@openclaw/qqbot 2026.5.27 → 2026.5.28-beta.2

package/dist/api.js

@@ -1,9 +1,9 @@
-import { C as recordMessageReply, E as setOutboundAudioPort, S as getMessageReplyStats, T as OUTBOUND_ERROR_CODES, _ as sendVoice, a as sendText, b as checkMessageReplyLimit, d as buildMediaTarget, f as parseTarget, g as sendVideoMsg, h as sendPhoto, i as sendProactiveMessage, m as sendDocument, n as sendCronMessage, p as resolveOutboundMediaPath, r as sendMedia, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR, x as getMessageReplyConfig, y as MESSAGE_REPLY_LIMIT } from "./outbound-DHc9KJCp.js";
+import { C as recordMessageReply, E as setOutboundAudioPort, S as getMessageReplyStats, T as OUTBOUND_ERROR_CODES, _ as sendVoice, a as sendText, b as checkMessageReplyLimit, d as buildMediaTarget, f as parseTarget, g as sendVideoMsg, h as sendPhoto, i as sendProactiveMessage, m as sendDocument, n as sendCronMessage, p as resolveOutboundMediaPath, r as sendMedia, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR, x as getMessageReplyConfig, y as MESSAGE_REPLY_LIMIT } from "./outbound-DsXljRHh.js";
 import { c as listQQBotAccountIds, l as resolveDefaultQQBotAccountId, o as DEFAULT_ACCOUNT_ID, s as applyQQBotAccountConfig, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { t as qqbotPlugin } from "./channel-C_7BS_5A.js";
-import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
+import { t as qqbotPlugin } from "./channel-Cx3C1vCZ.js";
+import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
 import { t as qqbotSetupPlugin } from "./channel.setup-BxGpVkdx.js";
-import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-Dge7ttkg.js";
+import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-D4dkxrmN.js";
 import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/qqbot/src/engine/tools/channel-api.ts
 /**
@@ -269,14 +269,17 @@ const RemindSchema = {
 * @returns Milliseconds or null if unparseable.
 */
 function parseRelativeTime(timeStr) {
-	const s = timeStr.toLowerCase();
+	const s = timeStr.trim().toLowerCase();
 	if (/^\d+$/.test(s)) return Number.parseInt(s, 10) * 6e4;
 	let totalMs = 0;
 	let matched = false;
-	const regex = /(\d+(?:\.\d+)?)\s*(d|h|m|s)/g;
+	let consumed = 0;
+	const regex = /(\d+(?:\.\d+)?)\s*(d|h|m|s)\s*/g;
 	let match;
 	while ((match = regex.exec(s)) !== null) {
+		if (match.index !== consumed) return null;
 		matched = true;
+		consumed = regex.lastIndex;
 		const value = Number.parseFloat(match[1]);
 		switch (match[2]) {
 			case "d":
@@ -293,7 +296,7 @@ function parseRelativeTime(timeStr) {
 				break;
 		}
 	}
-	return matched ? Math.round(totalMs) : null;
+	return matched && consumed === s.length ? Math.round(totalMs) : null;
 }
 /**
 * Check whether a time string is a cron expression (3–6 space-separated fields).

