@openclaw/qqbot 2026.5.7 → 2026.5.10-beta.1

package/dist/{gateway-Cs3-_on9.js → gateway-OhbnW8Uq.js}

@@ -1,49 +1,30 @@
-import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-BJfhwrPg.js";
-import { c as getPlatformAdapter, i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-Ci6NM5DE.js";
-import { d as setBridgeLogger, l as ensurePlatformAdapter, s as resolveAccountBase } from "./resolve-D_06fV6-.js";
+import { E as setOutboundAudioPort, _ as sendVoice, c as isMediaPayload, g as sendVideoMsg, h as sendPhoto, l as parseQQBotPayload, m as sendDocument, o as encodePayloadForCron, r as sendMedia, s as isCronReminderPayload, u as normalizeMediaTags, v as resolveUserFacingMediaError, w as DEFAULT_MEDIA_SEND_ERROR } from "./outbound-DL154TS6.js";
+import { c as getPlatformAdapter, i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-BzzzPOeb.js";
+import { d as setBridgeLogger, l as ensurePlatformAdapter, s as resolveAccountBase } from "./resolve-Cm33TWZp.js";
 import { i as parseApprovalButtonData } from "./approval-cg0SVahb.js";
 import { t as toGatewayAccount } from "./narrowing-BoieBTIU.js";
-import { B as StreamInputState, C as debugLog, E as getNextMsgSeq, I as formatDuration, L as formatErrorMessage, N as getImageMimeType, P as getMaxUploadSize, R as StreamContentType, S as debugError, a as createRawInputNotifyFn, b as withTokenRetry, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia$1, i as clearTokenCache, j as formatFileSize, k as downloadFile, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, v as startBackgroundTokenRefresh, w as debugWarn, x as openLocalFile, y as stopBackgroundTokenRefresh, z as StreamInputMode } from "./sender-p-B14eLG.js";
-import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-BJAS3eXW.js";
-import { a as getHomeDir, c as getQQBotMediaDir, d as isLocalPath, f as isWindows, i as checkSilkWasmAvailable, m as resolveQQBotPayloadLocalFilePath, o as getQQBotDataDir, p as normalizePath$1, s as getQQBotDataPath, u as getTempDir } from "./target-parser-Y0prnrXD.js";
-import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-Cjwx7OwW.js";
+import { B as StreamInputState, C as debugWarn, D as openLocalFile, I as formatDuration, L as formatErrorMessage, N as getImageMimeType, P as getMaxUploadSize, R as StreamContentType, S as debugLog, T as getNextMsgSeq, a as createRawInputNotifyFn, b as withTokenRetry, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia$1, i as clearTokenCache, j as formatFileSize, k as downloadFile, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, v as startBackgroundTokenRefresh, x as debugError, y as stopBackgroundTokenRefresh, z as StreamInputMode } from "./sender-C-TmIFow.js";
+import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-CHGblcVc.js";
+import { a as getHomeDir, c as getQQBotMediaDir, d as isLocalPath, f as isWindows, i as checkSilkWasmAvailable, m as resolveQQBotPayloadLocalFilePath, o as getQQBotDataDir, p as normalizePath$1, s as getQQBotDataPath, u as getTempDir } from "./target-parser-CTNFSKb1.js";
+import { a as getPluginVersion, i as getFrameworkVersion, n as runWithRequestContext, o as initCommands, s as matchSlashCommand } from "./request-context-Bn63CUkr.js";
 import * as fs$1 from "node:fs";
 import fs from "node:fs";
 import * as os$1 from "node:os";
 import crypto from "node:crypto";
+import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import { appendRegularFileSync, privateFileStoreSync, readRegularFileSync, replaceFileAtomicSync } from "openclaw/plugin-sdk/security-runtime";
 import * as path$1 from "node:path";
 import path from "node:path";
+import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
 import { resolveRuntimeServiceVersion } from "openclaw/plugin-sdk/cli-runtime";
 import WebSocket from "ws";
+import { resolveAmbientNodeProxyAgent } from "openclaw/plugin-sdk/extension-shared";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { fileURLToPath } from "node:url";
-import { implicitMentionKindWhen, resolveInboundMentionDecision } from "openclaw/plugin-sdk/channel-mention-gating";
+import { createChannelIngressResolver, defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { resolveInboundMentionDecision } from "openclaw/plugin-sdk/channel-mention-gating";
 import { buildPendingHistoryContextFromMap, clearHistoryEntriesIfEnabled, recordPendingHistoryEntryIfEnabled } from "openclaw/plugin-sdk/reply-history";
 //#region extensions/qqbot/src/engine/group/activation.ts
-/**
-* Group activation mode — how the bot decides whether to respond in a group.
-*
-* Resolution chain:
-*   1. session store override (`/activation` command writes per-session
-*      `groupActivation` value) — highest priority
-*   2. per-group `requireMention` config
-*   3. `"mention"` default (require @-bot to respond)
-*
-* File I/O is isolated in the default node-based reader so the gating
-* logic itself stays a pure function, testable without touching disk.
-*
-* Note: the implicit-mention predicate (quoting a bot message counts as
-* @-ing the bot) lives in `./mention.ts` alongside the other mention
-* helpers — see `resolveImplicitMention` there.
-*/
-/**
-* Resolve the effective activation mode for one inbound message.
-*
-* Order of precedence:
-*   1. `store[sessionKey].groupActivation` (read via the injected reader)
-*   2. config-level `requireMention` (maps to `"mention"` / `"always"`)
-*   3. `"mention"` (safe default)
-*/
 function resolveGroupActivation(params) {
 	const fallback = params.configRequireMention ? "mention" : "always";
 	const store = params.sessionStoreReader?.read({
@@ -57,14 +38,6 @@ function resolveGroupActivation(params) {
 	if (normalized === "mention" || normalized === "always") return normalized;
 	return fallback;
 }
-/**
-* Resolve the on-disk path to the agent-sessions file.
-*
-* Priority:
-*   1. `cfg.session.store` (supports `{agentId}` placeholder and `~` expansion)
-*   2. `$OPENCLAW_STATE_DIR` / `$CLAWDBOT_STATE_DIR`
-*   3. `~/.openclaw/agents/{agentId}/sessions/sessions.json`
-*/
 function resolveSessionStorePath(cfg, agentId) {
 	const resolvedAgentId = agentId || "default";
 	const session = typeof cfg.session === "object" && cfg.session !== null ? cfg.session : void 0;
@@ -81,16 +54,6 @@ function resolveSessionStorePath(cfg, agentId) {
 	const stateDir = process.env.OPENCLAW_STATE_DIR?.trim() || process.env.CLAWDBOT_STATE_DIR?.trim() || path.join(process.env.HOME || process.env.USERPROFILE || "", ".openclaw");
 	return path.join(stateDir, "agents", resolvedAgentId, "sessions", "sessions.json");
 }
-/**
-* Create the default, production-ready session-store reader.
-*
-* Reads the file synchronously on every call. The overhead is acceptable
-* because activation mode is only resolved once per group message and
-* the sessions file is typically a handful of kilobytes.
-*
-* Any I/O or JSON error is swallowed and returned as `null` so the
-* gating pipeline falls back to the config default.
