@openclaw/qqbot 2026.6.9-beta.1 → 2026.6.10-beta.1

package/dist/api.js

@@ -1,8 +1,8 @@
-import { t as qqbotPlugin } from "./channel-91Y8ZcpJ.js";
+import { t as qqbotPlugin } from "./channel-jbnSeYkd.js";
 import { a as resolveQQBotAccount, i as resolveDefaultQQBotAccountId, n as applyQQBotAccountConfig, r as listQQBotAccountIds, t as DEFAULT_ACCOUNT_ID } from "./config-ZEfgeoL4.js";
 import { t as qqbotSetupPlugin } from "./channel.setup-CQ_DFfPx.js";
-import { t as getFrameworkCommands } from "./slash-commands-impl-DVApdSop.js";
-import { n as registerRemindTool, r as registerChannelTool, t as registerQQBotTools } from "./tools-2d9t-N1b.js";
-import { t as registerQQBotFull } from "./channel-entry-D_eHXHMg.js";
-import { C as getMessageReplyConfig, D as OUTBOUND_ERROR_CODES, E as DEFAULT_MEDIA_SEND_ERROR, O as setOutboundAudioPort, S as checkMessageReplyLimit, T as recordMessageReply, _ as sendVideoMsg, a as sendText, b as resolveUserFacingMediaError, f as buildMediaTarget, g as sendPhoto, h as sendDocument, i as sendProactiveMessage, m as resolveOutboundMediaPath, n as sendCronMessage, p as parseTarget, r as sendMedia, v as sendVoice, w as getMessageReplyStats, x as MESSAGE_REPLY_LIMIT } from "./outbound-DN8kX1G3.js";
+import { t as getFrameworkCommands } from "./slash-commands-impl-BUH24Ycv.js";
+import { n as registerRemindTool, r as registerChannelTool, t as registerQQBotTools } from "./tools-CV5Y0isN.js";
+import { t as registerQQBotFull } from "./channel-entry-5YxjzTrA.js";
+import { C as getMessageReplyConfig, D as OUTBOUND_ERROR_CODES, E as DEFAULT_MEDIA_SEND_ERROR, O as setOutboundAudioPort, S as checkMessageReplyLimit, T as recordMessageReply, _ as sendVideoMsg, a as sendText, b as resolveUserFacingMediaError, f as buildMediaTarget, g as sendPhoto, h as sendDocument, i as sendProactiveMessage, m as resolveOutboundMediaPath, n as sendCronMessage, p as parseTarget, r as sendMedia, v as sendVoice, w as getMessageReplyStats, x as MESSAGE_REPLY_LIMIT } from "./outbound-BQcPCo-z.js";
 export { DEFAULT_ACCOUNT_ID, DEFAULT_MEDIA_SEND_ERROR, MESSAGE_REPLY_LIMIT, OUTBOUND_ERROR_CODES, applyQQBotAccountConfig, buildMediaTarget, checkMessageReplyLimit, getFrameworkCommands, getMessageReplyConfig, getMessageReplyStats, listQQBotAccountIds, parseTarget, qqbotPlugin, qqbotSetupPlugin, recordMessageReply, registerChannelTool, registerQQBotFull, registerQQBotTools, registerRemindTool, resolveDefaultQQBotAccountId, resolveOutboundMediaPath, resolveQQBotAccount, resolveUserFacingMediaError, sendCronMessage, sendDocument, sendMedia, sendPhoto, sendProactiveMessage, sendText, sendVideoMsg, sendVoice, setOutboundAudioPort };

package/dist/{channel-entry-D_eHXHMg.js → channel-entry-5YxjzTrA.js}

@@ -1,7 +1,7 @@
 import { a as resolveQQBotAccount } from "./config-ZEfgeoL4.js";
-import { t as getFrameworkCommands } from "./slash-commands-impl-DVApdSop.js";
-import { t as registerQQBotTools } from "./tools-2d9t-N1b.js";
-import { h as sendDocument } from "./outbound-DN8kX1G3.js";
+import { t as getFrameworkCommands } from "./slash-commands-impl-BUH24Ycv.js";
+import { t as registerQQBotTools } from "./tools-CV5Y0isN.js";
+import { h as sendDocument } from "./outbound-BQcPCo-z.js";
 //#region extensions/qqbot/src/bridge/commands/framework-context-adapter.ts
 /**
 * Default queue snapshot used for framework-registered commands.