package/dist/{channel-C_7BS_5A.js → channel-Cx3C1vCZ.js}

@@ -1,6 +1,6 @@
 import { c as getPlatformAdapter, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { a as qqbotSetupAdapterShared, c as listQQBotAccountIds, i as qqbotMeta, m as getBridgeLogger, n as qqbotSetupWizard, o as DEFAULT_ACCOUNT_ID$1, p as ensurePlatformAdapter, r as qqbotConfigAdapter, s as applyQQBotAccountConfig, t as qqbotChannelConfigSchema, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
+import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
 import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
 import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { createChannelApprovalCapability } from "openclaw/plugin-sdk/approval-delivery-runtime";
@@ -28,13 +28,7 @@ function buildExecApprovalText(request) {
 	lines.push("", `\u23f1\ufe0f \u8d85\u65f6: ${expiresIn} \u79d2`);
 	return lines.join("\n");
 }
-function appendCommandActionLines(lines, actions) {
-	const commandActions = actions.filter((action) => (action.kind === "command" || action.decision == null) && typeof action.command === "string" && action.command.trim().length > 0);
-	if (commandActions.length === 0) return;
-	lines.push("", "🗨️ 命令:");
-	for (const action of commandActions) lines.push(`- ${action.label}: ${action.command.trim()}`);
-}
-function buildPluginApprovalText(request, actions = []) {
+function buildPluginApprovalText(request) {
 	const timeoutSec = Math.round((request.request.timeoutMs ?? 12e4) / 1e3);
 	const lines = [`${request.request.severity === "critical" ? "🔴" : request.request.severity === "info" ? "🔵" : "🟡"} \u5ba1\u6279\u8bf7\u6c42`, ""];
 	lines.push(`\u{1f4cb} ${request.request.title}`);
@@ -42,7 +36,6 @@ function buildPluginApprovalText(request, actions = []) {
 	if (request.request.toolName) lines.push(`\u{1f527} \u5de5\u5177: ${request.request.toolName}`);
 	if (request.request.pluginId) lines.push(`\u{1f50c} \u63d2\u4ef6: ${request.request.pluginId}`);
 	if (request.request.agentId) lines.push(`\u{1f916} Agent: ${request.request.agentId}`);
-	appendCommandActionLines(lines, actions);
 	lines.push("", `\u23f1\ufe0f \u8d85\u65f6: ${timeoutSec} \u79d2`);
 	return lines.join("\n");
 }
@@ -381,7 +374,7 @@ function createQQBotApprovalCapability() {
 			},
 			load: async () => {
 				ensurePlatformAdapter();
-				return (await import("./handler-runtime-CSVOet7I.js")).qqbotApprovalNativeRuntime;
+				return (await import("./handler-runtime-yjslhmCX.js")).qqbotApprovalNativeRuntime;
 			}
 		})
 	});
@@ -875,7 +868,7 @@ function looksLikeQQBotTarget(id) {
 //#region extensions/qqbot/src/channel.ts
 let gatewayModulePromise;
 function loadGatewayModule() {
-	gatewayModulePromise ??= import("./gateway-BdWwKDtj.js");
+	gatewayModulePromise ??= import("./gateway-D1g0WRCr.js");
 	return gatewayModulePromise;
 }
 function createQQBotSendReceipt(params) {
@@ -893,7 +886,7 @@ function createQQBotSendReceipt(params) {
 async function sendQQBotText(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendText } = await import("./outbound-DHc9KJCp.js").then((n) => n.t);
+	const { sendText } = await import("./outbound-DsXljRHh.js").then((n) => n.t);
 	const result = await sendText({
 		to: params.to,
 		text: params.text,
@@ -915,7 +908,7 @@ async function sendQQBotText(params) {
 async function sendQQBotMedia(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendMedia } = await import("./outbound-DHc9KJCp.js").then((n) => n.t);
+	const { sendMedia } = await import("./outbound-DsXljRHh.js").then((n) => n.t);
 	const result = await sendMedia({
 		to: params.to,
 		text: params.text ?? "",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as qqbotPlugin } from "./channel-C_7BS_5A.js";
+import { t as qqbotPlugin } from "./channel-Cx3C1vCZ.js";
 export { qqbotPlugin };

package/dist/{gateway-BdWwKDtj.js → gateway-D1g0WRCr.js}

@@ -1,9 +1,9 @@
-import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-DHc9KJCp.js";
+import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-DsXljRHh.js";
 import { c as getPlatformAdapter, i as normalizeOptionalString$1, n as normalizeLowercaseStringOrEmpty$1, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { f as resolveAccountBase, h as setBridgeLogger, p as ensurePlatformAdapter } from "./config-schema-iX2iJzKm.js";
-import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath$1, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-C_7BS_5A.js";
-import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
-import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-Dge7ttkg.js";
+import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath$1, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-Cx3C1vCZ.js";
+import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
+import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-D4dkxrmN.js";
 import { asBoolean, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isImplicitSameChatApprovalAuthorization } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as fs$1 from "node:fs";
@@ -5665,7 +5665,7 @@ function parseWavFallback(buf) {
 *   QQBot reply path abort at ~5 minutes with "LLM request timed out",
 *   despite the direct ollama call to the same model working. The
 *   embedded-runner / idle-timeout layer already honors longer
-*   provider timeouts (see `src/agents/pi-embedded-runner/run/llm-idle-timeout.ts`),
+*   provider timeouts (see `src/agents/embedded-agent-runner/run/llm-idle-timeout.ts`),
 *   but the QQBot outbound dispatcher held an independent hardcoded
 *   `RESPONSE_TIMEOUT = 300_000` watchdog that quietly undercut the
 *   configured ceiling.
@@ -5690,7 +5690,7 @@ const DEFAULT_RESPONSE_TIMEOUT_MS = 3e5;
 /**
 * Upper bound to keep the watchdog inside the safe `setTimeout` range
 * (approximately 24.8 days). Mirrors `MAX_SAFE_TIMEOUT_MS` in
-* `src/agents/pi-embedded-runner/run/llm-idle-timeout.ts`.
+* `src/agents/embedded-agent-runner/run/llm-idle-timeout.ts`.
 */
 const MAX_SAFE_TIMEOUT_MS = 2147e6;
 function positiveSecondsToMs(value) {

