@openclaw/qqbot 2026.5.28-beta.2 → 2026.5.28-beta.4

package/dist/api.js

@@ -1,9 +1,9 @@
-import { C as recordMessageReply, E as setOutboundAudioPort, S as getMessageReplyStats, T as OUTBOUND_ERROR_CODES, _ as sendVoice, a as sendText, b as checkMessageReplyLimit, d as buildMediaTarget, f as parseTarget, g as sendVideoMsg, h as sendPhoto, i as sendProactiveMessage, m as sendDocument, n as sendCronMessage, p as resolveOutboundMediaPath, r as sendMedia, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR, x as getMessageReplyConfig, y as MESSAGE_REPLY_LIMIT } from "./outbound-DsXljRHh.js";
+import { C as getMessageReplyStats, D as setOutboundAudioPort, E as OUTBOUND_ERROR_CODES, S as getMessageReplyConfig, T as DEFAULT_MEDIA_SEND_ERROR, _ as sendVideoMsg, a as sendText, b as MESSAGE_REPLY_LIMIT, f as buildMediaTarget, g as sendPhoto, h as sendDocument, i as sendProactiveMessage, m as resolveOutboundMediaPath, n as sendCronMessage, p as parseTarget, r as sendMedia, v as sendVoice, w as recordMessageReply, x as checkMessageReplyLimit, y as resolveUserFacingMediaError } from "./outbound-Ba5ryGDm.js";
 import { c as listQQBotAccountIds, l as resolveDefaultQQBotAccountId, o as DEFAULT_ACCOUNT_ID, s as applyQQBotAccountConfig, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { t as qqbotPlugin } from "./channel-Cx3C1vCZ.js";
-import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
+import { t as qqbotPlugin } from "./channel-8Efx0wKu.js";
+import { C as debugError, l as getAccessToken, w as debugLog, z as formatErrorMessage } from "./runtime-DWfbz21q.js";
 import { t as qqbotSetupPlugin } from "./channel.setup-BxGpVkdx.js";
-import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-D4dkxrmN.js";
+import { r as getFrameworkCommands, t as getRequestContext } from "./request-context-BCsRtyph.js";
 import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/qqbot/src/engine/tools/channel-api.ts
 /**

package/dist/{channel-Cx3C1vCZ.js → channel-8Efx0wKu.js}

@@ -1,6 +1,6 @@
 import { c as getPlatformAdapter, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { a as qqbotSetupAdapterShared, c as listQQBotAccountIds, i as qqbotMeta, m as getBridgeLogger, n as qqbotSetupWizard, o as DEFAULT_ACCOUNT_ID$1, p as ensurePlatformAdapter, r as qqbotConfigAdapter, s as applyQQBotAccountConfig, t as qqbotChannelConfigSchema, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
+import { T as debugWarn, t as getQQBotRuntime, w as debugLog, z as formatErrorMessage } from "./runtime-DWfbz21q.js";
 import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
 import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { createChannelApprovalCapability } from "openclaw/plugin-sdk/approval-delivery-runtime";
@@ -374,7 +374,7 @@ function createQQBotApprovalCapability() {
 			},
 			load: async () => {
 				ensurePlatformAdapter();
-				return (await import("./handler-runtime-yjslhmCX.js")).qqbotApprovalNativeRuntime;
+				return (await import("./handler-runtime-C-5nL3Cl.js")).qqbotApprovalNativeRuntime;
 			}
 		})
 	});
@@ -868,7 +868,7 @@ function looksLikeQQBotTarget(id) {
 //#region extensions/qqbot/src/channel.ts
 let gatewayModulePromise;
 function loadGatewayModule() {
-	gatewayModulePromise ??= import("./gateway-D1g0WRCr.js");
+	gatewayModulePromise ??= import("./gateway-CuTCxSqs.js");
 	return gatewayModulePromise;
 }
 function createQQBotSendReceipt(params) {
@@ -886,7 +886,7 @@ function createQQBotSendReceipt(params) {
 async function sendQQBotText(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendText } = await import("./outbound-DsXljRHh.js").then((n) => n.t);
+	const { sendText } = await import("./outbound-Ba5ryGDm.js").then((n) => n.t);
 	const result = await sendText({
 		to: params.to,
 		text: params.text,
@@ -908,7 +908,7 @@ async function sendQQBotText(params) {
 async function sendQQBotMedia(params) {
 	await loadGatewayModule();
 	const account = resolveQQBotAccount(params.cfg, params.accountId);
-	const { sendMedia } = await import("./outbound-DsXljRHh.js").then((n) => n.t);
+	const { sendMedia } = await import("./outbound-Ba5ryGDm.js").then((n) => n.t);
 	const result = await sendMedia({
 		to: params.to,
 		text: params.text ?? "",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as qqbotPlugin } from "./channel-Cx3C1vCZ.js";
+import { t as qqbotPlugin } from "./channel-8Efx0wKu.js";
 export { qqbotPlugin };