package/dist/channel-entry-api.js

@@ -1,2 +1,2 @@
-import { t as registerQQBotFull } from "./channel-entry-D_eHXHMg.js";
+import { t as registerQQBotFull } from "./channel-entry-5YxjzTrA.js";
 export { registerQQBotFull };

package/dist/{channel-91Y8ZcpJ.js → channel-jbnSeYkd.js}

@@ -1,7 +1,7 @@
 import { t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { a as qqbotSetupAdapterShared, i as qqbotMeta, n as qqbotSetupWizard, o as ensurePlatformAdapter, r as qqbotConfigAdapter, s as getBridgeLogger, t as qqbotChannelConfigSchema } from "./config-schema-BFLNZ8Nf.js";
 import { a as resolveQQBotAccount, n as applyQQBotAccountConfig, r as listQQBotAccountIds, t as DEFAULT_ACCOUNT_ID$1 } from "./config-ZEfgeoL4.js";
-import { t as getQQBotRuntime } from "./runtime-B9UoQ5NI.js";
+import { t as getQQBotRuntime } from "./runtime-D1hn91-s.js";
 import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BYTS8-ia.js";
 import { n as normalizeTarget, s as getQQBotDataPath, t as looksLikeQQBotTarget } from "./target-parser-BdCUmxK7.js";
 import { getExecApprovalReplyMetadata } from "openclaw/plugin-sdk/approval-runtime";
@@ -370,7 +370,7 @@ function createQQBotApprovalCapability() {
 			},
 			load: async () => {
 				ensurePlatformAdapter();
-				return (await import("./handler-runtime-BzeYyTXb.js")).qqbotApprovalNativeRuntime;
+				return (await import("./handler-runtime-D0l75JR8.js")).qqbotApprovalNativeRuntime;
 			}
 		})
 	});
@@ -1066,12 +1066,12 @@ function resolveQQBotGroupToolPolicy(params) {
 //#region extensions/qqbot/src/channel.ts
 let gatewayModulePromise;
 function loadGatewayModule() {
-	gatewayModulePromise ??= import("./gateway-CwDoxaZF.js");
+	gatewayModulePromise ??= import("./gateway-DilADGTY.js");
 	return gatewayModulePromise;
 }
 let outboundMessagingModulePromise;
 function loadOutboundMessagingModule() {
-	outboundMessagingModulePromise ??= import("./outbound-DN8kX1G3.js").then((n) => n.t);
+	outboundMessagingModulePromise ??= import("./outbound-BQcPCo-z.js").then((n) => n.t);
 	return outboundMessagingModulePromise;
 }
 function createQQBotSendReceipt(params) {

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as qqbotPlugin } from "./channel-91Y8ZcpJ.js";
+import { t as qqbotPlugin } from "./channel-jbnSeYkd.js";
 export { qqbotPlugin };

