@openclaw/qqbot 2026.5.2 → 2026.5.3-beta.1

package/dist/approval-cg0SVahb.js

@@ -0,0 +1,94 @@
+//#region extensions/qqbot/src/engine/approval/index.ts
+function buildExecApprovalText(request) {
+	const expiresIn = Math.max(0, Math.round((request.expiresAtMs - Date.now()) / 1e3));
+	const lines = ["🔐 命令执行审批", ""];
+	const cmd = request.request.commandPreview ?? request.request.command ?? "";
+	if (cmd) lines.push(`\`\`\`\n${cmd.slice(0, 300)}\n\`\`\``);
+	if (request.request.cwd) lines.push(`\u{1f4c1} \u76ee\u5f55: ${request.request.cwd}`);
+	if (request.request.agentId) lines.push(`\u{1f916} Agent: ${request.request.agentId}`);
+	lines.push("", `\u23f1\ufe0f \u8d85\u65f6: ${expiresIn} \u79d2`);
+	return lines.join("\n");
+}
+function buildPluginApprovalText(request) {
+	const timeoutSec = Math.round((request.request.timeoutMs ?? 12e4) / 1e3);
+	const lines = [`${request.request.severity === "critical" ? "🔴" : request.request.severity === "info" ? "🔵" : "🟡"} \u5ba1\u6279\u8bf7\u6c42`, ""];
+	lines.push(`\u{1f4cb} ${request.request.title}`);
+	if (request.request.description) lines.push(`\u{1f4dd} ${request.request.description}`);
+	if (request.request.toolName) lines.push(`\u{1f527} \u5de5\u5177: ${request.request.toolName}`);
+	if (request.request.pluginId) lines.push(`\u{1f50c} \u63d2\u4ef6: ${request.request.pluginId}`);
+	if (request.request.agentId) lines.push(`\u{1f916} Agent: ${request.request.agentId}`);
+	lines.push("", `\u23f1\ufe0f \u8d85\u65f6: ${timeoutSec} \u79d2`);
+	return lines.join("\n");
+}
+/**
+* Build the three-button inline keyboard for approval messages.
+*
+* type=1 (Callback): click triggers INTERACTION_CREATE, button_data = data field.
+* group_id "approval": clicking one button grays out the others (mutual exclusion).
+* click_limit=1: each user can only click once.
+* permission.type=2: all users can interact.
+*/
+function buildApprovalKeyboard(approvalId, allowedDecisions = [
+	"allow-once",
+	"allow-always",
+	"deny"
+]) {
+	const makeBtn = (id, label, visitedLabel, data, style) => ({
+		id,
+		render_data: {
+			label,
+			visited_label: visitedLabel,
+			style
+		},
+		action: {
+			type: 1,
+			data,
+			permission: { type: 2 },
+			click_limit: 1
+		},
+		group_id: "approval"
+	});
+	const buttons = [];
+	if (allowedDecisions.includes("allow-once")) buttons.push(makeBtn("allow", "✅ 允许一次", "已允许", `approve:${approvalId}:allow-once`, 1));
+	if (allowedDecisions.includes("allow-always")) buttons.push(makeBtn("always", "⭐ 始终允许", "已始终允许", `approve:${approvalId}:allow-always`, 1));
+	if (allowedDecisions.includes("deny")) buttons.push(makeBtn("deny", "❌ 拒绝", "已拒绝", `approve:${approvalId}:deny`, 0));
+	return { content: { rows: [{ buttons }] } };
+}
+/**
+* Extract the delivery target from a sessionKey or turnSourceTo string.
+*
+* Expected formats:
+*   agent:main:qqbot:direct:OPENID  -> { type: "c2c", id: "OPENID" }
+*   agent:main:qqbot:c2c:OPENID     -> { type: "c2c", id: "OPENID" }
+*   agent:main:qqbot:group:GROUPID  -> { type: "group", id: "GROUPID" }
+*
+* Returns null if neither field matches the expected pattern.
+*/
+function resolveApprovalTarget(sessionKey, turnSourceTo) {
+	const sk = sessionKey ?? turnSourceTo;
+	if (!sk) return null;
+	const m = sk.match(/qqbot:(c2c|direct|group):([A-F0-9]+)/i);
+	if (!m) return null;
+	return {
+		type: m[1].toLowerCase() === "group" ? "group" : "c2c",
+		id: m[2]
+	};
+}
+/**
+* Parse the button_data string from an INTERACTION_CREATE event.
