@openclaw/qqbot 2026.5.24-beta.2 → 2026.5.26-beta.1

package/dist/api.js

@@ -1,9 +1,9 @@
-import { C as recordMessageReply, E as setOutboundAudioPort, S as getMessageReplyStats, T as OUTBOUND_ERROR_CODES, _ as sendVoice, a as sendText, b as checkMessageReplyLimit, d as buildMediaTarget, f as parseTarget, g as sendVideoMsg, h as sendPhoto, i as sendProactiveMessage, m as sendDocument, n as sendCronMessage, p as resolveOutboundMediaPath, r as sendMedia, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR, x as getMessageReplyConfig, y as MESSAGE_REPLY_LIMIT } from "./outbound-CVDwCPRR.js";
-import { c as listQQBotAccountIds, l as resolveDefaultQQBotAccountId, o as DEFAULT_ACCOUNT_ID, s as applyQQBotAccountConfig, u as resolveQQBotAccount } from "./config-schema-CfbaUZcI.js";
-import { t as qqbotPlugin } from "./channel-M_xgk02s.js";
-import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-CMJ5DY9K.js";
-import { t as qqbotSetupPlugin } from "./channel.setup-CNTkQaYC.js";
-import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-ykvLAJFX.js";
+import { C as recordMessageReply, E as setOutboundAudioPort, S as getMessageReplyStats, T as OUTBOUND_ERROR_CODES, _ as sendVoice, a as sendText, b as checkMessageReplyLimit, d as buildMediaTarget, f as parseTarget, g as sendVideoMsg, h as sendPhoto, i as sendProactiveMessage, m as sendDocument, n as sendCronMessage, p as resolveOutboundMediaPath, r as sendMedia, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR, x as getMessageReplyConfig, y as MESSAGE_REPLY_LIMIT } from "./outbound-Ce2aX078.js";
+import { c as listQQBotAccountIds, l as resolveDefaultQQBotAccountId, o as DEFAULT_ACCOUNT_ID, s as applyQQBotAccountConfig, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
+import { t as qqbotPlugin } from "./channel-DtN9gbLm.js";
+import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
+import { t as qqbotSetupPlugin } from "./channel.setup-BxGpVkdx.js";
+import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-D-rKRREP.js";
 import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/qqbot/src/engine/tools/channel-api.ts
 /**

package/dist/{channel-M_xgk02s.js → channel-DtN9gbLm.js}

@@ -1,6 +1,6 @@
-import { c as getPlatformAdapter, t as asOptionalObjectRecord } from "./string-normalize-du8a5Uk3.js";
-import { a as qqbotSetupAdapterShared, c as listQQBotAccountIds, i as qqbotMeta, m as getBridgeLogger, n as qqbotSetupWizard, o as DEFAULT_ACCOUNT_ID$1, p as ensurePlatformAdapter, r as qqbotConfigAdapter, s as applyQQBotAccountConfig, t as qqbotChannelConfigSchema, u as resolveQQBotAccount } from "./config-schema-CfbaUZcI.js";
-import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-CMJ5DY9K.js";
+import { c as getPlatformAdapter, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
+import { a as qqbotSetupAdapterShared, c as listQQBotAccountIds, i as qqbotMeta, m as getBridgeLogger, n as qqbotSetupWizard, o as DEFAULT_ACCOUNT_ID$1, p as ensurePlatformAdapter, r as qqbotConfigAdapter, s as applyQQBotAccountConfig, t as qqbotChannelConfigSchema, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
+import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
 import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
 import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-message";
 import { createChannelApprovalCapability } from "openclaw/plugin-sdk/approval-delivery-runtime";
@@ -374,7 +374,7 @@ function createQQBotApprovalCapability() {
 			},
 			load: async () => {
 				ensurePlatformAdapter();
-				return (await import("./handler-runtime-BcPUK_xf.js")).qqbotApprovalNativeRuntime;
+				return (await import("./handler-runtime-I6vCvj2m.js")).qqbotApprovalNativeRuntime;
 			}
 		})
 	});
@@ -419,12 +419,17 @@ async function writeOpenClawConfigThroughRuntime(runtime, cfg) {
 * The temp-directory fallback is delegated to the PlatformAdapter.
 */
 /**
-* Resolve the current user's home directory safely across platforms.
+* Resolve the current user's OS home directory safely across platforms.
 *
 * Priority:
 * 1. `os.homedir()`
 * 2. `$HOME` or `%USERPROFILE%`
 * 3. PlatformAdapter.getTempDir() as a last resort
+*
+* This is the *operating-system* home and intentionally ignores
+* `OPENCLAW_HOME`. Persistent QQ Bot data (sessions, known users, refs) is
+* keyed on this value to keep upgrades from hiding existing state when an
+* operator later sets `OPENCLAW_HOME`.
 */
 function getHomeDir() {
 	try {
@@ -435,7 +440,39 @@ function getHomeDir() {
 	if (envHome && fs$1.existsSync(envHome)) return envHome;
 	return getPlatformAdapter().getTempDir();
 }
-/** Return a path under `~/.openclaw/qqbot` without creating it. */
+/**
+* Resolve the effective OpenClaw home directory.
+*
+* Mirrors the contract from core (`src/infra/home-dir.ts::resolveEffectiveHomeDir`)
+* so QQ Bot media roots live under the same tree the rest of OpenClaw treats as
+* `~`. The extension cannot import the core helper directly (it is a separate
+* package with `openclaw` as a peer dependency), so this re-implements the
+* minimal contract:
+*
+* 1. `OPENCLAW_HOME` when set (with `~` / `~/...` expanded against the OS home).
+* 2. Otherwise fall back to {@link getHomeDir} so existing single-home
+*    deployments are unaffected.
+*
+* Empty / `"undefined"` / `"null"` strings are treated as unset to match how
+* core normalizes the variable.
+*/
+function resolveOpenClawHome() {
+	const raw = process.env.OPENCLAW_HOME?.trim();
+	if (!raw || raw === "undefined" || raw === "null") return getHomeDir();
+	if (raw === "~" || raw.startsWith("~/") || raw.startsWith("~\\")) {
+		const osHome = getHomeDir();
+		if (raw === "~") return osHome;
+		return path$1.join(osHome, raw.slice(2));
+	}
+	return raw;
+}
+/**
+* Return a path under `~/.openclaw/qqbot` without creating it.
+*
+* Anchored on the OS home (not `OPENCLAW_HOME`) so persisted QQ Bot data
+* (sessions, known users, ref index, credential backups) does not silently
+* disappear when an operator adds `OPENCLAW_HOME` after the fact.
+*/
 function getQQBotDataPath(...subPaths) {
 	return path$1.join(getHomeDir(), ".openclaw", "qqbot", ...subPaths);
 }
@@ -446,32 +483,36 @@ function getQQBotDataDir(...subPaths) {
 	return dir;
 }
 /**
-* Return a path under `~/.openclaw/media/qqbot` without creating it.
+* Return a path under `<openclaw-home>/.openclaw/media/qqbot` without creating it.
 *
-* Unlike `getQQBotDataPath`, this lives under OpenClaw's core media allowlist so
-* downloaded images and audio can be accessed by framework media tooling.
+* Unlike `getQQBotDataPath`, this lives under OpenClaw's core media allowlist
+* so downloaded images and audio can be accessed by framework media tooling.
+* The base honors `OPENCLAW_HOME` (when set) so files written by agents into
+* the OpenClaw-managed media tree are reachable by this plugin even when
+* `HOME` and `OPENCLAW_HOME` differ (Docker, multi-user hosts). Fixes #83562.
 */
 function getQQBotMediaPath(...subPaths) {
-	return path$1.join(getHomeDir(), ".openclaw", "media", "qqbot", ...subPaths);
+	return path$1.join(resolveOpenClawHome(), ".openclaw", "media", "qqbot", ...subPaths);
 }
-/** Return a path under `~/.openclaw/media/qqbot`, creating it on demand. */
+/** Return a path under `<openclaw-home>/.openclaw/media/qqbot`, creating it on demand. */
 function getQQBotMediaDir(...subPaths) {
 	const dir = getQQBotMediaPath(...subPaths);
 	if (!fs$1.existsSync(dir)) fs$1.mkdirSync(dir, { recursive: true });
 	return dir;
 }
 /**
-* Return `~/.openclaw/media`, OpenClaw's shared media root.
+* Return `<openclaw-home>/.openclaw/media`, OpenClaw's shared media root.
 *
 * This mirrors the directory that core's `buildMediaLocalRoots` exposes as an
 * allowlisted location (see `openclaw/src/media/local-roots.ts`). Using it as a
 * QQ Bot payload root lets the plugin trust framework-produced files that live
 * in sibling subdirectories such as `outbound/` (written by
 * `saveMediaBuffer(..., "outbound", ...)`) or `inbound/`, while still keeping
-* the check anchored to a single, well-known directory.
+* the check anchored to a single, well-known directory. Like
+* {@link getQQBotMediaPath}, the base honors `OPENCLAW_HOME`.
 */
 function getOpenClawMediaDir() {
-	return path$1.join(getHomeDir(), ".openclaw", "media");
+	return path$1.join(resolveOpenClawHome(), ".openclaw", "media");
 }
 function isWindows() {
 	return process.platform === "win32";
@@ -533,14 +574,15 @@ function isPathWithinRoot(candidate, root) {
 function resolveQQBotLocalMediaPath(p) {
 	const normalized = normalizePath(p);
 	if (!isLocalPath(normalized) || fs$1.existsSync(normalized)) return normalized;
-	const homeDir = getHomeDir();
+	const osHomeDir = getHomeDir();
+	const openclawHomeDir = resolveOpenClawHome();
 	const mediaRoot = getQQBotMediaPath();
 	const dataRoot = getQQBotDataPath();
 	const candidateRoots = [
-		{
-			from: path$1.join(homeDir, ".openclaw", "workspace", "qqbot"),
+		...Array.from(new Set([path$1.join(osHomeDir, ".openclaw", "workspace", "qqbot"), path$1.join(openclawHomeDir, ".openclaw", "workspace", "qqbot")])).map((from) => ({
+			from,
 			to: mediaRoot
-		},
+		})),
 		{
 			from: dataRoot,
 			to: mediaRoot
@@ -826,7 +868,7 @@ function looksLikeQQBotTarget(id) {
 //#region extensions/qqbot/src/channel.ts
 let gatewayModulePromise;
 function loadGatewayModule() {
-	gatewayModulePromise ??= import("./gateway-CkzNqy_N.js");
+	gatewayModulePromise ??= import("./gateway-DuIz6XAh.js");
 	return gatewayModulePromise;
 }
 function createQQBotSendReceipt(params) {
@@ -844,7 +886,7 @@ function createQQBotSendReceipt(params) {
 async function sendQQBotText(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendText } = await import("./outbound-CVDwCPRR.js").then((n) => n.t);
+	const { sendText } = await import("./outbound-Ce2aX078.js").then((n) => n.t);
 	const result = await sendText({
 		to: params.to,
 		text: params.text,
@@ -866,7 +908,7 @@ async function sendQQBotText(params) {
 async function sendQQBotMedia(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendMedia } = await import("./outbound-CVDwCPRR.js").then((n) => n.t);
+	const { sendMedia } = await import("./outbound-Ce2aX078.js").then((n) => n.t);
 	const result = await sendMedia({
 		to: params.to,
 		text: params.text ?? "",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as qqbotPlugin } from "./channel-M_xgk02s.js";
+import { t as qqbotPlugin } from "./channel-DtN9gbLm.js";
 export { qqbotPlugin };