package/dist/{gateway-CwDoxaZF.js → gateway-DilADGTY.js}

@@ -1,21 +1,22 @@
-import { C as getNextMsgSeq, D as downloadFile, F as StreamInputMode, I as StreamInputState, M as getMaxUploadSize, P as StreamContentType, T as openLocalFile, a as createRawInputNotifyFn, b as stopBackgroundTokenRefresh, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia, i as clearTokenCache, j as getImageMimeType, k as formatFileSize, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, x as withTokenRetry, y as startBackgroundTokenRefresh } from "./sender-DIMG7jHz.js";
+import { C as getNextMsgSeq, D as downloadFile, F as StreamInputMode, I as StreamInputState, M as getMaxUploadSize, P as StreamContentType, T as openLocalFile, a as createRawInputNotifyFn, b as stopBackgroundTokenRefresh, c as getMessageApi, d as initSender, f as onMessageSent, g as sendText, h as sendMedia, i as clearTokenCache, j as getImageMimeType, k as formatFileSize, l as getPluginUserAgent, m as sendInputNotify, n as acknowledgeInteraction, o as getAccessToken, p as registerAccount, r as buildDeliveryTarget, s as getGatewayUrl, t as accountToCreds, u as initApiConfig, x as withTokenRetry, y as startBackgroundTokenRefresh } from "./sender-CRZ2af7P.js";
 import { c as getPlatformAdapter, i as normalizeOptionalString$1, n as normalizeLowercaseStringOrEmpty$1, o as readStringField, s as sanitizeFileName, t as asOptionalObjectRecord } from "./string-normalize-R_0cKO7Q.js";
 import { c as setBridgeLogger, o as ensurePlatformAdapter } from "./config-schema-BFLNZ8Nf.js";
-import { a as toGatewayAccount, i as openQQBotSyncKeyedStore, m as parseApprovalButtonData, n as createQQBotMarkdownChunker, o as authorizeQQBotApprovalAction, r as buildQQBotStateKey } from "./channel-91Y8ZcpJ.js";
+import { a as toGatewayAccount, i as openQQBotSyncKeyedStore, m as parseApprovalButtonData, n as createQQBotMarkdownChunker, o as authorizeQQBotApprovalAction, r as buildQQBotStateKey } from "./channel-jbnSeYkd.js";
 import { d as resolveAccountBase } from "./config-ZEfgeoL4.js";
 import { a as formatErrorMessage, i as formatDuration, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
-import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-B9UoQ5NI.js";
+import { n as getQQBotRuntimeForEngine, t as getQQBotRuntime } from "./runtime-D1hn91-s.js";
 import { a as getHomeDir, c as getQQBotMediaDir, d as isLocalPath, f as isWindows, i as checkSilkWasmAvailable, o as getQQBotDataDir, p as normalizePath, s as getQQBotDataPath, u as getTempDir } from "./target-parser-BdCUmxK7.js";
-import { a as matchSlashCommand, i as initCommands, n as getFrameworkVersion, r as getPluginVersion } from "./slash-commands-impl-DVApdSop.js";
+import { a as matchSlashCommand, i as initCommands, n as getFrameworkVersion, r as getPluginVersion } from "./slash-commands-impl-BUH24Ycv.js";
 import { n as runWithRequestContext } from "./request-context-Bm7PTBD1.js";
-import { E as DEFAULT_MEDIA_SEND_ERROR, O as setOutboundAudioPort, _ as sendVideoMsg, b as resolveUserFacingMediaError, c as isCronReminderPayload, d as normalizeMediaTags, g as sendPhoto, h as sendDocument, l as isMediaPayload, o as decodeMediaPath, r as sendMedia$1, s as encodePayloadForCron, u as parseQQBotPayload, v as sendVoice, y as resolveTrustedOutboundMediaPath } from "./outbound-DN8kX1G3.js";
+import { E as DEFAULT_MEDIA_SEND_ERROR, O as setOutboundAudioPort, _ as sendVideoMsg, b as resolveUserFacingMediaError, c as isCronReminderPayload, d as normalizeMediaTags, g as sendPhoto, h as sendDocument, l as isMediaPayload, o as decodeMediaPath, r as sendMedia$1, s as encodePayloadForCron, u as parseQQBotPayload, v as sendVoice, y as resolveTrustedOutboundMediaPath } from "./outbound-BQcPCo-z.js";
 import { asBoolean, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isImplicitSameChatApprovalAuthorization } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as fs$1 from "node:fs";
 import fs from "node:fs";
 import * as os$1 from "node:os";
-import crypto from "node:crypto";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import crypto from "node:crypto";
 import { privateFileStoreSync, readRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
 import * as path$1 from "node:path";
 import path from "node:path";
@@ -1802,6 +1803,7 @@ var GatewayConnection = class {
 * Migrated from `src/stt.ts` — uses core/utils/string-normalize instead
 * of broad SDK text barrels.
 */
+const STT_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 /** Resolve the STT configuration from the nested config object. */
 function resolveSTTConfig(cfg) {
 	const channelStt = asOptionalObjectRecord(asOptionalObjectRecord(asOptionalObjectRecord(cfg.channels)?.qqbot)?.stt);
@@ -1855,7 +1857,7 @@ async function transcribeAudio(audioPath, cfg) {
 	});
 	try {
 		if (!resp.ok) {
-			const detail = await resp.text().catch(() => "");
+			const detail = await readResponseTextLimited(resp, STT_ERROR_BODY_LIMIT_BYTES).catch(() => "");
 			throw new Error(`STT failed (HTTP ${resp.status}): ${detail.slice(0, 300)}`);
 		}
 		return normalizeOptionalString$1((await resp.json()).text) ?? null;

