@openclaw/qqbot 2026.6.11 → 2026.7.1-beta.1

package/dist/{gateway-CCkrdgaK.js → gateway-BgfQAYxB.js}

@@ -1,23 +1,23 @@
-import { C as getNextMsgSeq, D as downloadFile, F as StreamInputMode, I as StreamInputState, M as getMaxUploadSize, P as StreamContentType, T as openLocalFile, a as createRawInputNotifyFn, b as stopBackgroundTokenRefresh, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia, i as clearTokenCache, j as getImageMimeType, k as formatFileSize, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, x as withTokenRetry, y as startBackgroundTokenRefresh } from "./sender-CRZ2af7P.js";
+import { C as getNextMsgSeq, D as downloadFile, F as StreamInputMode, I as StreamInputState, M as getMaxUploadSize, P as StreamContentType, T as openLocalFile, a as createRawInputNotifyFn, b as stopBackgroundTokenRefresh, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia, i as clearTokenCache, j as getImageMimeType, k as formatFileSize, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, x as withTokenRetry, y as startBackgroundTokenRefresh } from "./sender-BHWpE_yH.js";
 import { c as getPlatformAdapter, i as normalizeOptionalString$1, n as normalizeLowercaseStringOrEmpty$1, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { c as setBridgeLogger, o as ensurePlatformAdapter } from "./config-schema-gMW9zKvQ.js";
-import { a as toGatewayAccount, i as openQQBotSyncKeyedStore, m as parseApprovalButtonData, n as createQQBotMarkdownChunker, o as authorizeQQBotApprovalAction, r as buildQQBotStateKey } from "./channel-DvWrqcZB.js";
+import { a as authorizeQQBotApprovalAction, i as toGatewayAccount, n as createQQBotMarkdownChunker, p as parseApprovalButtonData, r as openQQBotSyncKeyedStore } from "./channel-Bh0MrYvU.js";
 import { d as resolveAccountBase } from "./config-C1qZbh0K.js";
 import { a as formatErrorMessage, i as formatDuration, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
-import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-D1hn91-s.js";
-import { a as getHomeDir, c as getQQBotMediaDir, d as isLocalPath, f as isWindows, i as checkSilkWasmAvailable, o as getQQBotDataDir, p as normalizePath, s as getQQBotDataPath, u as getTempDir } from "./target-parser-BdCUmxK7.js";
-import { a as resolveMentionPatterns, c as getPluginVersion, d as PRIVATE_CHAT_ONLY_TEXT, f as classifyCoreCommandForGroup, i as resolveGroupSettings, l as initCommands, n as resolveGroupCommandLevelFromAccountConfig, r as resolveGroupConfig, s as getFrameworkVersion, u as matchSlashCommand } from "./group-CvVXke_k.js";
+import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-BL0xZzWe.js";
+import { t as buildQQBotStateKey } from "./state-keys-CQKlAFyo.js";
+import { a as resolveMentionPatterns, c as getPluginVersion, d as PRIVATE_CHAT_ONLY_TEXT, f as classifyCoreCommandForGroup, i as resolveGroupSettings, l as initCommands, n as resolveGroupCommandLevelFromAccountConfig, r as resolveGroupConfig, s as getFrameworkVersion, u as matchSlashCommand } from "./group-DQQsZ6Y0.js";
+import { A as getHomeDir, E as DEFAULT_MEDIA_SEND_ERROR, F as isLocalPath, I as isWindows, L as normalizePath, M as getQQBotMediaDir, O as setOutboundAudioPort, P as getTempDir, _ as sendVideoMsg, b as resolveUserFacingMediaError, c as isCronReminderPayload, d as normalizeMediaTags, g as sendPhoto, h as sendDocument, j as getQQBotDataDir, k as checkSilkWasmAvailable, l as isMediaPayload, o as decodeMediaPath, r as sendMedia$1, s as encodePayloadForCron, u as parseQQBotPayload, v as sendVoice, y as resolveTrustedOutboundMediaPath } from "./outbound-Dfa2uOEp.js";
 import { n as runWithRequestContext } from "./request-context-Bm7PTBD1.js";
-import { E as DEFAULT_MEDIA_SEND_ERROR, O as setOutboundAudioPort, _ as sendVideoMsg, b as resolveUserFacingMediaError, c as isCronReminderPayload, d as normalizeMediaTags, g as sendPhoto, h as sendDocument, l as isMediaPayload, o as decodeMediaPath, r as sendMedia$1, s as encodePayloadForCron, u as parseQQBotPayload, v as sendVoice, y as resolveTrustedOutboundMediaPath } from "./outbound-BQcPCo-z.js";
 import { uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isImplicitSameChatApprovalAuthorization } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as fs$1 from "node:fs";
 import fs from "node:fs";
 import * as os$1 from "node:os";
-import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import crypto from "node:crypto";
-import { privateFileStoreSync, readRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
+import { readRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
 import * as path$1 from "node:path";
 import path from "node:path";
 import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
@@ -179,19 +179,10 @@ function formatRefEntryForAgent(entry) {
 //#region extensions/qqbot/src/engine/ref/store.ts
 /**
 * Ref-index store — SQLite KV-backed store for message reference index.
-*
-* Legacy JSONL entries are imported once, then deleted after SQLite has the
-* canonical ref-index rows.
 */
 const MAX_ENTRIES = 5e4;
 const TTL_MS = 10080 * 60 * 1e3;
 const REF_INDEX_NAMESPACE = "ref-index";
-const REF_INDEX_MIGRATIONS_NAMESPACE = "ref-index-migrations";
-const LEGACY_REF_INDEX_MIGRATION_KEY = "ref-index-jsonl-v1";
