@openclaw/qqbot 2026.5.1-beta.1

package/src/config-schema.ts

@@ -0,0 +1,84 @@
+import {
+  AllowFromListSchema,
+  buildChannelConfigSchema,
+} from "openclaw/plugin-sdk/channel-config-schema";
+import { buildSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
+import { z } from "zod";
+
+const AudioFormatPolicySchema = z
+  .object({
+    sttDirectFormats: z.array(z.string()).optional(),
+    uploadDirectFormats: z.array(z.string()).optional(),
+    transcodeEnabled: z.boolean().optional(),
+  })
+  .optional();
+
+const QQBotSttSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    provider: z.string().optional(),
+    baseUrl: z.string().optional(),
+    apiKey: z.string().optional(),
+    model: z.string().optional(),
+  })
+  .strict()
+  .optional();
+
+/** When `true`, same as `mode: "partial"` and `c2cStreamApi: true` for C2C. Object form kept for legacy configs. */
+const QQBotStreamingSchema = z
+  .union([
+    z.boolean(),
+    z
+      .object({
+        /** "partial" (default) enables block streaming; "off" disables it. */
+        mode: z.enum(["off", "partial"]).default("partial"),
+        /** @deprecated Prefer `streaming: true`. */
+        c2cStreamApi: z.boolean().optional(),
+      })
+      .passthrough(),
+  ])
+  .optional();
+
+const QQBotExecApprovalsSchema = z
+  .object({
+    enabled: z.union([z.boolean(), z.literal("auto")]).optional(),
+    approvers: z.array(z.string()).optional(),
+    agentFilter: z.array(z.string()).optional(),
+    sessionFilter: z.array(z.string()).optional(),
+    target: z.enum(["dm", "channel", "both"]).optional(),
+  })
+  .strict()
+  .optional();
+
+const QQBotDmPolicySchema = z.enum(["open", "allowlist", "disabled"]).optional();
+const QQBotGroupPolicySchema = z.enum(["open", "allowlist", "disabled"]).optional();
+
+const QQBotAccountSchema = z
+  .object({
+    enabled: z.boolean().optional(),
+    name: z.string().optional(),
+    appId: z.string().optional(),
+    clientSecret: buildSecretInputSchema().optional(),
+    clientSecretFile: z.string().optional(),
+    allowFrom: AllowFromListSchema,
+    groupAllowFrom: AllowFromListSchema,
+    dmPolicy: QQBotDmPolicySchema,
+    groupPolicy: QQBotGroupPolicySchema,
+    systemPrompt: z.string().optional(),
+    markdownSupport: z.boolean().optional(),
+    voiceDirectUploadFormats: z.array(z.string()).optional(),
+    audioFormatPolicy: AudioFormatPolicySchema,
+    urlDirectUpload: z.boolean().optional(),
+    upgradeUrl: z.string().optional(),
+    upgradeMode: z.enum(["doc", "hot-reload"]).optional(),
+    streaming: QQBotStreamingSchema,
+    execApprovals: QQBotExecApprovalsSchema,
+  })
+  .passthrough();
+
+export const QQBotConfigSchema = QQBotAccountSchema.extend({
+  stt: QQBotSttSchema,
+  accounts: z.object({}).catchall(QQBotAccountSchema.passthrough()).optional(),
+  defaultAccount: z.string().optional(),
+}).passthrough();
+export const qqbotChannelConfigSchema = buildChannelConfigSchema(QQBotConfigSchema);

package/src/config.test.ts

@@ -0,0 +1,364 @@
+import fs from "node:fs";
+import { type JsonSchemaObject, validateJsonSchemaValue } from "openclaw/plugin-sdk/config-schema";
+import type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
+import { describe, expect, it } from "vitest";
+import { qqbotSetupAdapterShared } from "./bridge/config-shared.js";
+import {
+  DEFAULT_ACCOUNT_ID,
+  resolveDefaultQQBotAccountId,
+  resolveQQBotAccount,
+} from "./bridge/config.js";
+import { qqbotSetupPlugin } from "./channel.setup.js";
+import { QQBotConfigSchema } from "./config-schema.js";
+import { makeQqbotDefaultAccountConfig, makeQqbotSecretRefConfig } from "./qqbot-test-support.js";
+
+describe("qqbot config", () => {
+  it("accepts top-level speech overrides in the manifest schema", () => {
+    const manifest = JSON.parse(
+      fs.readFileSync(new URL("../openclaw.plugin.json", import.meta.url), "utf-8"),