package/dist/{channel.setup-CNTkQaYC.js → channel.setup-BxGpVkdx.js}

@@ -1,4 +1,4 @@
-import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, r as qqbotConfigAdapter, t as qqbotChannelConfigSchema } from "./config-schema-CfbaUZcI.js";
+import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, r as qqbotConfigAdapter, t as qqbotChannelConfigSchema } from "./config-schema-iX2iJzKm.js";
 //#region extensions/qqbot/src/channel.setup.ts
 /**
 * Setup-only QQBot plugin — lightweight subset used during `openclaw onboard`

package/dist/{config-schema-CfbaUZcI.js → config-schema-iX2iJzKm.js}

@@ -1,4 +1,4 @@
-import { a as normalizeStringifiedOptionalString, c as getPlatformAdapter, d as registerPlatformAdapterFactory, l as hasPlatformAdapter, n as normalizeLowercaseStringOrEmpty, o as readStringField, r as normalizeOptionalLowercaseString, t as asOptionalObjectRecord, u as registerPlatformAdapter } from "./string-normalize-du8a5Uk3.js";
+import { a as normalizeStringifiedEntries, c as getPlatformAdapter, d as registerPlatformAdapterFactory, l as hasPlatformAdapter, n as normalizeLowercaseStringOrEmpty, o as readStringField, r as normalizeOptionalLowercaseString, t as asOptionalObjectRecord, u as registerPlatformAdapter } from "./string-normalize-R_0cKO7Q.js";
 import { buildSecretInputSchema, coerceSecretRef, hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";
 import fs from "node:fs";
@@ -285,7 +285,7 @@ function describeAccount(account) {
 }
 /** Normalize allowFrom entries into uppercase strings without the qqbot: prefix. */
 function formatAllowFrom(allowFrom) {
-	return (allowFrom ?? []).map((entry) => normalizeStringifiedOptionalString(entry)).filter((entry) => Boolean(entry)).map((entry) => entry.replace(/^qqbot:/i, "")).map((entry) => entry.toUpperCase());
+	return normalizeStringifiedEntries(allowFrom ?? []).map((entry) => entry.replace(/^qqbot:/i, "")).map((entry) => entry.toUpperCase());
 }
 //#endregion
 //#region extensions/qqbot/src/bridge/config.ts

