@qihoo/tuitui-openclaw-channel 1.0.0

package/src/channel.ts

@@ -0,0 +1,1147 @@
+/**
+ * TuiTui Channel Plugin for OpenClaw.
+ *
+ * Implements the ChannelPlugin interface following the Synology Chat pattern.
+ * Supports single chat (text, image, voice, file) and group chat with @mentions.
+ */
+import WebSocket from 'ws';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import {
+  DEFAULT_ACCOUNT_ID,
+  setAccountEnabledInConfigSection,
+  deleteAccountFromConfigSection,
+  registerPluginHttpRoute,
+  buildChannelConfigSchema,
+} from 'openclaw/plugin-sdk';
+import { z } from 'zod';
+import type {
+  TuiTuiInboundMessage,
+  TuiTuiMessageData,
+  TuiTuiOutboundTextMessage,
+  TuiTuiOutboundImageMessage,
+  TuiTuiOutboundMessage,
+} from './types';
+import {
+  CHANNEL_ID,
+  CHANNEL_NAME,
+  TUITUI_SSRF_POLICY,
+  postTuituiMsg,
+  uploadMediaToTuiTui,
+  buildMessageBody,
+  tuituiEmojiReaction,
+} from "./utils";
+
+export const TuiTuiConfigSchema = buildChannelConfigSchema(
+  z
+    .object({
+      enabled: z.boolean().optional().describe('开启或关闭'),
+      appId: z.string().min(1).describe('推推机器人身份 AppId（你可以推推搜索【推推机器人助手】，和它聊天自助申请推推机器人）'),
+      appSecret: z.string().min(1).describe('推推机器人密钥 Secret'),
+      // 私聊策略（默认 pairing）
+      dmPolicy: z
+        .enum(['pairing', 'allowlist', 'open', 'disabled'])
+        .optional()
+        .default('pairing')
+        .describe('私聊策略：pairing=配对（默认）；allowlist=白名单；open=允许所有（不安全）；disabled=禁用私聊',),
+      // 私聊允许列表（当 dmPolicy=allowlist 生效；pairing 下也可显式允许）
+      allowFrom: z
+        .array(z.string())
+        .optional()
+        .describe('私聊白名单（dmPolicy=allowlist 时生效；pairing 下可用于显式放行用户）'),
+
+      // 群组策略
+      groupPolicy: z
+        .enum(['allowlist', 'disabled'])
+        .default('allowlist')
+        .describe('群聊策略：allowlist=白名单；disabled=禁用群聊',),
+      // 仅在 allowlist 生效的群组 ID 列表
+      groupAllowFrom: z
+        .array(z.string())
+        .optional()
+        .describe('群组白名单（仅在 groupPolicy=allowlist 生效）'),
+      // 每个群组的覆盖配置
+      /*
+      groups: z
+        .record(
+          z.string(),
+          z
+            .object({
+              requireMention: z
+                .boolean()
+                .optional()
+                .describe('该群组是否需要 @ 机器人才触发 Agent（默认 true）'),
+              shouldReply: z
+                .boolean()
+                .optional()
+                .describe('该群组是否允许 Agent 回复（默认 true）'),
+            })
+            .passthrough(),
+        )
+        .optional()
+        .describe('群组级覆盖配置'),
+        */
+    })
+    .passthrough() as any,
+);
+
+type TuiTuiConfig = any;
+
+function resolveAccount(cfg: any, accountId?: string | null) {
+  const channelConfig = cfg?.channels?.[CHANNEL_ID] ?? {};
+  const targetId = accountId ?? DEFAULT_ACCOUNT_ID;
+  const acct = targetId === DEFAULT_ACCOUNT_ID ? channelConfig : channelConfig.accounts?.[targetId];
+
+  return {
+    accountId: targetId,
+    enabled: acct?.enabled ?? false,
+    appId: acct?.appId as string | undefined,
+    appSecret: acct?.appSecret as string | undefined,
+    dmPolicy: acct?.dmPolicy ?? "pairing",
+    allowFrom: acct?.allowFrom ?? [],
+    // 群组策略与白名单、群组级覆盖
+    groupPolicy: (acct?.groupPolicy as string | undefined) ?? "allowlist",
+    groupAllowFrom: Array.isArray(acct?.groupAllowFrom) ? acct.groupAllowFrom : [],
+    groups: (acct?.groups as Record<string, { requireMention?: boolean }> | undefined) ?? {},
+  };
+}
+
+function isConfigured(account: any) {
+    return Boolean(
+      String(account?.appId ?? "").trim() &&
+      String(account?.appSecret ?? "").trim()
+    );
+  }
+
+export function createTuiTuiChannelPlugin(apiRuntime: any) {
+  return {
+    id: CHANNEL_ID,
+
+    meta: {
+      id: CHANNEL_ID,
+      label: CHANNEL_NAME,
+      selectionLabel: CHANNEL_NAME,
+      detailLabel: CHANNEL_NAME,
+      docsPath: `/channels/${CHANNEL_ID}`,
+      blurb: `Connect to ${CHANNEL_NAME} bot via WebSocket`,
+      order: 100,
+    },
+
+    capabilities: {
+      chatTypes: ["direct" as const, "group" as const],
+      media: true,
+      threads: false,
+      reactions: false,
+      edit: false,
+      unsend: false,
+      reply: true,
+      effects: false,
+      blockStreaming: false,
+    },
+
+    reload: { configPrefixes: [`channels.${CHANNEL_ID}`] },
+
+    configSchema: TuiTuiConfigSchema,
+
+    config: {
+      listAccountIds: (cfg: any) => {
+        const base = cfg?.channels?.[CHANNEL_ID];