+    ) as { configSchema: JsonSchemaObject };
+
+    const result = validateJsonSchemaValue({
+      schema: manifest.configSchema,
+      cacheKey: "qqbot.manifest.speech-overrides",
+      value: {
+        stt: {
+          provider: "openai",
+          baseUrl: "https://example.com/v1",
+          apiKey: "stt-key",
+          model: "whisper-1",
+        },
+      },
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
+  it("accepts defaultAccount in the manifest schema", () => {
+    const manifest = JSON.parse(
+      fs.readFileSync(new URL("../openclaw.plugin.json", import.meta.url), "utf-8"),
+    ) as { configSchema: JsonSchemaObject };
+
+    const result = validateJsonSchemaValue({
+      schema: manifest.configSchema,
+      cacheKey: "qqbot.manifest.default-account",
+      value: {
+        defaultAccount: "bot2",
+        accounts: {
+          bot2: {
+            appId: "654321",
+          },
+        },
+      },
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
+  it("honors configured defaultAccount when resolving the default QQ Bot account id", () => {
+    const cfg = {
+      channels: {
+        qqbot: {
+          defaultAccount: "bot2",
+          accounts: {
+            bot2: {
+              appId: "654321",
+            },
+          },
+        },
+      },
+    } as OpenClawConfig;
+
+    expect(resolveDefaultQQBotAccountId(cfg)).toBe("bot2");
+  });
+
+  it("accepts SecretRef-backed credentials in the runtime schema", () => {
+    const parsed = QQBotConfigSchema.safeParse({
+      defaultAccount: "bot2",
+      appId: "123456",
+      clientSecret: {
+        source: "env",
+        provider: "default",
+        id: "QQBOT_CLIENT_SECRET",
+      },
+      allowFrom: ["*"],
+      audioFormatPolicy: {
+        sttDirectFormats: [".wav"],
+        uploadDirectFormats: [".mp3"],
+        transcodeEnabled: false,
+      },
+      urlDirectUpload: false,
+      upgradeUrl: "https://docs.openclaw.ai/channels/qqbot",
+      upgradeMode: "doc",
+      accounts: {
+        bot2: {
+          appId: "654321",
+          clientSecret: {
+            source: "env",
+            provider: "default",
+            id: "QQBOT_CLIENT_SECRET_BOT2",
+          },
+          allowFrom: ["user-1"],
+        },
+      },
+    });
+
+    expect(parsed.success).toBe(true);
+  });
+
+  it("accepts account-level speech overrides as forward-compatible config", () => {
+    const parsed = QQBotConfigSchema.safeParse({
+      accounts: {
+        bot2: {
+          appId: "654321",
+          stt: {
+            provider: "openai",
+          },
+        },
+      },
+    });
+
+    expect(parsed.success).toBe(true);
+  });
+
+  it("preserves top-level media and upgrade config on the default account", () => {
+    const cfg = {
+      channels: {
+        qqbot: {
+          appId: "123456",
+          clientSecret: "secret-value",
+          audioFormatPolicy: {
+            sttDirectFormats: [".wav"],
+            uploadDirectFormats: [".mp3"],
+            transcodeEnabled: false,
+          },
+          urlDirectUpload: false,
+          upgradeUrl: "https://docs.openclaw.ai/channels/qqbot",
+          upgradeMode: "hot-reload",
+        },
+      },
+    } as OpenClawConfig;
+
+    const resolved = resolveQQBotAccount(cfg, DEFAULT_ACCOUNT_ID);
+
+    expect(resolved.clientSecret).toBe("secret-value");
+    expect(resolved.config.audioFormatPolicy).toEqual({
+      sttDirectFormats: [".wav"],
+      uploadDirectFormats: [".mp3"],
+      transcodeEnabled: false,
+    });
+    expect(resolved.config.urlDirectUpload).toBe(false);
+    expect(resolved.config.upgradeUrl).toBe("https://docs.openclaw.ai/channels/qqbot");
+    expect(resolved.config.upgradeMode).toBe("hot-reload");
+  });
+
+  it("uses configured defaultAccount when accountId is omitted", () => {