package/dist/{gateway-D1g0WRCr.js → gateway-CuTCxSqs.js}

@@ -1,9 +1,9 @@
-import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-DsXljRHh.js";
+import { D as setOutboundAudioPort, T as DEFAULT_MEDIA_SEND_ERROR, _ as sendVideoMsg, c as isCronReminderPayload, d as normalizeMediaTags, g as sendPhoto, h as sendDocument, l as isMediaPayload, o as decodeMediaPath, r as sendMedia, s as encodePayloadForCron, u as parseQQBotPayload, v as sendVoice, y as resolveUserFacingMediaError } from "./outbound-Ba5ryGDm.js";
 import { c as getPlatformAdapter, i as normalizeOptionalString$1, n as normalizeLowercaseStringOrEmpty$1, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { f as resolveAccountBase, h as setBridgeLogger, p as ensurePlatformAdapter } from "./config-schema-iX2iJzKm.js";
-import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath$1, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-Cx3C1vCZ.js";
-import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
-import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-D4dkxrmN.js";
+import { C as parseApprovalButtonData, a as getQQBotDataDir, d as isWindows, f as normalizePath, h as authorizeQQBotApprovalAction, i as getHomeDir, l as getTempDir, m as toGatewayAccount, o as getQQBotDataPath, p as resolveQQBotPayloadLocalFilePath, r as checkSilkWasmAvailable, s as getQQBotMediaDir, u as isLocalPath } from "./channel-8Efx0wKu.js";
+import { B as StreamContentType, C as debugError, D as getNextMsgSeq, F as getImageMimeType, H as StreamInputState, I as getMaxUploadSize, N as formatFileSize, R as formatDuration, S as withTokenRetry, T as debugWarn, V as StreamInputMode, _ as sendInputNotify, a as acknowledgeInteraction, b as startBackgroundTokenRefresh, c as createRawInputNotifyFn, d as getMessageApi, f as getPluginUserAgent, g as registerAccount, h as onMessageSent, i as accountToCreds, j as downloadFile, k as openLocalFile, l as getAccessToken, m as initSender, n as getQQBotRuntimeForEngine, o as buildDeliveryTarget, p as initApiConfig, s as clearTokenCache, t as getQQBotRuntime, u as getGatewayUrl, v as sendMedia$1, w as debugLog, x as stopBackgroundTokenRefresh, y as sendText, z as formatErrorMessage } from "./runtime-DWfbz21q.js";
+import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-BCsRtyph.js";
 import { asBoolean, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isImplicitSameChatApprovalAuthorization } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as fs$1 from "node:fs";
@@ -15,6 +15,7 @@ import { appendRegularFileSync, privateFileStoreSync, readRegularFileSync, repla
 import * as path$1 from "node:path";
 import path from "node:path";
 import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
+import { MAX_TIMER_TIMEOUT_MS, finiteSecondsToTimerSafeMilliseconds } from "openclaw/plugin-sdk/number-runtime";
 import { resolveRuntimeServiceVersion } from "openclaw/plugin-sdk/cli-runtime";
 import { getRuntimeConfig } from "openclaw/plugin-sdk/runtime-config-snapshot";
 import WebSocket from "ws";
@@ -3465,64 +3466,6 @@ function hasQQBotImageSize(markdownImage) {
 	return /!\[#\d+px\s+#\d+px\]/.test(markdownImage);
 }
 //#endregion
-//#region extensions/qqbot/src/engine/messaging/decode-media-path.ts
-/**
-* Normalize a file path by expanding `~` to the home directory and trimming.
-*
-* This is a minimal re-implementation of `utils/platform.ts#normalizePath`
-* so that `core/` remains self-contained.
-*/
-function normalizePath(p) {
-	let result = p.trim();