+        if (!base) return [];
+        const ids = new Set<string>();
+        if (base.enabled !== undefined) {
+          ids.add(DEFAULT_ACCOUNT_ID);
+        }
+        if (base.accounts) {
+          for (const id of Object.keys(base.accounts)) ids.add(id);
+        }
+        return Array.from(ids);
+      },
+
+      resolveAccount: (cfg: any, accountId?: string | null) => resolveAccount(cfg, accountId),
+
+      defaultAccountId: (_cfg: any) => DEFAULT_ACCOUNT_ID,
+
+      isEnabled: (account: any) => account?.enabled !== false,
+
+      isConfigured,
+
+      describeAccount: (account: any) => ({
+        accountId: account?.accountId || DEFAULT_ACCOUNT_ID,
+        enabled: account?.enabled !== false,
+        configured: isConfigured(account),
+      }),
+
+      setAccountEnabled: ({ cfg, accountId, enabled }: any) => {
+        const channelConfig = cfg?.channels?.[CHANNEL_ID] ?? {};
+        if (accountId === DEFAULT_ACCOUNT_ID) {
+          return {
+            ...cfg,
+            channels: {
+              ...cfg.channels,
+              [CHANNEL_ID]: { ...channelConfig, enabled },
+            },
+          };
+        }
+        return setAccountEnabledInConfigSection({
+          cfg,
+          sectionKey: CHANNEL_ID,
+          accountId,
+          enabled,
+          allowTopLevel: true,
+        });
+      },
+
+      setAccountEnabled: ({ cfg, accountId, enabled }: any) => {
+        const channelConfig = cfg?.channels?.[CHANNEL_ID] ?? {};
+        if (accountId === DEFAULT_ACCOUNT_ID) {
+          return {
+            ...cfg,
+            channels: {
+              ...cfg.channels,
+              [CHANNEL_ID]: { ...channelConfig, enabled },
+            },
+          };
+        }
+        return setAccountEnabledInConfigSection({
+          cfg,
+          sectionKey: CHANNEL_ID,
+          accountId,
+          enabled,
+          allowTopLevel: true,
+        });
+      },
+
+      deleteAccount: ({ cfg, accountId }: any) => {
+        const channelConfig = cfg?.channels?.[CHANNEL_ID] ?? {};
+        if (accountId === DEFAULT_ACCOUNT_ID) {
+          // For default account, we don't delete the entire config
+          // Instead, we disable it and clear sensitive fields
+          return {
+            ...cfg,
+            channels: {
+              ...cfg.channels,
+              [CHANNEL_ID]: {
+                ...channelConfig,
+                enabled: false,
+                appId: undefined,
+                appSecret: undefined,
+              },
+            },
+          };
+        }
+        // For named accounts, use the standard delete function
+        return deleteAccountFromConfigSection({
+          cfg,
+          sectionKey: CHANNEL_ID,
+          accountId,
+          clearBaseFields: [
+            "appId",
+            "appSecret",
+            "dmPolicy",
+            "allowFrom",
+            "groupPolicy",
+            "groupAllowFrom",
+            "groups",
+          ],
+        });
+      },
+    },
+
+    pairing: {
+      idLabel: "tuituiUserId",
+      normalizeAllowEntry: (entry: string) => entry.toLowerCase().trim(),
+    },
+
+    status: {
+      buildAccountSnapshot: (params: any) => {
+        const account = params.account;
+        return {
+          ...params.runtime,
+          accountId: params.accountId ?? account?.accountId ?? DEFAULT_ACCOUNT_ID,
+          enabled: account?.enabled !== false,
+          configured: isConfigured(account),
+        };
+      },
+    },
+
+    security: {
+      resolveDmPolicy: ({
+        cfg,
+        accountId,
+        account: ctxAccount,
+      }: {
+        cfg: any;
+        accountId?: string | null;
+        account?: any;
+      }) => {
+        const account = ctxAccount ?? resolveAccount(cfg, accountId);
+        const resolvedAccountId = accountId ?? account.accountId ?? DEFAULT_ACCOUNT_ID;
+        const basePath =
+          resolvedAccountId === DEFAULT_ACCOUNT_ID
+            ? `channels.${CHANNEL_ID}.`
+            : `channels.${CHANNEL_ID}.accounts.${resolvedAccountId}.`;
+
+        const policy = account.dmPolicy ?? "pairing";
+        // dmPolicy semantics:
+        // - open: always allow everyone (["*"]), ignore allowFrom values.
+        // - pairing: unknown senders get a pairing code; approvals add to allowFrom store.
+        // - allowlist: only allow explicitly listed users in allowFrom.
+        // - disabled: block all DMs.
