@openclaw/qqbot 2026.5.14-beta.1 → 2026.5.14-beta.2

package/dist/channel-BYNY5Nwb.js

@@ -1,606 +0,0 @@
-import { t as asOptionalObjectRecord } from "./string-normalize-C46CS-F1.js";
-import { a as resolveQQBotAccount, f as ensurePlatformAdapter, n as applyQQBotAccountConfig, p as getBridgeLogger, t as DEFAULT_ACCOUNT_ID$1 } from "./config-DiBiPtf4.js";
-import { a as shouldHandleQQBotExecApprovalRequest, i as resolveQQBotExecApprovalConfig, n as isQQBotExecApprovalClientEnabled, r as matchesQQBotApprovalAccount, t as authorizeQQBotApprovalAction, u as resolveApprovalTarget } from "./exec-approvals-Deww_EGt.js";
-import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, r as qqbotConfigAdapter, t as qqbotChannelConfigSchema } from "./config-schema-BeJQUheK.js";
-import { n as writeOpenClawConfigThroughRuntime, t as toGatewayAccount } from "./narrowing-Bj4eMufj.js";
-import { t as getQQBotRuntime } from "./runtime-B-cqLImu.js";
-import { n as normalizeTarget, s as getQQBotDataPath, t as looksLikeQQBotTarget } from "./target-parser-ByU3srDK.js";
-import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
-import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-message";
-import { createChannelApprovalCapability } from "openclaw/plugin-sdk/approval-delivery-runtime";
-import { createLazyChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-adapter-runtime";
-import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
-import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import fs from "node:fs";
-import { replaceFileAtomicSync } from "openclaw/plugin-sdk/security-runtime";
-import path from "node:path";
-import { loadJsonFile } from "openclaw/plugin-sdk/json-store";
-//#region extensions/qqbot/src/bridge/approval/capability.ts
-/**
-* QQ Bot Approval Capability — entry point.
-*
-* QQBot uses a simpler approval model than Telegram/Slack: when no
-* approver list is configured, the bot sends the approval message to the
-* originating conversation and any participant can approve from there.
-*
-* When `execApprovals` IS configured, it gates which requests are
-* handled natively and who is authorized.  When it is NOT configured,
-* QQBot falls back to "always handle, anyone can approve".
-*/
-/**
-* When `execApprovals` is configured, delegate to the profile-based
-* check.  Otherwise fall back to target-resolvability plus the shared
-* per-account ownership rule in `matchesQQBotApprovalAccount` so that
-* each QQBot account handler only delivers approvals that originated
-* from its own account (openids are account-scoped — cross-account
-* delivery fails with 500 on the QQ Bot API).
-*/
-function shouldHandleRequest(params) {
-	if (hasExecApprovalConfig(params)) return shouldHandleQQBotExecApprovalRequest(params);
-	if (!canResolveTarget(params.request)) return false;
-	return matchesQQBotApprovalAccount({
-		cfg: params.cfg,
-		accountId: params.accountId,
-		request: params.request
-	});
-}
-function hasExecApprovalConfig(params) {
-	return resolveQQBotExecApprovalConfig(params) !== void 0;
-}
-function isNativeDeliveryEnabled(params) {
-	if (hasExecApprovalConfig(params)) return isQQBotExecApprovalClientEnabled(params);
-	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	return account.enabled && account.secretSource !== "none";
-}
-function canResolveTarget(request) {
-	if (resolveApprovalTarget(request.request.sessionKey ?? null, request.request.turnSourceTo ?? null)) return true;
-	return resolveApprovalRequestSessionConversation({
-		request,
-		channel: "qqbot",
-		bundledFallback: true
-	})?.id != null;
-}
-function createQQBotApprovalCapability() {
-	return createChannelApprovalCapability({
-		authorizeActorAction: ({ cfg, accountId, senderId, approvalKind }) => authorizeQQBotApprovalAction({