-*/
 function createNodeSessionStoreReader() {
 	return { read: ({ cfg, agentId }) => {
 		try {
@@ -258,7 +221,10 @@ function ensureDir$2() {
 function appendLine(line) {
 	try {
 		ensureDir$2();
-		fs.appendFileSync(getRefIndexFile(), JSON.stringify(line) + "\n", "utf-8");
+		appendRegularFileSync({
+			filePath: getRefIndexFile(),
+			content: JSON.stringify(line) + "\n"
+		});
 		totalLinesOnDisk++;
 	} catch (err) {
 		debugError(`[ref-index-store] Failed to append: ${formatErrorMessage(err)}`);
@@ -273,7 +239,6 @@ function compactFile() {
 	try {
 		ensureDir$2();
 		const refIndexFile = getRefIndexFile();
-		const tmpPath = refIndexFile + ".tmp";
 		const lines = [];
 		for (const [key, entry] of cache) lines.push(JSON.stringify({
 			k: key,
@@ -287,8 +252,11 @@ function compactFile() {
 			},
 			t: entry._createdAt
 		}));
-		fs.writeFileSync(tmpPath, lines.join("\n") + "\n", "utf-8");
-		fs.renameSync(tmpPath, refIndexFile);
+		replaceFileAtomicSync({
+			filePath: refIndexFile,
+			content: `${lines.join("\n")}\n`,
+			tempPrefix: ".qqbot-ref-index"
+		});
 		totalLinesOnDisk = cache.size;
 		debugLog(`[ref-index-store] Compacted: ${before} lines → ${totalLinesOnDisk} lines`);
 	} catch (err) {
@@ -405,27 +373,6 @@ async function runDiagnostics() {
 	return report;
 }
 //#endregion
-//#region extensions/qqbot/src/engine/access/resolve-policy.ts
-function hasRealRestriction(list) {
-	if (!list || list.length === 0) return false;
-	return !list.every((entry) => String(entry).trim() === "*");
-}
-/**
-* Derive the effective dmPolicy and groupPolicy applied at runtime.
-*
-* Caller should pass the raw `QQBotAccountConfig`. The resolver does
-* not look at `groups[id]` overrides — per-group overrides are layered
-* on top elsewhere (see `inbound-pipeline` mention gating).
-*/
-function resolveQQBotEffectivePolicies(input) {
-	const allowFromRestricted = hasRealRestriction(input.allowFrom);
-	const groupAllowFromRestricted = hasRealRestriction(input.groupAllowFrom);
-	return {
-		dmPolicy: input.dmPolicy ?? (allowFromRestricted ? "allowlist" : "open"),
-		groupPolicy: input.groupPolicy ?? (groupAllowFromRestricted || allowFromRestricted ? "allowlist" : "open")
-	};
-}
-//#endregion
 //#region extensions/qqbot/src/engine/access/sender-match.ts
 /**
 * QQBot sender normalization and allowlist matching.
@@ -465,177 +412,13 @@ function createQQBotSenderMatcher(senderId) {
 	};
 }
 //#endregion
-//#region extensions/qqbot/src/engine/access/types.ts
-/** Structured reason codes used in logs and metrics. */
-const QQBOT_ACCESS_REASON = {
-	DM_POLICY_OPEN: "dm_policy_open",
-	DM_POLICY_DISABLED: "dm_policy_disabled",
-	DM_POLICY_ALLOWLISTED: "dm_policy_allowlisted",
-	DM_POLICY_NOT_ALLOWLISTED: "dm_policy_not_allowlisted",
-	DM_POLICY_EMPTY_ALLOWLIST: "dm_policy_empty_allowlist",
-	GROUP_POLICY_ALLOWED: "group_policy_allowed",
-	GROUP_POLICY_DISABLED: "group_policy_disabled",
-	GROUP_POLICY_EMPTY_ALLOWLIST: "group_policy_empty_allowlist",
-	GROUP_POLICY_NOT_ALLOWLISTED: "group_policy_not_allowlisted",
-	BOT_SELF_ECHO: "bot_self_echo"
-};
-//#endregion
-//#region extensions/qqbot/src/engine/access/access-control.ts
-/**
-* QQBot inbound access decision.
-*
-* This module is the single place where the QQBot engine decides
-* whether an inbound message from a given sender is allowed to
-* proceed into the outbound pipeline. The implementation mirrors the
-* semantics of the framework-wide `resolveDmGroupAccessDecision`
-* (`src/security/dm-policy-shared.ts`) but is kept standalone so the
-* `engine/` layer does not pull in `openclaw/plugin-sdk/*` modules —
-* a hard constraint shared with the standalone `openclaw-qqbot` build.
-*
-* If in the future we lift the zero-dependency rule in the engine
-* layer, this file can be replaced by a thin adapter around the
-* framework API with identical semantics.
-*/
-/**
-* Evaluate the inbound access policy.
-*
-* Semantics (aligned with `resolveDmGroupAccessDecision`):
-*   - Group message:
-*     - `groupPolicy=disabled` → block
-*     - `groupPolicy=open`     → allow
-*     - `groupPolicy=allowlist`:
-*         - empty effectiveGroupAllowFrom → block (empty_allowlist)
-*         - sender not in list            → block (not_allowlisted)
-*         - otherwise                     → allow
-*   - Direct message:
-*     - `dmPolicy=disabled`    → block
-*     - `dmPolicy=open`        → allow wildcard, legacy empty allowFrom, or matching allowFrom
-*     - `dmPolicy=allowlist`:
-*         - empty effectiveAllowFrom → block (empty_allowlist)
-*         - sender not in list       → block (not_allowlisted)
-*         - otherwise                → allow
-*
-* The function never throws; callers can rely on the returned
-* `decision`/`reasonCode` pair for branching.