+        const allowFrom = policy === "open" ? ["*"] : (account.allowFrom ?? []);
+
+        return {
+          policy,
+          allowFrom,
+          policyPath: `${basePath}dmPolicy`,
+          allowFromPath: basePath,
+          approveHint: `openclaw pairing approve ${CHANNEL_ID} <code>`,
+          normalizeEntry: (raw: string) => raw.toLowerCase().trim(),
+        };
+      },
+    },
+
+    messaging: {
+      normalizeTarget: (target: string) => {
+        return target.trim();
+      },
+      targetResolver: {
+        looksLikeId: (id: string) => {
+          return Boolean(id && id.trim().length > 0);
+        },
+        hint: "<userId>",
+      },
+    },
+
+    directory: {
+      self: async () => null,
+      listPeers: async () => [],
+      listGroups: async () => [],
+    },
+
+    outbound: {
+      deliveryMode: "gateway" as const,
+      textChunkLimit: 2000,
+
+      sendText: async ({
+        cfg,
+        to,
+        text,
+        accountId,
+        account: ctxAccount,
+        log,
+      }: any) => {
+        const account = ctxAccount ?? resolveAccount(cfg, accountId);
+
+        console.log(`[${CHANNEL_ID}] sendText - to: ${to}, accountId: ${accountId}, text: ${text}; account: ${account}`);
+
+        if (!account.appId || !account.appSecret) {
+          throw new Error(`[${CHANNEL_ID}] appId and appSecret are required for sending text`);
+        }
+
+        // Determine if this is a group message based on 'to' being all digits (group) or not (direct)
+        const toStr = String(to ?? "").trim();
+        const isGroup = /^\d+$/.test(toStr);
+        const targetGroupId = isGroup ? toStr : undefined;
+        const targetUserId = isGroup ? undefined : toStr;
+
+        // Format message according to TuiTui's required structure
+        const payload: TuiTuiOutboundTextMessage = {
+          tousers: targetUserId ? [targetUserId] : [],
+          togroups: targetGroupId ? [targetGroupId] : [],
+          at: [],
+          msgtype: "text",
+          text: {
+            content: text,
+          },
+        };
+
+        log?.info?.(
+          `[${CHANNEL_ID}] sending text to TuiTui - 
+          account=${accountId ?? "default"},
+          to=${to},
+          target_users: [${payload.tousers.join(",")}],
+          target_groups: [${payload.togroups.join(",")}],
+          isGroup: ${isGroup},
+          textLength=${String(text ?? "").length}`
+        );
+
+        await postTuituiMsg(account, payload, 'tuitui.send.text', log);
+
+        return { channel: CHANNEL_ID, messageId: `tt-${Date.now()}`, chatId: to };
+      },
+
+      sendCustom: async ({
+        cfg,
+        to,
+        payload: customPayload,
+        accountId,
+        account: ctxAccount,
+        chatType,
+        groupId,
+        log,
+      }: any) => {
+        const account = ctxAccount ?? resolveAccount(cfg, accountId);
+
+        if (!account.appId || !account.appSecret) {
+          throw new Error(`[${CHANNEL_ID}] appId and appSecret are required for sending custom message`);
+        }
+
+        // Determine if this is a group message
+        // WORKAROUND: OpenClaw core doesn't pass chatType/groupId to sendPayload.
+        // If `to` is a numeric string and chatType/groupId are undefined, assume it's a group.
+        const toIsNumeric = typeof to === 'string' && /^\d+$/.test(to);
+        const inferredIsGroup = chatType === "group" || groupId || (toIsNumeric && chatType === undefined && groupId === undefined);
+        const isGroup = inferredIsGroup;
+        const targetGroupId = groupId || (isGroup ? to : undefined);
+        const targetUserId = isGroup ? undefined : to;
+
+        // If it's a page message, we need to construct it
+        if (customPayload?.msgtype === "page") {
+          const payload: any = {
+            tousers: targetUserId ? [targetUserId] : [],
+            togroups: targetGroupId ? [targetGroupId] : [],
+            msgtype: "page",
+            page: {
+              ...customPayload.page
+            }
+          };
+
+          if (customPayload.tousers) {
+            payload.tousers = customPayload.tousers;
+          }
+          if (customPayload.togroups) {
+            payload.togroups = customPayload.togroups;
+          }
+
+          log?.info?.(
+            `[${CHANNEL_ID}] sending page to TuiTui - 
+            target_users: [${payload.tousers.join(",")}], 
+            target_groups: [${payload.togroups.join(",")}], 
+            chatType: ${chatType ?? 'direct'},
+            account=${accountId ?? 'default'},
+            chatType=${chatType ?? 'direct'},
+            to=${to},
+            groupId=${groupId ?? '-'}`,
+          );
+
+          await postTuituiMsg(account, payload, 'tuitui.send.page', log);
+
+          return { channel: CHANNEL_ID, messageId: `tt-${Date.now()}`, chatId: to };
+        } else {
+          throw new Error(`[${CHANNEL_ID}] unsupported custom message type: ${customPayload?.msgtype}`);
+        }
+      },
+
+      sendMedia: async ({
+        cfg,
+        to,
+        mediaUrl,
+        accountId,
+        account: ctxAccount,
+        log,
+      }: any) => {
+        const account = ctxAccount ?? resolveAccount(cfg, accountId);
+
+        // sendMedia params sanitized; detailed logging added below
+
+        if (!account.appId || !account.appSecret) {
+          throw new Error(`[${CHANNEL_ID}] appId and appSecret are required for sending media`);
+        }
+
+        // Determine if this is a group message based on 'to' being all digits (group) or not (direct)
+        const toStr = String(to ?? "").trim();
+        const isGroup = /^\d+$/.test(toStr);
+        const targetGroupId = isGroup ? toStr : undefined;
+        const targetUserId = isGroup ? undefined : toStr;
+
+        // Detect image/file by URL pattern first; fallback to upload API type auto-detection when needed.
+        // NOTE: relying on `mediaUrl.includes("image")` is too broad and can misclassify files.
+        const isImageByExt = /\.(jpg|jpeg|png|gif|webp|bmp|svg)(?:$|[?#])/i.test(mediaUrl);
+        const isDataUrlImage = /^data:image\//i.test(mediaUrl);
+        const isImage = isImageByExt || isDataUrlImage;
+        const uploadType: "image" | "file" = isImage ? "image" : "file";
+
+        log?.debug?.(
+          `[${CHANNEL_ID}] sendMedia classify account=${accountId ?? "default"} to=${toStr} isGroup=${isGroup} mediaUrl=${mediaUrl} isImageByExt=${isImageByExt} isDataUrlImage=${isDataUrlImage} uploadType=${uploadType}`,
+        );
+
+        let payload: TuiTuiOutboundMessage;
+
+        const mediaId = await uploadMediaToTuiTui(
+          mediaUrl,
+          account.appId,
+          account.appSecret,
+          uploadType,
+        );
+        log?.debug?.(`[${CHANNEL_ID}] sendMedia upload done type=${uploadType} mediaId=${mediaId}`);
+
+        // Keep outbound msgtype consistent with upload type.
