@lansenger-pm/openclaw-lansenger-channel 3.16.3 → 3.16.5

package/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [3.16.5] - 2026-06-23
+
+### Added
+
+- **Native approval cards for exec commands**: Non-whitelist exec commands now trigger interactive approval cards. Users approve or deny via button clicks or `/approve <id>` slash commands. Cards update status in-place after resolution.
+- **`lansenger_send_approve_card`** Agent tool for sending interactive approval cards.
+- **`accountId` parameter** on all send tools (`lansenger_send_*`) for correct bot routing in multi-account setups.
+- **Auto-register native slash commands**: Built-in commands (`/help`, `/models`, `/reset`, etc.) are now auto-synced to Lansenger via `/v1/bot/commands/create` on gateway startup so they appear in the client command picker. Includes multi-language descriptions (zhHans/zhHant/zhHantHK/en/fr) via new `command-i18n.ts`.
+- **Auto-configured approvers**: Bot owner from `homeChannel` is automatically used when `approvals.exec.allowFrom.lansenger` is not set.
+- **`commands` block** in plugin manifest (`nativeCommandsAutoEnabled: true`, `nativeSkillsAutoEnabled: true`).
+
+### Changed
+
+- **Tool registration**: Refactored from inline factory arrays to declarative schema objects with `makeToolClient` lookup.
+- **`reminderUserIds` description**: Updated to reflect that `@姓名` must be written in the message text (Lansenger API no longer auto-prepends names).
+- **Multi-level config section fallback**: `dmPolicy`, `allowFrom`, `homeChannel`, and `apiGatewayUrl` in `resolveAccount` now fall back from account → section level (previously only account-level values were read).
+- **Documentation**: All 5 README config tables, `lansenger-setup` SKILL, and `lansenger-messaging` SKILL updated with missing config keys and approval workflow notes.
+
+### Fixed
+
+- **@BotName stripping broken for mid-message mentions**: Changed `endsWith` to `includes` so `"/models@bot openai"` is correctly normalized to `"/models openai"`.
+- **Blocked commands silently dropped**: Reply "此命令需要授权。"/"This command requires authorization." when an unauthorized user attempts a slash command.
+
 ## [3.16.3] - 2026-06-22
 
 ### Fixed

package/README.fr.md

@@ -184,6 +184,8 @@ Les identifiants peuvent aussi être fournis via la configuration `openclaw.json
 | `mediaLocalRoots` | Répertoires racine autorisés pour l'envoi de fichiers locaux via média ; tableau vide par défaut = workspace + `/tmp` | `[cwd, /tmp]` |
 | `ackMessageTextZh` | Texte du message ack en chinois | `收到，正在处理...` |
 | `ackMessageTextEn` | Texte du message ack en anglais | `Received, processing...` |
+| `requireMention` | Nécessite une mention `@nom_du_bot` pour déclencher dans les groupes. Mettre `false` pour répondre à tous les messages. | `true` |
+| `dangerouslyAllowPrivateNetwork` | Permettre à `sendImageUrl` de récupérer des images depuis des réseaux privés/internes (RFC1918, link-local, IP metadata). Désactivé par défaut pour la protection SSRF. | `false` |
 
 ### Debounce entrant (fusion de messages)
 

package/README.md

@@ -176,6 +176,8 @@ Credentials can also be provided via `openclaw.json` config (see Optional Config
 | `mediaLocalRoots` | Allowed root directories for sending local files via media; empty array defaults to workspace + `/tmp` | `[cwd, /tmp]` |
 | `ackMessageTextZh` | Chinese ack message text | `收到，正在处理...` |
 | `ackMessageTextEn` | English ack message text | `Received, processing...` |
+| `requireMention` | Require `@botName` mention to trigger in groups. Set `false` to respond to all messages. | `true` |
+| `dangerouslyAllowPrivateNetwork` | Allow `sendImageUrl` to fetch images from private/internal networks (RFC1918, link-local, metadata IPs). Disabled by default for SSRF protection. | `false` |
 
 ### Inbound Debounce (Message Merging)
 

package/README.zhHans.md

@@ -184,6 +184,8 @@ openclaw pairing approve lansenger <配对码>
 | `mediaLocalRoots` | 通过媒体发送本地文件时允许的根目录列表；空数组默认为工作区 + `/tmp` | `[cwd, /tmp]` |
 | `ackMessageTextZh` | 中文确认消息文案 | `收到，正在处理...` |
 | `ackMessageTextEn` | 英文确认消息文案 | `Received, processing...` |
+| `requireMention` | 群聊中是否需要 @机器人才会触发。设为 `false` 则任何消息都会触发。 | `true` |
+| `dangerouslyAllowPrivateNetwork` | 允许 `sendImageUrl` 从内网地址获取图片（RFC1918、链路本地、metadata IP）。默认禁用以防止 SSRF 攻击。 | `false` |
 
 ### 入站防抖合并（消息合并）
 

package/README.zhHant.md

@@ -184,6 +184,8 @@ openclaw pairing approve lansenger <配對碼>
 | `mediaLocalRoots` | 透過媒體傳送本地檔案時允許的根目錄列表；空陣列預設為工作區 + `/tmp` | `[cwd, /tmp]` |
 | `ackMessageTextZh` | 中文確認訊息文案 | `收到，正在處理...` |
 | `ackMessageTextEn` | 英文確認訊息文案 | `Received, processing...` |
+| `requireMention` | 羣聊中是否需要 @機器人才會觸發。設為 `false` 則任何訊息都會觸發。 | `true` |
+| `dangerouslyAllowPrivateNetwork` | 允許 `sendImageUrl` 從內網地址獲取圖片（RFC1918、鏈路本地、metadata IP）。預設禁用以防止 SSRF 攻擊。 | `false` |
 
 ### 入站防抖合併（訊息合併）
 

package/README.zhHantHK.md

@@ -184,6 +184,8 @@ openclaw pairing approve lansenger <配對碼>
 | `mediaLocalRoots` | 透過媒體發送本地檔案時允許的根目錄列表；空陣列預設為工作區 + `/tmp` | `[cwd, /tmp]` |
 | `ackMessageTextZh` | 中文確認訊息文案 | `收到，正在處理...` |
 | `ackMessageTextEn` | 英文確認訊息文案 | `Received, processing...` |
+| `requireMention` | 羣聊中是否需要 @機器人才會觸發。設為 `false` 則任何訊息都會觸發。 | `true` |
+| `dangerouslyAllowPrivateNetwork` | 允許 `sendImageUrl` 從內網地址獲取圖片（RFC1918、鏈路本地、metadata IP）。預設禁用以防止 SSRF 攻擊。 | `false` |
 
 ### 入站防抖合併（訊息合併）