package/dist/{gateway-CkzNqy_N.js → gateway-DuIz6XAh.js}

@@ -1,9 +1,10 @@
-import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-CVDwCPRR.js";
-import { c as getPlatformAdapter, i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-du8a5Uk3.js";
-import { f as resolveAccountBase, h as setBridgeLogger, p as ensurePlatformAdapter } from "./config-schema-CfbaUZcI.js";
-import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath$1, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-M_xgk02s.js";
-import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-CMJ5DY9K.js";
-import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-ykvLAJFX.js";
+import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-Ce2aX078.js";
+import { c as getPlatformAdapter, i as normalizeOptionalString$1, n as normalizeLowercaseStringOrEmpty$1, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
+import { f as resolveAccountBase, h as setBridgeLogger, p as ensurePlatformAdapter } from "./config-schema-iX2iJzKm.js";
+import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath$1, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-DtN9gbLm.js";
+import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
+import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-D-rKRREP.js";
+import { asBoolean, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import * as fs$1 from "node:fs";
 import fs from "node:fs";
 import * as os$1 from "node:os";
@@ -1822,7 +1823,7 @@ async function transcribeAudio(audioPath, cfg) {
 			const detail = await resp.text().catch(() => "");
 			throw new Error(`STT failed (HTTP ${resp.status}): ${detail.slice(0, 300)}`);
 		}
-		return normalizeOptionalString((await resp.json()).text) ?? null;
+		return normalizeOptionalString$1((await resp.json()).text) ?? null;
 	} finally {
 		await release();
 	}
@@ -1878,7 +1879,7 @@ async function processAttachments(attachments, ctx) {
 		};
 	});
 	const processTasks = (await Promise.all(downloadTasks)).map(async ({ att, attUrl, isVoice, localPath, audioPath }) => {
-		const asrReferText = normalizeOptionalString(att.asr_refer_text) ?? "";
+		const asrReferText = normalizeOptionalString$1(att.asr_refer_text) ?? "";
 		const voiceSourceUrl = (isVoice && att.voice_wav_url ? att.voice_wav_url.startsWith("//") ? `https:${att.voice_wav_url}` : att.voice_wav_url : "") || attUrl;
 		const meta = {
 			voiceUrl: isVoice && voiceSourceUrl ? voiceSourceUrl : void 0,
@@ -2450,6 +2451,14 @@ function escapeRegex(str) {
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/stages/envelope-stage.ts
+/**
+* Envelope stage — render the Web UI body, the dynamic-context block,
+* the final group system prompt, and the media classification arrays.
+*
+* All logic here is presentation-layer glue: it combines fields built by
+* earlier stages into the display-friendly strings the outbound
+* dispatcher needs. No decisions / gating.
+*/
 /** Format the inbound envelope (Web UI body). */
 function buildBody(input) {
 	const { event, deps, userContent, isGroupChat, imageUrls } = input;
@@ -2506,8 +2515,8 @@ function classifyMedia(processed) {
 			localMediaTypes.push(t);
 		}
 	}
-	const uniqueVoicePaths = [...new Set(processed.voiceAttachmentPaths)];
-	const uniqueVoiceUrls = [...new Set(processed.voiceAttachmentUrls)];
+	const uniqueVoicePaths = uniqueStrings(processed.voiceAttachmentPaths);
+	const uniqueVoiceUrls = uniqueStrings(processed.voiceAttachmentUrls);
 	const voiceMediaTypes = [...uniqueVoicePaths, ...uniqueVoiceUrls].map(() => "audio/wav");
 	return {
 		localMediaPaths,
@@ -2516,7 +2525,7 @@ function classifyMedia(processed) {
 		remoteMediaTypes,
 		uniqueVoicePaths,
 		uniqueVoiceUrls,
-		uniqueVoiceAsrReferTexts: [...new Set(processed.voiceAsrReferTexts)].filter(Boolean),
+		uniqueVoiceAsrReferTexts: uniqueStrings(processed.voiceAsrReferTexts).filter(Boolean),
 		voiceMediaTypes,
 		hasAsrReferFallback: processed.voiceTranscriptSources.includes("asr"),
 		voiceTranscriptSources: processed.voiceTranscriptSources
@@ -2540,8 +2549,7 @@ function readGroupsMap(cfg, accountId) {
 	return normalized;
 }
 function readBoolean(obj, key) {
-	const v = obj[key];
-	return typeof v === "boolean" ? v : void 0;
+	return asBoolean(obj[key]);
 }
 function readString(obj, key) {
 	const v = obj[key];
@@ -3209,11 +3217,10 @@ function authorizeApprovalButtonActor(params) {
 	};
 }
 function resolveApprovalActorSenderIds(event) {
-	const ids = [event.group_member_openid, event.user_openid].flatMap((value) => {
+	return uniqueStrings([event.group_member_openid, event.user_openid].flatMap((value) => {
 		const normalized = typeof value === "string" ? value.trim() : "";
 		return normalized ? [normalized] : [];
-	});
-	return Array.from(new Set(ids));
+	}));
 }
 function resolveApprovalKind(approvalId) {
 	return approvalId.toLowerCase().startsWith("plugin:") ? "plugin" : "exec";
@@ -3589,7 +3596,7 @@ async function parseAndSendMediaTags(replyText, event, actx, sendWithRetry, cons
 		normalizedText: text
 	};
 	const tagCounts = mediaTagMatches.reduce((acc, m) => {
-		const t = normalizeLowercaseStringOrEmpty(m[1]);
+		const t = normalizeLowercaseStringOrEmpty$1(m[1]);
 		acc[t] = (acc[t] ?? 0) + 1;
 		return acc;
 	}, {});
@@ -3604,8 +3611,8 @@ async function parseAndSendMediaTags(replyText, event, actx, sendWithRetry, cons
 			type: "text",
 			content: filterInternalMarkers(textBefore)
 		});
-		const tagName = normalizeLowercaseStringOrEmpty(match[1]);
-		const mediaPath = decodeMediaPath(normalizeOptionalString(match[2]) ?? "", log);
+		const tagName = normalizeLowercaseStringOrEmpty$1(match[1]);
+		const mediaPath = decodeMediaPath(normalizeOptionalString$1(match[2]) ?? "", log);
 		if (mediaPath) {
 			const itemType = {
 				qqmedia: "media",
@@ -4026,7 +4033,7 @@ async function handleImagePayload(ctx, payload) {
 		const base64Data = fileBuffer.toString("base64");
 		const mimeType = getImageMimeType(imageUrl);
 		if (!mimeType) {
-			const ext = normalizeLowercaseStringOrEmpty(path.extname(imageUrl));
+			const ext = normalizeLowercaseStringOrEmpty$1(path.extname(imageUrl));
 			log?.error(`Unsupported image format: ${ext}`);
 			return;
 		}
@@ -5282,7 +5289,7 @@ async function convertSilkToWav(inputPath, outputDir) {
 /** Check whether an attachment is a voice file (by MIME type or extension). */
 function isVoiceAttachment(att) {
 	if (att.content_type === "voice" || att.content_type?.startsWith("audio/")) return true;
-	const ext = att.filename ? normalizeLowercaseStringOrEmpty(path$1.extname(att.filename)) : "";
+	const ext = att.filename ? normalizeLowercaseStringOrEmpty$1(path$1.extname(att.filename)) : "";
 	return [
 		".amr",
 		".silk",
@@ -5295,7 +5302,7 @@ function isAudioFile(filePath, mimeType) {
 	if (mimeType) {
 		if (mimeType === "voice" || mimeType.startsWith("audio/")) return true;
 	}
-	const ext = normalizeLowercaseStringOrEmpty(path$1.extname(filePath));
+	const ext = normalizeLowercaseStringOrEmpty$1(path$1.extname(filePath));
 	return [
 		".silk",
 		".slk",
@@ -5329,8 +5336,8 @@ const QQ_NATIVE_VOICE_EXTS = new Set([
 ]);
 /** Check whether a voice file needs transcoding for upload (QQ-native formats skip it). */
 function shouldTranscodeVoice(filePath, mimeType) {
-	if (mimeType && QQ_NATIVE_VOICE_MIMES.has(normalizeLowercaseStringOrEmpty(mimeType))) return false;
-	const ext = normalizeLowercaseStringOrEmpty(path$1.extname(filePath));
+	if (mimeType && QQ_NATIVE_VOICE_MIMES.has(normalizeLowercaseStringOrEmpty$1(mimeType))) return false;
+	const ext = normalizeLowercaseStringOrEmpty$1(path$1.extname(filePath));
 	if (QQ_NATIVE_VOICE_EXTS.has(ext)) return false;
 	return isAudioFile(filePath, mimeType);
 }
@@ -5341,7 +5348,7 @@ const QQ_NATIVE_UPLOAD_FORMATS = [
 ];
 function normalizeFormats(formats) {
 	return formats.map((f) => {
-		const lower = normalizeLowercaseStringOrEmpty(f);
+		const lower = normalizeLowercaseStringOrEmpty$1(f);
 		return lower.startsWith(".") ? lower : `.${lower}`;
 	});
 }
@@ -5361,7 +5368,7 @@ async function audioFileToSilkBase64(filePath, directUploadFormats) {
 		debugError(`[audio-convert] file is empty: ${filePath}`);
 		return null;
 	}
-	const ext = normalizeLowercaseStringOrEmpty(path$1.extname(filePath));
+	const ext = normalizeLowercaseStringOrEmpty$1(path$1.extname(filePath));
 	if ((directUploadFormats ? normalizeFormats(directUploadFormats) : QQ_NATIVE_UPLOAD_FORMATS).includes(ext)) {
 		debugLog(`[audio-convert] direct upload (QQ native format): ${ext} (${buf.length} bytes)`);
 		return buf.toString("base64");
@@ -5586,8 +5593,75 @@ function parseWavFallback(buf) {
 	return null;
 }
 //#endregion
+//#region extensions/qqbot/src/engine/gateway/response-timeout.ts
+/**
+* QQBot outbound response watchdog timeout resolver.
+*
+* Background — issue #85267:
+*   The reporter ran openclaw + ollama + `qwen3.5:27b` (a slow local model)
+*   with `models.providers.ollama.timeoutSeconds: 1800` and saw the
+*   QQBot reply path abort at ~5 minutes with "LLM request timed out",
+*   despite the direct ollama call to the same model working. The
+*   embedded-runner / idle-timeout layer already honors longer
+*   provider timeouts (see `src/agents/pi-embedded-runner/run/llm-idle-timeout.ts`),
+*   but the QQBot outbound dispatcher held an independent hardcoded
+*   `RESPONSE_TIMEOUT = 300_000` watchdog that quietly undercut the
+*   configured ceiling.
+*
+* Fix shape (clawsweeper `clawsweeper:fix-shape-clear`):
+*   Don't add a new QQBot-only knob. Instead derive the QQBot wait
+*   budget from the existing agent/provider timeout settings the user
+*   already configured:
+*     - `agents.defaults.timeoutSeconds`
+*     - `models.providers.<id>.timeoutSeconds` (max across configured providers)
+*   Take the maximum and clamp to `[DEFAULT_RESPONSE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_MS]`.
+*   The default floor preserves the existing 5-minute guard for users
+*   that have not configured any longer ceiling — i.e. a no-op for
+*   typical cloud-model deployments.
+*/
+/**
+* Default QQBot outbound response watchdog when no config override is
+* present. Preserves the historical 5-minute guard for unconfigured
+* deployments.
+*/
+const DEFAULT_RESPONSE_TIMEOUT_MS = 3e5;
+/**
+* Upper bound to keep the watchdog inside the safe `setTimeout` range
+* (approximately 24.8 days). Mirrors `MAX_SAFE_TIMEOUT_MS` in
+* `src/agents/pi-embedded-runner/run/llm-idle-timeout.ts`.
+*/
+const MAX_SAFE_TIMEOUT_MS = 2147e6;
+function positiveSecondsToMs(value) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return;
+	return Math.floor(value * 1e3);
+}
+/**
+* Resolve the QQBot outbound response watchdog (ms).
+*
+* The watchdog is the longest of:
+*   - `DEFAULT_RESPONSE_TIMEOUT_MS` (5 min, historical floor)
+*   - `cfg.agents.defaults.timeoutSeconds` converted to ms
+*   - the maximum `cfg.models.providers.<id>.timeoutSeconds` across
+*     configured providers, converted to ms
+*
+* Returns at most `MAX_SAFE_TIMEOUT_MS` so the chosen value is always
+* a safe `setTimeout` argument.
+*/
+function resolveResponseTimeoutMs(cfg) {
+	const candidates = [DEFAULT_RESPONSE_TIMEOUT_MS];
+	const typed = cfg ?? {};
+	const agentDefaultMs = positiveSecondsToMs(typed.agents?.defaults?.timeoutSeconds);
+	if (agentDefaultMs !== void 0) candidates.push(agentDefaultMs);
+	const providers = typed.models?.providers;
+	if (providers && typeof providers === "object") for (const entry of Object.values(providers)) {
+		const providerMs = positiveSecondsToMs(entry?.timeoutSeconds);
+		if (providerMs !== void 0) candidates.push(providerMs);
+	}
+	const chosen = Math.max(...candidates);
+	return Math.min(chosen, MAX_SAFE_TIMEOUT_MS);
+}
+//#endregion
 //#region extensions/qqbot/src/engine/gateway/outbound-dispatch.ts
-const RESPONSE_TIMEOUT = 3e5;
 const TOOL_ONLY_TIMEOUT = 6e4;
 const MAX_TOOL_RENEWALS = 3;
 const TOOL_MEDIA_SEND_TIMEOUT = 45e3;
@@ -5659,10 +5733,11 @@ async function dispatchOutbound(inbound, deps) {
 		}
 		if (toolTexts.length > 0) await sendErrorMessage(toolTexts.slice(-3).join("\n---\n").slice(0, 2e3));
 	};
+	const responseTimeoutMs = resolveResponseTimeoutMs(cfg);
 	const timeoutPromise = new Promise((_, reject) => {
 		timeoutId = setTimeout(() => {
 			if (!hasResponse) reject(/* @__PURE__ */ new Error("Response timeout"));
-		}, RESPONSE_TIMEOUT);
+		}, responseTimeoutMs);
 	});
 	const deliverDeps = {
 		mediaSender: {