+*
+* Expected format: `approve:<approvalId>:<decision>`
+* where approvalId may be prefixed with "exec:" or "plugin:".
+*
+* Returns null if the data does not match the approval button format.
+*/
+function parseApprovalButtonData(buttonData) {
+	const m = buttonData.match(/^approve:((?:(?:exec|plugin):)?[0-9a-f-]+):(allow-once|allow-always|deny)$/i);
+	if (!m) return null;
+	return {
+		approvalId: m[1],
+		decision: m[2]
+	};
+}
+//#endregion
+export { resolveApprovalTarget as a, parseApprovalButtonData as i, buildExecApprovalText as n, buildPluginApprovalText as r, buildApprovalKeyboard as t };

package/dist/channel-N6Y_Rcjp.js

@@ -0,0 +1,551 @@
+import { t as asOptionalObjectRecord } from "./string-normalize-Ci6NM5DE.js";
+import { l as ensurePlatformAdapter, u as getBridgeLogger } from "./resolve-D_06fV6-.js";
+import { a as resolveApprovalTarget } from "./approval-cg0SVahb.js";
+import { a as resolveQQBotAccount, n as applyQQBotAccountConfig, t as DEFAULT_ACCOUNT_ID$1 } from "./config-D6545NkC.js";
+import { a as resolveQQBotExecApprovalConfig, i as matchesQQBotApprovalAccount, n as isQQBotExecApprovalAuthorizedSender, o as shouldHandleQQBotExecApprovalRequest, r as isQQBotExecApprovalClientEnabled, t as isQQBotExecApprovalApprover } from "./exec-approvals-COUsM6wZ.js";
+import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, r as qqbotConfigAdapter, t as qqbotChannelConfigSchema } from "./config-schema-DFcjQw73.js";
+import { n as writeOpenClawConfigThroughRuntime, t as toGatewayAccount } from "./narrowing-BoieBTIU.js";
+import { t as getQQBotRuntime } from "./runtime-BJAS3eXW.js";
+import { n as normalizeTarget, s as getQQBotDataPath, t as looksLikeQQBotTarget } from "./target-parser-Y0prnrXD.js";
+import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
+import { createChannelApprovalCapability } from "openclaw/plugin-sdk/approval-delivery-runtime";
+import { createLazyChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-adapter-runtime";
+import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
+import fs from "node:fs";
+import path from "node:path";
+//#region extensions/qqbot/src/bridge/approval/capability.ts
+/**
+* QQ Bot Approval Capability — entry point.
+*
+* QQBot uses a simpler approval model than Telegram/Slack: any user who
+* can see the inline-keyboard buttons can approve. No explicit approver
+* list is required — the bot simply sends the approval message to the
+* originating conversation and whoever clicks the button resolves it.
+*
+* When `execApprovals` IS configured, it gates which requests are
+* handled natively and who is authorized.  When it is NOT configured,
+* QQBot falls back to "always handle, anyone can approve".
+*/
+/**
+* When `execApprovals` is configured, delegate to the profile-based
+* check.  Otherwise fall back to target-resolvability plus the shared
+* per-account ownership rule in `matchesQQBotApprovalAccount` so that
+* each QQBot account handler only delivers approvals that originated
+* from its own account (openids are account-scoped — cross-account
+* delivery fails with 500 on the QQ Bot API).
