@invago/mixin 1.0.7 → 1.0.9

package/README.md

@@ -65,11 +65,19 @@ Edit your `openclaw.json` file manually and add both the channel configuration a
   "channels": {
     "mixin": {
       "enabled": true,
+      "defaultAccount": "default",
       "appId": "YOUR_APP_ID",
       "sessionId": "YOUR_SESSION_ID",
       "serverPublicKey": "YOUR_SERVER_PUBLIC_KEY_BASE64",
       "sessionPrivateKey": "YOUR_SESSION_PRIVATE_KEY_BASE64",
+      "dmPolicy": "pairing",
       "allowFrom": ["AUTHORIZED_USER_UUID"],
+      "requireMentionInGroup": true,
+      "mediaBypassMentionInGroup": true,
+      "mediaMaxMb": 30,
+      "audioSendAsVoiceByDefault": true,
+      "audioAutoDetectDuration": true,
+      "audioRequireFfprobe": false,
       "proxy": {
         "enabled": true,
         "url": "socks5://127.0.0.1:10808",
@@ -93,9 +101,32 @@ Notes:
 
 - `channels.mixin` configures the channel itself.
 - `plugins.allow` and `plugins.entries.mixin.enabled` are also required so OpenClaw loads this plugin.
-- This plugin currently uses `allowFrom` as its sender allowlist. Do not assume other generic OpenClaw DM policy fields apply here unless the plugin explicitly supports them.
+- Mixin supports the standard OpenClaw direct-message policies. The recommended setting is `dmPolicy: "pairing"`.
+- `allowFrom` remains useful for pre-authorized users or manual overrides. Pairing approvals are stored in OpenClaw's pairing allowlist store.
 - If `proxy.url` already contains credentials, `proxy.username` and `proxy.password` can be omitted.
 
+## Pairing
+
+For private chats, the recommended mode is:
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "dmPolicy": "pairing"
+    }
+  }
+}
+```
+
+Behavior:
+
+- A new, unauthorized Mixin user gets an 8-character pairing code in the DM.
+- Approve that user with `openclaw pairing approve mixin <code>`.
+- Use `openclaw pairing list mixin` to inspect pending pairing requests.
+- Once approved, the user is added to OpenClaw's pairing allowlist store for the `mixin` channel.
+- `allowFrom` is still honored and can be used alongside pairing for users you want to pre-authorize.
+
 ## Avoid Cross-Channel Session Mixing
 
 Mixin group chats already stay isolated by channel, but direct-message sessions follow the OpenClaw `session.dmScope` policy. If you keep the default `main` scope, Mixin direct messages can share the same main session with other channels such as Feishu.
@@ -117,12 +148,26 @@ Use `per-account-channel-peer` instead if you run multiple Mixin accounts and wa
 | Parameter | Required | Default | Description |
 |-----------|----------|---------|-------------|
 | `enabled` | No | `true` | Enable or disable this channel account |
+| `defaultAccount` | No | `default` | Default account ID used when `accounts` is configured |
 | `appId` | Yes | - | Mixin App UUID |
 | `sessionId` | Yes | - | Session UUID |
 | `serverPublicKey` | Yes | - | Server Public Key (Base64) |
 | `sessionPrivateKey` | Yes | - | Session Private Key (Ed25519 Base64) |
+| `dmPolicy` | No | `pairing` | Direct-message policy: `pairing`, `allowlist`, `open`, or `disabled` |
 | `allowFrom` | No | `[]` | Authorized user UUID whitelist |
+| `groupPolicy` | No | OpenClaw default | Group-message policy: `open`, `allowlist`, or `disabled` |
+| `groupAllowFrom` | No | `[]` | Authorized sender UUID whitelist for group messages when `groupPolicy` uses allowlisting |
 | `requireMentionInGroup` | No | `true` | Require trigger words in group chats |
+| `mediaBypassMentionInGroup` | No | `true` | Allow inbound group file/audio messages through even without trigger text |
+| `mediaMaxMb` | No | `30` | Max inbound and outbound media size in MB |
+| `audioSendAsVoiceByDefault` | No | `true` | Send OpenClaw native outbound audio as Mixin voice when possible |
+| `audioAutoDetectDuration` | No | `true` | Detect native outbound audio duration with `ffprobe` before sending voice |
+| `audioRequireFfprobe` | No | `false` | Fail native outbound audio instead of falling back to file when duration detection is unavailable |
+| `conversations.<conversationId>.enabled` | No | `true` | Enable or disable a specific group conversation |
+| `conversations.<conversationId>.requireMention` | No | Inherit account | Override group trigger-word requirement for a specific conversation |
+| `conversations.<conversationId>.allowFrom` | No | Inherit account | Override group sender allowlist for a specific conversation |
+| `conversations.<conversationId>.mediaBypassMention` | No | Inherit account | Override whether file/audio messages bypass mention filtering |
+| `conversations.<conversationId>.groupPolicy` | No | Inherit account | Override group policy for a specific conversation |
 | `debug` | No | `false` | Debug mode |
 | `proxy.enabled` | No | `false` | Enable per-plugin proxy |
 | `proxy.url` | Required when enabled | - | Proxy URL such as `http://127.0.0.1:7890` or `socks5://127.0.0.1:10808` |
@@ -135,6 +180,38 @@ Use `per-account-channel-peer` instead if you run multiple Mixin accounts and wa
 - Supported proxy URL styles depend on the underlying proxy agent stack; typical values are `http://...`, `https://...`, and `socks5://...`.
 - You must provide your own proxy software or proxy server. The plugin only consumes a proxy, it does not create one.
 
