@openclaw/qqbot 2026.7.1-beta.6 → 2026.7.2-beta.1

package/dist/{tools-UJJ-tLHP.js → tools-DYb23LBU.js}

@@ -1,10 +1,11 @@
-import { a as resolveQQBotAccount, r as listQQBotAccountIds } from "./config-C1qZbh0K.js";
-import { a as formatErrorMessage, n as debugLog, t as debugError } from "./log-DEtcoDWe.js";
+import { a as resolveQQBotAccount, r as listQQBotAccountIds } from "./config-CpOXnoEc.js";
+import { a as formatErrorMessage, n as debugLog, t as debugError } from "./log-Da4jz75I.js";
 import { t as getRequestContext } from "./request-context-Bm7PTBD1.js";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { readProviderTextResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { resolveExpiresAtMsFromDurationMs } from "openclaw/plugin-sdk/number-runtime";
+import { resolveChannelGroupPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { jsonResult } from "openclaw/plugin-sdk/tool-results";
 import { callGatewayTool } from "openclaw/plugin-sdk/agent-harness-runtime";
 //#region extensions/qqbot/src/engine/tools/channel-api.ts
@@ -109,6 +110,35 @@ function decodePathSegments(path) {
 		return null;
 	}
 }
+function resolvePathTarget(path) {
+	const segments = decodePathSegments(path);
+	if (!segments || segments.length === 0) return { kind: "unverified" };
+	const [scope, firstId, second] = segments;
+	if (scope?.toLowerCase() === "users" && firstId?.toLowerCase() === "@me" && second?.toLowerCase() === "guilds") return { kind: "guild-list" };
+	if (scope?.toLowerCase() === "guilds" && firstId) return {
+		kind: "guild",
+		id: firstId
+	};
+	if (scope?.toLowerCase() === "channels" && firstId) return {
+		kind: "channel",
+		id: firstId
+	};
+	return { kind: "unverified" };
+}
+function validateConfiguredTargetScope(path, options) {
+	if (!options.cfg) return null;
+	const basePolicy = resolveChannelGroupPolicy({
+		cfg: options.cfg,
+		channel: "qqbot",
+		accountId: options.accountId,
+		groupIdCaseInsensitive: true
+	});
+	if (!basePolicy.allowlistEnabled && basePolicy.allowed) return null;
+	const target = resolvePathTarget(path);
+	if (target.kind === "guild-list") return basePolicy.allowed ? null : "QQ channel API guild listing is unavailable while qqbot groups are scoped.";
+	if (target.kind === "unverified") return basePolicy.allowed ? null : "QQ channel API path target cannot be verified against configured qqbot groups.";
+	return basePolicy.allowed ? null : `QQ channel API ${target.kind} paths are unavailable while qqbot groups are scoped.`;
+}
 function isBulkAnnouncementDeletePath(path) {
 	const segments = decodePathSegments(path);
 	return Boolean(segments && segments.length === 4 && segments[0]?.toLowerCase() === "guilds" && segments[2]?.toLowerCase() === "announces" && segments[3]?.toLowerCase() === "all");
@@ -140,6 +170,11 @@ async function executeChannelApi(params, options) {
 	].includes(method)) return jsonResult({ error: `Unsupported HTTP method: ${method}. Allowed values: GET, POST, PUT, PATCH, DELETE` });
 	const pathError = validatePath(params.path);
 	if (pathError) return jsonResult({ error: pathError });
+	const scopeError = validateConfiguredTargetScope(params.path, options);
+	if (scopeError) return jsonResult({
+		error: scopeError,
+		path: params.path
+	});
 	const confirmationError = validateDeleteConfirmation({
 		...params,
 		method
@@ -266,8 +301,12 @@ function registerChannelTool(api) {
 		description: "Authenticated HTTP proxy for QQ Open Platform channel APIs. Use write and delete endpoints only after explicit user intent; DELETE requires confirmed=true, and bulk deletes require bulkConfirmed=true after confirming the exact target. Common endpoints: list guilds GET /users/@me/guilds | list channels GET /guilds/{guild_id}/channels | get channel GET /channels/{channel_id} | create channel POST /guilds/{guild_id}/channels | list members GET /guilds/{guild_id}/members?after=0&limit=100 | get member GET /guilds/{guild_id}/members/{user_id} | list threads GET /channels/{channel_id}/threads | create thread PUT /channels/{channel_id}/threads | create announce POST /guilds/{guild_id}/announces | create schedule POST /channels/{channel_id}/schedules. See the qqbot-channel skill for full endpoint details.",
 		parameters: ChannelApiSchema,
 		async execute(_toolCallId, params) {
-			const { getAccessToken } = await import("./sender-CjDuU-uz.js").then((n) => n._);
-			return executeChannelApi(params, { accessToken: await getAccessToken(account.appId, account.clientSecret) });
+			const { getAccessToken } = await import("./sender-0vqsivoI.js").then((n) => n._);
+			return executeChannelApi(params, {
+				accessToken: await getAccessToken(account.appId, account.clientSecret),
+				cfg,
+				accountId: firstAccountId
+			});
 		}
 	}, { name: "qqbot_channel_api" });
 }
@@ -337,8 +376,11 @@ function parseRelativeTime(timeStr) {
 		if (match.index !== consumed) return null;
 		matched = true;
 		consumed = regex.lastIndex;
-		const value = Number.parseFloat(match[1]);
-		switch (match[2]) {
+		const valueText = match[1];
+		const unit = match[2];
+		if (valueText === void 0 || unit === void 0) return null;
+		const value = Number.parseFloat(valueText);
+		switch (unit) {
 			case "d":
 				totalMs += value * 864e5;
 				break;