+        // 群消息：togroups 填群ID，tousers 是空数组；私聊：tousers 填 to；均不设置 at
+        payload =
+          uploadType === "image"
+            ? {
+              tousers: targetUserId ? [targetUserId] : [],
+              togroups: targetGroupId ? [targetGroupId] : [],
+              msgtype: "image",
+              image: {
+                media_id: mediaId,
+              },
+            }
+            : {
+              tousers: targetUserId ? [targetUserId] : [],
+              togroups: targetGroupId ? [targetGroupId] : [],
+              msgtype: "attachment",
+              attachment: {
+                media_id: mediaId,
+              },
+            };
+
+        const infoTousers = Array.isArray((payload as any).tousers) ? (payload as any).tousers : [];
+        const infoTogroups = Array.isArray((payload as any).togroups) ? (payload as any).togroups : [];
+        log?.info?.(
+          `[${CHANNEL_ID}] sending media to TuiTui - 
+          target_users: [${infoTousers.join(",")}],
+          target_groups: [${infoTogroups.join(",")}],
+          type: ${payload.msgtype},
+          isGroup=${isGroup},
+          msgtype=${payload.msgtype},
+          account=${accountId ?? "default"},
+          to=${to},
+          isGroup=${isGroup},
+          payload=${JSON.stringify(payload)},
+          targetGroupId=${targetGroupId},
+          targetUserId=${targetUserId},
+          uploadType=${uploadType},
+          mediaId=${mediaId}`
+        );
+
+        await postTuituiMsg(account, payload, 'tuitui.send.media', log);
+
+        return { channel: CHANNEL_ID, messageId: `tt-${Date.now()}`, chatId: to };
+      },
+    },
+
+    gateway: {
+      startAccount: async (ctx: any) => {
+        const { cfg, accountId, log, abortSignal, setStatus, getStatus } = ctx;
+        const _setStatus = (obj = {}) => {
+          if (!setStatus || !getStatus) return;
+          setStatus({ ...getStatus(), running: false, connected: false, ...obj });
+        };
+        const account = resolveAccount(cfg, accountId);
+
+        if (!account.enabled) {
+          log?.info?.(`[${CHANNEL_ID}] account ${accountId} is disabled, skipping`);
+          return _setStatus();
+        }
+
+        if (!isConfigured(account)) {
+          log?.warn?.(`[${CHANNEL_ID}] account ${accountId} not fully configured (missing appId/appSecret)`);
+          return _setStatus();
+        }
+
+        log?.info?.(`[${CHANNEL_ID}] Starting TuiTui channel (account: ${accountId})`);
+        _setStatus({ running: true });
+        let ws: any = null;
+        const wsUrl = `wss://im.live.360.cn:8282/robot/callback/ws?auth=${account.appId}.${account.appSecret}`;
+        const defSendMsg = (msg) => {
+          log?.info?.('[${CHANNEL_ID}] WebSocket.Error 环境未就绪，消息发送失败', msg);
+        };
+        let _sendMsg = defSendMsg;
+        const startWebSocket = () => {
+          log?.info?.(`[${CHANNEL_ID}] Registered WebSocket URL: ${wsUrl} for TuiTui`);
+          ws = new WebSocket(wsUrl, { rejectUnauthorized: true });
+          ws.on('open', () => {
+            log?.info?.(`[${CHANNEL_ID}] WebSocket connect success`);
+            _setStatus({ running: true, connected: true });
+            _sendMsg = (msg) => ws.send(msg);
+          });
+
+          // on receiving messages from tuitui websocket server
+          ws.on('message', async (wsData: string) => {
+            let json = null;
+            try {
+              json = JSON.parse(wsData);
+              // 收到任意消息则回复一下，权当“收到”
+              if (json.event_id) _sendMsg(`{ "ack": "${json.event_id}" }`);
+            } catch(err) {
+              log?.warn?.(`[${CHANNEL_ID}] WebSocket Message Is Invalid JSON: ${wsData}`);
+              return;
+            }
+            const wsEvent = json?.body?.event;
+            const isKeepalive = wsEvent === 'keepalive';
+
+            // 心跳日志太多了，滤掉，异常信息上面 JSON.parse catch 会输出
+            if (!isKeepalive) log?.info?.(`[${CHANNEL_ID}] Received TuiTui WebSocket message: ${wsData}`);
+
+            // 忽略无效信息、心跳信息
+            if (!json?.header || !wsEvent || isKeepalive) return;
+
+            // Preferred TuiTui signature validation:
+            // X-Tuitui-Robot-Checksum = sha1(app_secret + timestamp + nonce + raw_json_body)
+            // Also verifies appid in header matches configured appId.