+    const cfg = {
+      channels: {
+        qqbot: {
+          defaultAccount: "bot2",
+          accounts: {
+            bot2: {
+              appId: "654321",
+              clientSecret: "secret-value",
+              name: "Bot Two",
+            },
+          },
+        },
+      },
+    } as OpenClawConfig;
+
+    const resolved = resolveQQBotAccount(cfg);
+
+    expect(resolved.accountId).toBe("bot2");
+    expect(resolved.appId).toBe("654321");
+    expect(resolved.clientSecret).toBe("secret-value");
+    expect(resolved.name).toBe("Bot Two");
+  });
+
+  it("rejects unresolved SecretRefs on runtime resolution", () => {
+    const cfg = makeQqbotSecretRefConfig();
+
+    expect(() => resolveQQBotAccount(cfg, DEFAULT_ACCOUNT_ID)).toThrow(
+      'channels.qqbot.clientSecret: unresolved SecretRef "env:default:QQBOT_CLIENT_SECRET"',
+    );
+  });
+
+  it("allows unresolved SecretRefs for setup/status flows", () => {
+    const cfg = makeQqbotSecretRefConfig();
+
+    const resolved = resolveQQBotAccount(cfg, DEFAULT_ACCOUNT_ID, {
+      allowUnresolvedSecretRef: true,
+    });
+
+    expect(resolved.clientSecret).toBe("");
+    expect(resolved.secretSource).toBe("config");
+    expect(qqbotSetupPlugin.config.isConfigured?.(resolved, cfg)).toBe(true);
+    expect(qqbotSetupPlugin.config.describeAccount?.(resolved, cfg)?.configured).toBe(true);
+  });
+
+  it.each([
+    {
+      accountId: DEFAULT_ACCOUNT_ID,
+      inputAccountId: DEFAULT_ACCOUNT_ID,
+      expectedPath: ["channels", "qqbot"],
+    },
+    {
+      accountId: "bot2",
+      inputAccountId: "bot2",
+      expectedPath: ["channels", "qqbot", "accounts", "bot2"],
+    },
+  ])("splits --token on the first colon for $accountId", ({ inputAccountId, expectedPath }) => {
+    const setup = qqbotSetupPlugin.setup;
+    expect(setup).toBeDefined();
+
+    const next = setup!.applyAccountConfig?.({
+      cfg: {} as OpenClawConfig,
+      accountId: inputAccountId,
+      input: {
+        token: "102905186:Oi2Mg1Mh2Ni3:Pl7TpBXuHe1OmAYwKi7W",
+      },
+    }) as Record<string, unknown>;
+
+    const accountConfig = expectedPath.reduce<unknown>((value, key) => {
+      if (!value || typeof value !== "object") {
+        return undefined;
+      }
+      return (value as Record<string, unknown>)[key];
+    }, next) as Record<string, unknown> | undefined;
+
+    expect(accountConfig).toMatchObject({
+      enabled: true,
+      appId: "102905186",
+      clientSecret: "Oi2Mg1Mh2Ni3:Pl7TpBXuHe1OmAYwKi7W",
+    });
+  });
+
+  it("rejects malformed --token consistently across setup paths", () => {
+    const runtimeSetup = qqbotSetupAdapterShared;
+    const lightweightSetup = qqbotSetupPlugin.setup;
+    expect(runtimeSetup).toBeDefined();
+    expect(lightweightSetup).toBeDefined();
+
+    const input = { token: "broken", name: "Bad" };
+
+    expect(
+      runtimeSetup.validateInput?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toBe("QQBot --token must be in appId:clientSecret format");
+    expect(
+      lightweightSetup!.validateInput?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toBe("QQBot --token must be in appId:clientSecret format");
+    expect(
+      runtimeSetup.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toEqual({});
+    expect(
+      lightweightSetup!.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toEqual({});
+  });
+
+  it("preserves the --use-env add flow across setup paths", () => {
+    const runtimeSetup = qqbotSetupAdapterShared;
+    const lightweightSetup = qqbotSetupPlugin.setup;
+    expect(runtimeSetup).toBeDefined();
+    expect(lightweightSetup).toBeDefined();
+
+    const input = { useEnv: true, name: "Env Bot" };
+
+    expect(
+      runtimeSetup.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toMatchObject({
+      channels: {
+        qqbot: {