package/dist/{handler-runtime-BcPUK_xf.js → handler-runtime-I6vCvj2m.js}

@@ -1,6 +1,6 @@
-import { m as getBridgeLogger, p as ensurePlatformAdapter, u as resolveQQBotAccount } from "./config-schema-CfbaUZcI.js";
-import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-M_xgk02s.js";
-import { d as getMessageApi, i as accountToCreds } from "./runtime-CMJ5DY9K.js";
+import { m as getBridgeLogger, p as ensurePlatformAdapter, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
+import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-DtN9gbLm.js";
+import { d as getMessageApi, i as accountToCreds } from "./runtime-TzkQ0YbR.js";
 import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
 //#region extensions/qqbot/src/bridge/approval/handler-runtime.ts

package/dist/{outbound-CVDwCPRR.js → outbound-Ce2aX078.js}

@@ -1,6 +1,6 @@
-import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-du8a5Uk3.js";
-import { a as getQQBotDataDir, f as normalizePath, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-M_xgk02s.js";
-import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-CMJ5DY9K.js";
+import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
+import { a as getQQBotDataDir, f as normalizePath, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-DtN9gbLm.js";
+import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
 import { pathExistsSync, resolveLocalPathFromRootsSync } from "openclaw/plugin-sdk/security-runtime";
 import path from "node:path";
 import { getFileExtension } from "openclaw/plugin-sdk/media-mime";

package/dist/{request-context-ykvLAJFX.js → request-context-D-rKRREP.js}

@@ -1,5 +1,6 @@
-import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-M_xgk02s.js";
-import { w as debugLog } from "./runtime-CMJ5DY9K.js";
+import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-DtN9gbLm.js";
+import { w as debugLog } from "./runtime-TzkQ0YbR.js";
+import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs";
 import path from "node:path";
 import { loadJsonFile } from "openclaw/plugin-sdk/json-store";
@@ -648,7 +649,7 @@ function buildBotLogsResult() {
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
 	const tmpFile = writeNewTextFileSync(path.join(tmpDir, `bot-logs-${timestamp}.txt`), lines.join("\n"));
 	const fileCount = recentFiles.length;
-	const topSources = Array.from(new Set(recentFiles.map((item) => item.sourceDir))).slice(0, 3);
+	const topSources = uniqueStrings(recentFiles.map((item) => item.sourceDir)).slice(0, 3);
 	let summaryText = `共 ${fileCount} 个日志文件，包含 ${totalIncluded} 行内容`;
 	if (truncatedCount > 0) summaryText += `（其中 ${truncatedCount} 个文件已截断为最后 ${MAX_LINES_PER_FILE} 行，总计原始 ${totalOriginal} 行）`;
 	return {