+*/
+function shouldHandleRequest(params) {
+	if (hasExecApprovalConfig(params)) return shouldHandleQQBotExecApprovalRequest(params);
+	if (!canResolveTarget(params.request)) return false;
+	return matchesQQBotApprovalAccount({
+		cfg: params.cfg,
+		accountId: params.accountId,
+		request: params.request
+	});
+}
+function hasExecApprovalConfig(params) {
+	return resolveQQBotExecApprovalConfig(params) !== void 0;
+}
+function isNativeDeliveryEnabled(params) {
+	if (hasExecApprovalConfig(params)) return isQQBotExecApprovalClientEnabled(params);
+	const account = resolveQQBotAccount(params.cfg, params.accountId);
+	return account.enabled && account.secretSource !== "none";
+}
+function canResolveTarget(request) {
+	if (resolveApprovalTarget(request.request.sessionKey ?? null, request.request.turnSourceTo ?? null)) return true;
+	return resolveApprovalRequestSessionConversation({
+		request,
+		channel: "qqbot",
+		bundledFallback: true
+	})?.id != null;
+}
+function createQQBotApprovalCapability() {
+	return createChannelApprovalCapability({
+		authorizeActorAction: ({ cfg, accountId, senderId, approvalKind }) => {
+			if (hasExecApprovalConfig({
+				cfg,
+				accountId
+			})) return (approvalKind === "plugin" ? isQQBotExecApprovalApprover({
+				cfg,
+				accountId,
+				senderId
+			}) : isQQBotExecApprovalAuthorizedSender({
+				cfg,
+				accountId,
+				senderId
+			})) ? { authorized: true } : {
+				authorized: false,
+				reason: "You are not authorized to approve this request."
+			};
+			return { authorized: true };
+		},
+		getActionAvailabilityState: ({ cfg, accountId }) => {
+			return isNativeDeliveryEnabled({
+				cfg,
+				accountId
+			}) ? { kind: "enabled" } : { kind: "disabled" };
+		},
+		getExecInitiatingSurfaceState: ({ cfg, accountId }) => {
+			return isNativeDeliveryEnabled({
+				cfg,
+				accountId
+			}) ? { kind: "enabled" } : { kind: "disabled" };
+		},
+		describeExecApprovalSetup: ({ accountId }) => {
+			return `QQBot native exec approvals are enabled by default. To restrict who can approve, configure \`${accountId && accountId !== "default" ? `channels.qqbot.accounts.${accountId}` : "channels.qqbot"}.execApprovals.approvers\` with QQ user OpenIDs.`;
+		},
+		delivery: {
+			hasConfiguredDmRoute: () => true,
+			shouldSuppressForwardingFallback: (input) => {
+				const channel = normalizeOptionalString(input.target?.channel);
+				if (channel !== "qqbot") return false;
+				const accountId = normalizeOptionalString(input.target?.accountId) ?? normalizeOptionalString(input.request?.request?.turnSourceAccountId);
+				const result = isNativeDeliveryEnabled({
+					cfg: input.cfg,
+					accountId
+				});
+				getBridgeLogger().debug?.(`[qqbot:approval] shouldSuppressForwardingFallback channel=${channel} accountId=${accountId} → ${result}`);
+				return result;
+			}
+		},
+		native: {
+			describeDeliveryCapabilities: ({ cfg, accountId }) => ({
+				enabled: isNativeDeliveryEnabled({
+					cfg,
+					accountId
+				}),
+				preferredSurface: "origin",
+				supportsOriginSurface: true,
+				supportsApproverDmSurface: false,
+				notifyOriginWhenDmOnly: false
+			}),
+			resolveOriginTarget: ({ request }) => {
+				const target = resolveApprovalTarget(request.request.sessionKey ?? null, request.request.turnSourceTo ?? null);
+				if (target) return { to: `${target.type}:${target.id}` };
+				const sessionConversation = resolveApprovalRequestSessionConversation({
+					request,
+					channel: "qqbot",
+					bundledFallback: true
+				});
+				if (sessionConversation?.id) return { to: `${sessionConversation.kind === "group" ? "group" : "c2c"}:${sessionConversation.id}` };
+				return null;
+			}
+		},
+		nativeRuntime: createLazyChannelApprovalNativeRuntimeAdapter({
+			eventKinds: ["exec", "plugin"],
+			isConfigured: ({ cfg, accountId }) => {
+				const result = isNativeDeliveryEnabled({
+					cfg,
+					accountId
+				});
+				getBridgeLogger().debug?.(`[qqbot:approval] nativeRuntime.isConfigured accountId=${accountId} → ${result}`);
+				return result;
+			},
+			shouldHandle: ({ cfg, accountId, request }) => {
+				const result = shouldHandleRequest({
+					cfg,
+					accountId,
+					request
+				});
+				getBridgeLogger().debug?.(`[qqbot:approval] nativeRuntime.shouldHandle accountId=${accountId} → ${result}`);
+				return result;
+			},
+			load: async () => {
+				ensurePlatformAdapter();
+				return (await import("./handler-runtime-Bqm6N0WG.js")).qqbotApprovalNativeRuntime;
+			}
+		})
+	});
+}
+const qqbotApprovalCapability = createQQBotApprovalCapability();
+let _cachedCapability;
+function getQQBotApprovalCapability() {
+	_cachedCapability ??= qqbotApprovalCapability;
+	return _cachedCapability;
+}
+//#endregion
+//#region extensions/qqbot/src/engine/utils/data-paths.ts
+/**
+* Centralised filename helpers for persisted QQBot state.