-			cfg,
-			accountId,
-			senderId,
-			approvalKind
-		}),
-		getActionAvailabilityState: ({ cfg, accountId }) => {
-			return isNativeDeliveryEnabled({
-				cfg,
-				accountId
-			}) ? { kind: "enabled" } : { kind: "disabled" };
-		},
-		getExecInitiatingSurfaceState: ({ cfg, accountId }) => {
-			return isNativeDeliveryEnabled({
-				cfg,
-				accountId
-			}) ? { kind: "enabled" } : { kind: "disabled" };
-		},
-		describeExecApprovalSetup: ({ accountId }) => {
-			return `QQBot native exec approvals are enabled by default. To restrict who can approve, configure \`${accountId && accountId !== "default" ? `channels.qqbot.accounts.${accountId}` : "channels.qqbot"}.execApprovals.approvers\` with QQ user OpenIDs.`;
-		},
-		delivery: {
-			hasConfiguredDmRoute: () => true,
-			shouldSuppressForwardingFallback: (input) => {
-				const channel = normalizeOptionalString(input.target?.channel);
-				if (channel !== "qqbot") return false;
-				const accountId = normalizeOptionalString(input.target?.accountId) ?? normalizeOptionalString(input.request?.request?.turnSourceAccountId);
-				const result = isNativeDeliveryEnabled({
-					cfg: input.cfg,
-					accountId
-				});
-				getBridgeLogger().debug?.(`[qqbot:approval] shouldSuppressForwardingFallback channel=${channel} accountId=${accountId} → ${result}`);
-				return result;
-			}
-		},
-		native: {
-			describeDeliveryCapabilities: ({ cfg, accountId }) => ({
-				enabled: isNativeDeliveryEnabled({
-					cfg,
-					accountId
-				}),
-				preferredSurface: "origin",
-				supportsOriginSurface: true,
-				supportsApproverDmSurface: false,
-				notifyOriginWhenDmOnly: false
-			}),
-			resolveOriginTarget: ({ request }) => {
-				const target = resolveApprovalTarget(request.request.sessionKey ?? null, request.request.turnSourceTo ?? null);
-				if (target) return { to: `${target.type}:${target.id}` };
-				const sessionConversation = resolveApprovalRequestSessionConversation({
-					request,
-					channel: "qqbot",
-					bundledFallback: true
-				});
-				if (sessionConversation?.id) return { to: `${sessionConversation.kind === "group" ? "group" : "c2c"}:${sessionConversation.id}` };
-				return null;
-			}
-		},
-		nativeRuntime: createLazyChannelApprovalNativeRuntimeAdapter({
-			eventKinds: ["exec", "plugin"],
-			isConfigured: ({ cfg, accountId }) => {
-				const result = isNativeDeliveryEnabled({
-					cfg,
-					accountId
-				});
-				getBridgeLogger().debug?.(`[qqbot:approval] nativeRuntime.isConfigured accountId=${accountId} → ${result}`);
-				return result;
-			},
-			shouldHandle: ({ cfg, accountId, request }) => {
-				const result = shouldHandleRequest({
-					cfg,
-					accountId,
-					request
-				});
-				getBridgeLogger().debug?.(`[qqbot:approval] nativeRuntime.shouldHandle accountId=${accountId} → ${result}`);
-				return result;
-			},
-			load: async () => {
-				ensurePlatformAdapter();
-				return (await import("./handler-runtime-COWL4RMq.js")).qqbotApprovalNativeRuntime;
-			}
-		})
-	});
-}
-const qqbotApprovalCapability = createQQBotApprovalCapability();
-let _cachedCapability;
-function getQQBotApprovalCapability() {
-	_cachedCapability ??= qqbotApprovalCapability;
-	return _cachedCapability;
-}
-//#endregion
-//#region extensions/qqbot/src/engine/utils/data-paths.ts
-/**
-* Centralised filename helpers for persisted QQBot state.
-*
-* Every persistence module routes file paths through these helpers so the
-* naming convention stays in sync and legacy migrations are handled
-* consistently.
-*
-* Key design decisions:
-* - Credential backup is keyed only by `accountId` because recovery runs
-*   exactly when the appId is missing from config.
-*/
-/**
-* Normalise an identifier so it is safe to embed in a filename.