-	if (result.startsWith("~/") || result === "~") {
-		const home = typeof process !== "undefined" ? process.env.HOME ?? process.env.USERPROFILE : void 0;
-		if (home) result = result === "~" ? home : `${home}${result.slice(1)}`;
-	}
-	return result;
-}
-/**
-* Decode a media path by stripping `MEDIA:`, expanding `~`, and unescaping
-* octal/UTF-8 byte sequences.
-*
-* @param raw - Raw path string from a media tag.
-* @param log - Optional logger for decode diagnostics.
-* @returns The decoded, normalized media path.
-*/
-function decodeMediaPath(raw, log) {
-	let mediaPath = raw;
-	if (mediaPath.startsWith("MEDIA:")) mediaPath = mediaPath.slice(6);
-	mediaPath = normalizePath(mediaPath);
-	mediaPath = mediaPath.replace(/\\\\/g, "\\");
-	const isWinLocal = /^[a-zA-Z]:[\\/]/.test(mediaPath) || mediaPath.startsWith("\\\\");
-	try {
-		const hasOctal = /\\[0-7]{1,3}/.test(mediaPath);
-		const hasNonASCII = /[\u0080-\u00FF]/.test(mediaPath);
-		if (!isWinLocal && (hasOctal || hasNonASCII)) {
-			log?.debug?.(`Decoding path with mixed encoding: ${mediaPath}`);
-			const decoded = mediaPath.replace(/\\([0-7]{1,3})/g, (_, octal) => {
-				return String.fromCharCode(Number.parseInt(octal, 8));
-			});
-			const bytes = [];
-			for (let i = 0; i < decoded.length; i++) {
-				const code = decoded.charCodeAt(i);
-				if (code <= 255) bytes.push(code);
-				else {
-					const charBytes = Buffer.from(decoded[i], "utf8");
-					bytes.push(...charBytes);
-				}
-			}
-			const utf8Decoded = Buffer.from(bytes).toString("utf8");
-			if (!utf8Decoded.includes("�") || utf8Decoded.length < decoded.length) {
-				mediaPath = utf8Decoded;
-				log?.debug?.(`Successfully decoded path: ${mediaPath}`);
-			}
-		}
-	} catch (decodeErr) {
-		log?.error(`Path decode error: ${String(decodeErr)}`);
-	}
-	return mediaPath;
-}
-//#endregion
 //#region extensions/qqbot/src/engine/messaging/outbound-deliver.ts
 /** Maximum text length for a single QQ Bot message. */
 const TEXT_CHUNK_LIMIT = 5e3;
@@ -4018,7 +3961,7 @@ function isInlineImageDataUrl(p) {
 }
 function resolveStructuredPayloadPath(ctx, payload, mediaType) {
 	const originalPath = payload.path ?? "";
-	const normalizedPath = normalizePath$1(originalPath);
+	const normalizedPath = normalizePath(originalPath);
 	const isHttpUrl = isRemoteHttpUrl(normalizedPath);
 	const resolvedPath = isHttpUrl ? normalizedPath : validateStructuredPayloadLocalPath(ctx, originalPath, mediaType);
 	if (!resolvedPath) return null;
@@ -4080,7 +4023,7 @@ async function assertLocalFileWithinTypeLimit(filePath, fileType) {
 }
 async function handleImagePayload(ctx, payload) {
 	const { target, account, log } = ctx;
-	const normalizedPath = normalizePath$1(payload.path);
+	const normalizedPath = normalizePath(payload.path);
 	let imageUrl;
 	if (payload.source === "file") imageUrl = validateStructuredPayloadLocalPath(ctx, normalizedPath, "image");
 	else if (isRemoteHttpUrl(normalizedPath) || isInlineImageDataUrl(normalizedPath)) imageUrl = normalizedPath;
@@ -4368,7 +4311,7 @@ function findFirstClosedMediaTag(text, log) {
 		const tagName = match[1].toLowerCase();
 		let mediaPath = match[2]?.trim() ?? "";
 		if (mediaPath.startsWith("MEDIA:")) mediaPath = mediaPath.slice(6);
-		mediaPath = normalizePath$1(mediaPath);
+		mediaPath = normalizePath(mediaPath);
 		mediaPath = fixPathEncoding(mediaPath, log);
 		return {
 			textBefore,
@@ -5676,7 +5619,7 @@ function parseWavFallback(buf) {
 *   already configured:
 *     - `agents.defaults.timeoutSeconds`