package/dist/{runtime-CMJ5DY9K.js → runtime-TzkQ0YbR.js}

@@ -1,4 +1,4 @@
-import { c as getPlatformAdapter, i as normalizeOptionalString, s as sanitizeFileName } from "./string-normalize-du8a5Uk3.js";
+import { c as getPlatformAdapter, i as normalizeOptionalString, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
 import * as fs$1 from "node:fs";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import os from "node:os";
@@ -985,6 +985,194 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
+//#region extensions/qqbot/src/engine/api/token.ts
+const TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken";
+/**
+* Per-appId token manager with caching, singleflight, and background refresh.
+*
+* Usage:
+* ```ts
+* const tm = new TokenManager({ logger, userAgent: 'QQBotPlugin/1.0' });
+* const token = await tm.getAccessToken('appId', 'secret');
+* ```
+*/
+var TokenManager = class {
+	constructor(config) {
+		this.cache = /* @__PURE__ */ new Map();
+		this.fetchPromises = /* @__PURE__ */ new Map();
+		this.refreshControllers = /* @__PURE__ */ new Map();
+		this.logger = config?.logger;
+		const ua = config?.userAgent ?? "QQBotPlugin/unknown";
+		this.resolveUserAgent = typeof ua === "function" ? ua : () => ua;
+	}
+	/**
+	* Obtain an access token with caching and singleflight semantics.
+	*
+	* When multiple callers request a token for the same appId concurrently,
+	* only one actual HTTP request is made — the others await the same promise.
+	*/
+	async getAccessToken(appId, clientSecret) {
+		const normalizedId = appId.trim();
+		const cached = this.cache.get(normalizedId);
+		const refreshAheadMs = cached ? Math.min(300 * 1e3, (cached.expiresAt - Date.now()) / 3) : 0;
+		if (cached && Date.now() < cached.expiresAt - refreshAheadMs) return cached.token;
+		let pending = this.fetchPromises.get(normalizedId);
+		if (pending) {
+			this.logger?.debug?.(`[qqbot:token:${normalizedId}] Fetch in progress, reusing promise`);
+			return pending;
+		}
+		pending = (async () => {
+			try {
+				return await this.doFetchToken(normalizedId, clientSecret);
+			} finally {
+				this.fetchPromises.delete(normalizedId);
+			}
+		})();
+		this.fetchPromises.set(normalizedId, pending);
+		return pending;
+	}
+	/** Clear the cached token for one appId, or all. */
+	clearCache(appId) {
+		if (appId) {
+			this.cache.delete(appId.trim());
+			this.logger?.debug?.(`[qqbot:token:${appId}] Cache cleared`);
+		} else {
+			this.cache.clear();
+			this.logger?.debug?.(`[token] All caches cleared`);
+		}
+	}
+	/** Return token status for diagnostics. */
+	getStatus(appId) {
+		if (this.fetchPromises.has(appId)) return {
+			status: "refreshing",
+			expiresAt: this.cache.get(appId)?.expiresAt ?? null
+		};
+		const cached = this.cache.get(appId);
+		if (!cached) return {
+			status: "none",
+			expiresAt: null
+		};
+		const remaining = cached.expiresAt - Date.now();
+		return {
+			status: remaining > Math.min(300 * 1e3, remaining / 3) ? "valid" : "expired",
+			expiresAt: cached.expiresAt
+		};
+	}
+	/** Start a background token refresh loop for one appId. */
+	startBackgroundRefresh(appId, clientSecret, options) {
+		if (this.refreshControllers.has(appId)) {
+			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh already running`);
+			return;
+		}
+		const { refreshAheadMs = 300 * 1e3, randomOffsetMs = 30 * 1e3, minRefreshIntervalMs = 60 * 1e3, retryDelayMs = 5 * 1e3 } = options ?? {};
+		const controller = new AbortController();
+		this.refreshControllers.set(appId, controller);
+		const { signal } = controller;
+		const loop = async () => {
+			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh started`);
+			while (!signal.aborted) try {
+				await this.getAccessToken(appId, clientSecret);
+				const cached = this.cache.get(appId);
+				if (cached) {
+					const expiresIn = cached.expiresAt - Date.now();
+					const randomOffset = Math.random() * randomOffsetMs;
+					const refreshIn = Math.max(expiresIn - refreshAheadMs - randomOffset, minRefreshIntervalMs);
+					this.logger?.debug?.(`[qqbot:token:${appId}] Next refresh in ${Math.round(refreshIn / 1e3)}s`);
+					await this.abortableSleep(refreshIn, signal);
+				} else await this.abortableSleep(minRefreshIntervalMs, signal);
+			} catch (err) {
+				if (signal.aborted) break;
+				this.logger?.error?.(`[qqbot:token:${appId}] Background refresh failed: ${formatErrorMessage(err)}`);
+				await this.abortableSleep(retryDelayMs, signal);
+			}
+			this.refreshControllers.delete(appId);
+			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh stopped`);
+		};
+		loop().catch((err) => {
+			this.refreshControllers.delete(appId);
+			this.logger?.error?.(`[qqbot:token:${appId}] Background refresh crashed: ${err}`);
+		});
+	}
+	/** Stop background refresh for one appId, or all. */
+	stopBackgroundRefresh(appId) {
+		if (appId) {
+			const ctrl = this.refreshControllers.get(appId);
+			if (ctrl) {
+				ctrl.abort();
+				this.refreshControllers.delete(appId);
+			}
+		} else {
+			for (const ctrl of this.refreshControllers.values()) ctrl.abort();
+			this.refreshControllers.clear();
+		}
+	}
+	/** Check whether background refresh is running. */
+	isBackgroundRefreshRunning(appId) {
+		if (appId) return this.refreshControllers.has(appId);
+		return this.refreshControllers.size > 0;
+	}
+	async doFetchToken(appId, clientSecret) {
+		this.logger?.debug?.(`[qqbot:token:${appId}] >>> POST ${TOKEN_URL}`);
+		let response;
+		try {
+			response = await fetch(TOKEN_URL, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					"User-Agent": this.resolveUserAgent()
+				},
+				body: JSON.stringify({
+					appId,
+					clientSecret
+				})
+			});
+		} catch (err) {
+			this.logger?.error?.(`[qqbot:token:${appId}] Network error: ${formatErrorMessage(err)}`);
+			throw new Error(`Network error getting access_token: ${formatErrorMessage(err)}`, { cause: err });
+		}
+		const traceId = response.headers.get("x-tps-trace-id") ?? "";
+		this.logger?.debug?.(`[qqbot:token:${appId}] <<< ${response.status}${traceId ? ` | TraceId: ${traceId}` : ""}`);
+		let rawBody;
+		try {
+			rawBody = await response.text();
+		} catch (err) {
+			throw new Error(`Failed to read access_token response: ${formatErrorMessage(err)}`, { cause: err });
+		}
+		const logBody = rawBody.replace(/"access_token"\s*:\s*"[^"]+"/g, "\"access_token\": \"***\"");
+		this.logger?.debug?.(`[qqbot:token:${appId}] <<< Body: ${logBody}`);
+		let data;
+		try {
+			data = JSON.parse(rawBody);
+		} catch {
+			throw new Error("QQBot access_token response was malformed JSON");
+		}
+		if (!data.access_token) throw new Error(`Failed to get access_token: ${JSON.stringify(data)}`);
+		const expiresAt = Date.now() + (data.expires_in ?? 7200) * 1e3;
+		this.cache.set(appId, {
+			token: data.access_token,
+			expiresAt,
+			appId
+		});
+		this.logger?.debug?.(`[qqbot:token:${appId}] Cached, expires at: ${new Date(expiresAt).toISOString()}`);
+		return data.access_token;
+	}
+	abortableSleep(ms, signal) {
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(resolve, ms);
+			if (signal.aborted) {
+				clearTimeout(timer);
+				reject(/* @__PURE__ */ new Error("Aborted"));
+				return;
+			}
+			const onAbort = () => {
+				clearTimeout(timer);
+				reject(/* @__PURE__ */ new Error("Aborted"));