-* Keeps alphanumerics, dot, underscore, dash; everything else becomes `_`.
-*/
-function safeName(id) {
-	return id.replace(/[^a-zA-Z0-9._-]/g, "_");
-}
-/**
-* Per-accountId credential backup file. Not keyed by appId because the
-* whole point of this file is to recover credentials when appId is
-* missing from the live config.
-*/
-function getCredentialBackupFile(accountId) {
-	return path.join(getQQBotDataPath("data"), `credential-backup-${safeName(accountId)}.json`);
-}
-/** Legacy single-file credential backup (pre-multi-account-isolation). */
-function getLegacyCredentialBackupFile() {
-	return path.join(getQQBotDataPath("data"), "credential-backup.json");
-}
-//#endregion
-//#region extensions/qqbot/src/engine/config/credential-backup.ts
-/**
-* Credential backup & recovery.
-* 凭证暂存与恢复。
-*
-* Solves the "hot-upgrade interrupted, appId/secret vanished from
-* openclaw.json" failure mode.
-*
-* Mechanics:
-*   - After each successful gateway start we snapshot the currently
-*     resolved `appId` / `clientSecret` to a per-account backup file.
-*   - During plugin startup, if the live config has an empty appId or
-*     secret, the gateway consults the backup and restores the values
-*     via the config mutation API.
-*   - Backups live under `~/.openclaw/qqbot/data/` so they survive
-*     plugin directory replacement.
-*
-* Safety notes:
-*   - Only restore when credentials are **actually empty** — never
-*     overwrite a user's intentional config change.
-*   - Atomic write (temp file + rename) to avoid torn files.
-*   - Per-account file: `credential-backup-<accountId>.json`. We do
-*     **not** also key by appId because recovery happens precisely
-*     when appId is unknown.
-*   - Legacy single `credential-backup.json` is migrated automatically
-*     when the stored accountId matches the caller.
-*/
-/** Persist a credential snapshot (called once gateway reaches READY). */
-function saveCredentialBackup(accountId, appId, clientSecret) {
-	if (!appId || !clientSecret) return;
-	try {
-		const backupPath = getCredentialBackupFile(accountId);
-		const data = {
-			accountId,
-			appId,
-			clientSecret,
-			savedAt: (/* @__PURE__ */ new Date()).toISOString()
-		};
-		replaceFileAtomicSync({
-			filePath: backupPath,
-			content: `${JSON.stringify(data, null, 2)}\n`,
-			tempPrefix: ".qqbot-credential-backup"
-		});
-	} catch {}
-}
-/**
-* Load a credential snapshot for `accountId`.
-*
-* Consults the new per-account file first; falls back to the legacy
-* global backup file and migrates it when the embedded `accountId`
-* matches the request. Returns `null` when no usable backup exists.
-*/
-function loadCredentialBackup(accountId) {
-	try {
-		if (accountId) {
-			const data = loadJsonFile(getCredentialBackupFile(accountId));
-			if (data?.appId && data.clientSecret) return data;
-		}
-		const legacy = getLegacyCredentialBackupFile();
-		const data = loadJsonFile(legacy);
-		if (data) {
-			if (!data?.appId || !data?.clientSecret) return null;
-			if (accountId && data.accountId !== accountId) return null;
-			if (data.accountId) try {
-				replaceFileAtomicSync({
-					filePath: getCredentialBackupFile(data.accountId),
-					content: `${JSON.stringify(data, null, 2)}\n`,
-					tempPrefix: ".qqbot-credential-backup"
-				});
-				fs.unlinkSync(legacy);
-			} catch {}
-			return data;
-		}
-	} catch {}
-	return null;
-}
-//#endregion
-//#region extensions/qqbot/src/engine/config/credentials.ts
-/**
-* QQBot credential management (pure logic layer).
-* QQBot 凭证管理（纯逻辑层）。
-*
-* Credential clearing and field-level cleanup for logout and setup
-* flows. All functions operate on plain objects (Record<string, unknown>)
-* and stay framework-agnostic.
-*/
-/**
-* Remove clientSecret / clientSecretFile from a QQBot account config.