 *     - `models.providers.<id>.timeoutSeconds` (max across configured providers)
-*   Take the maximum and clamp to `[DEFAULT_RESPONSE_TIMEOUT_MS, MAX_SAFE_TIMEOUT_MS]`.
+*   Take the maximum and clamp to `[DEFAULT_RESPONSE_TIMEOUT_MS, MAX_TIMER_TIMEOUT_MS]`.
 *   The default floor preserves the existing 5-minute guard for users
 *   that have not configured any longer ceiling — i.e. a no-op for
 *   typical cloud-model deployments.
@@ -5688,16 +5631,6 @@ function parseWavFallback(buf) {
 */
 const DEFAULT_RESPONSE_TIMEOUT_MS = 3e5;
 /**
-* Upper bound to keep the watchdog inside the safe `setTimeout` range
-* (approximately 24.8 days). Mirrors `MAX_SAFE_TIMEOUT_MS` in
-* `src/agents/embedded-agent-runner/run/llm-idle-timeout.ts`.
-*/
-const MAX_SAFE_TIMEOUT_MS = 2147e6;
-function positiveSecondsToMs(value) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return;
-	return Math.floor(value * 1e3);
-}
-/**
 * Resolve the QQBot outbound response watchdog (ms).
 *
 * The watchdog is the longest of:
@@ -5706,21 +5639,21 @@ function positiveSecondsToMs(value) {
 *   - the maximum `cfg.models.providers.<id>.timeoutSeconds` across
 *     configured providers, converted to ms
 *
-* Returns at most `MAX_SAFE_TIMEOUT_MS` so the chosen value is always
+* Returns at most `MAX_TIMER_TIMEOUT_MS` so the chosen value is always
 * a safe `setTimeout` argument.
 */
 function resolveResponseTimeoutMs(cfg) {
 	const candidates = [DEFAULT_RESPONSE_TIMEOUT_MS];
 	const typed = cfg ?? {};
-	const agentDefaultMs = positiveSecondsToMs(typed.agents?.defaults?.timeoutSeconds);
+	const agentDefaultMs = finiteSecondsToTimerSafeMilliseconds(typed.agents?.defaults?.timeoutSeconds);
 	if (agentDefaultMs !== void 0) candidates.push(agentDefaultMs);
 	const providers = typed.models?.providers;
 	if (providers && typeof providers === "object") for (const entry of Object.values(providers)) {
-		const providerMs = positiveSecondsToMs(entry?.timeoutSeconds);
+		const providerMs = finiteSecondsToTimerSafeMilliseconds(entry?.timeoutSeconds);
 		if (providerMs !== void 0) candidates.push(providerMs);
 	}
 	const chosen = Math.max(...candidates);
-	return Math.min(chosen, MAX_SAFE_TIMEOUT_MS);
+	return Math.min(chosen, MAX_TIMER_TIMEOUT_MS);
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/outbound-dispatch.ts
@@ -6341,7 +6274,7 @@ async function startTypingForEvent(event, account, log) {
 	try {
 		const creds = accountToCreds(account);
 		const rawNotifyFn = createRawInputNotifyFn(account.appId);
-		try {
+		const sendNotifyAndStartKeepAlive = async () => {
 			const resp = await sendInputNotify({
 				openid: event.senderId,
 				creds,
@@ -6354,22 +6287,14 @@ async function startTypingForEvent(event, account, log) {
 				refIdx: resp.refIdx,
 				keepAlive
 			};
+		};
+		try {
+			return await sendNotifyAndStartKeepAlive();
 		} catch (notifyErr) {
 			const errMsg = String(notifyErr);
 			if (errMsg.includes("token") || errMsg.includes("401") || errMsg.includes("11244")) {
 				clearTokenCache(account.appId);
-				const resp = await sendInputNotify({
-					openid: event.senderId,
-					creds,
-					msgId: event.messageId,
-					inputSecond: 10
-				});
-				const keepAlive = new TypingKeepAlive(() => getAccessToken(account.appId, account.clientSecret), () => clearTokenCache(account.appId), rawNotifyFn, event.senderId, event.messageId, log);
-				keepAlive.start();
-				return {
-					refIdx: resp.refIdx,
-					keepAlive
-				};
+				return await sendNotifyAndStartKeepAlive();
 			}
 			throw notifyErr;
 		}