-let legacyImported$1 = false;
-function getRefIndexFile() {
-	return path.join(getQQBotDataPath("data"), "ref-index.jsonl");
-}
 function createRefIndexStore() {
 	return openQQBotSyncKeyedStore({
 		namespace: REF_INDEX_NAMESPACE,
@@ -199,12 +190,6 @@ function createRefIndexStore() {
 		defaultTtlMs: TTL_MS
 	});
 }
-function createRefIndexMigrationStore() {
-	return openQQBotSyncKeyedStore({
-		namespace: REF_INDEX_MIGRATIONS_NAMESPACE,
-		maxEntries: 100
-	});
-}
 function refIndexStateKey(refIdx) {
 	return buildQQBotStateKey("ref-index", refIdx);
 }
@@ -240,51 +225,9 @@ function toRefIndexEntry(entry) {
 		...entry.attachments ? { attachments: entry.attachments.map(toStoredAttachment) } : {}
 	};
 }
-function ensureLegacyRefIndexImported() {
-	if (legacyImported$1) return;
-	const migrationStore = createRefIndexMigrationStore();
-	if (migrationStore.lookup(LEGACY_REF_INDEX_MIGRATION_KEY)) {
-		legacyImported$1 = true;
-		return;
-	}
-	try {
-		const refIndexFile = getRefIndexFile();
-		if (!fs.existsSync(refIndexFile)) {
-			migrationStore.register(LEGACY_REF_INDEX_MIGRATION_KEY, { importedAt: (/* @__PURE__ */ new Date()).toISOString() });
-			legacyImported$1 = true;
-			return;
-		}
-		const lines = fs.readFileSync(refIndexFile, "utf-8").split("\n");
-		const now = Date.now();
-		let expired = 0;
-		let imported = 0;
-		const store = createRefIndexStore();
-		for (const line of lines) {
-			const trimmed = line.trim();
-			if (!trimmed) continue;
-			try {
-				const entry = JSON.parse(trimmed);
-				if (!entry.k || !entry.v || !entry.t) continue;
-				if (now - entry.t > TTL_MS) {
-					expired++;
-					continue;
-				}
-				store.register(refIndexStateKey(entry.k), toStoredRefIndexEntry(entry.v, entry.t), { ttlMs: Math.max(1, TTL_MS - (now - entry.t)) });
-				imported++;
-			} catch {}
-		}
-		migrationStore.register(LEGACY_REF_INDEX_MIGRATION_KEY, { importedAt: (/* @__PURE__ */ new Date()).toISOString() });
-		legacyImported$1 = true;
-		fs.rmSync(refIndexFile, { force: true });
-		debugLog(`[ref-index-store] Migrated ${imported} entries to SQLite (${expired} expired)`);
-	} catch (err) {
-		debugError(`[ref-index-store] Failed to import legacy JSONL: ${formatErrorMessage(err)}`);
-	}
-}
 /** Persist a refIdx mapping for one message. */
 function setRefIndex(refIdx, entry) {
 	try {
-		ensureLegacyRefIndexImported();
 		const now = Date.now();
 		createRefIndexStore().register(refIndexStateKey(refIdx), toStoredRefIndexEntry(entry, now), { ttlMs: TTL_MS });
 	} catch (err) {
@@ -294,7 +237,6 @@ function setRefIndex(refIdx, entry) {
 /** Look up one quoted message by refIdx. */
 function getRefIndex(refIdx) {
 	try {
-		ensureLegacyRefIndexImported();
 		const store = createRefIndexStore();
 		const key = refIndexStateKey(refIdx);
 		const entry = store.lookup(key);
@@ -567,34 +509,19 @@ async function trySlashCommand(msg, ctx) {
 //#region extensions/qqbot/src/engine/session/known-users.ts
 /**
 * Known user tracking — SQLite KV-backed store.
-*
-* Legacy `known-users.json` data is imported once, then deleted after SQLite
-* has the canonical copy.
 */
-function getKnownUsersFile() {
-	return path.join(getQQBotDataPath("data"), "known-users.json");
-}
 function makeUserKey(user) {
 	const base = `${user.accountId}:${user.type}:${user.openid}`;
 	return user.type === "group" && user.groupOpenid ? `${base}:${user.groupOpenid}` : base;
 }
 const KNOWN_USERS_NAMESPACE = "known-users";
-const KNOWN_USERS_MIGRATIONS_NAMESPACE = "known-users-migrations";
-const LEGACY_KNOWN_USERS_MIGRATION_KEY = "known-users-json-v1";
 const MAX_KNOWN_USERS = 1e5;
-let legacyImported = false;
 function createKnownUsersStore() {
 	return openQQBotSyncKeyedStore({
 		namespace: KNOWN_USERS_NAMESPACE,
 		maxEntries: MAX_KNOWN_USERS
 	});
 }
-function createKnownUsersMigrationStore() {
-	return openQQBotSyncKeyedStore({
-		namespace: KNOWN_USERS_MIGRATIONS_NAMESPACE,
-		maxEntries: 100
-	});
-}
 function knownUserStateKey(key) {
 	return crypto.createHash("sha256").update(key).digest("hex");
 }
@@ -610,32 +537,9 @@ function toStoredKnownUser(user) {
 		interactionCount: user.interactionCount
 	};
 }
-function ensureLegacyKnownUsersImported() {
-	if (legacyImported) return;
-	const migrationStore = createKnownUsersMigrationStore();
-	if (migrationStore.lookup(LEGACY_KNOWN_USERS_MIGRATION_KEY)) {
-		legacyImported = true;
-		return;
-	}
-	try {
-		const knownUsersFile = getKnownUsersFile();
-		const users = privateFileStoreSync(path.dirname(knownUsersFile)).readJsonIfExists(path.basename(knownUsersFile));
-		if (Array.isArray(users)) {
-			const store = createKnownUsersStore();
-			for (const user of users) store.registerIfAbsent(knownUserStateKey(makeUserKey(user)), toStoredKnownUser(user));
-			debugLog(`[known-users] Migrated ${users.length} users to SQLite`);
-			fs.rmSync(knownUsersFile, { force: true });
-		}
-		migrationStore.register(LEGACY_KNOWN_USERS_MIGRATION_KEY, { importedAt: (/* @__PURE__ */ new Date()).toISOString() });
-		legacyImported = true;
-	} catch (err) {
-		debugError(`[known-users] Failed to import legacy users: ${formatErrorMessage(err)}`);
-	}
-}