+            const { appId, appSecret } = account;
+            if (appSecret) {
+              const hdAppId = json.header['X-Tuitui-Robot-Appid'];
+              const hdTs = json.header['X-Tuitui-Robot-Timestamp'];
+              const hdNonce = json.header['X-Tuitui-Robot-Nonce'];
+              const hdChecksum = json.header['X-Tuitui-Robot-Checksum'];
+
+              if (!hdAppId || !hdTs || !hdNonce || !hdChecksum) {
+                log?.info?.(`[${CHANNEL_ID}] Missing TuiTui authentication headers`);
+                return;
+              }
+
+              if (appId && hdAppId !== appId) {
+                log?.info?.(`[${CHANNEL_ID}] Invalid appId`);
+                return;
+              }
+            }
+
+            // Parse TuiTui message format
+            // userAccount: 推推用户账号，用于 tousers（发送消息的目标用户）
+            const msg = json.body as TuiTuiInboundMessage;
+            let userAccount: string | undefined;
+            let userName: string | undefined;
+            let userUid: string | undefined;
+            let chatType: "direct" | "group";
+            let text: string;
+            let groupId: string | undefined;
+            let groupName: string | undefined;
+            let mediaUrls: string[] | undefined;
+            let replyToId: string | undefined;
+            let suppressReply = false; // 是否抑制回复（用于 shouldReply: false 且没有 @ 机器人的情况）
+
+            // Handle different event types
+            if (wsEvent === 'single_chat' && msg.data) {
+              // Single chat message
+              userAccount = msg.user_account;
+              userUid = msg.uid;
+              userName = msg.user_name;
+              chatType = "direct";
+              text = buildMessageBody(msg.data);
+
+              log?.debug?.(
+                `[${CHANNEL_ID}] inbound single_chat user_account=${String(userAccount)} uid=${String(userUid)} user_name=${String(msg.user_name)}`,
+              );
+
+              // Extract media URLs for image/voice/file messages
+              if (
+                (msg.data.msg_type === "image" || msg.data.msg_type === "mixed") &&
+                msg.data.images?.length
+              ) {
+                mediaUrls = msg.data.images;
+              } else if (msg.data.msg_type === "voice" && msg.data.voice) {
+                mediaUrls = [msg.data.voice];
+              } else if (msg.data.msg_type === "file" && msg.data.file) {
+                mediaUrls = [msg.data.file.url];
+              }
+
+              // Handle reference/reply
+              if (msg.data.ref?.is_me && msg.data.ref.msgid) {
+                replyToId = msg.data.ref.msgid;
+              }
+
+              if (!userAccount && !userUid) {
+                log?.info?.(`[${CHANNEL_ID}] Missing user_account or uid in single_chat event`);
+                return;
+              }
+            } else if (wsEvent === "group_chat" && msg.data) {
+              // Group chat message - only process if bot is mentioned
+              userAccount = msg.user_account;
+              userUid = msg.uid;
+              userName = msg.user_name;
+              chatType = "group";
+              groupId = msg.data.group_id;
+              groupName = msg.data.group_name;
+
+              log?.debug?.(
+                `[${CHANNEL_ID}] inbound group_chat user_account=${String(userAccount)} uid=${String(userUid)} user_name=${String(msg.user_name)} group_id=${String(groupId)}`,
+              );
+
+              // Group policy gating and @mention requirements
+              const groupPolicy = String(account.groupPolicy ?? "allowlist").toLowerCase();
+              const groupAllowFromRaw = Array.isArray(account.groupAllowFrom) ? account.groupAllowFrom : [];
+              const normalizedGroupAllowFrom = groupAllowFromRaw
+                .filter((v: unknown) => v != null)
+                .map((v: unknown) => String(v).trim())
+                .filter(Boolean);
+              log?.debug?.(
+                `[${CHANNEL_ID}] groupPolicy=${groupPolicy} groupId=${String(groupId)} groupAllowFrom=${JSON.stringify(normalizedGroupAllowFrom)} at_me=${JSON.stringify(msg.data.at_me)} at=${JSON.stringify(msg.data.at)}`,
+              );
+
+              if (groupPolicy === "disabled") {
+                log?.info?.("Groups disabled");
+                return;
+              }
+     
+
+              // 群消息处理策略
+              const groupCfg = account.groups?.[String(groupId)];
+
+              // @机器人触发策略
+              let requireMention = true;
+              if (groupCfg && typeof groupCfg.requireMention === "boolean") {
+                requireMention = groupCfg.requireMention;
+              }
+
+              // 是否需要回复
+              let shouldReply = true;
+              if (groupCfg && typeof groupCfg.shouldReply === "boolean") {
+                shouldReply = groupCfg.shouldReply;
+              }
+
+              // 群消息处理逻辑：
+              // 1. requireMention: false, shouldReply: true  -> 接收所有群消息并自动回复（无论是否 @）
+              // 2. requireMention: true,  shouldReply: true  -> 仅当 @ 机器人时才触发 Agent 并回复，不 @ 的消息直接忽略
+              // 3. requireMention: true,  shouldReply: false -> 接收所有群消息触发 Agent，但仅当 @ 机器人时才回复
+
+              if (msg.data.at_me) {
+                // 消息中 @ 了机器人，必须触发 Agent 并回复（即使 shouldReply: false）
+                text = buildMessageBody(msg.data);
+                if (!userAccount || !groupId) {
+                  log?.info?.(`[${CHANNEL_ID}] Missing user_account or group_id in group_chat event`);
+                  return;
+                }
+                // 继续执行后续的 Agent 处理逻辑
+              } else if (!requireMention) {
+                // 消息中没有 @ 机器人，但配置为自动回复（无需 @）
+                // 触发 Agent 并回复
+                text = buildMessageBody(msg.data);
+                if (!userAccount || !groupId) {
+                  log?.info?.(`[${CHANNEL_ID}] Missing user_account or group_id in group_chat event`);
+                  return;
+                }
+                // 继续执行后续的 Agent 处理逻辑
+              } else if (!shouldReply) {
+                // 消息中没有 @ 机器人，requireMention=true，shouldReply=false
+                // 触发 Agent 但不回复（Agent 可以处理消息，但 deliver 不会发送回复）
+                text = buildMessageBody(msg.data);
+                suppressReply = true; // 标记为抑制回复
+                if (!userAccount || !groupId) {
+                  log?.info?.(`[${CHANNEL_ID}] Missing user_account or group_id in group_chat event`);
+                  return;
+                }
+                // 继续执行后续的 Agent 处理逻辑
+              } else {
+                // 默认情况：不 @ 机器人，requireMention=true，shouldReply=true
+                // 忽略消息
+                log?.info?.(`[${CHANNEL_ID}] ignore (not mentioned)`);
+                return;
+              }
+
+              if (!userAccount || !groupId) {
+                log?.info?.(`[${CHANNEL_ID}] Missing user_account or group_id in group_chat event`);
+                return;
+              }
+
+              if (
+                !normalizedGroupAllowFrom.includes(String(groupId))
+              ) {
+                log?.info?.(`[${CHANNEL_ID}] Group ${groupId} not allowed`);
+                
+                const payload: TuiTuiOutboundTextMessage = {
+                  tousers: [],
+                  togroups: [groupId],
+                  at: [],
+                  msgtype: "text",
+                  text: { content: `当前openclaw群聊策略为白名单，需要主人在群白名单(Group Allow From)增加当前群ID：\n${groupId}` },
+                };
+                await postTuituiMsg(account, payload, 'tuitui.groupPolicy.reply', log);
+                return;
+              }
+
+            } else {
+              log?.info?.(`[${CHANNEL_ID}] ignore unknown event ${wsEvent}`);
+              return;
+            }
+
+            // Enforce DM allowlist at ingress to guarantee closed policy blocks unauthorized senders.