package/dist/{handler-runtime-CSVOet7I.js → handler-runtime-yjslhmCX.js}

@@ -1,14 +1,11 @@
 import { m as getBridgeLogger, p as ensurePlatformAdapter, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-C_7BS_5A.js";
-import { d as getMessageApi, i as accountToCreds } from "./runtime-TzkQ0YbR.js";
+import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-Cx3C1vCZ.js";
+import { d as getMessageApi, i as accountToCreds } from "./runtime-PZU9ND1Q.js";
 import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
 //#region extensions/qqbot/src/bridge/approval/handler-runtime.ts
 function isExecRequest(request) {
-	return "command" in request.request;
-}
-function listDecisionActions(actions) {
-	return actions.flatMap((action) => action.kind === "decision" && action.decision ? [action.decision] : []);
+	return "expiresAtMs" in request;
 }
 function resolveQQTarget(request) {
 	const sessionConversation = resolveApprovalRequestSessionConversation({
@@ -74,9 +71,8 @@ const qqbotApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
 	presentation: {
 		buildPendingPayload: ({ request, view }) => {
 			const req = request;
-			const text = isExecRequest(req) ? buildExecApprovalText(req) : buildPluginApprovalText(req, view.actions);
-			const decisionActions = listDecisionActions(view.actions);
-			const keyboard = decisionActions.length > 0 ? buildApprovalKeyboard(req.id, decisionActions) : void 0;
+			const text = isExecRequest(req) ? buildExecApprovalText(req) : buildPluginApprovalText(req);
+			const keyboard = buildApprovalKeyboard(req.id, view.actions.map((action) => action.decision));
 			getBridgeLogger().debug?.(`[qqbot:approval-runtime] buildPendingPayload requestId=${req.id} kind=${isExecRequest(req) ? "exec" : "plugin"}`);
 			return {
 				text,

package/dist/{outbound-DHc9KJCp.js → outbound-DsXljRHh.js}

@@ -1,6 +1,6 @@
 import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
-import { a as getQQBotDataDir, f as normalizePath, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-C_7BS_5A.js";
-import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-TzkQ0YbR.js";
+import { a as getQQBotDataDir, f as normalizePath, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-Cx3C1vCZ.js";
+import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
 import { pathExistsSync, resolveLocalPathFromRootsSync } from "openclaw/plugin-sdk/security-runtime";
 import path from "node:path";
 import { getFileExtension } from "openclaw/plugin-sdk/media-mime";

package/dist/{request-context-Dge7ttkg.js → request-context-D4dkxrmN.js}

@@ -1,5 +1,5 @@
-import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-C_7BS_5A.js";
-import { w as debugLog } from "./runtime-TzkQ0YbR.js";
+import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-Cx3C1vCZ.js";
+import { w as debugLog } from "./runtime-PZU9ND1Q.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs";
 import path from "node:path";