package/dist/tools-api.js

@@ -1,2 +1,2 @@
-import { t as registerQQBotTools } from "./tools-UJJ-tLHP.js";
+import { t as registerQQBotTools } from "./tools-DYb23LBU.js";
 export { registerQQBotTools };

package/node_modules/p-map/index.d.ts

@@ -0,0 +1,155 @@
+type BaseOptions = {
+	/**
+	Number of concurrently pending promises returned by `mapper`.
+
+	Must be an integer from 1 and up or `Infinity`.
+
+	@default Infinity
+	*/
+	readonly concurrency?: number;
+};
+
+export type Options = BaseOptions & {
+	/**
+	When `true`, the first mapper rejection will be rejected back to the consumer.
+
+	When `false`, instead of stopping when a promise rejects, it will wait for all the promises to settle and then reject with an [`AggregateError`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/AggregateError) containing all the errors from the rejected promises.
+
+	Caveat: When `true`, any already-started async mappers will continue to run until they resolve or reject. In the case of infinite concurrency with sync iterables, *all* mappers are invoked on startup and will continue after the first rejection. Use the `signal` option for abort control.
+
+	@default true
+	*/
+	readonly stopOnError?: boolean;
+
+	/**
+	You can abort the promises using [`AbortController`](https://developer.mozilla.org/en-US/docs/Web/API/AbortController).
+
+	@example
+	```
+	import pMap from 'p-map';
+	import delay from 'delay';
+
+	const abortController = new AbortController();
+
+	setTimeout(() => {
+		abortController.abort();
+	}, 500);
+
+	const mapper = async value => value;
+
+	await pMap([delay(1000), delay(1000)], mapper, {signal: abortController.signal});
+	// Throws AbortError (DOMException) after 500 ms.
+	```
+	*/
+	readonly signal?: AbortSignal | undefined;
+};
+
+export type IterableOptions = BaseOptions & {
+	/**
+	Maximum number of promises returned by `mapper` that have resolved but not yet collected by the consumer of the async iterable. Calls to `mapper` will be limited so that there is never too much backpressure.
+
+	Useful whenever you are consuming the iterable slower than what the mapper function can produce concurrently. For example, to avoid making an overwhelming number of HTTP requests if you are saving each of the results to a database.
+
+	Default: `options.concurrency`
+	*/
+	readonly backpressure?: number;
+};
+
+type MaybePromise<T> = T | Promise<T>;
+
+/**
+Function which is called for every item in `input`. Expected to return a `Promise` or value.
+
+@param element - Iterated element.
+@param index - Index of the element in the source array.
+*/
+export type Mapper<Element = any, NewElement = unknown> = (
+	element: Element,
+	index: number
+) => MaybePromise<NewElement | typeof pMapSkip>;
+
+/**
+@param input - Synchronous or asynchronous iterable that is iterated over concurrently, calling the `mapper` function for each element. Each iterated item is `await`'d before the `mapper` is invoked so the iterable may return a `Promise` that resolves to an item. Asynchronous iterables (different from synchronous iterables that return `Promise` that resolves to an item) can be used when the next item may not be ready without waiting for an asynchronous process to complete and/or the end of the iterable may be reached after the asynchronous process completes. For example, reading from a remote queue when the queue has reached empty, or reading lines from a stream.
+@param mapper - Function which is called for every item in `input`. Expected to return a `Promise` or value.
+@returns A `Promise` that is fulfilled when all promises in `input` and the ones returned from `mapper` are fulfilled, or rejects if any of the promises reject. The fulfilled value is an `Array` of the fulfilled values returned from `mapper` in `input` order.
+
+@example
+```
+import pMap from 'p-map';
+import got from 'got';
+
+const sites = [
+	getWebsiteFromUsername('sindresorhus'), //=> Promise
+	'https://avajs.dev',
+	'https://github.com'
+];
+
+const mapper = async site => {
+	const {requestUrl} = await got.head(site);
+	return requestUrl;
+};
+
+const result = await pMap(sites, mapper, {concurrency: 2});
+
+console.log(result);
+//=> ['https://sindresorhus.com/', 'https://avajs.dev/', 'https://github.com/']
+```
+*/
+export default function pMap<Element, NewElement>(
+	input: AsyncIterable<Element | Promise<Element>> | Iterable<Element | Promise<Element>>,
+	mapper: Mapper<Element, NewElement>,
+	options?: Options
+): Promise<Array<Exclude<NewElement, typeof pMapSkip>>>;
+
+/**
+@param input - Synchronous or asynchronous iterable that is iterated over concurrently, calling the `mapper` function for each element. Each iterated item is `await`'d before the `mapper` is invoked so the iterable may return a `Promise` that resolves to an item. Asynchronous iterables (different from synchronous iterables that return `Promise` that resolves to an item) can be used when the next item may not be ready without waiting for an asynchronous process to complete and/or the end of the iterable may be reached after the asynchronous process completes. For example, reading from a remote queue when the queue has reached empty, or reading lines from a stream.
+@param mapper - Function which is called for every item in `input`. Expected to return a `Promise` or value.
+@returns An async iterable that streams each return value from `mapper` in order.
+
+@example
+```
+import {pMapIterable} from 'p-map';
+
+// Multiple posts are fetched concurrently, with limited concurrency and backpressure
+for await (const post of pMapIterable(postIds, getPostMetadata, {concurrency: 8})) {
+	console.log(post);
+};
+```
+*/
+export function pMapIterable<Element, NewElement>(
+	input: AsyncIterable<Element | Promise<Element>> | Iterable<Element | Promise<Element>>,
+	mapper: Mapper<Element, NewElement>,
+	options?: IterableOptions
+): AsyncIterable<Exclude<NewElement, typeof pMapSkip>>;
+
+/**
+Return this value from a `mapper` function to skip including the value in the returned array.
+
+@example
+```
+import pMap, {pMapSkip} from 'p-map';
+import got from 'got';
+
+const sites = [
+	getWebsiteFromUsername('sindresorhus'), //=> Promise
+	'https://avajs.dev',
+	'https://example.invalid',
+	'https://github.com'
+];
+
+const mapper = async site => {
+	try {
+		const {requestUrl} = await got.head(site);
+		return requestUrl;
+	} catch {
+		return pMapSkip;
+	}
+};
+
+const result = await pMap(sites, mapper, {concurrency: 2});
+
+console.log(result);
+//=> ['https://sindresorhus.com/', 'https://avajs.dev/', 'https://github.com/']
+```
+*/
+export const pMapSkip: unique symbol;