package/dist/{handler-runtime-yjslhmCX.js → handler-runtime-C-5nL3Cl.js}

@@ -1,6 +1,6 @@
 import { m as getBridgeLogger, p as ensurePlatformAdapter, u as resolveQQBotAccount } from "./config-schema-iX2iJzKm.js";
-import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-Cx3C1vCZ.js";
-import { d as getMessageApi, i as accountToCreds } from "./runtime-PZU9ND1Q.js";
+import { S as buildPluginApprovalText, _ as matchesQQBotApprovalAccount, b as buildApprovalKeyboard, g as isQQBotExecApprovalClientEnabled, v as resolveQQBotExecApprovalConfig, w as resolveApprovalTarget, x as buildExecApprovalText, y as shouldHandleQQBotExecApprovalRequest } from "./channel-8Efx0wKu.js";
+import { d as getMessageApi, i as accountToCreds } from "./runtime-DWfbz21q.js";
 import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
 //#region extensions/qqbot/src/bridge/approval/handler-runtime.ts

package/dist/{outbound-DsXljRHh.js → outbound-Ba5ryGDm.js}

@@ -1,6 +1,6 @@
 import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
-import { a as getQQBotDataDir, f as normalizePath, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-Cx3C1vCZ.js";
-import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-PZU9ND1Q.js";
+import { a as getQQBotDataDir, f as normalizePath$1, n as parseTarget$1, p as resolveQQBotPayloadLocalFilePath, s as getQQBotMediaDir, u as isLocalPath } from "./channel-8Efx0wKu.js";
+import { A as checkFileSize, C as debugError, E as UploadDailyLimitExceededError, F as getImageMimeType, I as getMaxUploadSize, L as readFileAsync, M as fileExistsAsync, N as formatFileSize, O as UPLOAD_PREPARE_FALLBACK_CODE, P as getFileTypeName, T as debugWarn, i as accountToCreds, j as downloadFile, p as initApiConfig, v as sendMedia$1, w as debugLog, y as sendText$1, z as formatErrorMessage } from "./runtime-DWfbz21q.js";
 import { pathExistsSync, resolveLocalPathFromRootsSync } from "openclaw/plugin-sdk/security-runtime";
 import path from "node:path";
 import { getFileExtension } from "openclaw/plugin-sdk/media-mime";
@@ -258,7 +258,7 @@ function resolveExistingPathWithinRoots(normalizedPath, allowedRoots) {
 	})?.path ?? null;
 }
 function resolveOutboundMediaPath(rawPath, mediaKind, options = {}) {
-	const normalizedPath = normalizePath(rawPath);
+	const normalizedPath = normalizePath$1(rawPath);
 	if (isHttpOrDataSource(normalizedPath)) return {
 		ok: true,
 		mediaPath: normalizedPath
@@ -970,6 +970,75 @@ function isMediaPayload(payload) {
 	return payload.type === "media";
 }
 //#endregion
+//#region extensions/qqbot/src/engine/messaging/decode-media-path.ts
+function getHomeForTildePath(windowsStyle) {
+	if (windowsStyle && process.env.USERPROFILE) return process.env.USERPROFILE;
+	return process.env.HOME ?? process.env.USERPROFILE;
+}
+/**
+* Normalize a file path by expanding `~` to the home directory and trimming.
+*
+* This is a minimal re-implementation of `utils/platform.ts#normalizePath`
+* so that `core/` remains self-contained.
+*/
+function normalizePath(p) {
+	let result = p.trim();
+	if (result.startsWith("file://")) {
+		result = result.slice(7);
+		try {
+			result = decodeURIComponent(result);
+		} catch {}
+	}
+	const windowsStyleHomePath = result.startsWith("~\\");
+	if (result === "~" || result.startsWith("~/") || windowsStyleHomePath) {
+		const home = typeof process !== "undefined" ? getHomeForTildePath(windowsStyleHomePath) : void 0;
+		if (home) result = result === "~" ? home : `${home}${result.slice(1)}`;
+	}
+	return result;
+}
+/**
+* Decode a media path by stripping `MEDIA:`, expanding `~`, and unescaping
+* octal/UTF-8 byte sequences.
+*
+* @param raw - Raw path string from a media tag.
+* @param log - Optional logger for decode diagnostics.
+* @returns The decoded, normalized media path.
+*/
+function decodeMediaPath(raw, log) {
+	let mediaPath = raw;
+	if (mediaPath.startsWith("MEDIA:")) mediaPath = mediaPath.slice(6);
+	mediaPath = normalizePath(mediaPath);
+	mediaPath = mediaPath.replace(/\\\\/g, "\\");
+	const isWinLocal = /^[a-zA-Z]:[\\/]/.test(mediaPath) || mediaPath.startsWith("\\\\");
+	try {
+		const hasOctal = /\\[0-7]{1,3}/.test(mediaPath);
+		const hasNonASCII = /[\u0080-\u00FF]/.test(mediaPath);
+		if (!isWinLocal && (hasOctal || hasNonASCII)) {
+			log?.debug?.(`Decoding path with mixed encoding: ${mediaPath}`);
+			const decoded = mediaPath.replace(/\\([0-7]{1,3})/g, (_, octal) => {
+				return String.fromCharCode(Number.parseInt(octal, 8));
