@qwen-code/qwen-code 0.19.5 → 0.19.6-nightly.20260704.5dc2e1501

package/chunks/{dist-AP5V4WYU.js → dist-AAO65DPC.js}

@@ -3,8 +3,8 @@
 import {
   ChannelBase,
   isTerminalTaskLifecycleType
-} from "./chunk-7DMQRPC7.js";
-import "./chunk-UFC57OYT.js";
+} from "./chunk-6BEOH4KK.js";
+import "./chunk-VRDMOSQS.js";
 import "./chunk-K5PGHDBN.js";
 import {
   require_abort_controller,

package/chunks/{dist-X4ZDE726.js → dist-ABQ7VWRR.js}

@@ -11,12 +11,12 @@ import {
   sendMessage,
   sendTyping,
   uploadToCdn
-} from "./chunk-5B2WNM6V.js";
+} from "./chunk-ZI4MGBB5.js";
 import {
   ChannelBase,
   isTerminalTaskLifecycleType
-} from "./chunk-7DMQRPC7.js";
-import "./chunk-UFC57OYT.js";
+} from "./chunk-6BEOH4KK.js";
+import "./chunk-VRDMOSQS.js";
 import "./chunk-K5PGHDBN.js";
 import {
   init_esbuild_shims

package/chunks/{dist-SNXOUPYS.js → dist-AW5ZYMUI.js}

@@ -11,8 +11,8 @@ import {
   isTerminalTaskLifecycleType,
   sanitizeLogText,
   sanitizeSenderName
-} from "./chunk-7DMQRPC7.js";
-import "./chunk-UFC57OYT.js";
+} from "./chunk-6BEOH4KK.js";
+import "./chunk-VRDMOSQS.js";
 import "./chunk-K5PGHDBN.js";
 import "./chunk-UWCTAVOD.js";
 import {

package/chunks/{dist-Z57Q4YF5.js → dist-BV56HW3W.js}

@@ -7,8 +7,8 @@ import {
   sanitizeLogText,
   sanitizePromptText,
   sanitizeSenderName
-} from "./chunk-7DMQRPC7.js";
-import "./chunk-UFC57OYT.js";
+} from "./chunk-6BEOH4KK.js";
+import "./chunk-VRDMOSQS.js";
 import "./chunk-K5PGHDBN.js";
 import {
   wrapper_default
@@ -1114,7 +1114,7 @@ init_esbuild_shims();
 
 // packages/channels/qqbot/dist/QQChannel.js
 init_esbuild_shims();
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, renameSync, unlinkSync } from "node:fs";
 import { join as join2 } from "node:path";
 