package/dist/{handler-runtime-BzeYyTXb.js → handler-runtime-D0l75JR8.js}

@@ -1,6 +1,6 @@
-import { c as getMessageApi, t as accountToCreds } from "./sender-DIMG7jHz.js";
+import { c as getMessageApi, t as accountToCreds } from "./sender-CRZ2af7P.js";
 import { o as ensurePlatformAdapter, s as getBridgeLogger } from "./config-schema-BFLNZ8Nf.js";
-import { c as matchesQQBotApprovalAccount, d as buildApprovalKeyboard, f as buildExecApprovalText, h as resolveApprovalTarget, l as resolveQQBotExecApprovalConfig, p as buildPluginApprovalText, s as isQQBotExecApprovalClientEnabled, u as shouldHandleQQBotExecApprovalRequest } from "./channel-91Y8ZcpJ.js";
+import { c as matchesQQBotApprovalAccount, d as buildApprovalKeyboard, f as buildExecApprovalText, h as resolveApprovalTarget, l as resolveQQBotExecApprovalConfig, p as buildPluginApprovalText, s as isQQBotExecApprovalClientEnabled, u as shouldHandleQQBotExecApprovalRequest } from "./channel-jbnSeYkd.js";
 import { a as resolveQQBotAccount } from "./config-ZEfgeoL4.js";
 import { resolveApprovalRequestSessionConversation } from "openclaw/plugin-sdk/approval-native-runtime";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";

package/dist/{outbound-DN8kX1G3.js → outbound-BQcPCo-z.js}

@@ -1,4 +1,4 @@
-import { A as getFileTypeName, D as downloadFile, E as checkFileSize, L as __exportAll, M as getMaxUploadSize, N as readFileAsync, O as fileExistsAsync, S as UploadDailyLimitExceededError, g as sendText$1, h as sendMedia$1, j as getImageMimeType, k as formatFileSize, t as accountToCreds, u as initApiConfig, w as UPLOAD_PREPARE_FALLBACK_CODE } from "./sender-DIMG7jHz.js";
+import { A as getFileTypeName, D as downloadFile, E as checkFileSize, L as __exportAll, M as getMaxUploadSize, N as readFileAsync, O as fileExistsAsync, S as UploadDailyLimitExceededError, g as sendText$1, h as sendMedia$1, j as getImageMimeType, k as formatFileSize, t as accountToCreds, u as initApiConfig, w as UPLOAD_PREPARE_FALLBACK_CODE } from "./sender-CRZ2af7P.js";
 import { i as normalizeOptionalString, n as normalizeLowercaseStringOrEmpty, s as sanitizeFileName } from "./string-normalize-R_0cKO7Q.js";
 import { a as formatErrorMessage, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
 import { c as getQQBotMediaDir, d as isLocalPath, m as resolveQQBotPayloadLocalFilePath, o as getQQBotDataDir, p as normalizePath$1, r as parseTarget$1 } from "./target-parser-BdCUmxK7.js";

package/dist/{runtime-B9UoQ5NI.js → runtime-D1hn91-s.js}

@@ -1,4 +1,4 @@
-import { v as setOpenClawVersion } from "./sender-DIMG7jHz.js";
+import { v as setOpenClawVersion } from "./sender-CRZ2af7P.js";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/qqbot/src/bridge/runtime.ts
 const { setRuntime: _setRuntime, clearRuntime: resetQQBotRuntimeForTest, getRuntime: getQQBotRuntime } = createPluginRuntimeStore({