-*
-* Returns a shallow-cloned config with credentials removed, plus flags
-* indicating whether anything actually changed.
-*/
-function clearAccountCredentials(cfg, accountId) {
-	const nextCfg = { ...cfg };
-	const channels = asOptionalObjectRecord(cfg.channels);
-	const nextQQBot = channels?.qqbot ? { ...asOptionalObjectRecord(channels.qqbot) } : void 0;
-	let cleared = false;
-	let changed = false;
-	if (nextQQBot) {
-		const qqbot = nextQQBot;
-		if (accountId === "default") {
-			if (qqbot.clientSecret) {
-				delete qqbot.clientSecret;
-				cleared = true;
-				changed = true;
-			}
-			if (qqbot.clientSecretFile) {
-				delete qqbot.clientSecretFile;
-				cleared = true;
-				changed = true;
-			}
-		}
-		const accounts = qqbot.accounts;
-		if (accounts && accountId in accounts) {
-			const entry = accounts[accountId];
-			if (entry && "clientSecret" in entry) {
-				delete entry.clientSecret;
-				cleared = true;
-				changed = true;
-			}
-			if (entry && "clientSecretFile" in entry) {
-				delete entry.clientSecretFile;
-				cleared = true;
-				changed = true;
-			}
-			if (entry && Object.keys(entry).length === 0) {
-				delete accounts[accountId];
-				changed = true;
-			}
-		}
-	}
-	if (changed && nextQQBot) nextCfg.channels = {
-		...channels,
-		qqbot: nextQQBot
-	};
-	return {
-		nextCfg,
-		cleared,
-		changed
-	};
-}
-//#endregion
-//#region extensions/qqbot/src/channel.ts
-let gatewayModulePromise;
-function loadGatewayModule() {
-	gatewayModulePromise ??= import("./gateway-DEJhmN-p.js");
-	return gatewayModulePromise;
-}
-function createQQBotSendReceipt(params) {
-	const messageId = params.messageId?.trim();
-	return createMessageReceiptFromOutboundResults({
-		results: messageId ? [{
-			channel: "qqbot",
-			messageId,
-			conversationId: params.target
-		}] : [],
-		threadId: params.target,
-		kind: params.kind
-	});
-}
-async function sendQQBotText(params) {
-	await loadGatewayModule();
-	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendText } = await import("./outbound-BdQEr78b.js").then((n) => n.t);
-	const result = await sendText({
-		to: params.to,
-		text: params.text,
-		accountId: params.accountId,
-		replyToId: params.replyToId,
-		account: toGatewayAccount(account)
-	});
-	return {
-		channel: "qqbot",
-		messageId: result.messageId ?? "",
-		receipt: createQQBotSendReceipt({
-			messageId: result.messageId,
-			target: params.to,
-			kind: "text"
-		}),
-		meta: result.error ? { error: result.error } : void 0
-	};
-}
-async function sendQQBotMedia(params) {
-	await loadGatewayModule();
-	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendMedia } = await import("./outbound-BdQEr78b.js").then((n) => n.t);
-	const result = await sendMedia({
-		to: params.to,
-		text: params.text ?? "",
-		mediaUrl: params.mediaUrl ?? "",
-		accountId: params.accountId,
-		replyToId: params.replyToId,
-		account: toGatewayAccount(account)
-	});
-	return {
-		channel: "qqbot",
-		messageId: result.messageId ?? "",
-		receipt: createQQBotSendReceipt({
-			messageId: result.messageId,
-			target: params.to,
-			kind: "media"
-		}),
-		meta: result.error ? { error: result.error } : void 0
-	};
-}
-function toQQBotMessageSendResult(result) {
-	return {
-		messageId: result.messageId,
-		receipt: result.receipt
-	};
-}
-const qqbotMessageAdapter = defineChannelMessageAdapter({
-	id: "qqbot",
-	durableFinal: { capabilities: {
-		text: true,
-		media: true,
-		replyTo: true