package/dist/{runtime-TzkQ0YbR.js → runtime-PZU9ND1Q.js}

@@ -4,10 +4,11 @@ import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import os from "node:os";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { FsSafeError, openLocalFileSafely, readRegularFile, statRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
 import * as path$1 from "node:path";
 import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
+import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 //#region extensions/qqbot/src/engine/types.ts
 /**
 * Core API layer public types.
@@ -755,7 +756,8 @@ var ChunkedMediaApi = class {
 			this.logger?.info?.(`${prefix} Start: file=${displayName} size=${formatFileSize(fileSize)} type=${opts.fileType}`);
 			const hashes = await computeHashes(input);
 			this.logger?.debug?.(`${prefix} hashes: md5=${hashes.md5} sha1=${hashes.sha1} md5_10m=${hashes.md5_10m}`);
-			if (this.cache) {
+			const canUseUploadCache = opts.fileType !== 4;
+			if (this.cache && canUseUploadCache) {
 				const cached = this.cache.get(hashes.md5, opts.scope, opts.targetId, opts.fileType);
 				if (cached) {
 					this.logger?.info?.(`${prefix} cache HIT (md5=${hashes.md5.slice(0, 8)}) — skipping chunked upload`);
@@ -798,7 +800,7 @@ var ChunkedMediaApi = class {
 			this.logger?.info?.(`${prefix} all parts uploaded, completing...`);
 			const result = await this.callCompleteUpload(opts, upload_id);
 			this.logger?.info?.(`${prefix} completed: file_uuid=${result.file_uuid} ttl=${result.ttl}s`);
-			if (this.cache && result.file_info && result.ttl > 0) this.cache.set(hashes.md5, opts.scope, opts.targetId, opts.fileType, result.file_info, result.file_uuid, result.ttl);
+			if (this.cache && canUseUploadCache && result.file_info && result.ttl > 0) this.cache.set(hashes.md5, opts.scope, opts.targetId, opts.fileType, result.file_info, result.file_uuid, result.ttl);
 			return result;
 		} finally {
 			if (input.kind === "localPath" && input.closeWhenDone) await input.opened.close().catch(() => void 0);
@@ -1186,6 +1188,82 @@ var TokenManager = class {
 * {@link ./media-chunked.ts}; this module currently handles only the
 * one-shot path.
 */
+const DIRECT_UPLOAD_DOWNLOAD_TIMEOUT_MS = 3e4;
+const DIRECT_UPLOAD_READ_IDLE_TIMEOUT_MS = 1e4;
+const DIRECT_UPLOAD_BODY_GRACE_TIMEOUT_MS = 3e4;
+const DIRECT_UPLOAD_MIN_DOWNLOAD_BYTES_PER_SECOND = 256 * 1024;
+const DIRECT_UPLOAD_MAX_BODY_TIMEOUT_MS = 8 * 6e4;
+function assertDirectUploadDownloadHostAllowed(hostname) {
+	if (isBlockedHostnameOrIp(hostname)) throw new Error("Blocked hostname or private/internal/special-use IP address");
+}
+async function fetchDirectUploadDownload(url) {
+	const controller = new AbortController();
+	const timeoutError = /* @__PURE__ */ new Error("Direct-upload media URL fetch timed out");
+	let timedOut = false;
+	let timeout;
+	const timeoutPromise = new Promise((_, reject) => {
+		timeout = setTimeout(() => {
+			timedOut = true;
+			controller.abort(timeoutError);
+			reject(timeoutError);
+		}, DIRECT_UPLOAD_DOWNLOAD_TIMEOUT_MS);
+		unrefTimer(timeout);
+	});
+	const guardedFetch = fetchWithSsrFGuard({
+		url,
+		maxRedirects: 0,
+		signal: controller.signal
+	});
+	guardedFetch.then((result) => {
+		if (timedOut) result.release().catch(() => void 0);
+	}, () => void 0);
+	try {
+		return await Promise.race([guardedFetch, timeoutPromise]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+function unrefTimer(timeout) {
+	if (typeof timeout === "object" && "unref" in timeout) timeout.unref();
+}
+function resolveDirectUploadBodyTimeoutMs(maxBytes) {
+	const transferTimeoutMs = Math.ceil(maxBytes / DIRECT_UPLOAD_MIN_DOWNLOAD_BYTES_PER_SECOND * 1e3);
+	return Math.min(DIRECT_UPLOAD_BODY_GRACE_TIMEOUT_MS + transferTimeoutMs, DIRECT_UPLOAD_MAX_BODY_TIMEOUT_MS);
+}
+async function readDirectUploadResponse(response, maxBytes) {
+	const timeoutMs = resolveDirectUploadBodyTimeoutMs(maxBytes);
+	const timeoutError = /* @__PURE__ */ new Error(`Direct-upload media URL body timed out after ${timeoutMs}ms`);
+	let timeout;
+	const timeoutPromise = new Promise((_, reject) => {
+		timeout = setTimeout(() => {
+			response.body?.cancel(timeoutError).catch(() => void 0);
+			reject(timeoutError);
+		}, timeoutMs);
+		unrefTimer(timeout);
+	});
+	try {
+		return await Promise.race([readResponseWithLimit(response, maxBytes, { chunkTimeoutMs: DIRECT_UPLOAD_READ_IDLE_TIMEOUT_MS }), timeoutPromise]);
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+async function downloadDirectUploadUrl(url, opts = {}) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("Direct-upload media URL must be a valid URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error("Direct-upload media URL must use HTTP or HTTPS");