+			});
+			const bytes = [];
+			for (let i = 0; i < decoded.length; i++) {
+				const code = decoded.charCodeAt(i);
+				if (code <= 255) bytes.push(code);
+				else {
+					const charBytes = Buffer.from(decoded[i], "utf8");
+					bytes.push(...charBytes);
+				}
+			}
+			const utf8Decoded = Buffer.from(bytes).toString("utf8");
+			if (!utf8Decoded.includes("�") || utf8Decoded.length < decoded.length) {
+				mediaPath = utf8Decoded;
+				log?.debug?.(`Successfully decoded path: ${mediaPath}`);
+			}
+		}
+	} catch (decodeErr) {
+		log?.error(`Path decode error: ${String(decodeErr)}`);
+	}
+	return mediaPath;
+}
+//#endregion
 //#region extensions/qqbot/src/engine/messaging/media-type-detect.ts
 /**
 * Media type detection — pure functions for classifying files by MIME or extension.
@@ -1016,6 +1085,11 @@ var outbound_exports = /* @__PURE__ */ __exportAll({
 });
 const isImageFile = isImageFile$1;
 const isVideoFile = isVideoFile$1;
+const mediaPathDecodeLog = {
+	info: (message) => debugLog(`[qqbot] sendText: ${message}`),
+	error: (message) => debugError(`[qqbot] sendText: ${message}`),
+	debug: (message) => debugLog(`[qqbot] sendText: ${message}`)
+};
 /**
 * Send text, optionally falling back from passive reply mode to proactive mode.
 *
@@ -1062,37 +1136,7 @@ async function sendText(ctx) {
 				content: textBefore
 			});
 			const tagName = normalizeLowercaseStringOrEmpty(match[1]);
-			let mediaPath = normalizeOptionalString(match[2]) ?? "";
-			if (mediaPath.startsWith("MEDIA:")) mediaPath = mediaPath.slice(6);
-			mediaPath = normalizePath(mediaPath);
-			mediaPath = mediaPath.replace(/\\\\/g, "\\");
-			const isWinLocal = /^[a-zA-Z]:[\\/]/.test(mediaPath) || mediaPath.startsWith("\\\\");
-			try {
-				const hasOctal = /\\[0-7]{1,3}/.test(mediaPath);
-				const hasNonASCII = /[\u0080-\u00FF]/.test(mediaPath);
-				if (!isWinLocal && (hasOctal || hasNonASCII)) {
-					debugLog(`[qqbot] sendText: Decoding path with mixed encoding: ${mediaPath}`);
-					let decoded = mediaPath.replace(/\\([0-7]{1,3})/g, (_, octal) => {
-						return String.fromCharCode(Number.parseInt(octal, 8));
-					});
-					const bytes = [];
-					for (let i = 0; i < decoded.length; i++) {
-						const code = decoded.charCodeAt(i);
-						if (code <= 255) bytes.push(code);
-						else {
-							const charBytes = Buffer.from(decoded[i], "utf8");
-							bytes.push(...charBytes);
-						}
-					}
-					const utf8Decoded = Buffer.from(bytes).toString("utf8");
-					if (!utf8Decoded.includes("�") || utf8Decoded.length < decoded.length) {
-						mediaPath = utf8Decoded;
-						debugLog(`[qqbot] sendText: Successfully decoded path: ${mediaPath}`);
-					}
-				}
-			} catch (decodeErr) {
-				debugError(`[qqbot] sendText: Path decode error: ${decodeErr instanceof Error ? decodeErr.message : JSON.stringify(decodeErr)}`);
-			}
+			const mediaPath = decodeMediaPath(normalizeOptionalString(match[2]) ?? "", mediaPathDecodeLog);
 			if (mediaPath) if (tagName === "qqmedia") {
 				sendQueue.push({
 					type: "media",
@@ -1322,4 +1366,4 @@ async function sendCronMessage(account, to, message) {
 	});
 }
 //#endregion
-export { recordMessageReply as C, setOutboundAudioPort as E, getMessageReplyStats as S, OUTBOUND_ERROR_CODES as T, sendVoice as _, sendText as a, checkMessageReplyLimit as b, isMediaPayload as c, buildMediaTarget as d, parseTarget as f, sendVideoMsg as g, sendPhoto as h, sendProactiveMessage as i, parseQQBotPayload as l, sendDocument as m, sendCronMessage as n, encodePayloadForCron as o, resolveOutboundMediaPath as p, sendMedia as r, isCronReminderPayload as s, outbound_exports as t, normalizeMediaTags as u, resolveUserFacingMediaError as v, DEFAULT_MEDIA_SEND_ERROR as w, getMessageReplyConfig as x, MESSAGE_REPLY_LIMIT as y };
+export { getMessageReplyStats as C, setOutboundAudioPort as D, OUTBOUND_ERROR_CODES as E, getMessageReplyConfig as S, DEFAULT_MEDIA_SEND_ERROR as T, sendVideoMsg as _, sendText as a, MESSAGE_REPLY_LIMIT as b, isCronReminderPayload as c, normalizeMediaTags as d, buildMediaTarget as f, sendPhoto as g, sendDocument as h, sendProactiveMessage as i, isMediaPayload as l, resolveOutboundMediaPath as m, sendCronMessage as n, decodeMediaPath as o, parseTarget as p, sendMedia as r, encodePayloadForCron as s, outbound_exports as t, parseQQBotPayload as u, sendVoice as v, recordMessageReply as w, checkMessageReplyLimit as x, resolveUserFacingMediaError as y };