-*/
-function resolveQQBotAccess(input) {
-	const { dmPolicy, groupPolicy } = resolveQQBotEffectivePolicies(input);
-	const rawGroupAllowFrom = input.groupAllowFrom && input.groupAllowFrom.length > 0 ? input.groupAllowFrom : input.allowFrom ?? [];
-	const normalizedAllowFrom = normalizeQQBotAllowFrom(input.allowFrom);
-	const effectiveAllowFrom = dmPolicy === "open" && normalizedAllowFrom.length === 0 ? ["*"] : normalizedAllowFrom;
-	const effectiveGroupAllowFrom = normalizeQQBotAllowFrom(rawGroupAllowFrom);
-	const isSenderAllowed = createQQBotSenderMatcher(input.senderId);
-	if (input.isGroup) return evaluateGroupDecision({
-		groupPolicy,
-		dmPolicy,
-		effectiveAllowFrom,
-		effectiveGroupAllowFrom,
-		isSenderAllowed
-	});
-	return evaluateDmDecision({
-		groupPolicy,
-		dmPolicy,
-		effectiveAllowFrom,
-		effectiveGroupAllowFrom,
-		isSenderAllowed
-	});
-}
-function evaluateGroupDecision(ctx) {
-	const base = buildResultBase(ctx);
-	if (ctx.groupPolicy === "disabled") return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.GROUP_POLICY_DISABLED,
-		reason: "groupPolicy=disabled"
-	};
-	if (ctx.groupPolicy === "open") return {
-		...base,
-		decision: "allow",
-		reasonCode: QQBOT_ACCESS_REASON.GROUP_POLICY_ALLOWED,
-		reason: "groupPolicy=open"
-	};
-	if (ctx.effectiveGroupAllowFrom.length === 0) return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.GROUP_POLICY_EMPTY_ALLOWLIST,
-		reason: "groupPolicy=allowlist (empty allowlist)"
-	};
-	if (!ctx.isSenderAllowed(ctx.effectiveGroupAllowFrom)) return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.GROUP_POLICY_NOT_ALLOWLISTED,
-		reason: "groupPolicy=allowlist (not allowlisted)"
-	};
-	return {
-		...base,
-		decision: "allow",
-		reasonCode: QQBOT_ACCESS_REASON.GROUP_POLICY_ALLOWED,
-		reason: "groupPolicy=allowlist (allowlisted)"
-	};
-}
-function evaluateDmDecision(ctx) {
-	const base = buildResultBase(ctx);
-	if (ctx.dmPolicy === "disabled") return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_DISABLED,
-		reason: "dmPolicy=disabled"
-	};
-	if (ctx.dmPolicy === "open") {
-		if (ctx.effectiveAllowFrom.includes("*")) return {
-			...base,
-			decision: "allow",
-			reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_OPEN,
-			reason: "dmPolicy=open"
-		};
-		if (ctx.isSenderAllowed(ctx.effectiveAllowFrom)) return {
-			...base,
-			decision: "allow",
-			reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_ALLOWLISTED,
-			reason: "dmPolicy=open (allowlisted)"
-		};
-		return {
-			...base,
-			decision: "block",
-			reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_NOT_ALLOWLISTED,
-			reason: "dmPolicy=open (not allowlisted)"
-		};
-	}
-	if (ctx.effectiveAllowFrom.length === 0) return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_EMPTY_ALLOWLIST,
-		reason: "dmPolicy=allowlist (empty allowlist)"
-	};
-	if (!ctx.isSenderAllowed(ctx.effectiveAllowFrom)) return {
-		...base,
-		decision: "block",
-		reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_NOT_ALLOWLISTED,
-		reason: "dmPolicy=allowlist (not allowlisted)"
-	};
-	return {
-		...base,
-		decision: "allow",
-		reasonCode: QQBOT_ACCESS_REASON.DM_POLICY_ALLOWLISTED,
-		reason: "dmPolicy=allowlist (allowlisted)"
-	};
-}
-function buildResultBase(ctx) {
-	return {
-		effectiveAllowFrom: ctx.effectiveAllowFrom,
-		effectiveGroupAllowFrom: ctx.effectiveGroupAllowFrom,
-		dmPolicy: ctx.dmPolicy,
-		groupPolicy: ctx.groupPolicy
-	};
-}
-//#endregion
 //#region extensions/qqbot/src/engine/commands/slash-command-auth.ts
 /**
 * Pre-dispatch authorization for requireAuth slash commands.
 *
-* Unlike the access-stage's `resolveCommandAuthorized` (which permits
-* `dm_policy_open` senders — i.e. anyone), this function requires the
-* sender to appear in an **explicit non-wildcard** allowFrom list.
+* Unlike the inbound message ingress command projection (which permits
+* open-policy chat senders), this function requires the sender to appear in an
+* **explicit non-wildcard** allowFrom list.
 *
 * Rationale: sensitive operations (log export, file deletion, approval
 * config changes) must be gated behind a deliberate operator decision.
@@ -704,6 +487,22 @@ async function trySlashCommand(msg, ctx) {
 	}
 	const receivedAt = Date.now();
 	const peerId = ctx.getMessagePeerId(msg);
+	const isGroup = msg.type === "group" || msg.type === "guild";
+	const commandsAllowFrom = resolveQQBotCommandsAllowFrom(ctx.cfg);
+	const commandAuthorized = ctx.resolveCommandAuthorized ? await ctx.resolveCommandAuthorized({
+		isGroup,
+		senderId: msg.senderId,
+		conversationId: msg.groupOpenid ?? msg.channelId ?? msg.senderId,
+		allowFrom: account.config?.allowFrom,
+		groupAllowFrom: account.config?.groupAllowFrom,
+		commandsAllowFrom
+	}) : resolveSlashCommandAuth({
+		senderId: msg.senderId,
+		isGroup,
+		allowFrom: account.config?.allowFrom,
+		groupAllowFrom: account.config?.groupAllowFrom,
+		commandsAllowFrom
+	});
 	const cmdCtx = {
 		type: msg.type,
 		senderId: msg.senderId,
@@ -718,13 +517,7 @@ async function trySlashCommand(msg, ctx) {
 		accountId: account.accountId,
 		appId: account.appId,
 		accountConfig: account.config,
-		commandAuthorized: resolveSlashCommandAuth({
-			senderId: msg.senderId,
-			isGroup: msg.type === "group" || msg.type === "guild",
-			allowFrom: account.config?.allowFrom,
-			groupAllowFrom: account.config?.groupAllowFrom,
-			commandsAllowFrom: resolveQQBotCommandsAllowFrom(ctx.cfg)
-		}),
+		commandAuthorized,
 		queueSnapshot: ctx.getQueueSnapshot(peerId)
 	};
 	try {
@@ -778,9 +571,8 @@ function loadUsersFromFile() {
 	usersCache = /* @__PURE__ */ new Map();
 	try {
 		const knownUsersFile = getKnownUsersFile();
-		if (fs.existsSync(knownUsersFile)) {
-			const data = fs.readFileSync(knownUsersFile, "utf-8");
-			const users = JSON.parse(data);
+		const users = privateFileStoreSync(path.dirname(knownUsersFile)).readJsonIfExists(path.basename(knownUsersFile));
+		if (users) {
 			for (const user of users) usersCache.set(makeUserKey(user), user);
 			debugLog(`[known-users] Loaded ${usersCache.size} users`);
 		}
@@ -801,7 +593,8 @@ function doSaveUsersToFile() {
 	if (!usersCache || !isDirty) return;
 	try {
 		ensureDir$1();
-		fs.writeFileSync(getKnownUsersFile(), JSON.stringify(Array.from(usersCache.values()), null, 2), "utf-8");
+		const filePath = getKnownUsersFile();
+		privateFileStoreSync(path.dirname(filePath)).writeJson(path.basename(filePath), Array.from(usersCache.values()));
 		isDirty = false;
 	} catch (err) {
 		debugError(`[known-users] Failed to save users: ${formatErrorMessage(err)}`);
@@ -878,13 +671,15 @@ function getCandidateSessionPaths(accountId) {
 function loadSession(accountId, expectedAppId) {
 	try {
 		let filePath = null;
-		for (const candidatePath of getCandidateSessionPaths(accountId)) if (fs.existsSync(candidatePath)) {
-			filePath = candidatePath;
-			break;
+		let state = null;
+		for (const candidatePath of getCandidateSessionPaths(accountId)) {
+			state = privateFileStoreSync(path.dirname(candidatePath)).readJsonIfExists(path.basename(candidatePath));
+			if (state) {
+				filePath = candidatePath;
+				break;
+			}
 		}
-		if (!filePath) return null;
-		const data = fs.readFileSync(filePath, "utf-8");
-		const state = JSON.parse(data);
+		if (!filePath || !state) return null;
 		const now = Date.now();
 		if (now - state.savedAt > SESSION_EXPIRE_TIME) {
 			debugLog(`[session-store] Session expired for ${accountId}, age: ${Math.round((now - state.savedAt) / 1e3)}s`);
@@ -958,7 +753,7 @@ function doSaveSession(state) {
 			...state,
 			savedAt: Date.now()
 		};
-		fs.writeFileSync(filePath, JSON.stringify(stateToSave, null, 2), "utf-8");
+		privateFileStoreSync(path.dirname(filePath)).writeJson(path.basename(filePath), stateToSave);
 		if (legacyPath !== filePath && fs.existsSync(legacyPath)) fs.unlinkSync(legacyPath);
 		debugLog(`[session-store] Saved session for ${state.accountId}: sessionId=${state.sessionId}, lastSeq=${state.lastSeq}`);
 	} catch (err) {
@@ -1334,43 +1129,16 @@ function buildGroupQueuedMessage(data, accountId, eventType) {
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/message-queue.ts
-/**
-* Per-user concurrent message queue.