+	assertDirectUploadDownloadHostAllowed(parsed.hostname);
+	const { response, release } = await fetchDirectUploadDownload(parsed.toString());
+	try {
+		if (!response.ok) throw new Error(`Direct-upload media URL returned HTTP ${response.status}`);
+		return await readDirectUploadResponse(response, opts.maxBytes ?? 20971520);
+	} finally {
+		await release?.();
+	}
+}
 /**
 * Small-file media upload module.
 *
@@ -1227,9 +1305,11 @@ var MediaApi = class {
 		let fileData = opts.fileData;
 		if (opts.buffer) fileData = opts.buffer.toString("base64");
 		else if (opts.localPath) fileData = (await fs$1.promises.readFile(opts.localPath)).toString("base64");
-		if (fileData && this.cache) {
-			const hash = this.cache.computeHash(fileData);
-			const cached = this.cache.get(hash, scope, targetId, fileType);
+		else if (opts.url !== void 0) fileData = (await downloadDirectUploadUrl(opts.url)).toString("base64");
+		const uploadCache = fileData !== void 0 && !(fileType === 4 && opts.fileName) ? this.cache : void 0;
+		if (fileData !== void 0 && uploadCache) {
+			const hash = uploadCache.computeHash(fileData);
+			const cached = uploadCache.get(hash, scope, targetId, fileType);
 			if (cached) return {
 				file_uuid: "",
 				file_info: cached,
@@ -1240,8 +1320,7 @@ var MediaApi = class {
 			file_type: fileType,
 			srv_send_msg: opts.srvSendMsg ?? false
 		};
-		if (opts.url) body.url = opts.url;
-		else if (fileData) body.file_data = fileData;
+		if (fileData !== void 0) body.file_data = fileData;
 		if (fileType === 4 && opts.fileName) body.file_name = this.sanitize(opts.fileName);
 		const token = await this.tokenManager.getAccessToken(creds.appId, creds.clientSecret);
 		const path = mediaUploadPath(scope, targetId);
@@ -1249,9 +1328,9 @@ var MediaApi = class {
 			redactBodyKeys: ["file_data"],
 			uploadRequest: true
 		}), UPLOAD_RETRY_POLICY, void 0, this.logger);
-		if (fileData && result.file_info && result.ttl > 0 && this.cache) {
-			const hash = this.cache.computeHash(fileData);
-			this.cache.set(hash, scope, targetId, fileType, result.file_info, result.file_uuid, result.ttl);
+		if (fileData !== void 0 && uploadCache && result.file_info && result.ttl > 0) {
+			const hash = uploadCache.computeHash(fileData);
+			uploadCache.set(hash, scope, targetId, fileType, result.file_info, result.file_uuid, result.ttl);
 		}
 		return result;
 	}
@@ -1900,10 +1979,25 @@ async function sendMediaInternal(ctx, opts) {
 */
 async function dispatchUpload(ctx, scope, targetId, fileType, source, creds, fileName) {
 	switch (source.kind) {
-		case "url": return ctx.mediaApi.uploadMedia(scope, targetId, fileType, creds, {
-			url: source.url,
-			fileName
-		});
+		case "url": {
+			const buffer = await downloadDirectUploadUrl(source.url, { maxBytes: getMaxUploadSize(fileType) });
+			if (buffer.length >= 5242880) return ctx.chunkedMediaApi.uploadChunked({
+				scope,
+				targetId,
+				fileType,
+				source: {
+					kind: "buffer",
+					buffer,
+					fileName
+				},
+				creds,
+				fileName
+			});
+			return ctx.mediaApi.uploadMedia(scope, targetId, fileType, creds, {
+				buffer,
+				fileName
+			});
+		}
 		case "base64": return ctx.mediaApi.uploadMedia(scope, targetId, fileType, creds, {
 			fileData: source.data,
 			fileName

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-TzkQ0YbR.js";
+import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-PZU9ND1Q.js";
 export { getQQBotRuntime, setQQBotRuntime };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.27",
+  "version": "2026.5.28-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/qqbot",
-      "version": "2026.5.27",
+      "version": "2026.5.28-beta.2",
       "dependencies": {
         "@tencent-connect/qqbot-connector": "1.1.0",
         "mpg123-decoder": "1.0.3",
@@ -15,7 +15,7 @@
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.5.27"
+        "openclaw": ">=2026.5.28-beta.2"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.27",
+  "version": "2026.5.28-beta.2",
   "private": false,
   "description": "OpenClaw QQ Bot channel plugin for group and direct-message workflows.",
   "repository": {
@@ -16,7 +16,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.27"
+    "openclaw": ">=2026.5.28-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -45,10 +45,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.27"
+      "pluginApi": ">=2026.5.28-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.5.27"
+      "openclawVersion": "2026.5.28-beta.2"
     },
     "release": {
       "publishToClawHub": true,