+*
+* Every persistence module routes file paths through these helpers so the
+* naming convention stays in sync and legacy migrations are handled
+* consistently.
+*
+* Key design decisions:
+* - Credential backup is keyed only by `accountId` because recovery runs
+*   exactly when the appId is missing from config.
+*/
+/**
+* Normalise an identifier so it is safe to embed in a filename.
+* Keeps alphanumerics, dot, underscore, dash; everything else becomes `_`.
+*/
+function safeName(id) {
+	return id.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+/**
+* Per-accountId credential backup file. Not keyed by appId because the
+* whole point of this file is to recover credentials when appId is
+* missing from the live config.
+*/
+function getCredentialBackupFile(accountId) {
+	return path.join(getQQBotDataPath("data"), `credential-backup-${safeName(accountId)}.json`);
+}
+/** Legacy single-file credential backup (pre-multi-account-isolation). */
+function getLegacyCredentialBackupFile() {
+	return path.join(getQQBotDataPath("data"), "credential-backup.json");
+}
+//#endregion
+//#region extensions/qqbot/src/engine/config/credential-backup.ts
+/**
+* Credential backup & recovery.
+* 凭证暂存与恢复。
+*
+* Solves the "hot-upgrade interrupted, appId/secret vanished from
+* openclaw.json" failure mode.
+*
+* Mechanics:
+*   - After each successful gateway start we snapshot the currently
+*     resolved `appId` / `clientSecret` to a per-account backup file.
+*   - During plugin startup, if the live config has an empty appId or
+*     secret, the gateway consults the backup and restores the values
+*     via the config mutation API.
+*   - Backups live under `~/.openclaw/qqbot/data/` so they survive
+*     plugin directory replacement.
+*
+* Safety notes:
+*   - Only restore when credentials are **actually empty** — never
+*     overwrite a user's intentional config change.
+*   - Atomic write (temp file + rename) to avoid torn files.
+*   - Per-account file: `credential-backup-<accountId>.json`. We do
+*     **not** also key by appId because recovery happens precisely
+*     when appId is unknown.
+*   - Legacy single `credential-backup.json` is migrated automatically
+*     when the stored accountId matches the caller.
+*/
+/** Persist a credential snapshot (called once gateway reaches READY). */
+function saveCredentialBackup(accountId, appId, clientSecret) {
+	if (!appId || !clientSecret) return;
+	try {
+		const backupPath = getCredentialBackupFile(accountId);
+		fs.mkdirSync(path.dirname(backupPath), { recursive: true });
+		const data = {
+			accountId,
+			appId,
+			clientSecret,
+			savedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const tmpPath = `${backupPath}.tmp`;
+		fs.writeFileSync(tmpPath, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+		fs.renameSync(tmpPath, backupPath);
+	} catch {}
+}
+/**
+* Load a credential snapshot for `accountId`.
+*
+* Consults the new per-account file first; falls back to the legacy
+* global backup file and migrates it when the embedded `accountId`
+* matches the request. Returns `null` when no usable backup exists.