-*
-* Messages are serialized per **peer** (one DM user, one group, one guild
-* channel) and processed in parallel across peers up to
-* {@link DEFAULT_MAX_CONCURRENT_USERS}.
-*
-* Group-specific enhancements (added when merging from the standalone build):
-*   - Group peers have a larger queue cap ({@link DEFAULT_GROUP_QUEUE_SIZE})
-*     because groups can burst more chatter than a single DM.
-*   - When a group's queue overflows, bot-authored messages are evicted
-*     preferentially so human messages don't get dropped.
-*   - When draining a group peer with more than one queued message, the
-*     non-command messages are **merged** into one logical turn (see
-*     {@link mergeGroupMessages}). Slash commands are always processed
-*     individually to avoid conflating a "/stop" with surrounding chatter.
-*
-* The module is self-contained: the only injected dependency is the
-* logger / abort probe supplied via {@link MessageQueueContext}.
-*/
-/** Global cap across all peers. */
 const DEFAULT_GLOBAL_QUEUE_SIZE = 1e3;
-/** Per-DM / per-channel cap. */
 const DEFAULT_PER_PEER_QUEUE_SIZE = 20;
-/** Per-group cap — larger because groups burst more. */
 const DEFAULT_GROUP_QUEUE_SIZE = 50;
-/** Parallel fanout across peers. */
 const DEFAULT_MAX_CONCURRENT_USERS = 10;
-/** Convenience predicate: is this a merged multi-message turn? */
 function isMergedTurn(msg) {
 	return (msg.merge?.count ?? 0) > 1;
 }
-/** Return true when the peer id refers to a group-like conversation. */
 function isGroupPeer(peerId) {
 	return peerId.startsWith("group:") || peerId.startsWith("guild:");
 }
-/** Slash-command test used by {@link drainGroupBatch}. */
 function isSlashCommand(msg) {
 	return (msg.content ?? "").trim().startsWith("/");
 }
@@ -1437,9 +1205,6 @@ function mergeGroupMessages(batch) {
 		}
 	};
 }
-/**
-* Create a per-user concurrent queue with built-in group enhancements.
-*/
 function createMessageQueue(ctx) {
 	const { accountId: _accountId, log } = ctx;
 	const globalQueueSize = ctx.globalQueueSize ?? DEFAULT_GLOBAL_QUEUE_SIZE;
@@ -1455,13 +1220,6 @@ function createMessageQueue(ctx) {
 		if (msg.type === "group") return `group:${msg.groupOpenid ?? "unknown"}`;
 		return `dm:${msg.senderId}`;
 	};
-	/**
-	* Evict one message from an over-full queue.
-	*
-	* For group peers we prefer to drop a bot-authored message so human
-	* input never gets lost. Falling back to dropping the oldest keeps the
-	* queue bounded when all members are bots.
-	*/
 	const evictOne = (queue, isGroup) => {
 		if (isGroup) {
 			const botIdx = queue.findIndex((m) => m.senderIsBot);
@@ -1469,7 +1227,6 @@ function createMessageQueue(ctx) {
 		}
 		return queue.shift();
 	};
-	/** Run a single message, capturing errors in the log. */
 	const processOne = async (msg, peerId, label) => {
 		try {
 			await handleMessageFnRef(msg);
@@ -1477,11 +1234,6 @@ function createMessageQueue(ctx) {
 			log?.error(`${label} error for ${peerId}: ${formatErrorMessage(err)}`);
 		}
 	};
-	/**
-	* Drain a group's batch:
-	*   - slash commands are processed one by one (order preserved);
-	*   - the remaining messages are merged into a single turn.
-	*/
 	const drainGroupBatch = async (batch, peerId) => {
 		const commands = [];
 		const normal = [];
@@ -1497,7 +1249,6 @@ function createMessageQueue(ctx) {
 			await processOne(merged, peerId, `Message processor (merged batch of ${normal.length})`);
 		}
 	};
-	/** Process one peer's queue serially. */
 	const drainUserQueue = async (peerId) => {
 		if (activeUsers.has(peerId)) return;
 		if (activeUsers.size >= maxConcurrentUsers) {
@@ -1740,13 +1491,16 @@ var ReconnectState = class {
 	}
 };
 //#endregion
+//#region extensions/qqbot/src/engine/gateway/ws-client.ts
+async function createQQWSClient(options) {
+	const wsAgent = await resolveAmbientNodeProxyAgent();
+	return new WebSocket(options.gatewayUrl, {
+		headers: { "User-Agent": options.userAgent },
+		...wsAgent ? { agent: wsAgent } : {}
+	});
+}
+//#endregion
 //#region extensions/qqbot/src/engine/gateway/gateway-connection.ts
-/**
-* GatewayConnection — WebSocket lifecycle, heartbeat, reconnect, and session persistence.
-*
-* Encapsulates all connection state as class fields (replaces 11 closure variables).
-* Event handling and message processing are delegated to injected handlers.
-*/
 var GatewayConnection = class {
 	constructor(ctx) {
 		this.isAborted = false;
@@ -1765,7 +1519,6 @@ var GatewayConnection = class {
 			isAborted: () => this.isAborted
 		});
 	}
-	/** Start the connection loop. Resolves when abortSignal fires. */
 	async start() {
 		this.restoreSession();
 		this.registerAbortHandler();
@@ -1852,14 +1605,22 @@ var GatewayConnection = class {
 			log?.info(`✅ Access token obtained successfully`);
 			const gatewayUrl = await getGatewayUrl(accessToken, account.appId);
 			log?.info(`Connecting to ${gatewayUrl}`);
-			const ws = new WebSocket(gatewayUrl, { headers: { "User-Agent": getPluginUserAgent() } });
+			const ws = await createQQWSClient({
+				gatewayUrl,
+				userAgent: getPluginUserAgent()
+			});
 			this.currentWs = ws;
 			const slashCtx = {
 				account,
 				cfg: this.ctx.cfg,
 				log,
 				getMessagePeerId: (msg) => this.msgQueue.getMessagePeerId(msg),
-				getQueueSnapshot: (peerId) => this.msgQueue.getSnapshot(peerId)
+				getQueueSnapshot: (peerId) => this.msgQueue.getSnapshot(peerId),
+				resolveCommandAuthorized: (params) => this.ctx.adapters.access.resolveSlashCommandAuthorization({
+					cfg: this.ctx.cfg,
+					accountId: account.accountId,
+					...params
+				})
 			};
 			const trySlashCommandOrEnqueue = async (msg) => {
 				const result = await trySlashCommand(msg, slashCtx);
@@ -2026,20 +1787,28 @@ async function transcribeAudio(audioPath, cfg) {
 	if (!sttCfg) return null;
 	const fileBuffer = fs$1.readFileSync(audioPath);
 	const fileName = sanitizeFileName(path.basename(audioPath));
-	const mime = fileName.endsWith(".wav") ? "audio/wav" : fileName.endsWith(".mp3") ? "audio/mpeg" : fileName.endsWith(".ogg") ? "audio/ogg" : "application/octet-stream";
+	const mime = mimeTypeFromFilePath(fileName) ?? "application/octet-stream";
 	const form = new FormData();
 	form.append("file", new Blob([fileBuffer], { type: mime }), fileName);
 	form.append("model", sttCfg.model);
-	const resp = await fetch(`${sttCfg.baseUrl}/audio/transcriptions`, {
-		method: "POST",
-		headers: { Authorization: `Bearer ${sttCfg.apiKey}` },
-		body: form
+	const { response: resp, release } = await fetchWithSsrFGuard({
+		url: `${sttCfg.baseUrl}/audio/transcriptions`,
+		auditContext: "qqbot-stt",
+		init: {
+			method: "POST",