+			};
+			signal.addEventListener("abort", onAbort, { once: true });
+		});
+	}
+};
+//#endregion
 //#region extensions/qqbot/src/engine/api/media.ts
 /**
 * Media upload API for the QQ Open Platform (small-file direct upload).
@@ -1240,194 +1428,6 @@ var MessageApi = class {
 	}
 };
 //#endregion
-//#region extensions/qqbot/src/engine/api/token.ts
-const TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken";
-/**
-* Per-appId token manager with caching, singleflight, and background refresh.
-*
-* Usage:
-* ```ts
-* const tm = new TokenManager({ logger, userAgent: 'QQBotPlugin/1.0' });
-* const token = await tm.getAccessToken('appId', 'secret');
-* ```
-*/
-var TokenManager = class {
-	constructor(config) {
-		this.cache = /* @__PURE__ */ new Map();
-		this.fetchPromises = /* @__PURE__ */ new Map();
-		this.refreshControllers = /* @__PURE__ */ new Map();
-		this.logger = config?.logger;
-		const ua = config?.userAgent ?? "QQBotPlugin/unknown";
-		this.resolveUserAgent = typeof ua === "function" ? ua : () => ua;
-	}
-	/**
-	* Obtain an access token with caching and singleflight semantics.
-	*
-	* When multiple callers request a token for the same appId concurrently,
-	* only one actual HTTP request is made — the others await the same promise.
-	*/
-	async getAccessToken(appId, clientSecret) {
-		const normalizedId = appId.trim();
-		const cached = this.cache.get(normalizedId);
-		const refreshAheadMs = cached ? Math.min(300 * 1e3, (cached.expiresAt - Date.now()) / 3) : 0;
-		if (cached && Date.now() < cached.expiresAt - refreshAheadMs) return cached.token;
-		let pending = this.fetchPromises.get(normalizedId);
-		if (pending) {
-			this.logger?.debug?.(`[qqbot:token:${normalizedId}] Fetch in progress, reusing promise`);
-			return pending;
-		}
-		pending = (async () => {
-			try {
-				return await this.doFetchToken(normalizedId, clientSecret);
-			} finally {
-				this.fetchPromises.delete(normalizedId);
-			}
-		})();
-		this.fetchPromises.set(normalizedId, pending);
-		return pending;
-	}
-	/** Clear the cached token for one appId, or all. */
-	clearCache(appId) {
-		if (appId) {
-			this.cache.delete(appId.trim());
-			this.logger?.debug?.(`[qqbot:token:${appId}] Cache cleared`);
-		} else {
-			this.cache.clear();
-			this.logger?.debug?.(`[token] All caches cleared`);
-		}
-	}
-	/** Return token status for diagnostics. */
-	getStatus(appId) {
-		if (this.fetchPromises.has(appId)) return {
-			status: "refreshing",
-			expiresAt: this.cache.get(appId)?.expiresAt ?? null
-		};
-		const cached = this.cache.get(appId);
-		if (!cached) return {
-			status: "none",
-			expiresAt: null
-		};
-		const remaining = cached.expiresAt - Date.now();
-		return {
-			status: remaining > Math.min(300 * 1e3, remaining / 3) ? "valid" : "expired",
-			expiresAt: cached.expiresAt
-		};
-	}
-	/** Start a background token refresh loop for one appId. */
-	startBackgroundRefresh(appId, clientSecret, options) {
-		if (this.refreshControllers.has(appId)) {
-			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh already running`);
-			return;
-		}
-		const { refreshAheadMs = 300 * 1e3, randomOffsetMs = 30 * 1e3, minRefreshIntervalMs = 60 * 1e3, retryDelayMs = 5 * 1e3 } = options ?? {};
-		const controller = new AbortController();
-		this.refreshControllers.set(appId, controller);
-		const { signal } = controller;
-		const loop = async () => {
-			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh started`);
-			while (!signal.aborted) try {
-				await this.getAccessToken(appId, clientSecret);
-				const cached = this.cache.get(appId);
-				if (cached) {
-					const expiresIn = cached.expiresAt - Date.now();
-					const randomOffset = Math.random() * randomOffsetMs;
-					const refreshIn = Math.max(expiresIn - refreshAheadMs - randomOffset, minRefreshIntervalMs);
-					this.logger?.debug?.(`[qqbot:token:${appId}] Next refresh in ${Math.round(refreshIn / 1e3)}s`);
-					await this.abortableSleep(refreshIn, signal);
-				} else await this.abortableSleep(minRefreshIntervalMs, signal);
-			} catch (err) {
-				if (signal.aborted) break;
-				this.logger?.error?.(`[qqbot:token:${appId}] Background refresh failed: ${formatErrorMessage(err)}`);
-				await this.abortableSleep(retryDelayMs, signal);
-			}
-			this.refreshControllers.delete(appId);
-			this.logger?.info?.(`[qqbot:token:${appId}] Background refresh stopped`);
-		};
-		loop().catch((err) => {
-			this.refreshControllers.delete(appId);
-			this.logger?.error?.(`[qqbot:token:${appId}] Background refresh crashed: ${err}`);
-		});
-	}
-	/** Stop background refresh for one appId, or all. */
-	stopBackgroundRefresh(appId) {
-		if (appId) {
-			const ctrl = this.refreshControllers.get(appId);
-			if (ctrl) {
-				ctrl.abort();
-				this.refreshControllers.delete(appId);
-			}
-		} else {
-			for (const ctrl of this.refreshControllers.values()) ctrl.abort();
-			this.refreshControllers.clear();
-		}
-	}
-	/** Check whether background refresh is running. */
-	isBackgroundRefreshRunning(appId) {
-		if (appId) return this.refreshControllers.has(appId);
-		return this.refreshControllers.size > 0;
-	}
-	async doFetchToken(appId, clientSecret) {
-		this.logger?.debug?.(`[qqbot:token:${appId}] >>> POST ${TOKEN_URL}`);
-		let response;
-		try {
-			response = await fetch(TOKEN_URL, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					"User-Agent": this.resolveUserAgent()
-				},
-				body: JSON.stringify({
-					appId,
-					clientSecret
-				})
-			});
-		} catch (err) {
-			this.logger?.error?.(`[qqbot:token:${appId}] Network error: ${formatErrorMessage(err)}`);
-			throw new Error(`Network error getting access_token: ${formatErrorMessage(err)}`, { cause: err });
-		}
-		const traceId = response.headers.get("x-tps-trace-id") ?? "";
-		this.logger?.debug?.(`[qqbot:token:${appId}] <<< ${response.status}${traceId ? ` | TraceId: ${traceId}` : ""}`);
-		let rawBody;
-		try {
-			rawBody = await response.text();
-		} catch (err) {
-			throw new Error(`Failed to read access_token response: ${formatErrorMessage(err)}`, { cause: err });
-		}
-		const logBody = rawBody.replace(/"access_token"\s*:\s*"[^"]+"/g, "\"access_token\": \"***\"");
-		this.logger?.debug?.(`[qqbot:token:${appId}] <<< Body: ${logBody}`);
-		let data;
-		try {
-			data = JSON.parse(rawBody);
-		} catch {
-			throw new Error("QQBot access_token response was malformed JSON");
-		}
-		if (!data.access_token) throw new Error(`Failed to get access_token: ${JSON.stringify(data)}`);
-		const expiresAt = Date.now() + (data.expires_in ?? 7200) * 1e3;
-		this.cache.set(appId, {
-			token: data.access_token,
-			expiresAt,
-			appId
-		});
-		this.logger?.debug?.(`[qqbot:token:${appId}] Cached, expires at: ${new Date(expiresAt).toISOString()}`);
-		return data.access_token;
-	}
-	abortableSleep(ms, signal) {
-		return new Promise((resolve, reject) => {
-			const timer = setTimeout(resolve, ms);
-			if (signal.aborted) {
-				clearTimeout(timer);
-				reject(/* @__PURE__ */ new Error("Aborted"));
-				return;
-			}
-			const onAbort = () => {
-				clearTimeout(timer);
-				reject(/* @__PURE__ */ new Error("Aborted"));
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-		});
-	}
-};
-//#endregion
 //#region extensions/qqbot/src/engine/utils/log.ts
 /**
 * QQBot debug logging utilities.