 /** Record a known user whenever a message is received. */
 function recordKnownUser(user) {
 	try {
-		ensureLegacyKnownUsersImported();
 		const store = createKnownUsersStore();
 		const stateKey = knownUserStateKey(makeUserKey(user));
 		const now = Date.now();
@@ -669,34 +573,12 @@ function recordKnownUser(user) {
 //#region extensions/qqbot/src/engine/session/session-store.ts
 /**
 * Gateway session persistence — SQLite KV-backed store.
-*
-* Legacy JSON session files are imported on first account access, then
-* removed after SQLite has the canonical short-lived session entry.
 */
 const SESSION_EXPIRE_TIME = 300 * 1e3;
 const SAVE_THROTTLE_MS = 1e3;
 const SESSION_NAMESPACE = "gateway-sessions";
 const MAX_SESSIONS = 1e3;
 const throttleState = /* @__PURE__ */ new Map();
-function getSessionDir() {
-	return getQQBotDataPath("sessions");
-}
-function encodeAccountIdForFileName(accountId) {
-	return Buffer.from(accountId, "utf8").toString("base64url");
-}
-function getLegacySessionPath(accountId) {
-	const safeId = accountId.replace(/[^a-zA-Z0-9_-]/g, "_");
-	return path.join(getSessionDir(), `session-${safeId}.json`);
-}
-function getSessionPath(accountId) {
-	const encodedId = encodeAccountIdForFileName(accountId);
-	return path.join(getSessionDir(), `session-${encodedId}.json`);
-}
-function getCandidateSessionPaths(accountId) {
-	const primaryPath = getSessionPath(accountId);
-	const legacyPath = getLegacySessionPath(accountId);
-	return primaryPath === legacyPath ? [primaryPath] : [primaryPath, legacyPath];
-}
 function createSessionStore() {
 	return openQQBotSyncKeyedStore({
 		namespace: SESSION_NAMESPACE,
@@ -707,9 +589,6 @@ function createSessionStore() {
 function sessionKey(accountId) {
 	return buildQQBotStateKey("gateway-session", accountId);
 }
-function remainingSessionTtlMs(state, now = Date.now()) {
-	return Math.max(1, SESSION_EXPIRE_TIME - (now - state.savedAt));
-}
 function toStoredSessionState(state) {
 	return {
 		sessionId: state.sessionId,
@@ -721,35 +600,11 @@ function toStoredSessionState(state) {
 		...state.appId ? { appId: state.appId } : {}
 	};
 }
-function removeFileQuietly(filePath) {
-	try {
-		fs.unlinkSync(filePath);
-	} catch {}
-}
-function loadLegacySession(accountId) {
-	for (const candidatePath of getCandidateSessionPaths(accountId)) {
-		const state = privateFileStoreSync(path.dirname(candidatePath)).readJsonIfExists(path.basename(candidatePath));
-		if (state) return {
-			state,
-			filePath: candidatePath
-		};
-	}
-	return null;
-}
-function migrateLegacySession(accountId) {
-	const legacy = loadLegacySession(accountId);
-	if (!legacy) return null;
-	const now = Date.now();
-	if (now - legacy.state.savedAt <= SESSION_EXPIRE_TIME) createSessionStore().register(sessionKey(accountId), toStoredSessionState(legacy.state), { ttlMs: remainingSessionTtlMs(legacy.state, now) });
-	for (const filePath of getCandidateSessionPaths(accountId)) removeFileQuietly(filePath);
-	return legacy.state;
-}
 /** Load a saved session, rejecting expired or mismatched appId entries. */
 function loadSession(accountId, expectedAppId) {
 	try {
 		const store = createSessionStore();
-		let state = store.lookup(sessionKey(accountId));
-		if (!state) state = migrateLegacySession(accountId) ?? void 0;
+		const state = store.lookup(sessionKey(accountId));
 		if (!state) return null;
 		const now = Date.now();
 		if (now - state.savedAt > SESSION_EXPIRE_TIME) {
@@ -813,16 +668,12 @@ function saveSession(state) {
 	}
 }
 function doSaveSession(state) {
-	const filePath = getSessionPath(state.accountId);
-	const legacyPath = getLegacySessionPath(state.accountId);
 	try {
 		const stateToSave = {
 			...state,
 			savedAt: Date.now()
 		};
 		createSessionStore().register(sessionKey(state.accountId), toStoredSessionState(stateToSave), { ttlMs: SESSION_EXPIRE_TIME });
-		removeFileQuietly(filePath);
-		removeFileQuietly(legacyPath);
 		debugLog(`[session-store] Saved session for ${state.accountId}: sessionId=${state.sessionId}, lastSeq=${state.lastSeq}`);
 	} catch (err) {
 		debugError(`[session-store] Failed to save session for ${state.accountId}: ${formatErrorMessage(err)}`);
@@ -836,9 +687,7 @@ function clearSession(accountId) {
 		throttleState.delete(accountId);
 	}
 	try {
-		const cleared = createSessionStore().delete(sessionKey(accountId));
-		for (const filePath of getCandidateSessionPaths(accountId)) removeFileQuietly(filePath);
-		if (cleared) debugLog(`[session-store] Cleared session for ${accountId}`);
+		if (createSessionStore().delete(sessionKey(accountId))) debugLog(`[session-store] Cleared session for ${accountId}`);
 	} catch (err) {
 		debugError(`[session-store] Failed to clear session for ${accountId}: ${formatErrorMessage(err)}`);
 	}
@@ -1869,7 +1718,7 @@ async function transcribeAudio(audioPath, cfg) {
 			const detail = await readResponseTextLimited(resp, STT_ERROR_BODY_LIMIT_BYTES).catch(() => "");
 			throw new Error(`STT failed (HTTP ${resp.status}): ${detail.slice(0, 300)}`);
 		}
-		return normalizeOptionalString$1((await resp.json()).text) ?? null;
+		return normalizeOptionalString$1((await readProviderJsonResponse(resp, "qqbot.stt")).text) ?? null;
 	} finally {
 		await release();
 	}