+## Group Access Control
+
+Mixin now supports formal group access controls in addition to direct-message `dmPolicy`.
+
+- `groupPolicy: "open"` allows any sender in a group conversation.
+- `groupPolicy: "allowlist"` requires the sender UUID to appear in `groupAllowFrom`.
+- `groupPolicy: "disabled"` blocks the entire conversation.
+- `conversations.<conversationId>` overrides account-level group settings for that single conversation.
+
+Example:
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "groupPolicy": "allowlist",
+      "groupAllowFrom": ["USER_A_UUID"],
+      "conversations": {
+        "70000000-0000-0000-0000-000000000001": {
+          "requireMention": false,
+          "allowFrom": ["USER_B_UUID"],
+          "mediaBypassMention": false
+        },
+        "70000000-0000-0000-0000-000000000002": {
+          "enabled": false
+        }
+      }
+    }
+  }
+}
+```
+
 ## Usage
 
 - Direct message: `/status` or `Hello`
@@ -156,6 +233,18 @@ Plugin-specific command:
 - Send `/mixin-outbox` to inspect the current pending queue size, next retry time, and latest error.
 - Send `/mixin-outbox purge-invalid` to remove old `APP_CARD` / `APP_BUTTON_GROUP` entries that are stuck on permanent invalid-field errors.
 
+Companion onboarding CLI:
+
+- This repository also includes a companion CLI at [tools/mixin-plugin-onboard/README.md](/E:/AI/mixin-claw/tools/mixin-plugin-onboard/README.md).
+- It is bundled into the same npm package, `@invago/mixin`.
+- It currently provides `info`, `doctor`, `install`, and `update` commands for local OpenClaw + Mixin plugin maintenance.
+- Local examples:
+  - `node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts info`
+  - `node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts doctor`
+- Installed package examples:
+  - `npx -y @invago/mixin info`
+  - `npx -y @invago/mixin doctor`
+
 ## Delivery and Retry Behavior
 
 - Outbound messages are persisted to a local outbox before send attempts.
@@ -163,6 +252,32 @@ Plugin-specific command:
 - Pending messages survive plugin restarts.
 - Inbound Blaze messages are acknowledged before dispatch so Mixin receives a read receipt as early as possible.
 