package/node_modules/p-map/index.js

@@ -0,0 +1,284 @@
+export default async function pMap(
+	iterable,
+	mapper,
+	{
+		concurrency = Number.POSITIVE_INFINITY,
+		stopOnError = true,
+		signal,
+	} = {},
+) {
+	return new Promise((resolve_, reject_) => {
+		if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
+			throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+		}
+
+		if (typeof mapper !== 'function') {
+			throw new TypeError('Mapper function is required');
+		}
+
+		if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
+			throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+		}
+
+		const result = [];
+		const errors = [];
+		const skippedIndexesMap = new Map();
+		let isRejected = false;
+		let isResolved = false;
+		let isIterableDone = false;
+		let resolvingCount = 0;
+		let currentIndex = 0;
+		const iterator = iterable[Symbol.iterator] === undefined ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
+
+		const signalListener = () => {
+			reject(signal.reason);
+		};
+
+		const cleanup = () => {
+			signal?.removeEventListener('abort', signalListener);
+		};
+
+		const resolve = value => {
+			resolve_(value);
+			cleanup();
+		};
+
+		const reject = reason => {
+			isRejected = true;
+			isResolved = true;
+			reject_(reason);
+			cleanup();
+		};
+
+		if (signal) {
+			if (signal.aborted) {
+				reject(signal.reason);
+			}
+
+			signal.addEventListener('abort', signalListener, {once: true});
+		}
+
+		const next = async () => {
+			if (isResolved) {
+				return;
+			}
+
+			const nextItem = await iterator.next();
+
+			const index = currentIndex;
+			currentIndex++;
+
+			// Note: `iterator.next()` can be called many times in parallel.
+			// This can cause multiple calls to this `next()` function to
+			// receive a `nextItem` with `done === true`.
+			// The shutdown logic that rejects/resolves must be protected
+			// so it runs only one time as the `skippedIndex` logic is
+			// non-idempotent.
+			if (nextItem.done) {
+				isIterableDone = true;
+
+				if (resolvingCount === 0 && !isResolved) {
+					if (!stopOnError && errors.length > 0) {
+						reject(new AggregateError(errors)); // eslint-disable-line unicorn/error-message
+						return;
+					}
+
+					isResolved = true;
+
+					if (skippedIndexesMap.size === 0) {
+						resolve(result);
+						return;
+					}
+
+					const pureResult = [];
+
+					// Support multiple `pMapSkip`'s.
+					for (const [index, value] of result.entries()) {
+						if (skippedIndexesMap.get(index) === pMapSkip) {
+							continue;
+						}
+
+						pureResult.push(value);
+					}
+
+					resolve(pureResult);
+				}
+
+				return;
+			}
+
+			resolvingCount++;
+
+			// Intentionally detached
+			(async () => {
+				try {
+					const element = await nextItem.value;
+
+					if (isResolved) {
+						return;
+					}
+
+					const value = await mapper(element, index);
+
+					// Use Map to stage the index of the element.
+					if (value === pMapSkip) {
+						skippedIndexesMap.set(index, value);
+					}
+
+					result[index] = value;
+
+					resolvingCount--;
+					await next();
+				} catch (error) {
+					if (stopOnError) {
+						reject(error);
+					} else {
+						errors.push(error);
+						resolvingCount--;
+
+						// In that case we can't really continue regardless of `stopOnError` state
+						// since an iterable is likely to continue throwing after it throws once.
+						// If we continue calling `next()` indefinitely we will likely end up
+						// in an infinite loop of failed iteration.
+						try {
+							await next();
+						} catch (error) {