+			headers: { Authorization: `Bearer ${sttCfg.apiKey}` },
+			body: form
+		}
 	});
-	if (!resp.ok) {
-		const detail = await resp.text().catch(() => "");
-		throw new Error(`STT failed (HTTP ${resp.status}): ${detail.slice(0, 300)}`);
+	try {
+		if (!resp.ok) {
+			const detail = await resp.text().catch(() => "");
+			throw new Error(`STT failed (HTTP ${resp.status}): ${detail.slice(0, 300)}`);
+		}
+		return normalizeOptionalString((await resp.json()).text) ?? null;
+	} finally {
+		await release();
 	}
-	return normalizeOptionalString((await resp.json()).text) ?? null;
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/inbound-attachments.ts
@@ -2288,7 +2057,6 @@ async function processVoiceAttachment(localPath, audioPath, att, asrReferText, c
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/stages/stub-contexts.ts
-/** Build an {@link InboundContext} with all non-routing fields cleared. */
 function emptyInboundContext(fields) {
 	return {
 		event: fields.event,
@@ -2297,30 +2065,12 @@ function emptyInboundContext(fields) {
 		peerId: fields.peerId,
 		qualifiedTarget: fields.qualifiedTarget,
 		fromAddress: fields.fromAddress,
-		parsedContent: "",
-		userContent: "",
-		quotePart: "",
-		dynamicCtx: "",
-		userMessage: "",
 		agentBody: "",
 		body: "",
-		systemPrompts: [],
 		groupSystemPrompt: void 0,
-		attachments: {
-			attachmentInfo: "",
-			imageUrls: [],
-			imageMediaTypes: [],
-			voiceAttachmentPaths: [],
-			voiceAttachmentUrls: [],
-			voiceAsrReferTexts: [],
-			voiceTranscripts: [],
-			voiceTranscriptSources: [],
-			attachmentLocalPaths: []
-		},
 		localMediaPaths: [],
 		localMediaTypes: [],
 		remoteMediaUrls: [],
-		remoteMediaTypes: [],
 		uniqueVoicePaths: [],
 		uniqueVoiceUrls: [],
 		uniqueVoiceAsrReferTexts: [],
@@ -2336,52 +2086,29 @@ function emptyInboundContext(fields) {
 		inputNotifyRefIdx: void 0
 	};
 }
-/**
-* Build an {@link InboundContext} that represents a message blocked by
-* access control (policy denial, allowlist mismatch, etc.).
-*/
 function buildBlockedInboundContext(params) {
 	return {
 		...emptyInboundContext(params),
 		blocked: true,
-		blockReason: params.access.reason,
-		blockReasonCode: params.access.reasonCode,
-		accessDecision: params.access.decision
+		blockReason: params.access.senderAccess.reasonCode,
+		blockReasonCode: params.access.senderAccess.reasonCode,
+		accessDecision: params.access.senderAccess.decision
 	};
 }
-/**
-* Build an {@link InboundContext} that represents a message stopped by
-* the group gate (drop_other_mention, block_unauthorized_command,
-* skip_no_mention). Any history side-effects have already been applied
-* by the gate stage.
-*/
 function buildSkippedInboundContext(params) {
 	return {
 		...emptyInboundContext(params),
 		group: params.group,
 		skipped: true,
 		skipReason: params.skipReason,
-		accessDecision: params.access.decision,
+		accessDecision: params.access.senderAccess.decision,
 		typing: params.typing,
 		inputNotifyRefIdx: params.inputNotifyRefIdx
 	};
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/stages/access-stage.ts
-/**
-* Access stage — resolves routing target + runs access control.
-*
-* Split from the pipeline so it is trivially unit-testable: given a raw
-* event and the runtime's routing info, the stage returns either:
-*   - `{ kind: "allow", ... }` — proceed through the rest of the pipeline
-*   - `{ kind: "block", context }` — short-circuit; the caller returns
-*     `context` directly to its own caller.
-*/
-/**
-* Resolve the routing target, walk the access policy, and decide whether
-* the inbound message should proceed to the rest of the pipeline.
-*/
-function runAccessStage(event, deps) {
+async function runAccessStage(event, deps) {
 	const { account, cfg, runtime, log } = deps;
 	const isGroupChat = event.type === "guild" || event.type === "group";
 	const peerId = resolvePeerId(event, isGroupChat);
@@ -2395,16 +2122,19 @@ function runAccessStage(event, deps) {
 			id: peerId
 		}
 	});
-	const access = resolveQQBotAccess({
+	const access = await deps.adapters.access.resolveInboundAccess({
+		cfg,
+		accountId: account.accountId,
 		isGroup: isGroupChat,
 		senderId: event.senderId,
+		conversationId: peerId,
 		allowFrom: account.config?.allowFrom,
 		groupAllowFrom: account.config?.groupAllowFrom,
 		dmPolicy: account.config?.dmPolicy,
 		groupPolicy: account.config?.groupPolicy
 	});
-	if (access.decision !== "allow") {
-		log?.info(`Blocked qqbot inbound: decision=${access.decision} reasonCode=${access.reasonCode} reason=${access.reason} senderId=${event.senderId} accountId=${account.accountId} isGroup=${isGroupChat}`);
+	if (access.senderAccess.decision !== "allow") {
+		log?.info(`Blocked qqbot inbound: decision=${access.senderAccess.decision} reasonCode=${access.senderAccess.reasonCode} senderId=${event.senderId} accountId=${account.accountId} isGroup=${isGroupChat}`);
 		return {
 			kind: "block",
 			context: buildBlockedInboundContext({
@@ -2438,28 +2168,9 @@ function buildQualifiedTarget(event, isGroupChat) {
 	if (isGroupChat) return event.type === "guild" ? `qqbot:channel:${event.channelId}` : `qqbot:group:${event.groupOpenid}`;
 	return event.type === "dm" ? `qqbot:dm:${event.guildId}` : `qqbot:c2c:${event.senderId}`;
 }
-/**
-* Decide whether the access decision permits running text-based control
-* commands. Placed in the access stage because the rule is an
-* access-policy derivative, not a gate derivative.
-*/
-function resolveCommandAuthorized(access) {
-	return access.reasonCode === "dm_policy_open" || access.reasonCode === "dm_policy_allowlisted" || access.reasonCode === "group_policy_allowed" && access.effectiveGroupAllowFrom.length > 0 && access.groupPolicy === "allowlist";
-}
 //#endregion
 //#region extensions/qqbot/src/engine/group/mention.ts
-/** Regex detecting `<@openid>` / `<@!openid>` mention tags in raw content. */
 const MENTION_TAG_RE = /<@!?\w+>/;
-/**
-* Detect whether the inbound message explicitly targets the bot.
-*
-* Priority order:
-*   1. `mentions[].is_you === true`           (most reliable)
-*   2. `eventType === "GROUP_AT_MESSAGE_CREATE"` (QQ-level @bot event)
-*   3. regex match on any of `mentionPatterns` (fallback, e.g. "@bot-name")
-*
-* Returns `false` for direct messages or when no signal is found.
-*/
 function detectWasMentioned(input) {
 	const { eventType, mentions, content, mentionPatterns } = input;
 	if (mentions?.some((m) => m.is_you)) return true;
@@ -2472,30 +2183,11 @@ function detectWasMentioned(input) {
 	}
 	return false;
 }
-/**
-* Report whether the message contains **any** @mention (not necessarily @bot).