+## Media Support
+
+Current media behavior is split into outbound and inbound support:
+
+- OpenClaw native outbound media is enabled through the channel `sendMedia` path.
+- OpenClaw native `sendPayload` now uses the same Mixin outbound planner as buffered agent replies, so text/post/buttons/card/file/audio selection is consistent.
+- The plugin sends outbound audio as `PLAIN_AUDIO` when it can resolve the media as audio and detect duration.
+- If audio duration cannot be detected, the plugin falls back to regular file attachment sending.
+- Non-audio outbound media is sent as Mixin file attachments.
+- If OpenClaw sends both caption text and media, the plugin sends the text first and then the file.
+- Voice-bubble style outbound audio is currently intended for the explicit `mixin-audio` template path.
+- Inbound `PLAIN_DATA` and `PLAIN_AUDIO` messages are downloaded, saved locally, and attached to the OpenClaw inbound context through `MediaPath` / `MediaType`.
+- Group attachment messages are allowed through even when `requireMentionInGroup` is enabled, unless `mediaBypassMentionInGroup` is set to `false`.
+
+Current limits:
+
+- Outbound audio does not transcode automatically.
+- `mixin-audio` still requires a prepared local file, explicit `duration`, and optional `waveForm`.
+- OpenClaw native outbound audio depends on local `ffprobe` availability to detect duration.
+- OpenClaw native `sendMedia` still does not generate `waveForm`, so explicit `mixin-audio` remains the most deterministic path for polished voice-message output.
+- Whether the agent can summarize, transcribe, or reason over inbound files/audio depends on your OpenClaw media-understanding configuration.
+
+Manual test guide:
+
+- See [docs/media-testing.md](docs/media-testing.md) for ready-to-run prompts and expected results.
+
 ## Explicit Reply Templates
 
 When you want deterministic Mixin output instead of heuristic auto-selection, have the agent reply with exactly one fenced template block.
@@ -214,11 +329,40 @@ Card:
 ```
 ```
 
+File:
+
+```text
+```mixin-file
+{
+  "filePath": "/absolute/path/to/report.pdf",
+  "fileName": "report.pdf",
+  "mimeType": "application/pdf"
+}
+```
+```
+
+Audio:
+
+```text
+```mixin-audio
+{
+  "filePath": "/absolute/path/to/voice.ogg",
+  "mimeType": "audio/ogg",
+  "duration": 12,
+  "waveForm": "AAMMQQ=="
+}
+```
+```
+
 Rules:
 
 - Explicit templates take priority over automatic detection.
 - Replies containing tables or fenced code blocks are sent as `mixin-post` by default.
 - `mixin-buttons` and `mixin-card` accept JSON only.
+- `mixin-file` and `mixin-audio` also accept JSON only.
+- `mixin-audio` requires `duration` in seconds. `waveForm` is optional.
+- `mixin-file` and `mixin-audio` require absolute local file paths on the machine where OpenClaw runs.
+- Invalid explicit `mixin-*` templates are no longer dropped silently; the plugin now sends a visible `Mixin template error: ...` message instead.
 - Button and card links must use `http://` or `https://`.
 - Mixin clients may require your target domains to be present in the bot app's `Resource Patterns` allowlist.
 
@@ -235,6 +379,7 @@ Rules:
           "sessionId": "...",
           "serverPublicKey": "...",
           "sessionPrivateKey": "...",
+          "dmPolicy": "pairing",
           "allowFrom": ["..."]
         },
         "bot2": {
@@ -260,14 +405,14 @@ Rules:
 |---------|---------------|
 | Plugin not loaded | Run `openclaw plugins list` and `openclaw plugins info mixin` |
 | Channel not starting | Verify `channels.mixin` exists and credentials are complete |
-| Not receiving messages | Check `allowFrom`, trigger words, and Blaze connectivity |
+| Not receiving messages | Check pairing approval or `allowFrom`, trigger words, and Blaze connectivity |
 | Messages not sending | Check proxy reachability, outbox backlog, and `/mixin-outbox` output |
 | Repeated inbound pushes | Check Blaze connectivity and confirm ACK logs/behavior |
 
 ## Security Notes
 
 - Keep `sessionPrivateKey` private.
-- Use `allowFrom` in production.
+- Use `dmPolicy: "pairing"` or a strict `allowFrom` list in production.
 - Outbox files contain pending message bodies, so do not expose the `data/` directory.
 