+*/
+function loadCredentialBackup(accountId) {
+	try {
+		if (accountId) {
+			const newPath = getCredentialBackupFile(accountId);
+			if (fs.existsSync(newPath)) {
+				const data = JSON.parse(fs.readFileSync(newPath, "utf8"));
+				if (data?.appId && data.clientSecret) return data;
+			}
+		}
+		const legacy = getLegacyCredentialBackupFile();
+		if (fs.existsSync(legacy)) {
+			const data = JSON.parse(fs.readFileSync(legacy, "utf8"));
+			if (!data?.appId || !data?.clientSecret) return null;
+			if (accountId && data.accountId !== accountId) return null;
+			if (data.accountId) try {
+				const backupPath = getCredentialBackupFile(data.accountId);
+				fs.mkdirSync(path.dirname(backupPath), { recursive: true });
+				const tmpPath = `${backupPath}.tmp`;
+				fs.writeFileSync(tmpPath, `${JSON.stringify(data, null, 2)}\n`, "utf8");
+				fs.renameSync(tmpPath, backupPath);
+				fs.unlinkSync(legacy);
+			} catch {}
+			return data;
+		}
+	} catch {}
+	return null;
+}
+//#endregion
+//#region extensions/qqbot/src/engine/config/credentials.ts
+/**
+* QQBot credential management (pure logic layer).
+* QQBot 凭证管理（纯逻辑层）。
+*
+* Credential clearing and field-level cleanup for logout and setup
+* flows. All functions operate on plain objects (Record<string, unknown>)
+* and stay framework-agnostic.
+*/
+/**
+* Remove clientSecret / clientSecretFile from a QQBot account config.
+*
+* Returns a shallow-cloned config with credentials removed, plus flags
+* indicating whether anything actually changed.
+*/
+function clearAccountCredentials(cfg, accountId) {
+	const nextCfg = { ...cfg };
+	const channels = asOptionalObjectRecord(cfg.channels);
+	const nextQQBot = channels?.qqbot ? { ...asOptionalObjectRecord(channels.qqbot) } : void 0;
+	let cleared = false;
+	let changed = false;
+	if (nextQQBot) {
+		const qqbot = nextQQBot;
+		if (accountId === "default") {
+			if (qqbot.clientSecret) {
+				delete qqbot.clientSecret;
+				cleared = true;
+				changed = true;
+			}
+			if (qqbot.clientSecretFile) {
+				delete qqbot.clientSecretFile;
+				cleared = true;
+				changed = true;
+			}
+		}
+		const accounts = qqbot.accounts;
+		if (accounts && accountId in accounts) {
+			const entry = accounts[accountId];
+			if (entry && "clientSecret" in entry) {
+				delete entry.clientSecret;
+				cleared = true;
+				changed = true;
+			}
+			if (entry && "clientSecretFile" in entry) {
+				delete entry.clientSecretFile;
+				cleared = true;
+				changed = true;
+			}
+			if (entry && Object.keys(entry).length === 0) {
+				delete accounts[accountId];
+				changed = true;
+			}
+		}
+	}
+	if (changed && nextQQBot) nextCfg.channels = {
+		...channels,
+		qqbot: nextQQBot
+	};
+	return {
+		nextCfg,
+		cleared,
+		changed
+	};
+}
+//#endregion
+//#region extensions/qqbot/src/channel.ts
+let _gatewayModulePromise;
+function loadGatewayModule() {
+	_gatewayModulePromise ??= import("./gateway-CmSUJKSt.js");
+	return _gatewayModulePromise;
+}
+const EXEC_APPROVAL_COMMAND_RE = /\/approve(?:@[^\s]+)?\s+[A-Za-z0-9][A-Za-z0-9._:-]*\s+(?:allow-once|allow-always|always|deny)\b/i;
+function persistAccountCredentialSnapshot(account) {
+	if (account.appId && account.clientSecret) saveCredentialBackup(account.accountId, account.appId, account.clientSecret);
+}
+function shouldSuppressLocalQQBotApprovalPrompt(params) {
+	if (params.hint?.kind !== "approval-pending" || params.hint.approvalKind !== "exec") return false;
+	const account = resolveQQBotAccount(params.cfg, params.accountId);
+	if (!account.enabled || account.secretSource === "none") return false;
+	if (getExecApprovalReplyMetadata(params.payload)) return true;
+	const text = typeof params.payload.text === "string" ? params.payload.text : "";
+	return EXEC_APPROVAL_COMMAND_RE.test(text);
+}
+const qqbotPlugin = {
+	id: "qqbot",
+	setupWizard: qqbotSetupWizard,
+	meta: { ...qqbotMeta },
+	capabilities: {
+		chatTypes: ["direct", "group"],
+		media: true,
+		reactions: false,
+		threads: false,
+		blockStreaming: true
+	},
+	reload: { configPrefixes: ["channels.qqbot"] },
+	configSchema: qqbotChannelConfigSchema,
+	config: {
+		...qqbotConfigAdapter,
+		/**
+		* Treat an account as configured when either the live config has
+		* credentials OR a recoverable credential backup exists. This mirrors
+		* the standalone plugin and lets the gateway survive a hot upgrade
+		* that wiped openclaw.json mid-flight.