package/dist/{group-CvVXke_k.js → group-DQQsZ6Y0.js}

@@ -1,12 +1,12 @@
 import { t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { d as resolveAccountBase } from "./config-C1qZbh0K.js";
 import { n as debugLog } from "./log-SDfMMBWe.js";
-import { a as getHomeDir, f as isWindows, l as getQQBotMediaPath, o as getQQBotDataDir } from "./target-parser-BdCUmxK7.js";
+import { A as getHomeDir, I as isWindows, N as getQQBotMediaPath, j as getQQBotDataDir } from "./outbound-Dfa2uOEp.js";
 import { asBoolean, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import fs from "node:fs";
 import path from "node:path";
-import { loadJsonFile } from "openclaw/plugin-sdk/json-store";
 import { clearRuntimeConfigSnapshot } from "openclaw/plugin-sdk/runtime-config-snapshot";
+import { loadJsonFile } from "openclaw/plugin-sdk/json-store";
 //#region extensions/qqbot/src/engine/commands/builtin/state.ts
 let resolveVersionGetter = () => "unknown";
 let approveRuntimeGetter = null;

package/dist/{handler-runtime--OTMkFWa.js → handler-runtime-BQ72YPsH.js}

@@ -1,6 +1,6 @@
-import { c as getMessageApi, t as accountToCreds } from "./sender-CRZ2af7P.js";
+import { c as getMessageApi, t as accountToCreds } from "./sender-BHWpE_yH.js";
 import { o as ensurePlatformAdapter, s as getBridgeLogger } from "./config-schema-gMW9zKvQ.js";
-import { c as matchesQQBotApprovalAccount, d as buildApprovalKeyboard, f as buildExecApprovalText, h as resolveApprovalTarget, l as resolveQQBotExecApprovalConfig, p as buildPluginApprovalText, s as isQQBotExecApprovalClientEnabled, u as shouldHandleQQBotExecApprovalRequest } from "./channel-DvWrqcZB.js";
+import { c as resolveQQBotExecApprovalConfig, d as buildExecApprovalText, f as buildPluginApprovalText, l as shouldHandleQQBotExecApprovalRequest, m as resolveApprovalTarget, o as isQQBotExecApprovalClientEnabled, s as matchesQQBotApprovalAccount, u as buildApprovalKeyboard } from "./channel-Bh0MrYvU.js";
 import { a as resolveQQBotAccount } from "./config-C1qZbh0K.js";
 import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";