 ## Links

package/README.zh-CN.md

@@ -66,11 +66,19 @@ openclaw plugins install .
   "channels": {
     "mixin": {
       "enabled": true,
+      "defaultAccount": "default",
       "appId": "你的 App ID",
       "sessionId": "你的 Session ID",
       "serverPublicKey": "服务端公钥 Base64",
       "sessionPrivateKey": "会话私钥 Base64",
+      "dmPolicy": "pairing",
       "allowFrom": ["授权用户 UUID"],
+      "requireMentionInGroup": true,
+      "mediaBypassMentionInGroup": true,
+      "mediaMaxMb": 30,
+      "audioSendAsVoiceByDefault": true,
+      "audioAutoDetectDuration": true,
+      "audioRequireFfprobe": false,
       "proxy": {
         "enabled": true,
         "url": "socks5://127.0.0.1:10808",
@@ -94,9 +102,32 @@ openclaw plugins install .
 
 - `channels.mixin` 负责配置这个频道本身。
 - `plugins.allow` 和 `plugins.entries.mixin.enabled` 也需要配置，否则 OpenClaw 不会加载这个插件。
-- 当前插件使用 `allowFrom` 作为发送者白名单，不要直接套用其他 OpenClaw 通用 DM 策略字段，除非插件明确支持。
+- Mixin 现在支持 OpenClaw 官方的私聊 `dmPolicy`，推荐使用 `dmPolicy: "pairing"`。
+- `allowFrom` 仍然保留，适合预授权用户或人工补充白名单；配对批准结果会写入 OpenClaw 的 pairing allowlist store。
 - 如果 `proxy.url` 已经包含认证信息，可以不再填写 `proxy.username` 和 `proxy.password`。
 
+## 配对模式
+
+私聊推荐配置：
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "dmPolicy": "pairing"
+    }
+  }
+}
+```
+
+行为说明：
+
+- 未授权的私聊用户会先收到一个 8 位配对码。
+- 管理员使用 `openclaw pairing approve mixin <code>` 完成批准。
+- 使用 `openclaw pairing list mixin` 查看待批准的配对请求。
+- 批准后，该用户会被加入 OpenClaw 的 `mixin` pairing allowlist store。
+- `allowFrom` 仍然生效，可以和 pairing 一起使用。
+
 ## 避免跨通道串会话
 
 Mixin 群聊本身会按频道隔离，但私聊会话是否独立，取决于 OpenClaw 的 `session.dmScope` 配置。如果保持默认的 `main`，Mixin 私聊可能会和飞书等其它通道共用同一个主会话。
@@ -118,12 +149,26 @@ Mixin 群聊本身会按频道隔离，但私聊会话是否独立，取决于 O
 | 参数 | 必填 | 默认值 | 说明 |
 |------|------|--------|------|
 | `enabled` | 否 | `true` | 是否启用该频道账号 |
+| `defaultAccount` | 否 | `default` | 配置了 `accounts` 时默认使用的账号 ID |
 | `appId` | 是 | - | Mixin 应用 UUID |
 | `sessionId` | 是 | - | 会话 UUID |
 | `serverPublicKey` | 是 | - | 服务端公钥 Base64 |
 | `sessionPrivateKey` | 是 | - | 会话私钥 Ed25519 Base64 |
+| `dmPolicy` | 否 | `pairing` | 私聊策略：`pairing`、`allowlist`、`open`、`disabled` |
 | `allowFrom` | 否 | `[]` | 授权用户 UUID 白名单 |
+| `groupPolicy` | 否 | 跟随 OpenClaw 默认值 | 群消息策略：`open`、`allowlist`、`disabled` |
+| `groupAllowFrom` | 否 | `[]` | 当 `groupPolicy` 走 allowlist 时，允许触发群消息的发送者 UUID 白名单 |
 | `requireMentionInGroup` | 否 | `true` | 群聊是否要求触发词 |
+| `mediaBypassMentionInGroup` | 否 | `true` | 群里的文件/语音消息是否可绕过文本触发词过滤 |
+| `mediaMaxMb` | 否 | `30` | 入站和出站媒体大小上限，单位 MB |
+| `audioSendAsVoiceByDefault` | 否 | `true` | OpenClaw 原生音频出站时尽量按 Mixin 语音发送 |
+| `audioAutoDetectDuration` | 否 | `true` | 发送原生音频前是否用 `ffprobe` 自动探测时长 |
+| `audioRequireFfprobe` | 否 | `false` | 时长探测不可用时是否直接失败，而不是降级为文件发送 |
+| `conversations.<conversationId>.enabled` | 否 | `true` | 是否启用某个指定群会话 |
+| `conversations.<conversationId>.requireMention` | 否 | 继承账号级配置 | 覆盖该群会话的触发词要求 |
+| `conversations.<conversationId>.allowFrom` | 否 | 继承账号级配置 | 覆盖该群会话的发送者白名单 |
+| `conversations.<conversationId>.mediaBypassMention` | 否 | 继承账号级配置 | 覆盖该群会话中文件/语音是否绕过触发词过滤 |
+| `conversations.<conversationId>.groupPolicy` | 否 | 继承账号级配置 | 覆盖该群会话的群消息策略 |
 | `debug` | 否 | `false` | 调试模式 |
 | `proxy.enabled` | 否 | `false` | 是否启用插件级代理 |
 | `proxy.url` | 启用时必填 | - | 代理地址，例如 `http://127.0.0.1:7890` 或 `socks5://127.0.0.1:10808` |
@@ -136,6 +181,38 @@ Mixin 群聊本身会按频道隔离，但私聊会话是否独立，取决于 O
 - 常见代理地址格式包括 `http://...`、`https://...`、`socks5://...`。
 - 代理软件或代理服务器需要你自己提供，插件只负责使用代理。
 