 // packages/channels/qqbot/dist/types.js
@@ -1351,8 +1351,11 @@ async function fetchAccessToken(appId, appSecret) {
     signal: AbortSignal.timeout(FETCH_TIMEOUT)
   });
   if (!resp.ok) {
-    const body = await resp.text().catch(() => "");
-    throw new Error(`QQ Bot token request failed (HTTP ${resp.status}): ${body}`);
+    await resp.body?.cancel().catch(() => {
+    });
+    process.stderr.write(`[QQ] Token request failed (HTTP ${resp.status})
+`);
+    throw new Error(`QQ Bot token request failed (HTTP ${resp.status})`);
   }
   const data = await resp.json();
   if (!data.access_token) {
@@ -1364,6 +1367,27 @@ async function fetchAccessToken(appId, appSecret) {
   };
 }
 __name(fetchAccessToken, "fetchAccessToken");
+function validateGatewayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "wss:") {
+      throw new Error(`QQ Bot gateway URL must use wss:// protocol, got: ${parsed.protocol}`);
+    }
+    if (!parsed.hostname.toLowerCase().endsWith(".qq.com")) {
+      throw new Error(`QQ Bot gateway URL has unexpected hostname: ${parsed.hostname} (expected *.qq.com)`);
+    }
+    const clean = new URL(url);
+    clean.username = "";
+    clean.password = "";
+    return clean.href;
+  } catch (e) {
+    if (e instanceof TypeError) {
+      throw new Error("QQ Bot gateway URL is not a valid URL");
+    }
+    throw e;
+  }
+}
+__name(validateGatewayUrl, "validateGatewayUrl");
 async function fetchGatewayUrl(accessToken, sandbox) {
   const gw = sandbox ? `${SANDBOX_HOST}/gateway` : `${API_HOST}/gateway`;
   const resp = await fetch(gw, {
@@ -1371,13 +1395,15 @@ async function fetchGatewayUrl(accessToken, sandbox) {
     signal: AbortSignal.timeout(FETCH_TIMEOUT)
   });
   if (!resp.ok) {
+    await resp.body?.cancel().catch(() => {
+    });
     throw new Error(`QQ Bot gateway request failed (HTTP ${resp.status})`);
   }
   const data = await resp.json();
   if (!data["url"]) {
     throw new Error("QQ Bot gateway response missing WebSocket URL");
   }
-  return data["url"];
+  return validateGatewayUrl(data["url"]);
 }
 __name(fetchGatewayUrl, "fetchGatewayUrl");
 function getApiBase(sandbox) {
@@ -1402,32 +1428,7 @@ function isValidChatId(id) {
   return /^[A-Za-z0-9_-]+$/.test(id) && id.length <= 128;
 }
 __name(isValidChatId, "isValidChatId");
-function hasLinkSyntax(text) {
-  const open = text.indexOf("[");
-  if (open === -1)
-    return false;
-  const mid = text.indexOf("](", open + 1);
-  if (mid === -1)
-    return false;
-  return text.indexOf(")", mid + 2) !== -1;
-}
-__name(hasLinkSyntax, "hasLinkSyntax");
-function hasMarkdownSyntax(text) {
-  return /^#{1,6}\s/m.test(text) || text.includes("```") || /\*\*|__|~~/.test(text) || /`[^`]+`/.test(text) || hasLinkSyntax(text) || /^[-*+]\s/m.test(text) || /^\d+\.\s/m.test(text);
-}
-__name(hasMarkdownSyntax, "hasMarkdownSyntax");
-function splitText(text) {
-  const MAX = 2e3;
-  if (text.length <= MAX)
-    return [text];
-  const chunks = [];
-  for (let i = 0; i < text.length; i += MAX) {
-    chunks.push(text.slice(i, i + MAX));
-  }
-  return chunks;
-}
-__name(splitText, "splitText");
-var QQChannel = class extends ChannelBase {
+var QQChannel = class _QQChannel extends ChannelBase {
   static {
     __name(this, "QQChannel");
   }
@@ -1459,6 +1460,8 @@ var QQChannel = class extends ChannelBase {
   lastHeartbeatAck = 0;
   /** Debounce timer for saveQQState to avoid blocking event loop. */
   saveTimer = null;
+  /** beforeExit hook to flush state when the event loop drains naturally. Does NOT fire for SIGKILL, OOM kills, or uncaughtException. */
+  beforeExitHook = null;
   /** Timer for reconnectWithRetry fallback (unref'd so it doesn't block exit). */
   reconnectTimer = null;
   /** Guard against parallel reconnectWithRetry chains from stale close events. */