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-B9UoQ5NI.js";
+import { r as setQQBotRuntime, t as getQQBotRuntime } from "./runtime-D1hn91-s.js";
 export { getQQBotRuntime, setQQBotRuntime };

package/dist/{sender-DIMG7jHz.js → sender-CRZ2af7P.js}

@@ -2,9 +2,10 @@ import { c as getPlatformAdapter, i as normalizeOptionalString, s as sanitizeFil
 import { a as formatErrorMessage, n as debugLog, r as debugWarn, t as debugError } from "./log-SDfMMBWe.js";
 import * as fs$1 from "node:fs";
 import os from "node:os";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import * as crypto$1 from "node:crypto";
 import crypto from "node:crypto";
-import { fetchWithSsrFGuard, isBlockedHostnameOrIp } from "openclaw/plugin-sdk/ssrf-runtime";
 import { FsSafeError, openLocalFileSafely, readRegularFile, statRegularFileSync } from "openclaw/plugin-sdk/security-runtime";
 import * as path$1 from "node:path";
 import { mimeTypeFromFilePath } from "openclaw/plugin-sdk/media-mime";
@@ -72,6 +73,13 @@ const StreamContentType = { MARKDOWN: "markdown" };
 const DEFAULT_BASE_URL = "https://api.sgroup.qq.com";
 const DEFAULT_TIMEOUT_MS = 3e4;
 const FILE_UPLOAD_TIMEOUT_MS = 12e4;
+const QQBOT_API_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+function resolveQqbotApiSsrfPolicy(url) {
+	return {
+		hostnameAllowlist: [new URL(url).hostname],
+		allowRfc2544BenchmarkRange: true
+	};
+}
 /**
 * Stateful HTTP client for the QQ Open Platform.
 *
@@ -125,8 +133,16 @@ var ApiClient = class {
 			this.logger.debug(`[qqbot:api] >>> Body: ${JSON.stringify(logBody)}`);
 		}
 		let res;
+		let release;
 		try {
-			res = await fetch(url, fetchInit);
+			const guarded = await fetchWithSsrFGuard({
+				url,
+				init: fetchInit,
+				auditContext: "qqbot-api",
+				policy: resolveQqbotApiSsrfPolicy(url)
+			});
+			res = guarded.response;
+			release = guarded.release;
 		} catch (err) {
 			clearTimeout(timeoutId);
 			if (err instanceof Error && err.name === "AbortError") {
@@ -138,32 +154,38 @@ var ApiClient = class {
 		} finally {
 			clearTimeout(timeoutId);
 		}
-		const traceId = res.headers.get("x-tps-trace-id") ?? "";
-		this.logger?.info?.(`[qqbot:api] <<< Status: ${res.status} ${res.statusText}${traceId ? ` | TraceId: ${traceId}` : ""}`);
-		let rawBody;
 		try {
-			rawBody = await res.text();
-		} catch (err) {
-			throw new ApiError(`Failed to read response [${path}]: ${formatErrorMessage(err)}`, res.status, path);
-		}
-		this.logger?.debug?.(`[qqbot:api] <<< Body: ${rawBody}`);
-		const isHtmlResponse = (res.headers.get("content-type") ?? "").includes("text/html") || rawBody.trimStart().startsWith("<");
-		if (!res.ok) {
-			if (isHtmlResponse) throw new ApiError(`${res.status === 502 || res.status === 503 || res.status === 504 ? "调用发生异常，请稍候重试" : res.status === 429 ? "请求过于频繁，已被限流" : `开放平台返回 HTTP ${res.status}`}（${path}），请稍后重试`, res.status, path);
+			const traceId = res.headers.get("x-tps-trace-id") ?? "";
+			this.logger?.info?.(`[qqbot:api] <<< Status: ${res.status} ${res.statusText}${traceId ? ` | TraceId: ${traceId}` : ""}`);
+			const readBody = async (limitBytes) => {
+				try {
+					return limitBytes === void 0 ? await res.text() : await readResponseTextLimited(res, limitBytes);
+				} catch (err) {
+					throw new ApiError(`Failed to read response [${path}]: ${formatErrorMessage(err)}`, res.status, path);
+				}
+			};
+			const rawBody = res.ok ? await readBody() : await readBody(QQBOT_API_ERROR_BODY_LIMIT_BYTES);
+			this.logger?.debug?.(`[qqbot:api] <<< Body: ${rawBody}`);
+			const isHtmlResponse = (res.headers.get("content-type") ?? "").includes("text/html") || rawBody.trimStart().startsWith("<");
+			if (!res.ok) {