+## 群聊访问控制
+
+现在除了私聊 `dmPolicy`，Mixin 也支持正式的群聊访问控制：
+
+- `groupPolicy: "open"` 表示群里任何发送者都可以触发。
+- `groupPolicy: "allowlist"` 表示只有 `groupAllowFrom` 里的发送者 UUID 可以触发。
+- `groupPolicy: "disabled"` 表示整个群会话被禁用。
+- `conversations.<conversationId>` 可以对某一个群会话覆盖账号级配置。
+
+示例：
+
+```json
+{
+  "channels": {
+    "mixin": {
+      "groupPolicy": "allowlist",
+      "groupAllowFrom": ["USER_A_UUID"],
+      "conversations": {
+        "70000000-0000-0000-0000-000000000001": {
+          "requireMention": false,
+          "allowFrom": ["USER_B_UUID"],
+          "mediaBypassMention": false
+        },
+        "70000000-0000-0000-0000-000000000002": {
+          "enabled": false
+        }
+      }
+    }
+  }
+}
+```
+
 ## 使用方式
 
 - 私聊：`/status` 或 `你好`
@@ -157,6 +234,18 @@ openclaw status
 - 发送 `/mixin-outbox` 可查看当前待发队列数量、下次重试时间和最近错误。
 - 发送 `/mixin-outbox purge-invalid` 可删除历史遗留的 `APP_CARD` / `APP_BUTTON_GROUP` 永久无效重试项。
 
+配套运维 CLI：
+
+- 仓库里已经附带了一套配套工具，见 [tools/mixin-plugin-onboard/README.md](/E:/AI/mixin-claw/tools/mixin-plugin-onboard/README.md)。
+- 这套工具会和主包 `@invago/mixin` 一起发布，不再是单独第二个 npm 包。
+- 当前提供 `info`、`doctor`、`install`、`update` 四个命令，用于本地 OpenClaw + Mixin 插件的安装和诊断。
+- 本地运行示例：
+  - `node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts info`
+  - `node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts doctor`
+- 安装后使用示例：
+  - `npx -y @invago/mixin info`
+  - `npx -y @invago/mixin doctor`
+
 ## 投递与重试行为
 
 - 回复消息会先写入本地 outbox，再由后台 worker 发送。
@@ -164,6 +253,32 @@ openclaw status
 - 插件重启后，未完成的消息仍会继续补发。
 - 入站 Blaze 消息会在分发前尽快 ACK，尽量减少 Mixin 的重复推送。
 