package/dist/{outbound-BQcPCo-z.js → outbound-Dfa2uOEp.js}

@@ -1,11 +1,223 @@
-import { A as getFileTypeName, D as downloadFile, E as checkFileSize, L as __exportAll, M as getMaxUploadSize, N as readFileAsync, O as fileExistsAsync, S as UploadDailyLimitExceededError, g as sendText$1, h as sendMedia$1, j as getImageMimeType, k as formatFileSize, t as accountToCreds, u as initApiConfig, w as UPLOAD_PREPARE_FALLBACK_CODE } from "./sender-CRZ2af7P.js";
-import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
+import { A as getFileTypeName, D as downloadFile, E as checkFileSize, L as __exportAll, M as getMaxUploadSize, N as readFileAsync, O as fileExistsAsync, S as UploadDailyLimitExceededError, g as sendText$1, h as sendMedia$1, j as getImageMimeType, k as formatFileSize, t as accountToCreds, u as initApiConfig, w as UPLOAD_PREPARE_FALLBACK_CODE } from "./sender-BHWpE_yH.js";
+import { c as getPlatformAdapter, i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
 import { a as formatErrorMessage, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
-import { c as getQQBotMediaDir, d as isLocalPath, m as resolveQQBotPayloadLocalFilePath, o as getQQBotDataDir, p as normalizePath$1, r as parseTarget$1 } from "./target-parser-BdCUmxK7.js";
+import { r as parseTarget$1 } from "./target-parser-DagYRQkP.js";
+import * as fs$1 from "node:fs";
+import * as os$1 from "node:os";
 import { pathExistsSync, resolveLocalPathFromRootsSync } from "openclaw/plugin-sdk/security-runtime";
+import * as path$1 from "node:path";
 import path from "node:path";
 import { getFileExtension } from "openclaw/plugin-sdk/media-mime";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/sandbox";
+//#region extensions/qqbot/src/engine/utils/platform.ts
+/**
+* Cross-platform path and detection helpers for core/ modules.
+*
+* Provides home/data/media directory helpers, platform detection,
+* silk-wasm availability checks — all without importing `openclaw/plugin-sdk`.
+* The temp-directory fallback is delegated to the PlatformAdapter.
+*/
+/**
+* Resolve the current user's OS home directory safely across platforms.
+*
+* Priority:
+* 1. `os.homedir()`
+* 2. `$HOME` or `%USERPROFILE%`
+* 3. PlatformAdapter.getTempDir() as a last resort
+*
+* This is the *operating-system* home and intentionally ignores
+* `OPENCLAW_HOME`. QQ Bot still checks this tree for legacy state imports and
+* media-path remaps from older releases.
+*/
+function getHomeDir() {
+	try {
+		const home = os$1.homedir();
+		if (home && fs$1.existsSync(home)) return home;
+	} catch {}
+	const envHome = process.env.HOME || process.env.USERPROFILE;
+	if (envHome && fs$1.existsSync(envHome)) return envHome;
+	return getPlatformAdapter().getTempDir();
+}
+/**
+* Resolve the effective OpenClaw home directory.
+*
+* Mirrors the contract from core (`src/infra/home-dir.ts::resolveEffectiveHomeDir`)
+* so QQ Bot media roots live under the same tree the rest of OpenClaw treats as
+* `~`. The extension cannot import the core helper directly (it is a separate
+* package with `openclaw` as a peer dependency), so this re-implements the
+* minimal contract:
+*
+* 1. `OPENCLAW_HOME` when set (with `~` / `~/...` expanded against the OS home).
+* 2. Otherwise fall back to {@link getHomeDir} so existing single-home
+*    deployments are unaffected.
+*
+* Empty / `"undefined"` / `"null"` strings are treated as unset to match how
+* core normalizes the variable.
+*/
+function resolveOpenClawHome() {
+	const raw = process.env.OPENCLAW_HOME?.trim();
+	if (!raw || raw === "undefined" || raw === "null") return getHomeDir();
+	if (raw === "~" || raw.startsWith("~/") || raw.startsWith("~\\")) {
+		const osHome = getHomeDir();
+		if (raw === "~") return osHome;
+		return path$1.join(osHome, raw.slice(2));
+	}
+	return raw;
+}
+/**
+* Return a legacy path under `~/.openclaw/qqbot` without creating it.
+*