+          enabled: true,
+          allowFrom: ["*"],
+          name: "Env Bot",
+        },
+      },
+    });
+    expect(
+      lightweightSetup!.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: DEFAULT_ACCOUNT_ID,
+        input,
+      } as never),
+    ).toMatchObject({
+      channels: {
+        qqbot: {
+          enabled: true,
+          allowFrom: ["*"],
+          name: "Env Bot",
+        },
+      },
+    });
+  });
+
+  it("uses configured defaultAccount when runtime setup accountId is omitted", () => {
+    const runtimeSetup = qqbotSetupAdapterShared;
+    expect(runtimeSetup).toBeDefined();
+
+    expect(
+      runtimeSetup.resolveAccountId?.({
+        cfg: makeQqbotDefaultAccountConfig(),
+        accountId: undefined,
+      } as never),
+    ).toBe("bot2");
+  });
+
+  it("rejects --use-env for named accounts across setup paths", () => {
+    const runtimeSetup = qqbotSetupAdapterShared;
+    const lightweightSetup = qqbotSetupPlugin.setup;
+    expect(runtimeSetup).toBeDefined();
+    expect(lightweightSetup).toBeDefined();
+
+    const input = { useEnv: true, name: "Env Bot" };
+
+    expect(
+      runtimeSetup.validateInput?.({
+        cfg: {} as OpenClawConfig,
+        accountId: "bot2",
+        input,
+      } as never),
+    ).toBe("QQBot --use-env only supports the default account");
+    expect(
+      lightweightSetup!.validateInput?.({
+        cfg: {} as OpenClawConfig,
+        accountId: "bot2",
+        input,
+      } as never),
+    ).toBe("QQBot --use-env only supports the default account");
+    expect(
+      runtimeSetup.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: "bot2",
+        input,
+      } as never),
+    ).toEqual({});
+    expect(
+      lightweightSetup!.applyAccountConfig?.({
+        cfg: {} as OpenClawConfig,
+        accountId: "bot2",
+        input,
+      } as never),
+    ).toEqual({});
+  });
+});

package/src/engine/access/access-control.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, it } from "vitest";
+import { resolveQQBotAccess } from "./access-control.js";
+import { QQBOT_ACCESS_REASON } from "./types.js";
+
+describe("resolveQQBotAccess", () => {
+  describe("DM scenarios", () => {
+    it("allows default-open DMs when allowFrom is omitted", () => {
+      const result = resolveQQBotAccess({ isGroup: false, senderId: "USER1" });
+      expect(result).toMatchObject({
+        decision: "allow",
+        reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_OPEN,
+        dmPolicy: "open",
+        effectiveAllowFrom: ["*"],
+      });
+    });
+
+    it("allows default-open DMs when allowFrom is explicitly empty", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: [],
+      });
+      expect(result).toMatchObject({
+        decision: "allow",
+        reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_OPEN,
+        dmPolicy: "open",
+        effectiveAllowFrom: ["*"],
+      });
+    });
+
+    it("allows everyone with wildcard allowFrom", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: ["*"],
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_OPEN);
+    });
+
+    it("allows sender matching the allowlist", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: ["USER1"],
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_ALLOWLISTED);
+      expect(result.dmPolicy).toBe("allowlist");
+    });
+
+    it("allows open mode when sender matches restrictive allowFrom", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: ["USER1"],
+        dmPolicy: "open",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_ALLOWLISTED);
+      expect(result.reason).toBe("dmPolicy=open (allowlisted)");
+    });
+
+    it("blocks sender not in allowlist", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER2",
+        allowFrom: ["USER1"],
+      });