+## 媒体支持现状
+
+当前媒体能力分为发送侧和接收侧：
+
+- OpenClaw 原生媒体发送已经接入频道 `sendMedia`。
+- OpenClaw 原生 `sendPayload` 现在也会复用同一套 Mixin 出站 planner，所以文本、长文、按钮、卡片、文件、语音的选择逻辑和 agent 缓冲回复保持一致。
+- 当插件能把媒体识别为音频并成功拿到时长时，会优先按 `PLAIN_AUDIO` 发送。
+- 如果拿不到音频时长，会平稳降级为普通文件附件发送。
+- 非音频媒体会按 Mixin 文件附件发送。
+- 如果 OpenClaw 同时给出文本和媒体，插件会先发文本，再发文件。
+- 语音气泡式发送目前仍更适合走显式 `mixin-audio` 模板。
+- 入站 `PLAIN_DATA` 和 `PLAIN_AUDIO` 会被下载到本地，并通过 `MediaPath` / `MediaType` 挂到 OpenClaw 入站上下文。
+- 即使启用了 `requireMentionInGroup`，群里的附件消息也不会再因为缺少文本触发词被直接过滤；如果你把 `mediaBypassMentionInGroup` 设为 `false`，则会恢复和普通文本相同的群聊触发规则。
+
+当前边界：
+
+- 发送语音时不做自动转码。
+- `mixin-audio` 仍要求你提供已经准备好的本地文件，并显式给出 `duration`，`waveForm` 可选。
+- OpenClaw 原生音频发送依赖本机可用的 `ffprobe` 来提取时长。
+- OpenClaw 原生 `sendMedia` 仍不会自动生成 `waveForm`，所以如果你想更稳定地控制语音消息效果，显式 `mixin-audio` 仍然是最稳妥的路径。
+- 是否能自动总结文件、转写语音，取决于你的 OpenClaw 媒体理解配置是否开启。
+
+联调手册：
+
+- 见 [docs/media-testing.zh-CN.md](docs/media-testing.zh-CN.md)。
+
 ## 显式回复模板
 
 如果你希望 Mixin 回复严格按指定形式发送，而不是依赖自动判断，可以让 agent 只输出一个 fenced code block 模板。
@@ -215,11 +330,40 @@ openclaw status
 ```
 ```
 
+文件：
+
+```text
+```mixin-file
+{
+  "filePath": "/absolute/path/to/report.pdf",
+  "fileName": "report.pdf",
+  "mimeType": "application/pdf"
+}
+```
+```
+
+语音：
+
+```text
+```mixin-audio
+{
+  "filePath": "/absolute/path/to/voice.ogg",
+  "mimeType": "audio/ogg",
+  "duration": 12,
+  "waveForm": "AAMMQQ=="
+}
+```
+```
+
 规则：
 
 - 显式模板优先级高于自动识别。
 - 回复里只要出现表格或 fenced code block，默认就会走 `mixin-post` 长文。
 - `mixin-buttons` 和 `mixin-card` 只接受 JSON。
+- `mixin-file` 和 `mixin-audio` 也只接受 JSON。
+- `mixin-file` 和 `mixin-audio` 里的 `filePath` 必须是 OpenClaw 所在机器上的绝对路径。
+- `mixin-audio` 里的 `duration` 必填，单位为秒，`waveForm` 可选。
+- 如果显式 `mixin-*` 模板写错，插件不再静默跳过，而会直接发出可见的 `Mixin template error: ...` 文本提示。
 - 按钮和卡片链接必须使用 `http://` 或 `https://`。
 - Mixin 客户端可能要求目标域名已加入机器人应用的 `Resource Patterns` 白名单。
 
@@ -236,6 +380,7 @@ openclaw status
           "sessionId": "...",
           "serverPublicKey": "...",
           "sessionPrivateKey": "...",
+          "dmPolicy": "pairing",
           "allowFrom": ["..."]
         },
         "bot2": {
@@ -270,14 +415,14 @@ openclaw status
 | 插件未加载 | 运行 `openclaw plugins list` 和 `openclaw plugins info mixin` |
 | 频道未启动 | 检查 `channels.mixin` 是否存在，凭证是否完整 |
 | 插件未启用 | 检查 `plugins.allow` 和 `plugins.entries.mixin.enabled` |
-| 收不到消息 | 检查 `allowFrom`、触发词和 Blaze 连通性 |
+| 收不到消息 | 检查 pairing 是否已批准或 `allowFrom` 是否包含该用户，同时检查触发词和 Blaze 连通性 |
 | 消息发不出去 | 检查代理是否可达、outbox 堆积情况和 `/mixin-outbox` 输出 |
 | 入站消息重复推送 | 检查 Blaze 连通性，并确认 ACK 是否正常发送 |
 