+				if (isHtmlResponse) throw new ApiError(`${res.status === 502 || res.status === 503 || res.status === 504 ? "调用发生异常，请稍候重试" : res.status === 429 ? "请求过于频繁，已被限流" : `开放平台返回 HTTP ${res.status}`}（${path}），请稍后重试`, res.status, path);
+				try {
+					const error = JSON.parse(rawBody);
+					const bizCode = error.code ?? error.err_code;
+					throw new ApiError(`API Error [${path}]: ${error.message ?? rawBody}`, res.status, path, bizCode, error.message);
+				} catch (parseErr) {
+					if (parseErr instanceof ApiError) throw parseErr;
+					throw new ApiError(`API Error [${path}] HTTP ${res.status}: ${rawBody.slice(0, 200)}`, res.status, path);
+				}
+			}
+			if (isHtmlResponse) throw new ApiError(`QQ 服务端返回了非 JSON 响应（${path}），可能是临时故障，请稍后重试`, res.status, path);
 			try {
-				const error = JSON.parse(rawBody);
-				const bizCode = error.code ?? error.err_code;
-				throw new ApiError(`API Error [${path}]: ${error.message ?? rawBody}`, res.status, path, bizCode, error.message);
-			} catch (parseErr) {
-				if (parseErr instanceof ApiError) throw parseErr;
-				throw new ApiError(`API Error [${path}] HTTP ${res.status}: ${rawBody.slice(0, 200)}`, res.status, path);
+				return JSON.parse(rawBody);
+			} catch {
+				throw new ApiError(`开放平台响应格式异常（${path}），请稍后重试`, res.status, path);
 			}
-		}
-		if (isHtmlResponse) throw new ApiError(`QQ 服务端返回了非 JSON 响应（${path}），可能是临时故障，请稍后重试`, res.status, path);
-		try {
-			return JSON.parse(rawBody);
-		} catch {
-			throw new ApiError(`开放平台响应格式异常（${path}），请稍后重试`, res.status, path);
+		} finally {
+			await release?.();
 		}
 	}
 };
@@ -680,6 +702,7 @@ const MAX_CONCURRENT_PARTS = 10;
 const MAX_PART_FINISH_RETRY_TIMEOUT_MS = 600 * 1e3;
 /** Per-part PUT timeout (5 minutes). Matches the low-bandwidth tolerance. */
 const PART_UPLOAD_TIMEOUT_MS = 3e5;
+const PART_UPLOAD_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 /**
 * Boundary used by `md5_10m` — first 10,002,432 bytes.
 *
@@ -907,7 +930,7 @@ async function putToPresignedUrl(presignedUrl, data, partIndex, totalParts, logg
 				const requestId = response.headers.get("x-cos-request-id") ?? "-";
 				const etag = response.headers.get("ETag") ?? "-";
 				if (!response.ok) {
-					const body = await response.text().catch(() => "");
+					const body = await readResponseTextLimited(response, PART_UPLOAD_ERROR_BODY_LIMIT_BYTES).catch(() => "");
 					logger?.error?.(`${prefix} PUT part ${partIndex}/${totalParts}: HTTP ${response.status} ${response.statusText} (${elapsed}ms, requestId=${requestId}) body=${body.slice(0, 160)}`);
 					throw new Error(`COS PUT failed: ${response.status} ${response.statusText} - ${body.slice(0, 120)}`);
 				}
@@ -960,6 +983,7 @@ function sleep(ms) {
 */
 const TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken";
 const DEFAULT_TOKEN_EXPIRES_IN_SECONDS = 7200;
+const QQBOT_TOKEN_RESPONSE_LIMIT_BYTES = 8 * 1024;
 /**
 * Host-scoped SSRF policy for the QQ Bot token endpoint.
 *
@@ -1102,11 +1126,6 @@ var TokenManager = class {
 			this.refreshControllers.clear();
 		}
 	}
-	/** Check whether background refresh is running. */
-	isBackgroundRefreshRunning(appId) {
-		if (appId) return this.refreshControllers.has(appId);
-		return this.refreshControllers.size > 0;
-	}
 	async doFetchToken(appId, clientSecret) {
 		this.logger?.debug?.(`[qqbot:token:${appId}] >>> POST ${TOKEN_URL}`);
 		let response;
@@ -1140,7 +1159,7 @@ var TokenManager = class {
 			this.logger?.debug?.(`[qqbot:token:${appId}] <<< ${response.status}${traceId ? ` | TraceId: ${traceId}` : ""}`);
 			let rawBody;
 			try {
-				rawBody = await response.text();
+				rawBody = await readResponseTextLimited(response, QQBOT_TOKEN_RESPONSE_LIMIT_BYTES);
 			} catch (err) {
 				throw new Error(`Failed to read access_token response: ${formatErrorMessage(err)}`, { cause: err });
 			}