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-CMJ5DY9K.js";
+import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-TzkQ0YbR.js";
 export { getQQBotRuntime, setQQBotRuntime };

package/dist/setup-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as qqbotSetupPlugin } from "./channel.setup-CNTkQaYC.js";
+import { t as qqbotSetupPlugin } from "./channel.setup-BxGpVkdx.js";
 export { qqbotSetupPlugin };

package/dist/{string-normalize-du8a5Uk3.js → string-normalize-R_0cKO7Q.js}

@@ -45,6 +45,9 @@ function normalizeStringifiedOptionalString(value) {
 	if (typeof value === "string") return normalizeOptionalString(value);
 	if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return normalizeOptionalString(String(value));
 }
+function normalizeStringifiedEntries(values) {
+	return (values ?? []).map((entry) => normalizeStringifiedOptionalString(entry)).filter((entry) => Boolean(entry));
+}
 /** Return the trimmed lowercase string or `undefined`. */
 function normalizeOptionalLowercaseString(value) {
 	return normalizeOptionalString(value)?.toLowerCase();
@@ -79,4 +82,4 @@ function sanitizeFileName(name) {
 	return result;
 }
 //#endregion
-export { normalizeStringifiedOptionalString as a, getPlatformAdapter as c, registerPlatformAdapterFactory as d, normalizeOptionalString as i, hasPlatformAdapter as l, normalizeLowercaseStringOrEmpty as n, readStringField as o, normalizeOptionalLowercaseString as r, sanitizeFileName as s, asOptionalObjectRecord as t, registerPlatformAdapter as u };
+export { normalizeStringifiedEntries as a, getPlatformAdapter as c, registerPlatformAdapterFactory as d, normalizeOptionalString as i, hasPlatformAdapter as l, normalizeLowercaseStringOrEmpty as n, readStringField as o, normalizeOptionalLowercaseString as r, sanitizeFileName as s, asOptionalObjectRecord as t, registerPlatformAdapter as u };