+* Current QQ Bot runtime state lives in plugin SQLite KV. This path remains for
+* legacy imports and media-path remaps from older releases.
+*/
+function getQQBotDataPath(...subPaths) {
+	return path$1.join(getHomeDir(), ".openclaw", "qqbot", ...subPaths);
+}
+/** Return a path under `~/.openclaw/qqbot`, creating it on demand. */
+function getQQBotDataDir(...subPaths) {
+	const dir = getQQBotDataPath(...subPaths);
+	if (!fs$1.existsSync(dir)) fs$1.mkdirSync(dir, { recursive: true });
+	return dir;
+}
+/**
+* Return a path under `<openclaw-home>/.openclaw/media/qqbot` without creating it.
+*
+* Unlike `getQQBotDataPath`, this lives under OpenClaw's core media allowlist
+* so downloaded images and audio can be accessed by framework media tooling.
+* The base honors `OPENCLAW_HOME` (when set) so files written by agents into
+* the OpenClaw-managed media tree are reachable by this plugin even when
+* `HOME` and `OPENCLAW_HOME` differ (Docker, multi-user hosts). Fixes #83562.
+*/
+function getQQBotMediaPath(...subPaths) {
+	return path$1.join(resolveOpenClawHome(), ".openclaw", "media", "qqbot", ...subPaths);
+}
+/** Return a path under `<openclaw-home>/.openclaw/media/qqbot`, creating it on demand. */
+function getQQBotMediaDir(...subPaths) {
+	const dir = getQQBotMediaPath(...subPaths);
+	if (!fs$1.existsSync(dir)) fs$1.mkdirSync(dir, { recursive: true });
+	return dir;
+}
+/**
+* Return `<openclaw-home>/.openclaw/media`, OpenClaw's shared media root.
+*
+* This mirrors the directory that core's `buildMediaLocalRoots` exposes as an
+* allowlisted location (see `openclaw/src/media/local-roots.ts`). Using it as a
+* QQ Bot payload root lets the plugin trust framework-produced files that live
+* in sibling subdirectories such as `outbound/` (written by
+* `saveMediaBuffer(..., "outbound", ...)`) or `inbound/`, while still keeping
+* the check anchored to a single, well-known directory. Like
+* {@link getQQBotMediaPath}, the base honors `OPENCLAW_HOME`.
+*/
+function getOpenClawMediaDir() {
+	return path$1.join(resolveOpenClawHome(), ".openclaw", "media");
+}
+function isWindows() {
+	return process.platform === "win32";
+}
+/** Return the preferred temporary directory. */
+function getTempDir() {
+	return getPlatformAdapter().getTempDir();
+}
+let silkWasmAvailable = null;
+/** Check whether silk-wasm can run in the current environment. */
+async function checkSilkWasmAvailable() {
+	if (silkWasmAvailable !== null) return silkWasmAvailable;
+	try {
+		const { isSilk } = await import("silk-wasm");
+		isSilk(new Uint8Array(0));
+		silkWasmAvailable = true;
+		debugLog("[platform] silk-wasm: available");
+	} catch (err) {
+		silkWasmAvailable = false;
+		debugWarn(`[platform] silk-wasm: NOT available (${formatErrorMessage(err)})`);
+	}
+	return silkWasmAvailable;
+}
+/** Expand `~` to the current user's home directory. */
+function expandTilde$1(p) {
+	if (!p) return p;
+	if (p === "~") return getHomeDir();
+	if (p.startsWith("~/") || p.startsWith("~\\")) return path$1.join(getHomeDir(), p.slice(2));
+	return p;
+}
+/** Normalize a user-provided path by trimming, stripping `file://`, and expanding `~`. */
+function normalizePath$1(p) {
+	let result = p.trim();
+	if (result.startsWith("file://")) {
+		result = result.slice(7);
+		try {
+			result = decodeURIComponent(result);
+		} catch {}
+	}
+	return expandTilde$1(result);
+}
+/** Return true when the string looks like a local filesystem path rather than a URL. */
+function isLocalPath(p) {
+	if (!p) return false;
+	if (p.startsWith("file://")) return true;
+	if (p === "~" || p.startsWith("~/") || p.startsWith("~\\")) return true;
+	if (p.startsWith("/")) return true;
+	if (/^[a-zA-Z]:[\\/]/.test(p)) return true;
+	if (p.startsWith("\\\\")) return true;
+	if (p.startsWith("./") || p.startsWith("../")) return true;
+	if (p.startsWith(".\\") || p.startsWith("..\\")) return true;
+	return false;
+}