package/dist/{slash-commands-impl-DVApdSop.js → slash-commands-impl-BUH24Ycv.js}

@@ -909,10 +909,6 @@ var SlashCommandRegistry = class {
 			handler: cmd.handler
 		}));
 	}
-	/** Return all pre-dispatch commands. */
-	getPreDispatchCommands() {
-		return this.commands;
-	}
 	/** Return all registered commands (both maps) for help listing. */
 	getAllCommands() {
 		const all = /* @__PURE__ */ new Map();

package/dist/{tools-2d9t-N1b.js → tools-CV5Y0isN.js}

@@ -1,6 +1,8 @@
 import { a as resolveQQBotAccount, r as listQQBotAccountIds } from "./config-ZEfgeoL4.js";
 import { a as formatErrorMessage, n as debugLog, t as debugError } from "./log-SDfMMBWe.js";
 import { t as getRequestContext } from "./request-context-Bm7PTBD1.js";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
 import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/qqbot/src/engine/tools/channel-api.ts
@@ -15,6 +17,13 @@ import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 */
 const API_BASE = "https://api.sgroup.qq.com";
 const DEFAULT_TIMEOUT_MS = 3e4;
+const CHANNEL_API_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+function resolveChannelApiSsrfPolicy(url) {
+	return {
+		hostnameAllowlist: [new URL(url).hostname],
+		allowRfc2544BenchmarkRange: true
+	};
+}
 /**
 * JSON Schema for AI tool parameters (used by framework registration).
 * AI Tool 参数的 JSON Schema 定义（供框架注册使用）。
@@ -124,8 +133,16 @@ async function executeChannelApi(params, options) {
 		].includes(method)) fetchOptions.body = JSON.stringify(params.body);
 		debugLog(`[qqbot-channel-api] >>> ${method} ${url} (timeout: ${DEFAULT_TIMEOUT_MS}ms)`);
 		let res;
+		let release;
 		try {
-			res = await fetch(url, fetchOptions);
+			const guarded = await fetchWithSsrFGuard({
+				url,
+				init: fetchOptions,
+				auditContext: "qqbot-channel-api",
+				policy: resolveChannelApiSsrfPolicy(url)
+			});
+			res = guarded.response;
+			release = guarded.release;
 		} catch (err) {
 			clearTimeout(timeoutId);
 			if (err instanceof Error && err.name === "AbortError") {
@@ -143,42 +160,46 @@ async function executeChannelApi(params, options) {
 		} finally {
 			clearTimeout(timeoutId);
 		}
-		debugLog(`[qqbot-channel-api] <<< Status: ${res.status} ${res.statusText}`);
-		const rawBody = await res.text();
-		if (!rawBody || rawBody.trim() === "") {
-			if (res.ok) return json$1({
-				success: true,
-				status: res.status,
-				path: params.path
-			});
-			return json$1({
-				error: `API returned ${res.status} ${res.statusText}`,
-				status: res.status,
-				path: params.path
-			});
-		}
-		let parsed;
 		try {
-			parsed = JSON.parse(rawBody);
-		} catch {
-			parsed = rawBody;
-		}
-		if (!res.ok) {
-			const errMsg = typeof parsed === "object" && parsed && "message" in parsed ? String(parsed.message) : `${res.status} ${res.statusText}`;
-			debugError(`[qqbot-channel-api] Error [${method} ${params.path}]: ${errMsg}`);
+			debugLog(`[qqbot-channel-api] <<< Status: ${res.status} ${res.statusText}`);
+			const rawBody = res.ok ? await res.text() : await readResponseTextLimited(res, CHANNEL_API_ERROR_BODY_LIMIT_BYTES);
+			if (!rawBody || rawBody.trim() === "") {
+				if (res.ok) return json$1({
+					success: true,
+					status: res.status,
+					path: params.path
+				});
+				return json$1({
+					error: `API returned ${res.status} ${res.statusText}`,
+					status: res.status,