package/node_modules/ws/lib/receiver.js

@@ -40,6 +40,10 @@ class Receiver extends Writable {
    *     extensions
    * @param {Boolean} [options.isServer=false] Specifies whether to operate in
    *     client or server mode
+   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=0] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=0] The maximum allowed message length
    * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
    *     not to skip UTF-8 validation for text and close messages
@@ -54,6 +58,8 @@ class Receiver extends Writable {
     this._binaryType = options.binaryType || BINARY_TYPES[0];
     this._extensions = options.extensions || {};
     this._isServer = !!options.isServer;
+    this._maxBufferedChunks = options.maxBufferedChunks | 0;
+    this._maxFragments = options.maxFragments | 0;
     this._maxPayload = options.maxPayload | 0;
     this._skipUTF8Validation = !!options.skipUTF8Validation;
     this[kWebSocket] = undefined;
@@ -89,6 +95,22 @@ class Receiver extends Writable {
   _write(chunk, encoding, cb) {
     if (this._opcode === 0x08 && this._state == GET_INFO) return cb();
 
+    if (
+      this._maxBufferedChunks > 0 &&
+      this._buffers.length >= this._maxBufferedChunks
+    ) {
+      cb(
+        this.createError(
+          RangeError,
+          'Too many buffered chunks',
+          false,
+          1008,
+          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+        )
+      );
+      return;
+    }
+
     this._bufferedBytes += chunk.length;
     this._buffers.push(chunk);
     this.startLoop(cb);
@@ -485,6 +507,22 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
+      if (
+        this._maxFragments > 0 &&
+        this._fragments.length >= this._maxFragments
+      ) {
+        const error = this.createError(
+          RangeError,
+          'Too many message fragments',
+          false,
+          1008,
+          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+        );
+
+        cb(error);
+        return;
+      }
+
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -524,6 +562,22 @@ class Receiver extends Writable {
           return;
         }
 
+        if (
+          this._maxFragments > 0 &&
+          this._fragments.length >= this._maxFragments
+        ) {
+          const error = this.createError(
+            RangeError,
+            'Too many message fragments',
+            false,
+            1008,
+            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+          );
+
+          cb(error);
+          return;
+        }
+
         this._fragments.push(buf);
       }
 

package/node_modules/ws/lib/websocket-server.js

@@ -43,6 +43,10 @@ class WebSocketServer extends EventEmitter {
    *     called
    * @param {Function} [options.handleProtocols] A hook to handle protocols
    * @param {String} [options.host] The hostname where to bind the server
+   * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=131072] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=104857600] The maximum allowed message
    *     size
    * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -65,6 +69,8 @@ class WebSocketServer extends EventEmitter {
     options = {
       allowSynchronousEvents: true,
       autoPong: true,
+      maxBufferedChunks: 1024 * 1024,
+      maxFragments: 128 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: false,
@@ -424,6 +430,8 @@ class WebSocketServer extends EventEmitter {
 
     ws.setSocket(socket, head, {
       allowSynchronousEvents: this.options.allowSynchronousEvents,
+      maxBufferedChunks: this.options.maxBufferedChunks,
+      maxFragments: this.options.maxFragments,
       maxPayload: this.options.maxPayload,
       skipUTF8Validation: this.options.skipUTF8Validation
     });

package/node_modules/ws/lib/websocket.js

@@ -201,6 +201,10 @@ class WebSocket extends EventEmitter {
    *     multiple times in the same tick
    * @param {Function} [options.generateMask] The function used to generate the
    *     masking key
+   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+   *     buffered data chunks
+   * @param {Number} [options.maxFragments=0] The maximum number of message
+   *     fragments
    * @param {Number} [options.maxPayload=0] The maximum allowed message size
    * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
    *     not to skip UTF-8 validation for text and close messages
@@ -212,6 +216,8 @@ class WebSocket extends EventEmitter {
       binaryType: this.binaryType,
       extensions: this._extensions,
       isServer: this._isServer,
+      maxBufferedChunks: options.maxBufferedChunks,
+      maxFragments: options.maxFragments,
       maxPayload: options.maxPayload,
       skipUTF8Validation: options.skipUTF8Validation
     });
@@ -640,6 +646,10 @@ module.exports = WebSocket;
  *     masking key
  * @param {Number} [options.handshakeTimeout] Timeout in milliseconds for the
  *     handshake request
+ * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+ *     buffered data chunks
+ * @param {Number} [options.maxFragments=131072] The maximum number of message
+ *     fragments
  * @param {Number} [options.maxPayload=104857600] The maximum allowed message
  *     size
  * @param {Number} [options.maxRedirects=10] The maximum number of redirects
@@ -660,6 +670,8 @@ function initAsClient(websocket, address, protocols, options) {
     autoPong: true,
     closeTimeout: CLOSE_TIMEOUT,
     protocolVersion: protocolVersions[1],
+    maxBufferedChunks: 1024 * 1024,
+    maxFragments: 128 * 1024,
     maxPayload: 100 * 1024 * 1024,
     skipUTF8Validation: false,
     perMessageDeflate: true,
@@ -1017,6 +1029,8 @@ function initAsClient(websocket, address, protocols, options) {
     websocket.setSocket(socket, head, {
       allowSynchronousEvents: opts.allowSynchronousEvents,
       generateMask: opts.generateMask,
+      maxBufferedChunks: opts.maxBufferedChunks,
+      maxFragments: opts.maxFragments,
       maxPayload: opts.maxPayload,
       skipUTF8Validation: opts.skipUTF8Validation
     });

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.20.1",
+  "version": "8.21.0",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",

package/npm-shrinkwrap.json

@@ -1,21 +1,21 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.24-beta.2",
+  "version": "2026.5.26-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/qqbot",
-      "version": "2026.5.24-beta.2",
+      "version": "2026.5.26-beta.1",
       "dependencies": {
         "@tencent-connect/qqbot-connector": "1.1.0",
         "mpg123-decoder": "1.0.3",
         "silk-wasm": "3.7.1",
-        "ws": "8.20.1",
+        "ws": "8.21.0",
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.5.24-beta.2"
+        "openclaw": ">=2026.5.26-beta.1"
       },
       "peerDependenciesMeta": {
         "openclaw": {
@@ -92,9 +92,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.20.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.1.tgz",
-      "integrity": "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.24-beta.2",
+  "version": "2026.5.26-beta.1",
   "private": false,
   "description": "OpenClaw QQ Bot channel plugin",
   "repository": {
@@ -12,11 +12,11 @@
     "@tencent-connect/qqbot-connector": "1.1.0",
     "mpg123-decoder": "1.0.3",
     "silk-wasm": "3.7.1",
-    "ws": "8.20.1",
+    "ws": "8.21.0",
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.24-beta.2"
+    "openclaw": ">=2026.5.26-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -45,10 +45,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.24-beta.2"
+      "pluginApi": ">=2026.5.26-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.24-beta.2"
+      "openclawVersion": "2026.5.26-beta.1"
     },
     "release": {
       "publishToClawHub": true,