+		*/
+		isConfigured: (account) => {
+			if (qqbotConfigAdapter.isConfigured(account)) return true;
+			if (!account) return false;
+			const backup = loadCredentialBackup(account.accountId);
+			return Boolean(backup?.appId && backup?.clientSecret);
+		}
+	},
+	setup: { ...qqbotSetupAdapterShared },
+	approvalCapability: getQQBotApprovalCapability(),
+	messaging: {
+		targetPrefixes: ["qqbot"],
+		/** Normalize common QQ Bot target formats into the canonical qqbot:... form. */
+		normalizeTarget,
+		targetResolver: {
+			/** Return true when the id looks like a QQ Bot target. */
+			looksLikeId: looksLikeQQBotTarget,
+			hint: "QQ Bot target format: qqbot:c2c:openid (direct) or qqbot:group:groupid (group)"
+		}
+	},
+	outbound: {
+		deliveryMode: "direct",
+		chunker: (text, limit) => getQQBotRuntime().channel.text.chunkMarkdownText(text, limit),
+		chunkerMode: "markdown",
+		textChunkLimit: 5e3,
+		shouldSuppressLocalPayloadPrompt: ({ cfg, accountId, payload, hint }) => shouldSuppressLocalQQBotApprovalPrompt({
+			cfg,
+			accountId,
+			payload,
+			hint
+		}),
+		sendText: async ({ to, text, accountId, replyToId, cfg }) => {
+			await loadGatewayModule();
+			const account = resolveQQBotAccount(cfg, accountId);
+			const { sendText } = await import("./outbound-BJfhwrPg.js").then((n) => n.t);
+			const result = await sendText({
+				to,
+				text,
+				accountId,
+				replyToId,
+				account: toGatewayAccount(account)
+			});
+			return {
+				channel: "qqbot",
+				messageId: result.messageId ?? "",
+				meta: result.error ? { error: result.error } : void 0
+			};
+		},
+		sendMedia: async ({ to, text, mediaUrl, accountId, replyToId, cfg }) => {
+			await loadGatewayModule();
+			const account = resolveQQBotAccount(cfg, accountId);
+			const { sendMedia } = await import("./outbound-BJfhwrPg.js").then((n) => n.t);
+			const result = await sendMedia({
+				to,
+				text: text ?? "",
+				mediaUrl: mediaUrl ?? "",
+				accountId,
+				replyToId,
+				account: toGatewayAccount(account)
+			});
+			return {
+				channel: "qqbot",
+				messageId: result.messageId ?? "",
+				meta: result.error ? { error: result.error } : void 0
+			};
+		}
+	},
+	gateway: {
+		startAccount: async (ctx) => {
+			let { account, cfg } = ctx;
+			const { abortSignal, log } = ctx;
+			if (!account.appId || !account.clientSecret) {
+				const backup = loadCredentialBackup(account.accountId);
+				if (backup?.appId && backup?.clientSecret) try {
+					const nextCfg = applyQQBotAccountConfig(cfg, account.accountId, {
+						appId: backup.appId,
+						clientSecret: backup.clientSecret
+					});
+					await writeOpenClawConfigThroughRuntime(getQQBotRuntime(), nextCfg);
+					cfg = nextCfg;
+					account = resolveQQBotAccount(nextCfg, account.accountId);
+					log?.info(`[qqbot:${account.accountId}] Restored credentials from backup (appId=${account.appId})`);
+				} catch (err) {
+					log?.error(`[qqbot:${account.accountId}] Failed to restore credentials from backup: ${err instanceof Error ? err.message : String(err)}`);
+				}
+			}
+			const { startGateway } = await loadGatewayModule();
+			log?.info(`[qqbot:${account.accountId}] Starting gateway — appId=${account.appId}, enabled=${account.enabled}, name=${account.name ?? "unnamed"}`);
+			await startGateway({
+				account,
+				abortSignal,
+				cfg,
+				log,
+				channelRuntime: ctx.channelRuntime,
+				onReady: () => {