 ## 安全提示
 
 - 妥善保管 `sessionPrivateKey`
-- 生产环境务必配置 `allowFrom`
+- 生产环境建议使用 `dmPolicy: "pairing"` 或严格的 `allowFrom`
 - outbox 文件会保存待发送消息正文，不要暴露 `data/` 目录
 
 ## 相关链接

package/package.json

@@ -1 +1 @@
-{"name":"@invago/mixin","version":"1.0.7","description":"Mixin Messenger channel plugin for OpenClaw","type":"module","main":"index.ts","scripts":{"dev":"nodemon --exec \"node --import jiti/register index.ts\" --ext ts","lint":"eslint src/**/*.ts index.ts","typecheck":"tsc --noEmit"},"peerDependencies":{"openclaw":">=2026.2.0"},"dependencies":{"@mixin.dev/mixin-node-sdk":"^7.4.1","@noble/curves":"^2.0.1","@noble/hashes":"^2.0.1","axios":"^1.6.0","express":"^5.2.1","proxy-agent":"^6.5.0","ws":"^8.18.3","zod":"^4.3.6"},"devDependencies":{"@eslint/js":"^10.0.1","@types/node":"^20.0.0","eslint":"^10.0.3","globals":"^17.4.0","jiti":"^1.21.0","nodemon":"^3.0.0","typescript":"^5.3.0","typescript-eslint":"^8.56.1"},"keywords":["openclaw","mixin","messenger","plugin","channel"],"author":"invagao","license":"MIT","repository":{"type":"git","url":"git+https://github.com/invago/mixinclaw.git"},"openclaw":{"extensions":["./index.ts"],"channel":{"id":"mixin","label":"Mixin Messenger","selectionLabel":"Mixin Messenger (Blaze WebSocket)","docsPath":"/channels/mixin","order":70,"aliases":["mixin-messenger","mixin"],"quickstartAllowFrom":true},"install":{"npmSpec":"@invago/mixin","localPath":"extensions/mixin"}}}
+{"name":"@invago/mixin","version":"1.0.9","description":"Mixin Messenger channel plugin for OpenClaw","type":"module","main":"index.ts","bin":{"mixin-plugin-onboard":"tools/mixin-plugin-onboard/bin/mixin-plugin-onboard.mjs"},"scripts":{"dev":"nodemon --exec \"node --import jiti/register index.ts\" --ext ts","lint":"eslint src/**/*.ts index.ts","typecheck":"tsc --noEmit","tool:info":"node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts info","tool:doctor":"node --import jiti/register.js tools/mixin-plugin-onboard/src/index.ts doctor"},"peerDependencies":{"openclaw":">=2026.2.0"},"dependencies":{"@mixin.dev/mixin-node-sdk":"^7.4.1","@noble/curves":"^2.0.1","@noble/hashes":"^2.0.1","axios":"^1.6.0","express":"^5.2.1","jiti":"^1.21.0","proxy-agent":"^6.5.0","ws":"^8.18.3","zod":"^4.3.6"},"devDependencies":{"@eslint/js":"^10.0.1","@types/node":"^20.0.0","eslint":"^10.0.3","globals":"^17.4.0","nodemon":"^3.0.0","typescript":"^5.3.0","typescript-eslint":"^8.56.1"},"keywords":["openclaw","mixin","messenger","plugin","channel"],"author":"invagao","license":"MIT","repository":{"type":"git","url":"git+https://github.com/invago/mixinclaw.git"},"openclaw":{"extensions":["./index.ts"],"channel":{"id":"mixin","label":"Mixin Messenger","selectionLabel":"Mixin Messenger (Blaze WebSocket)","docsPath":"/channels/mixin","order":70,"aliases":["mixin-messenger","mixin"],"quickstartAllowFrom":true},"install":{"npmSpec":"@invago/mixin","localPath":"extensions/mixin"}}}