+            // We intentionally enforce here (in addition to downstream guards) because plugin runtime
+            // paths may vary between local/dev/prod setups.
+
+            // DM access gating (pairing/allowlist/open/disabled)
+            const dmPolicy = String(account.dmPolicy ?? "pairing").toLowerCase();
+            const configuredAllowFrom = Array.isArray(account.allowFrom) ? account.allowFrom : [];
+            const normalizedAllowFrom = configuredAllowFrom
+              .filter((v: unknown) => v != null)
+              .map((v: unknown) => String(v).toLowerCase().trim())
+              .filter(Boolean);
+            // 只使用 userAccount 作为匹配依据，因为用户希望 allowFrom 匹配 user_account
+            const senderForPolicy = userAccount ? String(userAccount).toLowerCase().trim() : "";
+            log?.debug?.(
+              `[${CHANNEL_ID}] dmPolicy=${dmPolicy} userAccount=${String(userAccount)} userUid=${String(userUid)} senderForPolicy=${senderForPolicy} allowFrom=${JSON.stringify(normalizedAllowFrom)}`,
+            );
+
+            if (chatType === "direct") {
+              if (dmPolicy === "disabled") {
+                log?.warn?.(`[${CHANNEL_ID}] DM blocked (disabled) sender=${senderForPolicy}`);
+                return;
+              }
+
+              if (dmPolicy !== "open") {
+                // Merge pairing-store entries unless policy is allowlist-only
+                let storeAllowFrom: string[] = [];
+                try {
+                  if (dmPolicy !== "allowlist") {
+                    const entries = await apiRuntime?.channel?.pairing?.readAllowFromStore?.({
+                      channel: CHANNEL_ID,
+                      accountId: account.accountId,
+                    });
+                    if (Array.isArray(entries)) {
+                      storeAllowFrom = entries
+                        .map((v: unknown) => String(v).toLowerCase().trim())
+                        .filter(Boolean);
+                    }
+                  }
+                } catch {
+                  storeAllowFrom = [];
+                }
+
+                // 只检查 userAccount 是否在 allowFrom 或 storeAllowFrom 中
+                const allowSet = new Set([...normalizedAllowFrom, ...storeAllowFrom]);
+                const isAllowed = userAccount ? allowSet.has(senderForPolicy) : false;
+
+                if (!isAllowed) {
+                  if (dmPolicy === "pairing") {
+                    try {
+                      log?.debug?.(
+                        `[${CHANNEL_ID}] pairing flow: checking if pairing request exists for sender=${senderForPolicy}`,
+                      );
+                      const req = await apiRuntime?.channel?.pairing?.upsertPairingRequest?.({
+                        channel: CHANNEL_ID,
+                        accountId: account.accountId,
+                        id: senderForPolicy,
+                      });
+                      log?.debug?.(
+                        `[${CHANNEL_ID}] pairing flow: upsertPairingRequest result=${JSON.stringify(req)}`,
+                      );
+                      /***
+                       * 把 req?.created 注释掉。不然一旦发消息失败，就进入死局。
+                       * 删除这个标志，只要没配对，会每次和机器人聊，都会返回配对信息。
+                      */
+                      if (/*req?.created && */ account.appId && account.appSecret) {
+                        const replyText =
+                          apiRuntime?.channel?.pairing?.buildPairingReply?.({
+                            channel: CHANNEL_ID,
+                            code: req.code,
+                          }) ?? "Pairing required. Ask the bot owner to approve.";
+
+                        // tousers 使用 userAccount（推推用户账号）
+                        const pairingTarget = userAccount;
+                        log?.debug?.(
+                          `[${CHANNEL_ID}] pairing.reply target=${String(pairingTarget)}`,
+                        );
+                        const payload: TuiTuiOutboundTextMessage = {
+                          tousers: pairingTarget ? [String(pairingTarget)] : [],
+                          togroups: [],
+                          at: [],
+                          msgtype: "text",
+                          text: { content: replyText },
+                        };
+                        await postTuituiMsg(account, payload, 'tuitui.pairing.reply', log);
+                      }
+                    } catch (err) {
+                      log?.warn?.(
+                        `[${CHANNEL_ID}] pairing flow failed for ${senderForPolicy}: ${String(
+                          err,
+                        )}`,
+                      );
+                    }
+                    // Drop unauthorized DM after pairing challenge
+                    log?.info?.(`[${CHANNEL_ID}] pairing required`);
+                    return;
+                  }
+
+                  // dmPolicy=allowlist and sender not allowed
+                  log?.warn?.(
+                    `[${CHANNEL_ID}] Blocked unauthorized sender (allowlist): sender=${senderForPolicy} allowFrom=${JSON.stringify(
+                      normalizedAllowFrom,
+                    )}`,
+                  );
+                  return;
+                }
+              }
+            }
+
+            // 表情回复。因为回复较慢，所以先回复一个表情
+            if (chatType === "direct") {
+              await tuituiEmojiReaction(account.appId, account.appSecret, userAccount, false, msg.data.msgid, "收到")
+            } else if(chatType === "group") {
+              await tuituiEmojiReaction(account.appId, account.appSecret, groupId, true, msg.data.msgid, "收到")
+            }
+
+            // Build MsgContext
+            // 优先使用 userAccount，如果为空则降级使用 userUid
+            const senderId = userAccount || userUid || "unknown";
+            // 确保 accountId 有有效值，优先使用 account.accountId，其次使用 ctx 中的 accountId，最后使用 DEFAULT_ACCOUNT_ID
+
+            const effectiveAccountId = String(account.accountId || accountId || DEFAULT_ACCOUNT_ID || 'default');
+            const sessionKey = chatType === "group"
+              ? `${CHANNEL_ID}:${effectiveAccountId}:${groupId}`