+      expect(result.decision).toBe("block");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_NOT_ALLOWLISTED);
+    });
+
+    it("blocks DM when dmPolicy=disabled (even with wildcard)", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: ["*"],
+        dmPolicy: "disabled",
+      });
+      expect(result.decision).toBe("block");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_DISABLED);
+    });
+
+    it("blocks DM with allowlist policy but empty allowlist", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        dmPolicy: "allowlist",
+      });
+      expect(result.decision).toBe("block");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.DM_POLICY_EMPTY_ALLOWLIST);
+    });
+
+    it("normalizes qqbot: prefix and case when matching", () => {
+      const result = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "qqbot:user1",
+        allowFrom: ["QQBot:USER1"],
+      });
+      expect(result.decision).toBe("allow");
+    });
+  });
+
+  describe("group scenarios", () => {
+    it("inherits allowFrom for group access when no groupAllowFrom is set", () => {
+      const allowed = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "USER1",
+        allowFrom: ["USER1"],
+      });
+      expect(allowed.decision).toBe("allow");
+      expect(allowed.groupPolicy).toBe("allowlist");
+
+      const blocked = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "USER2",
+        allowFrom: ["USER1"],
+      });
+      expect(blocked.decision).toBe("block");
+      expect(blocked.reasonCode).toBe(QQBOT_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED);
+    });
+
+    it("uses groupAllowFrom when explicitly provided", () => {
+      const result = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "USER2",
+        allowFrom: ["USER1"],
+        groupAllowFrom: ["USER2"],
+      });
+      expect(result.decision).toBe("allow");
+    });
+
+    it("blocks when groupPolicy=disabled", () => {
+      const result = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "USER1",
+        allowFrom: ["*"],
+        groupPolicy: "disabled",
+      });
+      expect(result.decision).toBe("block");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.GROUP_POLICY_DISABLED);
+    });
+
+    it("allows anyone when groupPolicy=open", () => {
+      const result = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "RANDOM_USER",
+        allowFrom: ["USER1"],
+        groupPolicy: "open",
+      });
+      expect(result.decision).toBe("allow");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.GROUP_POLICY_ALLOWED);
+    });
+
+    it("blocks when groupPolicy=allowlist but list is empty", () => {
+      const result = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "USER1",
+        groupPolicy: "allowlist",
+      });
+      expect(result.decision).toBe("block");
+      expect(result.reasonCode).toBe(QQBOT_ACCESS_REASON.GROUP_POLICY_EMPTY_ALLOWLIST);
+    });
+  });
+
+  describe("backwards compatibility (legacy allowFrom-only configs)", () => {
+    it("legacy allowFrom=['*'] stays fully open for both DM and group", () => {
+      const dm = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "RANDOM",
+        allowFrom: ["*"],
+      });
+      const group = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "RANDOM",
+        allowFrom: ["*"],
+      });
+      expect(dm.decision).toBe("allow");
+      expect(group.decision).toBe("allow");
+    });
+
+    it("legacy allowFrom=['USER1'] locks down both DM and group to USER1", () => {
+      const allowedDm = resolveQQBotAccess({
+        isGroup: false,
+        senderId: "USER1",
+        allowFrom: ["USER1"],
+      });
+      const blockedGroup = resolveQQBotAccess({
+        isGroup: true,
+        senderId: "INTRUDER",
+        allowFrom: ["USER1"],
+      });
+      expect(allowedDm.decision).toBe("allow");
+      expect(blockedGroup.decision).toBe("block");
+    });
+  });
+});