+					path: params.path
+				});
+			}
+			let parsed;
+			try {
+				parsed = JSON.parse(rawBody);
+			} catch {
+				parsed = rawBody;
+			}
+			if (!res.ok) {
+				const errMsg = typeof parsed === "object" && parsed && "message" in parsed ? String(parsed.message) : `${res.status} ${res.statusText}`;
+				debugError(`[qqbot-channel-api] Error [${method} ${params.path}]: ${errMsg}`);
+				return json$1({
+					error: errMsg,
+					status: res.status,
+					path: params.path,
+					details: parsed
+				});
+			}
 			return json$1({
-				error: errMsg,
+				success: true,
 				status: res.status,
 				path: params.path,
-				details: parsed
+				data: parsed
 			});
+		} finally {
+			await release?.();
 		}
-		return json$1({
-			success: true,
-			status: res.status,
-			path: params.path,
-			data: parsed
-		});
 	} catch (err) {
 		return json$1({
 			error: formatErrorMessage(err),
@@ -209,7 +230,7 @@ function registerChannelTool(api) {
 		description: "Authenticated HTTP proxy for QQ Open Platform channel APIs. Common endpoints: list guilds GET /users/@me/guilds | list channels GET /guilds/{guild_id}/channels | get channel GET /channels/{channel_id} | create channel POST /guilds/{guild_id}/channels | list members GET /guilds/{guild_id}/members?after=0&limit=100 | get member GET /guilds/{guild_id}/members/{user_id} | list threads GET /channels/{channel_id}/threads | create thread PUT /channels/{channel_id}/threads | create announce POST /guilds/{guild_id}/announces | create schedule POST /channels/{channel_id}/schedules. See the qqbot-channel skill for full endpoint details.",
 		parameters: ChannelApiSchema,
 		async execute(_toolCallId, params) {
-			const { getAccessToken } = await import("./sender-DIMG7jHz.js").then((n) => n._);
+			const { getAccessToken } = await import("./sender-CRZ2af7P.js").then((n) => n._);
 			return executeChannelApi(params, { accessToken: await getAccessToken(account.appId, account.clientSecret) });
 		}
 	}, { name: "qqbot_channel_api" });

package/dist/tools-api.js

@@ -1,2 +1,2 @@
-import { t as registerQQBotTools } from "./tools-2d9t-N1b.js";
+import { t as registerQQBotTools } from "./tools-CV5Y0isN.js";
 export { registerQQBotTools };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.6.9-beta.1",
+  "version": "2026.6.10-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/qqbot",
-      "version": "2026.6.9-beta.1",
+      "version": "2026.6.10-beta.1",
       "dependencies": {
         "@tencent-connect/qqbot-connector": "1.1.0",
         "mpg123-decoder": "1.0.3",
@@ -15,7 +15,7 @@
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.6.9-beta.1"
+        "openclaw": ">=2026.6.10-beta.1"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/qqbot",
-  "version": "2026.6.9-beta.1",
+  "version": "2026.6.10-beta.1",
   "private": false,
   "description": "OpenClaw QQ Bot channel plugin for group and direct-message workflows.",
   "repository": {
@@ -16,7 +16,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.6.9-beta.1"
+    "openclaw": ">=2026.6.10-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -45,10 +45,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.6.9-beta.1"
+      "pluginApi": ">=2026.6.10-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.6.9-beta.1"
+      "openclawVersion": "2026.6.10-beta.1"
     },
     "release": {
       "publishToClawHub": true,