-*
-* Used by the gating layer to decide whether to bypass mention requirements
-* for control commands. A control command like `/stop` that also @-s another
-* user should NOT bypass the mention gate — the `@other-user` prefix is a
-* strong signal that the command wasn't addressed to the bot.
-*/
 function hasAnyMention(input) {
 	if (input.mentions && input.mentions.length > 0) return true;
 	if (input.content && MENTION_TAG_RE.test(input.content)) return true;
 	return false;
 }
-/**
-* Clean up `<@openid>` mention tags in raw QQ group content.
-*
-* - For the bot's own mention (`is_you === true`): the tag is removed
-*   outright so prompts don't contain visible `<@BOTID>` garbage.
-* - For other mentioned users: the tag is replaced with `@nickname` (or
-*   `@username`) for readability. Entries without a display name are left
-*   as-is (rare in practice).
-*
-* Returns the original text unchanged when `text` or `mentions` is empty.
-*/
 function stripMentionText(text, mentions) {
 	if (!text || !mentions?.length) return text;
 	let cleaned = text;
@@ -2511,7 +2203,6 @@ function stripMentionText(text, mentions) {
 	}
 	return cleaned;
 }
-/** Escape characters that carry regex meaning. */
 function escapeRegex$1(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2821,7 +2512,6 @@ const DEFAULT_GROUP_CONFIG = {
 	name: "",
 	historyLimit: 50
 };
-/** Read a named account's raw `groups` map from an OpenClawConfig. */
 function readGroupsMap(cfg, accountId) {
 	const groups = asOptionalObjectRecord(resolveAccountBase(cfg, accountId).config.groups);
 	if (!groups) return {};
@@ -2849,12 +2539,6 @@ function readHistoryLimit(obj, key) {
 	if (typeof v !== "number" || !Number.isFinite(v)) return;
 	return Math.max(0, Math.floor(v));
 }
-/**
-* Resolve per-group configuration with `specific > "*" > default` precedence.
-*
-* When `groupOpenid` is not provided, only the wildcard/default values are
-* returned. This lets callers query the "default" behaviour for new groups.
-*/
 function resolveGroupConfig(cfg, groupOpenid, accountId) {
 	const groups = readGroupsMap(cfg, accountId);
 	const wildcard = groups["*"] ?? {};
@@ -2868,13 +2552,6 @@ function resolveGroupConfig(cfg, groupOpenid, accountId) {
 		historyLimit: readHistoryLimit(specific, "historyLimit") ?? readHistoryLimit(wildcard, "historyLimit") ?? DEFAULT_GROUP_CONFIG.historyLimit
 	};
 }
-/**
-* Resolve all per-inbound group-related settings in one pass.
-*
-* Prefer this over calling `resolveHistoryLimit` / `resolveRequireMention`
-* / etc. individually in hot paths — each of those currently re-walks
-* the config tree on its own.
-*/
 function resolveGroupSettings(params) {
 	const config = resolveGroupConfig(params.cfg, params.groupOpenid, params.accountId);
 	return {
@@ -2883,12 +2560,6 @@ function resolveGroupSettings(params) {
 		mentionPatterns: resolveMentionPatterns(params.cfg, params.agentId)
 	};
 }
-/**
-* Resolve mentionPatterns with `agent > global > []` precedence.
-*
-* Mirrors the framework's `messages.groupChat.mentionPatterns` / per-agent
-* `agents.list[].groupChat.mentionPatterns` chain.
-*/
 function resolveMentionPatterns(cfg, agentId) {
 	if (agentId) {
 		const agents = asOptionalObjectRecord(cfg.agents);
@@ -2907,34 +2578,6 @@ function resolveMentionPatterns(cfg, agentId) {
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/stages/group-gate-stage.ts
-/**
-* Group-gate stage — for `type === "group"` inbound events, decide
-* whether the message should pass to AI dispatch or be intercepted.
-*
-* Three possible outcomes:
-*   - `{ kind: "pass", groupInfo }` — continue the pipeline
-*   - `{ kind: "skip", groupInfo, skipReason }` — buffered to history
-*     (if applicable) and short-circuit
-*   - No group info at all — returned when the event isn't a group event
-*     (caller should treat as a straight pass-through)
-*
-* Consolidates the control-command auth check, session-store
-* activation override, mention detection, and the unified
-* {@link resolveGroupMessageGate} call. Delegates all pure logic to
-* existing `engine/group/*` modules so this stage remains a thin
-* orchestrator.
-*/
-/**
-* Run the group-gate stage.
-*
-* Precondition: `event.type === "group"` && `event.groupOpenid` is set.
-* The caller (pipeline) enforces this; the stage doesn't re-check.
-*
-* On `skip` outcomes the stage records the message into the group's
-* history buffer when the skip reason is one that should preserve
-* context (drop / skip_no_mention), then returns. `block` skip
-* reasons do NOT write history — they are silent rejects.
-*/
 function runGroupGateStage(input) {
 	const { event, deps, accountId, agentId, sessionKey, userContent, processedAttachments } = input;
 	const groupOpenid = event.groupOpenid;
@@ -2971,7 +2614,7 @@ function runGroupGateStage(input) {
 	});
 	const content = (event.content ?? "").trim();
 	const isControlCommand = Boolean(deps.isControlCommand?.(content));
-	const commandAuthorized = deps.allowTextCommands !== false && isSenderAllowedForCommands(event.senderId, deps);
+	const commandAuthorized = deps.allowTextCommands !== false && input.access.commandAccess.authorized;
 	const gate = resolveGateWithPort({
 		mentionGatePort: deps.adapters.mentionGate,
 		ignoreOtherMentions,
@@ -3021,12 +2664,6 @@ function runGroupGateStage(input) {
 		skipReason: gate.action
 	};
 }
-/**
-* Resolve the gate using the SDK MentionGatePort adapter.
-*
-* Layer 1 (ignoreOtherMentions) is QQ-specific and handled here.
-* Layers 2+3 delegate to the SDK's `resolveInboundMentionDecision`.
-*/
 function resolveGateWithPort(params) {
 	if (params.ignoreOtherMentions && params.hasAnyMention && !params.wasMentioned && !params.implicitMention) return {
 		action: "drop_other_mention",
@@ -3064,15 +2701,6 @@ function resolveGateWithPort(params) {
 		shouldBypassMention: decision.shouldBypassMention
 	};
 }
-/**
-* Test whether the sender is on the DM `allowFrom` list.
-*/
-function isSenderAllowedForCommands(senderId, deps) {
-	const raw = deps.account.config?.allowFrom;
-	if (!Array.isArray(raw) || raw.length === 0) return true;
-	const normalized = normalizeQQBotAllowFrom(raw);
-	return createQQBotSenderMatcher(senderId)(normalized);
-}
 function recordGroupHistory(params) {
 	const { historyMap, groupOpenid, historyLimit, event, userContent, historyPort, localPaths } = params;
 	if (!historyMap || historyLimit <= 0) return;
@@ -3240,15 +2868,9 @@ function writeRefIndex(params) {
 }
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/inbound-pipeline.ts
-/**
-* Process a raw queued message through the full inbound pipeline.
-*
-* Returns an {@link InboundContext} with `blocked` / `skipped` set when
-* the message should not reach the AI dispatcher.