+function isPathWithinRoot(candidate, root) {
+	const relative = path$1.relative(root, candidate);
+	return relative === "" || !relative.startsWith("..") && !path$1.isAbsolute(relative);
+}
+/** Remap legacy or hallucinated QQ Bot local media paths to real files when possible. */
+function resolveQQBotLocalMediaPath(p) {
+	const normalized = normalizePath$1(p);
+	if (!isLocalPath(normalized) || fs$1.existsSync(normalized)) return normalized;
+	const osHomeDir = getHomeDir();
+	const openclawHomeDir = resolveOpenClawHome();
+	const mediaRoot = getQQBotMediaPath();
+	const dataRoot = getQQBotDataPath();
+	const candidateRoots = [
+		...Array.from(new Set([path$1.join(osHomeDir, ".openclaw", "workspace", "qqbot"), path$1.join(openclawHomeDir, ".openclaw", "workspace", "qqbot")])).map((from) => ({
+			from,
+			to: mediaRoot
+		})),
+		{
+			from: dataRoot,
+			to: mediaRoot
+		},
+		{
+			from: mediaRoot,
+			to: dataRoot
+		}
+	];
+	for (const { from, to } of candidateRoots) {
+		if (!isPathWithinRoot(normalized, from)) continue;
+		const relative = path$1.relative(from, normalized);
+		const candidate = path$1.join(to, relative);
+		if (fs$1.existsSync(candidate)) {
+			debugWarn(`[platform] Remapped missing QQBot media path ${normalized} -> ${candidate}`);
+			return candidate;
+		}
+	}
+	return normalized;
+}
+/**
+* Resolve a structured-payload local file path and enforce that it stays within
+* QQ Bot-owned storage roots.
+*/
+function resolveQQBotPayloadLocalFilePath(p) {
+	const candidate = resolveQQBotLocalMediaPath(p);
+	if (!candidate.trim()) return null;
+	const resolvedCandidate = path$1.resolve(candidate);
+	if (!fs$1.existsSync(resolvedCandidate)) return null;
+	const canonicalCandidate = fs$1.realpathSync(resolvedCandidate);
+	const allowedRoots = [getOpenClawMediaDir(), getQQBotMediaPath()];
+	for (const root of allowedRoots) {
+		const resolvedRoot = path$1.resolve(root);
+		if (isPathWithinRoot(canonicalCandidate, fs$1.existsSync(resolvedRoot) ? fs$1.realpathSync(resolvedRoot) : resolvedRoot)) return canonicalCandidate;
+	}
+	return null;
+}
+//#endregion
 //#region extensions/qqbot/src/engine/messaging/outbound-audio-port.ts
 let outboundAudioPort = null;
 /**
@@ -1410,4 +1622,4 @@ async function sendCronMessage(account, to, message) {
 	});
 }
 //#endregion
-export { getMessageReplyConfig as C, OUTBOUND_ERROR_CODES as D, DEFAULT_MEDIA_SEND_ERROR as E, setOutboundAudioPort as O, checkMessageReplyLimit as S, recordMessageReply as T, sendVideoMsg as _, sendText as a, resolveUserFacingMediaError as b, isCronReminderPayload as c, normalizeMediaTags as d, buildMediaTarget as f, sendPhoto as g, sendDocument as h, sendProactiveMessage as i, isMediaPayload as l, resolveOutboundMediaPath as m, sendCronMessage as n, decodeMediaPath as o, parseTarget as p, sendMedia as r, encodePayloadForCron as s, outbound_exports as t, parseQQBotPayload as u, sendVoice as v, getMessageReplyStats as w, MESSAGE_REPLY_LIMIT as x, resolveTrustedOutboundMediaPath as y };
+export { getHomeDir as A, getMessageReplyConfig as C, OUTBOUND_ERROR_CODES as D, DEFAULT_MEDIA_SEND_ERROR as E, isLocalPath as F, isWindows as I, normalizePath$1 as L, getQQBotMediaDir as M, getQQBotMediaPath as N, setOutboundAudioPort as O, getTempDir as P, checkMessageReplyLimit as S, recordMessageReply as T, sendVideoMsg as _, sendText as a, resolveUserFacingMediaError as b, isCronReminderPayload as c, normalizeMediaTags as d, buildMediaTarget as f, sendPhoto as g, sendDocument as h, sendProactiveMessage as i, getQQBotDataDir as j, checkSilkWasmAvailable as k, isMediaPayload as l, resolveOutboundMediaPath as m, sendCronMessage as n, decodeMediaPath as o, parseTarget as p, sendMedia as r, encodePayloadForCron as s, outbound_exports as t, parseQQBotPayload as u, sendVoice as v, getMessageReplyStats as w, MESSAGE_REPLY_LIMIT as x, resolveTrustedOutboundMediaPath as y };