-	} },
-	send: {
-		text: async (ctx) => toQQBotMessageSendResult(await sendQQBotText({
-			cfg: ctx.cfg,
-			to: ctx.to,
-			text: ctx.text,
-			accountId: ctx.accountId,
-			replyToId: ctx.replyToId
-		})),
-		media: async (ctx) => toQQBotMessageSendResult(await sendQQBotMedia({
-			cfg: ctx.cfg,
-			to: ctx.to,
-			text: ctx.text,
-			mediaUrl: ctx.mediaUrl,
-			accountId: ctx.accountId,
-			replyToId: ctx.replyToId
-		}))
-	}
-});
-const EXEC_APPROVAL_COMMAND_RE = /\/approve(?:@[^\s]+)?\s+[A-Za-z0-9][A-Za-z0-9._:-]*\s+(?:allow-once|allow-always|always|deny)\b/i;
-function persistAccountCredentialSnapshot(account) {
-	if (account.appId && account.clientSecret) saveCredentialBackup(account.accountId, account.appId, account.clientSecret);
-}
-function shouldSuppressLocalQQBotApprovalPrompt(params) {
-	if (params.hint?.kind !== "approval-pending" || params.hint.approvalKind !== "exec") return false;
-	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	if (!account.enabled || account.secretSource === "none") return false;
-	if (getExecApprovalReplyMetadata(params.payload)) return true;
-	const text = typeof params.payload.text === "string" ? params.payload.text : "";
-	return EXEC_APPROVAL_COMMAND_RE.test(text);
-}
-const qqbotPlugin = {
-	id: "qqbot",
-	setupWizard: qqbotSetupWizard,
-	meta: { ...qqbotMeta },
-	capabilities: {
-		chatTypes: ["direct", "group"],
-		media: true,
-		reactions: false,
-		threads: false,
-		blockStreaming: true
-	},
-	reload: { configPrefixes: ["channels.qqbot"] },
-	configSchema: qqbotChannelConfigSchema,
-	config: {
-		...qqbotConfigAdapter,
-		/**
-		* Treat an account as configured when either the live config has
-		* credentials OR a recoverable credential backup exists. This mirrors
-		* the standalone plugin and lets the gateway survive a hot upgrade
-		* that wiped openclaw.json mid-flight.
-		*/
-		isConfigured: (account) => {
-			if (qqbotConfigAdapter.isConfigured(account)) return true;
-			if (!account) return false;
-			const backup = loadCredentialBackup(account.accountId);
-			return Boolean(backup?.appId && backup?.clientSecret);
-		}
-	},
-	setup: { ...qqbotSetupAdapterShared },
-	approvalCapability: getQQBotApprovalCapability(),
-	message: qqbotMessageAdapter,
-	messaging: {
-		targetPrefixes: ["qqbot"],
-		/** Normalize common QQ Bot target formats into the canonical qqbot:... form. */
-		normalizeTarget,
-		targetResolver: {
-			/** Return true when the id looks like a QQ Bot target. */
-			looksLikeId: looksLikeQQBotTarget,
-			hint: "QQ Bot target format: qqbot:c2c:openid (direct) or qqbot:group:groupid (group)"
-		}
-	},
-	outbound: {
-		deliveryMode: "direct",
-		chunker: (text, limit) => getQQBotRuntime().channel.text.chunkMarkdownText(text, limit),
-		chunkerMode: "markdown",
-		textChunkLimit: 5e3,
-		shouldSuppressLocalPayloadPrompt: ({ cfg, accountId, payload, hint }) => shouldSuppressLocalQQBotApprovalPrompt({
-			cfg,
-			accountId,
-			payload,
-			hint
-		}),
-		sendText: async ({ to, text, accountId, replyToId, cfg }) => await sendQQBotText({
-			cfg,
-			to,
-			text,
-			accountId,
-			replyToId
-		}),
-		sendMedia: async ({ to, text, mediaUrl, accountId, replyToId, cfg }) => await sendQQBotMedia({
-			cfg,
-			to,
-			text,
-			mediaUrl,
-			accountId,
-			replyToId
-		})
-	},
-	gateway: {
-		startAccount: async (ctx) => {
-			let { account, cfg } = ctx;
-			const { abortSignal, log } = ctx;
-			if (!account.appId || !account.clientSecret) {