+					log?.info(`[qqbot:${account.accountId}] Gateway ready`);
+					ctx.setStatus({
+						...ctx.getStatus(),
+						running: true,
+						connected: true,
+						lastConnectedAt: Date.now()
+					});
+					persistAccountCredentialSnapshot(account);
+				},
+				onResumed: () => {
+					log?.info(`[qqbot:${account.accountId}] Gateway resumed`);
+					ctx.setStatus({
+						...ctx.getStatus(),
+						running: true,
+						connected: true,
+						lastConnectedAt: Date.now()
+					});
+					persistAccountCredentialSnapshot(account);
+				},
+				onError: (error) => {
+					log?.error(`[qqbot:${account.accountId}] Gateway error: ${error.message}`);
+					ctx.setStatus({
+						...ctx.getStatus(),
+						lastError: error.message
+					});
+				}
+			});
+		},
+		logoutAccount: async ({ accountId, cfg }) => {
+			const { nextCfg, cleared, changed } = clearAccountCredentials(cfg, accountId);
+			if (changed) await writeOpenClawConfigThroughRuntime(getQQBotRuntime(), nextCfg);
+			const loggedOut = resolveQQBotAccount(changed ? nextCfg : cfg, accountId).secretSource === "none";
+			return {
+				ok: true,
+				cleared,
+				envToken: Boolean(process.env.QQBOT_CLIENT_SECRET),
+				loggedOut
+			};
+		}
+	},
+	status: {
+		defaultRuntime: {
+			accountId: DEFAULT_ACCOUNT_ID$1,
+			running: false,
+			connected: false,
+			lastConnectedAt: null,
+			lastError: null,
+			lastInboundAt: null,
+			lastOutboundAt: null
+		},
+		buildChannelSummary: ({ snapshot }) => ({
+			configured: snapshot.configured ?? false,
+			tokenSource: snapshot.tokenSource ?? "none",
+			running: snapshot.running ?? false,
+			connected: snapshot.connected ?? false,
+			lastConnectedAt: snapshot.lastConnectedAt ?? null,
+			lastError: snapshot.lastError ?? null
+		}),
+		buildAccountSnapshot: ({ account, runtime }) => ({
+			accountId: account?.accountId ?? DEFAULT_ACCOUNT_ID$1,
+			name: account?.name,
+			enabled: account?.enabled ?? false,
+			configured: Boolean(account?.appId && account?.clientSecret),
+			tokenSource: account?.secretSource,
+			running: runtime?.running ?? false,
+			connected: runtime?.connected ?? false,
+			lastConnectedAt: runtime?.lastConnectedAt ?? null,
+			lastError: runtime?.lastError ?? null,
+			lastInboundAt: runtime?.lastInboundAt ?? null,
+			lastOutboundAt: runtime?.lastOutboundAt ?? null
+		})
+	}
+};
+//#endregion
+export { qqbotPlugin as t };

package/dist/channel-plugin-api.js

@@ -0,0 +1,2 @@
+import { t as qqbotPlugin } from "./channel-N6Y_Rcjp.js";
+export { qqbotPlugin };

package/dist/channel.setup-ByCRAe5H.js

@@ -0,0 +1,25 @@
+import "./resolve-D_06fV6-.js";
+import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, r as qqbotConfigAdapter, t as qqbotChannelConfigSchema } from "./config-schema-DFcjQw73.js";
+//#region extensions/qqbot/src/channel.setup.ts
+/**
+* Setup-only QQBot plugin — lightweight subset used during `openclaw onboard`
+* and `openclaw configure` without pulling the full runtime dependencies.
+*/
+const qqbotSetupPlugin = {
+	id: "qqbot",
+	setupWizard: qqbotSetupWizard,
+	meta: { ...qqbotMeta },
+	capabilities: {
+		chatTypes: ["direct", "group"],
+		media: true,
+		reactions: false,
+		threads: false,
+		blockStreaming: true
+	},
+	reload: { configPrefixes: ["channels.qqbot"] },
+	configSchema: qqbotChannelConfigSchema,
+	config: { ...qqbotConfigAdapter },
+	setup: { ...qqbotSetupAdapterShared }
+};
+//#endregion
+export { qqbotSetupPlugin as t };