult.error ?? "mixin outbound file send failed");
+    }
+    lastMessageId = fileResult.messageId ?? lastMessageId;
+  }
+
+  return { channel: "mixin", messageId: lastMessageId };
+}
+
 export const mixinPlugin = {
   id: "mixin",
 
@@ -41,7 +153,7 @@ export const mixinPlugin = {
     chatTypes: ["direct", "group"] as Array<"direct" | "group">,
     reactions: false,
     threads: false,
-    media: false,
+    media: true,
     nativeCommands: false,
     blockStreaming: false,
   },
@@ -53,24 +165,48 @@ export const mixinPlugin = {
     defaultAccountId: () => "default",
   },
 
+  pairing: {
+    idLabel: "Mixin UUID",
+    normalizeAllowEntry: (entry: string) => entry.trim().toLowerCase(),
+  },
+
   security: {
     resolveDmPolicy: ({ account, accountId }: { account: ResolvedMixinAccount; accountId?: string | null }) => {
       const allowFrom = account.config.allowFrom ?? [];
       const basePath = accountId && accountId !== "default" ? `.accounts.${accountId}` : "";
+      const policy = account.config.dmPolicy ?? "pairing";
 
       return {
-        policy: "allowlist" as const,
+        policy,
         allowFrom,
+        policyPath: `channels.mixin${basePath}.dmPolicy`,
         allowFromPath: `channels.mixin${basePath}.allowFrom`,
-        approveHint: allowFrom.length > 0
-          ? `已配置白名单用户数 ${allowFrom.length}，将用户的 Mixin UUID 添加到 allowFrom 列表即可授权`
-          : "将用户的 Mixin UUID 添加到 allowFrom 列表即可授权",
+        approveHint: policy === "pairing"
+          ? formatPairingApproveHint("mixin")
+          : allowFrom.length > 0
+            ? `已配置白名单用户数 ${allowFrom.length}，将用户的 Mixin UUID 添加到 allowFrom 列表即可授权`
+            : "将用户的 Mixin UUID 添加到 allowFrom 列表即可授权",
       };
     },
   },
 
   outbound: {
     deliveryMode: "direct" as const,
+    sendPayload: async (ctx: {
+      cfg: OpenClawConfig;
+      to: string;
+      payload: ReplyPayload;
+      mediaLocalRoots?: readonly string[];
+      accountId?: string | null;
+    }) =>
+      deliverOutboundMixinPayload({
+        cfg: ctx.cfg,
+        to: ctx.to,
+        text: ctx.payload.text,
+        mediaUrls: resolvePayloadMediaUrls(ctx.payload),
+        mediaLocalRoots: ctx.mediaLocalRoots,
+        accountId: ctx.accountId,
+      }),
 
     sendText: async (ctx: {
       cfg: OpenClawConfig;
@@ -85,6 +221,22 @@ export const mixinPlugin = {
       }
       throw new Error(result.error ?? "sendText failed");
     },
+    sendMedia: async (ctx: {
+      cfg: OpenClawConfig;
+      to: string;
+      text: string;
+      mediaUrl?: string;
+      mediaLocalRoots?: readonly string[];
+      accountId?: string | null;
+    }) =>
+      deliverOutboundMixinPayload({
+        cfg: ctx.cfg,
+        to: ctx.to,
+        text: ctx.text,
+        mediaUrls: ctx.mediaUrl ? [ctx.mediaUrl] : [],
+        mediaLocalRoots: ctx.mediaLocalRoots,
+        accountId: ctx.accountId,
+      }),
   },
 
   gateway: {

package/src/config-schema.ts

@@ -1,3 +1,4 @@
+import { DmPolicySchema } from "openclaw/plugin-sdk";
 import { z } from "zod";
 
 export const MixinProxyConfigSchema = z.object({
@@ -28,6 +29,7 @@ export const MixinAccountConfigSchema = z.object({
   sessionId: z.string().optional(),
   serverPublicKey: z.string().optional(),
   sessionPrivateKey: z.string().optional(),
+  dmPolicy: DmPolicySchema.optional().default("pairing"),
   allowFrom: z.array(z.string()).optional().default([]),
   requireMentionInGroup: z.boolean().optional().default(true),
   debug: z.boolean().optional().default(false),

package/src/config.ts

@@ -41,6 +41,7 @@ export function resolveAccount(cfg: OpenClawConfig, accountId?: string) {
     sessionId: config.sessionId,
     serverPublicKey: config.serverPublicKey,
     sessionPrivateKey: config.sessionPrivateKey,
+    dmPolicy: config.dmPolicy,
     allowFrom: config.allowFrom,
     requireMentionInGroup: config.requireMentionInGroup,
     debug: config.debug,