package/dist/{request-context-D4dkxrmN.js → request-context-BCsRtyph.js}

@@ -1,5 +1,5 @@
-import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-Cx3C1vCZ.js";
-import { w as debugLog } from "./runtime-PZU9ND1Q.js";
+import { a as getQQBotDataDir, c as getQQBotMediaPath, d as isWindows, i as getHomeDir } from "./channel-8Efx0wKu.js";
+import { w as debugLog } from "./runtime-DWfbz21q.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs";
 import path from "node:path";

package/dist/{runtime-PZU9ND1Q.js → runtime-DWfbz21q.js}

@@ -9,6 +9,7 @@ import { FsSafeError, openLocalFileSafely, readRegularFile, statRegularFileSync
 import * as path$1 from "node:path";
 import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/qqbot/src/engine/types.ts
 /**
 * Core API layer public types.
@@ -988,7 +989,21 @@ function sleep(ms) {
 }
 //#endregion
 //#region extensions/qqbot/src/engine/api/token.ts
+/**
+* Token management for the QQ Open Platform.
+*
+* All state (cache, singleflight promises, background refresh controllers)
+* is encapsulated in the `TokenManager` class instance — no module-level
+* globals, fully supporting multi-account concurrent operation.
+*/
 const TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken";
+const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 7200;
+function resolveTokenExpiresInSeconds(value) {
+	const parsed = parseStrictPositiveInteger(value);
+	if (parsed !== void 0) return parsed;
+	if (value == null || typeof value === "number" && !Number.isFinite(value)) return DEFAULT_TOKEN_EXPIRES_IN_SECONDS;
+	return 0;
+}
 /**
 * Per-appId token manager with caching, singleflight, and background refresh.
 *
@@ -1116,47 +1131,59 @@ var TokenManager = class {
 	async doFetchToken(appId, clientSecret) {
 		this.logger?.debug?.(`[qqbot:token:${appId}] >>> POST ${TOKEN_URL}`);
 		let response;
+		let release;
 		try {
-			response = await fetch(TOKEN_URL, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					"User-Agent": this.resolveUserAgent()
-				},
-				body: JSON.stringify({
-					appId,
-					clientSecret
-				})
+			const guarded = await fetchWithSsrFGuard({
+				url: TOKEN_URL,
+				auditContext: "qqbot-token",
+				capture: false,
+				init: {
+					method: "POST",
+					headers: {
+						"Content-Type": "application/json",
+						"User-Agent": this.resolveUserAgent()
+					},
+					body: JSON.stringify({
+						appId,
+						clientSecret
+					})
+				}
 			});
+			response = guarded.response;
+			release = guarded.release;
 		} catch (err) {
 			this.logger?.error?.(`[qqbot:token:${appId}] Network error: ${formatErrorMessage(err)}`);
 			throw new Error(`Network error getting access_token: ${formatErrorMessage(err)}`, { cause: err });
 		}
-		const traceId = response.headers.get("x-tps-trace-id") ?? "";
-		this.logger?.debug?.(`[qqbot:token:${appId}] <<< ${response.status}${traceId ? ` | TraceId: ${traceId}` : ""}`);
-		let rawBody;
-		try {
-			rawBody = await response.text();
-		} catch (err) {
-			throw new Error(`Failed to read access_token response: ${formatErrorMessage(err)}`, { cause: err });
-		}
-		const logBody = rawBody.replace(/"access_token"\s*:\s*"[^"]+"/g, "\"access_token\": \"***\"");