+							reject(error);
+						}
+					}
+				}
+			})();
+		};
+
+		// Create the concurrent runners in a detached (non-awaited)
+		// promise. We need this so we can await the `next()` calls
+		// to stop creating runners before hitting the concurrency limit
+		// if the iterable has already been marked as done.
+		// NOTE: We *must* do this for async iterators otherwise we'll spin up
+		// infinite `next()` calls by default and never start the event loop.
+		(async () => {
+			for (let index = 0; index < concurrency; index++) {
+				try {
+					// eslint-disable-next-line no-await-in-loop
+					await next();
+				} catch (error) {
+					reject(error);
+					break;
+				}
+
+				if (isIterableDone || isRejected) {
+					break;
+				}
+			}
+		})();
+	});
+}
+
+export function pMapIterable(
+	iterable,
+	mapper,
+	{
+		concurrency = Number.POSITIVE_INFINITY,
+		backpressure = concurrency,
+	} = {},
+) {
+	if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
+		throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
+	}
+
+	if (typeof mapper !== 'function') {
+		throw new TypeError('Mapper function is required');
+	}
+
+	if (!((Number.isSafeInteger(concurrency) && concurrency >= 1) || concurrency === Number.POSITIVE_INFINITY)) {
+		throw new TypeError(`Expected \`concurrency\` to be an integer from 1 and up or \`Infinity\`, got \`${concurrency}\` (${typeof concurrency})`);
+	}
+
+	if (!((Number.isSafeInteger(backpressure) && backpressure >= concurrency) || backpressure === Number.POSITIVE_INFINITY)) {
+		throw new TypeError(`Expected \`backpressure\` to be an integer from \`concurrency\` (${concurrency}) and up or \`Infinity\`, got \`${backpressure}\` (${typeof backpressure})`);
+	}
+
+	return {
+		async * [Symbol.asyncIterator]() {
+			const iterator = iterable[Symbol.asyncIterator] === undefined ? iterable[Symbol.iterator]() : iterable[Symbol.asyncIterator]();
+
+			const promises = [];
+			let pendingPromisesCount = 0;
+			let isDone = false;
+			let index = 0;
+
+			function trySpawn() {
+				if (isDone || !(pendingPromisesCount < concurrency && promises.length < backpressure)) {
+					return;
+				}
+
+				pendingPromisesCount++;
+
+				const promise = (async () => {
+					const {done, value} = await iterator.next();
+
+					if (done) {
+						pendingPromisesCount--;
+						return {done: true};
+					}
+
+					// Spawn if still below concurrency and backpressure limit
+					trySpawn();
+
+					try {
+						const currentIndex = index++;
+						const returnValue = await mapper(await value, currentIndex);
+
+						pendingPromisesCount--;
+
+						if (returnValue === pMapSkip) {
+							const index = promises.indexOf(promise);
+
+							if (index > 0) {
+								promises.splice(index, 1);
+							}
+						}
+
+						// Spawn if still below backpressure limit and just dropped below concurrency limit
+						trySpawn();
+
+						return {done: false, value: returnValue};
+					} catch (error) {
+						pendingPromisesCount--;
+						isDone = true;
+						return {error};
+					}
+				})();
+
+				promises.push(promise);
+			}
+
+			trySpawn();
+
+			while (promises.length > 0) {
+				const {error, done, value} = await promises[0]; // eslint-disable-line no-await-in-loop
+
+				promises.shift();
+
+				if (error) {
+					throw error;
+				}
+
+				if (done) {
+					return;
+				}
+
+				// Spawn if just dropped below backpressure limit and below the concurrency limit
+				trySpawn();
+
+				if (value === pMapSkip) {
+					continue;
+				}
+
+				yield value;
+			}
+		},
+	};
+}
+
+export const pMapSkip = Symbol('skip');