-*/
 async function buildInboundContext(event, deps) {
 	const { account, log } = deps;
-	const accessResult = runAccessStage(event, deps);
+	const accessResult = await runAccessStage(event, deps);
 	if (accessResult.kind === "block") return accessResult.context;
 	const { isGroupChat, peerId, qualifiedTarget, fromAddress, route, access } = accessResult;
 	const typingPromise = deps.startTyping(event);
@@ -3280,7 +2902,8 @@ async function buildInboundContext(event, deps) {
 			agentId: route.agentId,
 			sessionKey: route.sessionKey,
 			userContent,
-			processedAttachments: processed
+			processedAttachments: processed,
+			access
 		});
 		if (gateOutcome.kind === "skip") {
 			typingResult.keepAlive?.stop();
@@ -3315,26 +2938,6 @@ async function buildInboundContext(event, deps) {
 		uniqueVoiceUrls: media.uniqueVoiceUrls,
 		uniqueVoiceAsrReferTexts: media.uniqueVoiceAsrReferTexts
 	});
-	const userMessage = buildUserMessage({
-		event,
-		userContent,
-		quotePart,
-		isGroupChat,
-		groupInfo
-	});
-	const agentBody = buildAgentBody({
-		event,
-		userContent,
-		userMessage,
-		dynamicCtx,
-		isGroupChat,
-		groupInfo,
-		deps
-	});
-	const systemPrompts = [];
-	if (account.systemPrompt) systemPrompts.push(account.systemPrompt);
-	const groupSystemPrompt = buildGroupSystemPrompt(systemPrompts.length > 0 ? systemPrompts.join("\n") : "", groupInfo);
-	const commandAuthorized = resolveCommandAuthorized(access);
 	return {
 		event,
 		route,
@@ -3342,20 +2945,26 @@ async function buildInboundContext(event, deps) {
 		peerId,
 		qualifiedTarget,
 		fromAddress,
-		parsedContent,
-		userContent,
-		quotePart,
-		dynamicCtx,
-		userMessage,
-		agentBody,
+		agentBody: buildAgentBody({
+			event,
+			userContent,
+			userMessage: buildUserMessage({
+				event,
+				userContent,
+				quotePart,
+				isGroupChat,
+				groupInfo
+			}),
+			dynamicCtx,
+			isGroupChat,
+			groupInfo,
+			deps
+		}),
 		body,
-		systemPrompts,
-		groupSystemPrompt,
-		attachments: processed,
+		groupSystemPrompt: buildGroupSystemPrompt(account.systemPrompt ?? "", groupInfo),
 		localMediaPaths: media.localMediaPaths,
 		localMediaTypes: media.localMediaTypes,
 		remoteMediaUrls: media.remoteMediaUrls,
-		remoteMediaTypes: media.remoteMediaTypes,
 		uniqueVoicePaths: media.uniqueVoicePaths,
 		uniqueVoiceUrls: media.uniqueVoiceUrls,
 		uniqueVoiceAsrReferTexts: media.uniqueVoiceAsrReferTexts,
@@ -3363,19 +2972,15 @@ async function buildInboundContext(event, deps) {
 		hasAsrReferFallback: media.hasAsrReferFallback,
 		voiceTranscriptSources: media.voiceTranscriptSources,
 		replyTo,
-		commandAuthorized,
+		commandAuthorized: access.commandAccess.authorized,
 		group: groupInfo,
 		blocked: false,
 		skipped: false,
-		accessDecision: access.decision,
+		accessDecision: access.senderAccess.decision,
 		typing: { keepAlive: typingResult.keepAlive },
 		inputNotifyRefIdx: typingResult.refIdx
 	};
 }
-/**
-* Clear a group's pending history buffer. Exposed so the gateway can
-* call it in its `finally` block after a reply attempt.
-*/
 function clearGroupPendingHistory(params) {
 	if (!params.historyMap || !params.groupOpenid) return;
 	params.historyPort.clearPendingHistory({
@@ -3385,6 +2990,20 @@ function clearGroupPendingHistory(params) {
 	});
 }
 //#endregion
+//#region extensions/qqbot/src/engine/access/resolve-policy.ts
+function hasRealRestriction(list) {
+	if (!list || list.length === 0) return false;
+	return !list.every((entry) => String(entry).trim() === "*");
+}
+function resolveQQBotEffectivePolicies(input) {
+	const allowFromRestricted = hasRealRestriction(input.allowFrom);
+	const groupAllowFromRestricted = hasRealRestriction(input.groupAllowFrom);
+	return {
+		dmPolicy: input.dmPolicy ?? (allowFromRestricted ? "allowlist" : "open"),
+		groupPolicy: input.groupPolicy ?? (groupAllowFromRestricted || allowFromRestricted ? "allowlist" : "open")
+	};
+}
+//#endregion
 //#region extensions/qqbot/src/engine/gateway/interaction-handler.ts
 /**
 * INTERACTION_CREATE event handler.
@@ -5552,8 +5171,13 @@ function stripAmrHeader(buf) {
 }
 /** Convert a SILK or AMR voice file to WAV format. */
 async function convertSilkToWav(inputPath, outputDir) {
-	if (!fs$1.existsSync(inputPath)) return null;
-	const strippedBuf = stripAmrHeader(fs$1.readFileSync(inputPath));
+	let fileBuf;
+	try {
+		fileBuf = readRegularFileSync({ filePath: inputPath }).buffer;
+	} catch {
+		return null;
+	}
+	const strippedBuf = stripAmrHeader(fileBuf);
 	const rawData = new Uint8Array(strippedBuf.buffer, strippedBuf.byteOffset, strippedBuf.byteLength);
 	const silk = await loadSilkWasm();
 	if (!silk || !silk.isSilk(rawData)) return null;
@@ -5642,8 +5266,12 @@ function normalizeFormats(formats) {
 * Attempts conversion via direct QQ-native upload → WASM decoders → null fallback chain.
 */
 async function audioFileToSilkBase64(filePath, directUploadFormats) {
-	if (!fs$1.existsSync(filePath)) return null;
-	const buf = fs$1.readFileSync(filePath);
+	let buf;
+	try {
+		buf = readRegularFileSync({ filePath }).buffer;
+	} catch {
+		return null;
+	}
 	if (buf.length === 0) {
 		debugError(`[audio-convert] file is empty: ${filePath}`);
 		return null;
@@ -5902,7 +5530,7 @@ async function dispatchOutbound(inbound, deps) {
 	};
 	const sendWithRetry = (sendFn) => sendWithTokenRetry(account.appId, account.clientSecret, sendFn, log, account.accountId);
 	const sendErrorMessage = (errorText) => sendErrorToTarget(replyCtx, errorText);
-	const ctxPayload = buildCtxPayload(inbound, runtime);
+	const ctxPayload = buildCtxPayload(inbound, runtime, cfg);
 	let hasResponse = false;
 	let hasBlockResponse = false;
 	let toolDeliverCount = 0;
@@ -6186,8 +5814,14 @@ async function dispatchOutbound(inbound, deps) {
 		}
 	}
 }
-function buildCtxPayload(inbound, runtime) {
+function resolveCommandSource(inbound, runtime, cfg) {
+	const commandBody = inbound.event.content;
+	if (!runtime.channel.commands?.isControlCommandMessage?.(commandBody, cfg)) return;
+	return "text";
+}
+function buildCtxPayload(inbound, runtime, cfg) {
 	const { event } = inbound;
+	const commandSource = resolveCommandSource(inbound, runtime, cfg);
 	return runtime.channel.reply.finalizeInboundContext({
 		Body: inbound.body,
 		BodyForAgent: inbound.agentBody,
@@ -6217,6 +5851,7 @@ function buildCtxPayload(inbound, runtime) {
 		QQVoiceAsrReferTexts: inbound.uniqueVoiceAsrReferTexts,
 		QQVoiceInputStrategy: "prefer_audio_stt_then_asr_fallback",
 		CommandAuthorized: inbound.commandAuthorized,
+		...commandSource ? { CommandSource: commandSource } : {},
 		...inbound.voiceMediaTypes.length > 0 ? {
 			MediaTypes: inbound.voiceMediaTypes,
 			MediaType: inbound.voiceMediaTypes[0]
@@ -6297,22 +5932,6 @@ var TypingKeepAlive = class {
 };
 //#endregion
 //#region extensions/qqbot/src/engine/gateway/gateway.ts
-/**
-* Core gateway entry point — thin shell that wires together:
-*
-* - GatewayConnection: WebSocket lifecycle, heartbeat, reconnect
-* - buildInboundContext: content building, attachments, quote resolution
-* - dispatchOutbound: AI dispatch, deliver callbacks, timeouts
-*
-* The only responsibilities of this file are:
-* 1. Initialize adapters from EngineAdapters
-* 2. Initialize API config + refIdx cache hook
-* 3. Create the message handler (inbound → outbound pipeline)
-* 4. Start GatewayConnection
-*/
-/**
-* Start the Gateway WebSocket connection with automatic reconnect support.