-		this.logger?.debug?.(`[qqbot:token:${appId}] <<< Body: ${logBody}`);
-		let data;
 		try {
-			data = JSON.parse(rawBody);
-		} catch {
-			throw new Error("QQBot access_token response was malformed JSON");
+			const traceId = response.headers.get("x-tps-trace-id") ?? "";
+			this.logger?.debug?.(`[qqbot:token:${appId}] <<< ${response.status}${traceId ? ` | TraceId: ${traceId}` : ""}`);
+			let rawBody;
+			try {
+				rawBody = await response.text();
+			} catch (err) {
+				throw new Error(`Failed to read access_token response: ${formatErrorMessage(err)}`, { cause: err });
+			}
+			const logBody = rawBody.replace(/"access_token"\s*:\s*"[^"]+"/g, "\"access_token\": \"***\"");
+			this.logger?.debug?.(`[qqbot:token:${appId}] <<< Body: ${logBody}`);
+			let data;
+			try {
+				data = JSON.parse(rawBody);
+			} catch {
+				throw new Error("QQBot access_token response was malformed JSON");
+			}
+			if (!data.access_token) throw new Error(`Failed to get access_token: ${JSON.stringify(data)}`);
+			const expiresAt = Date.now() + resolveTokenExpiresInSeconds(data.expires_in) * 1e3;
+			this.cache.set(appId, {
+				token: data.access_token,
+				expiresAt,
+				appId
+			});
+			this.logger?.debug?.(`[qqbot:token:${appId}] Cached, expires at: ${new Date(expiresAt).toISOString()}`);
+			return data.access_token;
+		} finally {
+			await release?.();
 		}
-		if (!data.access_token) throw new Error(`Failed to get access_token: ${JSON.stringify(data)}`);
-		const expiresAt = Date.now() + (data.expires_in ?? 7200) * 1e3;
-		this.cache.set(appId, {
-			token: data.access_token,
-			expiresAt,
-			appId
-		});
-		this.logger?.debug?.(`[qqbot:token:${appId}] Cached, expires at: ${new Date(expiresAt).toISOString()}`);
-		return data.access_token;
 	}
 	abortableSleep(ms, signal) {
 		return new Promise((resolve, reject) => {

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-PZU9ND1Q.js";
+import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-DWfbz21q.js";
 export { getQQBotRuntime, setQQBotRuntime };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.28-beta.2",
+  "version": "2026.5.28-beta.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/qqbot",
-      "version": "2026.5.28-beta.2",
+      "version": "2026.5.28-beta.4",
       "dependencies": {
         "@tencent-connect/qqbot-connector": "1.1.0",
         "mpg123-decoder": "1.0.3",
@@ -15,7 +15,7 @@
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.5.28-beta.2"
+        "openclaw": ">=2026.5.28-beta.4"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.5.28-beta.2",
+  "version": "2026.5.28-beta.4",
   "private": false,
   "description": "OpenClaw QQ Bot channel plugin for group and direct-message workflows.",
   "repository": {
@@ -16,7 +16,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.28-beta.2"
+    "openclaw": ">=2026.5.28-beta.4"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -45,10 +45,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.28-beta.2"
+      "pluginApi": ">=2026.5.28-beta.4"
     },
     "build": {
-      "openclawVersion": "2026.5.28-beta.2"
+      "openclawVersion": "2026.5.28-beta.4"
     },
     "release": {
       "publishToClawHub": true,