package/node_modules/p-map/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/node_modules/p-map/package.json

@@ -0,0 +1,57 @@
+{
+	"name": "p-map",
+	"version": "7.0.5",
+	"description": "Map over promises concurrently",
+	"license": "MIT",
+	"repository": "sindresorhus/p-map",
+	"funding": "https://github.com/sponsors/sindresorhus",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"type": "module",
+	"exports": {
+		"types": "./index.d.ts",
+		"default": "./index.js"
+	},
+	"sideEffects": false,
+	"engines": {
+		"node": ">=18"
+	},
+	"scripts": {
+		"test": "xo && ava && tsd"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"promise",
+		"map",
+		"resolved",
+		"wait",
+		"collection",
+		"iterable",
+		"iterator",
+		"race",
+		"fulfilled",
+		"async",
+		"await",
+		"promises",
+		"concurrently",
+		"concurrency",
+		"parallel",
+		"bluebird"
+	],
+	"devDependencies": {
+		"ava": "^5.2.0",
+		"chalk": "^5.3.0",
+		"delay": "^6.0.0",
+		"in-range": "^3.0.0",
+		"random-int": "^3.0.0",
+		"time-span": "^5.1.0",
+		"tsd": "^0.29.0",
+		"xo": "^0.56.0"
+	}
+}