-*/
 async function startGateway$1(ctx) {
 	const { account, log, runtime, adapters } = ctx;
 	setOutboundAudioPort(adapters.outboundAudio);
@@ -6435,6 +6054,7 @@ async function startGateway$1(ctx) {
 		cfg: ctx.cfg,
 		log,
 		runtime,
+		adapters,
 		onReady: ctx.onReady,
 		onResumed: ctx.onResumed,
 		onError: ctx.onError,
@@ -6572,24 +6192,14 @@ function readQQBotVersionFromManifest(manifestPath) {
 }
 //#endregion
 //#region extensions/qqbot/src/bridge/sdk-adapter.ts
-/**
-* SDK adapter — binds engine port interfaces to the framework's shared
-* SDK implementations.
-*
-* This file lives in bridge/ (not engine/) because it imports from
-* `openclaw/plugin-sdk/*`. The engine layer stays zero-SDK-dependency;
-* only the bridge layer couples to the framework.
-*/
+const qqbotIngressIdentity = defineStableChannelIngressIdentity({
+	key: "sender-id",
+	normalize: normalizeQQBotSenderId,
+	isWildcardEntry: (entry) => normalizeQQBotSenderId(entry) === "*"
+});
 function asSdkMap(map) {
 	return map;
 }
-/**
-* History adapter backed by SDK `reply-history`.
-*
-* Delegates record/build/clear to the SDK's shared implementation so
-* the engine benefits from SDK improvements (e.g. future visibility
-* filtering) without code duplication.
-*/
 function createSdkHistoryAdapter() {
 	return {
 		recordPendingHistoryEntry(params) {
@@ -6619,38 +6229,69 @@ function createSdkHistoryAdapter() {
 		}
 	};
 }
-/**
-* MentionGate adapter backed by SDK `channel-mention-gating`.
-*
-* Maps the engine's mention facts/policy to the SDK's
-* `resolveInboundMentionDecision` call, normalizing the implicit
-* mention boolean into the SDK's typed `ImplicitMentionKind[]`.
-*/
 function createSdkMentionGateAdapter() {
 	return { resolveInboundMentionDecision(params) {
-		const result = resolveInboundMentionDecision({
-			facts: {
-				canDetectMention: params.facts.canDetectMention,
-				wasMentioned: params.facts.wasMentioned,
-				hasAnyMention: params.facts.hasAnyMention,
-				implicitMentionKinds: params.facts.implicitMentionKinds ?? implicitMentionKindWhen("reply_to_bot", false)
-			},
-			policy: {
-				isGroup: params.policy.isGroup,
-				requireMention: params.policy.requireMention,
-				allowTextCommands: params.policy.allowTextCommands,
-				hasControlCommand: params.policy.hasControlCommand,
-				commandAuthorized: params.policy.commandAuthorized
-			}
-		});
-		return {
-			effectiveWasMentioned: result.effectiveWasMentioned,
-			shouldSkip: result.shouldSkip,
-			shouldBypassMention: result.shouldBypassMention,
-			implicitMention: result.implicitMention
-		};
+		return resolveInboundMentionDecision(params);
 	} };
 }
+function createSdkAccessAdapter() {
+	return {
+		async resolveInboundAccess(input) {
+			const { dmPolicy, groupPolicy } = resolveQQBotEffectivePolicies(input);
+			const rawGroupAllowFrom = input.groupAllowFrom && input.groupAllowFrom.length > 0 ? input.groupAllowFrom : input.allowFrom ?? [];
+			const normalizedAllowFrom = normalizeQQBotAllowFrom(input.allowFrom);
+			const dmAllowFromForIngress = dmPolicy === "open" && normalizedAllowFrom.length === 0 ? ["*"] : input.allowFrom ?? [];
+			const commandOwnerAllowFrom = input.isGroup ? [] : input.allowFrom && input.allowFrom.length > 0 ? input.allowFrom : ["*"];
+			return await createChannelIngressResolver({
+				channelId: "qqbot",
+				accountId: input.accountId,
+				identity: qqbotIngressIdentity,
+				cfg: input.cfg
+			}).message({
+				subject: { stableId: input.senderId },
+				conversation: {
+					kind: input.isGroup ? "group" : "direct",
+					id: input.conversationId
+				},
+				event: { mayPair: false },
+				dmPolicy,
+				groupPolicy,
+				policy: { groupAllowFromFallbackToAllowFrom: false },
+				allowFrom: dmAllowFromForIngress,
+				groupAllowFrom: rawGroupAllowFrom,
+				command: { commandOwnerAllowFrom }
+			});
+		},
+		async resolveSlashCommandAuthorization(input) {
+			return await resolveQQBotSlashCommandAuthorized(input);
+		}
+	};
+}
+async function resolveQQBotSlashCommandAuthorized(params) {
+	const explicitAllowFrom = normalizeQQBotAllowFrom(params.commandsAllowFrom ?? (params.isGroup && params.groupAllowFrom && params.groupAllowFrom.length > 0 ? params.groupAllowFrom : params.allowFrom)).filter((entry) => entry !== "*");
+	if (explicitAllowFrom.length === 0) return false;
+	return (await createChannelIngressResolver({
+		channelId: "qqbot",
+		accountId: params.accountId,
+		identity: qqbotIngressIdentity,
+		cfg: params.cfg
+	}).message({
+		subject: { stableId: params.senderId },
+		conversation: {
+			kind: params.isGroup ? "group" : "direct",
+			id: params.conversationId
+		},
+		event: {
+			kind: "slash-command",
+			authMode: "none",
+			mayPair: false
+		},
+		dmPolicy: "allowlist",
+		groupPolicy: "open",
+		allowFrom: explicitAllowFrom,
+		command: { modeWhenAccessGroupsOff: "configured" }
+	})).commandAccess.authorized;
+}
 //#endregion
 //#region extensions/qqbot/src/bridge/gateway.ts
 /**
@@ -6676,6 +6317,7 @@ function createEngineAdapters(_runtime) {
 	return {
 		history: createSdkHistoryAdapter(),
 		mentionGate: createSdkMentionGateAdapter(),
+		access: createSdkAccessAdapter(),
 		audioConvert: {
 			convertSilkToWav,
 			isVoiceAttachment,