package/dist/{runtime-D1hn91-s.js → runtime-BL0xZzWe.js}

@@ -1,4 +1,4 @@
-import { v as setOpenClawVersion } from "./sender-CRZ2af7P.js";
+import { v as setOpenClawVersion } from "./sender-BHWpE_yH.js";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/qqbot/src/bridge/runtime.ts
 const { setRuntime: _setRuntime, clearRuntime: resetQQBotRuntimeForTest, getRuntime: getQQBotRuntime } = createPluginRuntimeStore({

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-D1hn91-s.js";
+import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-BL0xZzWe.js";
 export { getQQBotRuntime, setQQBotRuntime };

package/dist/{sender-CRZ2af7P.js → sender-BHWpE_yH.js}

@@ -2,7 +2,7 @@ import { c as getPlatformAdapter, i as normalizeOptionalString, s as sanitizeFil
 import { a as formatErrorMessage, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
 import * as fs$1 from "node:fs";
 import os from "node:os";
-import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { readProviderTextResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
@@ -159,7 +159,7 @@ var ApiClient = class {
 			this.logger?.info?.(`[qqbot:api] <<< Status: ${res.status} ${res.statusText}${traceId ? ` | TraceId: ${traceId}` : ""}`);
 			const readBody = async (limitBytes) => {
 				try {
-					return limitBytes === void 0 ? await res.text() : await readResponseTextLimited(res, limitBytes);
+					return limitBytes === void 0 ? await readProviderTextResponse(res, "QQBot API response") : await readResponseTextLimited(res, limitBytes);
 				} catch (err) {
 					throw new ApiError(`Failed to read response [${path}]: ${formatErrorMessage(err)}`, res.status, path);
 				}

package/dist/{doctor-contract-BYTS8-ia.js → state-keys-CQKlAFyo.js}

@@ -1,3 +1,4 @@
+import crypto from "node:crypto";
 import { asObjectRecord } from "openclaw/plugin-sdk/runtime-doctor";
 //#region extensions/qqbot/src/doctor-contract.ts
 const RESTRICTED_GROUP_TOOLS = { deny: [
@@ -132,4 +133,9 @@ function normalizeCompatibilityConfig({ cfg }) {
 	};
 }
 //#endregion
-export { normalizeCompatibilityConfig as n, legacyConfigRules as t };
+//#region extensions/qqbot/src/engine/utils/state-keys.ts
+function buildQQBotStateKey(...parts) {
+	return crypto.createHash("sha256").update(JSON.stringify(parts)).digest("hex");
+}
+//#endregion
+export { legacyConfigRules as n, normalizeCompatibilityConfig as r, buildQQBotStateKey as t };