+              : `${CHANNEL_ID}:${effectiveAccountId}:${senderId}`;
+            console.log(`[${CHANNEL_ID}] effectiveAccountId infos: 
+              account.accountId : ${account.accountId}, 
+              accountId: ${accountId}, 
+              DEFAULT_ACCOUNT_ID: ${DEFAULT_ACCOUNT_ID}, 
+              chatType: ${chatType},
+              sessionKey: ${sessionKey},
+              effectiveAccountId: ${effectiveAccountId},
+            `);
+
+            const msgCtx: any = {
+              Body: text || " ",
+              From: String(senderId),
+              To: CHANNEL_ID,
+              SessionId: String(sessionKey).replace(/\//g, "_"),
+              SessionKey: String(sessionKey).replace(/\//g, "_"),
+              AccountId: effectiveAccountId,
+              OriginatingChannel: CHANNEL_ID,
+              OriginatingTo: chatType === "group" ? String(groupId) : String(senderId),
+              ChatType: chatType,
+              Surface: CHANNEL_ID,
+              Provider: CHANNEL_ID,
+              SenderName: msg.user_name || String(senderId),
+            };
+
+            // Add group-specific fields
+            if (chatType === "group" && groupId) {
+              msgCtx.GroupSubject = groupName;
+              msgCtx.GroupId = groupId;
+            }
+
+            // Add media URLs if present
+            if (mediaUrls?.length) {
+              msgCtx.MediaUrls = mediaUrls;
+            }
+
+            // Add reply context if present
+            if (replyToId) {
+              msgCtx.ReplyToId = replyToId;
+            }
+
+            // Dispatch via the SDK's buffered block dispatcher
+            let sentCount = 0;
+            if (!apiRuntime) {
+              log?.error?.(`[${CHANNEL_ID}] TuiTuiRuntime error，未能发送回复。`);
+              return;
+            }
+            const currentCfg = await apiRuntime.config.loadConfig();
+            await apiRuntime.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
+              ctx: msgCtx,
+              cfg: currentCfg,
+              dispatcherOptions: {
+                deliver: async (payload: {
+                  text?: string;
+                  body?: string;
+                  mediaUrl?: string;
+                  mediaUrls?: string[];
+                  custom?: {
+                    msgtype: string;
+                    tousers?: string[];
+                    togroups?: string[];
+                    [key: string]: any;
+                  };
+                }) => {
+                  // mark that we received a deliver call (attempt to send reply)
+                  sentCount++;
+
+                  // 如果设置了 suppressReply 标志，则不发送回复
+                  if (suppressReply) {
+                    log?.debug?.(`[${CHANNEL_ID}] Reply suppressed by configuration (shouldReply: false)`);
+                    return;
+                  }
+
+                  // Handle custom messages (e.g., page messages)
+                  if (payload.custom) {
+                    try {
+                      const customPayload = payload.custom;
+
+                      // Handle page message type
+                      if (customPayload.msgtype === "page" && customPayload.page) {
+                        const pagePayload: any = {
+                          tousers: customPayload.tousers ?? (chatType === "direct" && userAccount ? [userAccount] : []),
+                          togroups: customPayload.togroups ?? (chatType === "group" && groupId ? [groupId] : []),
+                          msgtype: "page",
+                          page: customPayload.page,
+                        };
+
+                        log?.info?.(
+                          `[${CHANNEL_ID}] sending page reply to TuiTui - 
+                          target_users: [${pagePayload.tousers.join(",")}],
+                          target_groups: [${pagePayload.togroups.join(",")}]
+                          chatType=${chatType},
+                          tousers=${JSON.stringify(pagePayload.tousers)},
+                          togroups=${JSON.stringify(pagePayload.togroups)},
+                          title=${String(pagePayload?.page?.title ?? '')}`,
+                        );
+
+                        await postTuituiMsg(account, pagePayload, 'tuitui.deliver.page', log);
+                      } else {
+                        log?.warn?.(`[${CHANNEL_ID}] Unsupported custom message type: ${customPayload.msgtype}`);
+                      }
+                    } catch (e) {
+                      log?.error?.(`[${CHANNEL_ID}] Error sending custom reply to TuiTui: ${e}`);
+                    }
+                    return;
+                  }
+
+                  if (payload.mediaUrl || payload.mediaUrls?.length) {
+                    // Handle media messages
+                    const mediaUrl = payload.mediaUrl || payload.mediaUrls?.[0];
+                    if (mediaUrl) {
+                      try {
+                        if (!account.appId || !account.appSecret) {
+                          log?.error?.(`[${CHANNEL_ID}] Cannot send media: appId and appSecret are required`);
+                          return;
+                        }
+
+                        // Check if mediaUrl looks like an image
+                        const isImage = /\.(jpg|jpeg|png|gif|webp|bmp)$/i.test(mediaUrl);
+
+                        let mediaId: string;
+                        if (isImage) {
+                          mediaId = await uploadMediaToTuiTui(
+                            mediaUrl,
+                            account.appId,
+                            account.appSecret,
+                            "image",
+                          );
+                        } else {
+                          mediaId = await uploadMediaToTuiTui(
+                            mediaUrl,
+                            account.appId,
+                            account.appSecret,
+                            "file",
+                          );
+                        }
+
+                        // Build outbound message based on chat type
+                        // 群消息：togroups 填群ID，at 是 userAccount 的字符串值，tousers 是空数组