-				const backup = loadCredentialBackup(account.accountId);
-				if (backup?.appId && backup?.clientSecret) try {
-					const nextCfg = applyQQBotAccountConfig(cfg, account.accountId, {
-						appId: backup.appId,
-						clientSecret: backup.clientSecret
-					});
-					await writeOpenClawConfigThroughRuntime(getQQBotRuntime(), nextCfg);
-					cfg = nextCfg;
-					account = resolveQQBotAccount(nextCfg, account.accountId);
-					log?.info(`[qqbot:${account.accountId}] Restored credentials from backup (appId=${account.appId})`);
-				} catch (err) {
-					log?.error(`[qqbot:${account.accountId}] Failed to restore credentials from backup: ${err instanceof Error ? err.message : String(err)}`);
-				}
-			}
-			const { startGateway } = await loadGatewayModule();
-			log?.info(`[qqbot:${account.accountId}] Starting gateway — appId=${account.appId}, enabled=${account.enabled}, name=${account.name ?? "unnamed"}`);
-			await startGateway({
-				account,
-				abortSignal,
-				cfg,
-				log,
-				channelRuntime: ctx.channelRuntime,
-				onReady: () => {
-					log?.info(`[qqbot:${account.accountId}] Gateway ready`);
-					ctx.setStatus({
-						...ctx.getStatus(),
-						running: true,
-						connected: true,
-						lastConnectedAt: Date.now()
-					});
-					persistAccountCredentialSnapshot(account);
-				},
-				onResumed: () => {
-					log?.info(`[qqbot:${account.accountId}] Gateway resumed`);
-					ctx.setStatus({
-						...ctx.getStatus(),
-						running: true,
-						connected: true,
-						lastConnectedAt: Date.now()
-					});
-					persistAccountCredentialSnapshot(account);
-				},
-				onError: (error) => {
-					log?.error(`[qqbot:${account.accountId}] Gateway error: ${error.message}`);
-					ctx.setStatus({
-						...ctx.getStatus(),
-						lastError: error.message
-					});
-				}
-			});
-		},
-		logoutAccount: async ({ accountId, cfg }) => {
-			const { nextCfg, cleared, changed } = clearAccountCredentials(cfg, accountId);
-			if (changed) await writeOpenClawConfigThroughRuntime(getQQBotRuntime(), nextCfg);
-			const loggedOut = resolveQQBotAccount(changed ? nextCfg : cfg, accountId).secretSource === "none";
-			return {
-				ok: true,
-				cleared,
-				envToken: Boolean(process.env.QQBOT_CLIENT_SECRET),
-				loggedOut
-			};
-		}
-	},
-	status: {
-		defaultRuntime: {
-			accountId: DEFAULT_ACCOUNT_ID$1,
-			running: false,
-			connected: false,
-			lastConnectedAt: null,
-			lastError: null,
-			lastInboundAt: null,
-			lastOutboundAt: null
-		},
-		buildChannelSummary: ({ snapshot }) => ({
-			configured: snapshot.configured ?? false,
-			tokenSource: snapshot.tokenSource ?? "none",
-			running: snapshot.running ?? false,
-			connected: snapshot.connected ?? false,
-			lastConnectedAt: snapshot.lastConnectedAt ?? null,
-			lastError: snapshot.lastError ?? null
-		}),
-		buildAccountSnapshot: ({ account, runtime }) => ({
-			accountId: account?.accountId ?? DEFAULT_ACCOUNT_ID$1,
-			name: account?.name,
-			enabled: account?.enabled ?? false,
-			configured: Boolean(account?.appId && account?.clientSecret),
-			tokenSource: account?.secretSource,
-			running: runtime?.running ?? false,
-			connected: runtime?.connected ?? false,
-			lastConnectedAt: runtime?.lastConnectedAt ?? null,
-			lastError: runtime?.lastError ?? null,
-			lastInboundAt: runtime?.lastInboundAt ?? null,
-			lastOutboundAt: runtime?.lastOutboundAt ?? null
-		})
-	}
-};
-//#endregion
-export { qqbotPlugin as t };