+                        // 私聊消息：tousers 填 userAccount，at 不存在，togroups 不存在
+                        const outboundMsg: TuiTuiOutboundImageMessage | TuiTuiOutboundAttachmentMessage =
+                          isImage
+                            ? {
+                                tousers: chatType === "group" ? [] : userAccount ? [userAccount] : [],
+                                togroups: chatType === "group" && groupId ? [groupId] : [],
+                                at: chatType === "group" && userAccount ? userAccount : undefined,
+                                msgtype: "image",
+                                image: {
+                                  media_id: mediaId,
+                                },
+                              }
+                            : {
+                                tousers: chatType === "group" ? [] : userAccount ? [userAccount] : [],
+                                togroups: chatType === "group" && groupId ? [groupId] : [],
+                                at: chatType === "group" && userAccount ? userAccount : undefined,
+                                msgtype: "attachment",
+                                attachment: {
+                                  media_id: mediaId,
+                                },
+                              };
+
+                        log?.info?.(
+                          `[${CHANNEL_ID}] sending media reply to TuiTui - 
+                          target_users: [${outboundMsg.tousers.join(",")}],
+                          target_groups: [${outboundMsg.togroups.join(",")}],
+                          type: ${outboundMsg.msgtype},
+                          to=${JSON.stringify(outboundMsg.tousers)},
+                          group=${JSON.stringify(outboundMsg.togroups)},
+                          msgtype=${outboundMsg.msgtype},
+                          chatType=${chatType},
+                          userAccount=${userAccount},
+                          groupId=${groupId},
+                          isImage=${isImage},
+                          outboundMsg.tousers=${JSON.stringify(outboundMsg.tousers)},
+                          outboundMsg.togroups=${JSON.stringify(outboundMsg.togroups)},
+                          outboundMsg.at=${outboundMsg.at}`
+                        );
+
+                        await postTuituiMsg(account, outboundMsg, 'tuitui.deliver.media', log);
+                      } catch (e) {
+                        log?.error?.(`[${CHANNEL_ID}] Error sending media reply to TuiTui: ${e}`);
+                      }
+                    }
+                  } else if (payload.text || payload.body) {
+                    // Handle text messages
+                    const replyText = payload?.text ?? payload?.body;
+                    if (replyText) {
+                      try {
+                        // Build outbound message based on chat type
+                        // tousers 使用 userAccount（推推用户账号）
+                        // at 使用 userAccount（群聊 @ 用户）
+                        // 群消息回复时不再使用 reference_msgid 避免并发时引用错乱，依靠 @ 来提醒用户
+                        const outboundMsg: TuiTuiOutboundTextMessage = {
+                          tousers: chatType === "direct" && userAccount ? [userAccount] : [],
+                          togroups: chatType === "group" && groupId ? [groupId] : [],
+                          at: chatType === "group" && userAccount ? [userAccount] : [],
+                          msgtype: "text",
+                          text: {
+                            content: replyText,
+                          },
+                        };
+
+                        log?.info?.(
+                          `[${CHANNEL_ID}] sending text reply to TuiTui - 
+                          target_users: [${outboundMsg.tousers.join(",")}],
+                          target_groups: [${outboundMsg.togroups.join(",")}]
+                          chatType=${chatType},
+                          tousers=${JSON.stringify(outboundMsg.tousers)},
+                          togroups=${JSON.stringify(outboundMsg.togroups)},
+                          at=${JSON.stringify((outboundMsg as any).at ?? [])},
+                          userAccount=${String(userAccount)},
+                          groupId=${String(groupId)}`,
+                        );
+
+                        await postTuituiMsg(account, outboundMsg, 'tuitui.deliver.text', log);
+                      } catch (e) {
+                        log?.error?.(`[${CHANNEL_ID}] Error sending reply to TuiTui: ${e}`);
+                      }
+                    }
+                  }
+                },
+                onReplyStart: () => {
+                  log?.info?.(`[${CHANNEL_ID}] Agent reply started for ${userAccount ?? userUid}`);
+                },
+              },
+            });
+          });
+          
+          const onErrOrClose = () => {
+            _setStatus({ running: false, connected: false });
+            _sendMsg = defSendMsg;
+            if (!abortSignal?.aborted) {
+              startWebSocket(); // 重启
+            }
+          };
+          ws.on('close', () => {
+            log?.info?.(`[${CHANNEL_ID}] WebSocket closed`);
+            onErrOrClose();
+          });
+
+          // on socket errors
+          ws.on('error', (err) => {
+            log?.warn?.(`[${CHANNEL_ID}] WebSocket error: ${err}`);
+            onErrOrClose();
+          });
+        };
+        startWebSocket();
+
+        // Keep the account running until abortSignal is triggered
+        await new Promise<void>((resolve) => {
+          const _onAbort = () => {
+            log?.info?.(`[${CHANNEL_ID}] AccountId ${accountId} stopping (abort signal)`);
+            ws && ws.close();
+            resolve();
+          };
+          if (abortSignal?.aborted) return _onAbort();
+          abortSignal?.addEventListener("abort", _onAbort, { once: true });
+        });
+      },
+
+      stopAccount: async (ctx: any) => {
+        ctx.log?.info?.(`[${CHANNEL_ID}] AccountId ${ctx.accountId} stopped`);
+        ctx.setStatus?.({ ...ctx.getStatus?.(), running: false, connected: false });
+      },
+    },
+  };
+}