@@ -1469,6 +1472,10 @@ var QQChannel = class extends ChannelBase {
   replyMsgId = /* @__PURE__ */ new Map();
   /** msg_seq counter per user messageId, for multi-block streaming. */
   msgSeqMap = /* @__PURE__ */ new Map();
+  /** Periodic cleanup timer for expired replyMsgId entries. */
+  replyMsgIdCleanupTimer = null;
+  /** 5-minute TTL for replyMsgId entries and seenMessages dedup. */
+  static REPLY_MSG_ID_TTL_MS = 3e5;
   /** Path to persisted QQ routing state: chatTypeMap, replyMsgId, msgSeqMap. */
   qqStatePath;
   /**
@@ -1504,71 +1511,145 @@ var QQChannel = class extends ChannelBase {
         "## QQ Bot Channel",
         "",
         "\u4F60\u662F\u901A\u8FC7 QQ Bot \u4E0E\u7528\u6237\u5BF9\u8BDD\u7684 AI \u52A9\u624B\u3002",
-        "\u56DE\u590D\u63A7\u5236\u5728 2000 \u5B57\u7B26\u4EE5\u5185\uFF08\u8D85\u957F\u4F1A\u81EA\u52A8\u5206\u5757\uFF09\uFF0C\u652F\u6301 Markdown \u683C\u5F0F\u3002"
+        "\u56DE\u590D\u63A7\u5236\u5728 2000 \u5B57\u7B26\u4EE5\u5185\uFF0C\u652F\u6301 Markdown \u683C\u5F0F\u3002"
       ].join("\n");
     }
     for (let attempt = 0; attempt < 3; attempt++) {
       try {
         await this.fetchToken();
         await this.connectGateway();
+        if (this.beforeExitHook) {
+          process.off("beforeExit", this.beforeExitHook);
+        }
+        this.beforeExitHook = () => this.flushQQState();
+        process.on("beforeExit", this.beforeExitHook);
+        this.startReplyMsgIdCleanup();
         return;
       } catch (e) {
         if (attempt < 2) {
           const msg = e instanceof Error ? e.message : String(e);
-          process.stderr.write(`[QQ:${this.name}] Connect attempt ${attempt + 1} failed: ${msg}, retrying...
+          process.stderr.write(`[QQ:${this.name}] Connect attempt ${attempt + 1} failed: ${sanitizeLogText(msg, 200)}, retrying...
 `);
           await this.sleep(2e3);
         } else {
-          throw e;
+          throw new Error(sanitizeLogText(e instanceof Error ? e.message : String(e), 200), { cause: e });
         }
       }
     }
   }
   async sendMessage(chatId, text) {
+    if (text.trim() === "<noreply>") {
+      process.stderr.write(`[QQ:${this.name}] <noreply> skipped for ${sanitizeLogText(chatId, 64)}
+`);
+      return;
+    }
     const route = await this.resolveRoute(chatId);
     if (!route)
       return;
-    const msgId = this.replyMsgId.get(chatId);
-    const useMarkdown = hasMarkdownSyntax(text);
-    for (const chunk of splitText(text)) {
-      try {
-        const body = useMarkdown ? { msg_type: 2, markdown: { content: chunk } } : { content: chunk, msg_type: 0 };
-        const nextSeq = msgId ? (this.msgSeqMap.get(msgId) ?? 0) + 1 : 0;
-        if (msgId) {
-          body["msg_id"] = msgId;
-          body["msg_seq"] = nextSeq;
-        }
-        let resp = await sendQQMessage(route.base, route.path, this.accessToken, body);
-        if (!resp.ok && useMarkdown) {
-          const errBody = await resp.text().catch(() => "");
-          process.stderr.write(`[QQ:${this.name}] Markdown rejected (HTTP ${resp.status}: ${errBody.slice(0, 100)}), retrying as plain text
+    const entry = this.replyMsgId.get(chatId);
+    const msgId = entry && Date.now() - entry.timestamp < _QQChannel.REPLY_MSG_ID_TTL_MS ? entry.msgId : void 0;
+    if (entry && !msgId) {
+      process.stderr.write(`[QQ:${this.name}] replyMsgId entry expired for ${sanitizeLogText(chatId, 64)}, reply context expired, sending without msg_id
+`);
+      this.msgSeqMap.delete(entry.msgId);
+      this.replyMsgId.delete(chatId);
+      this.saveQQState();
+    }
+    let nextSeq = 0;
+    let rollbackApplied = false;
+    try {
+      const body = {
+        msg_type: 2,
+        markdown: { content: text }
+      };
+      nextSeq = msgId ? (this.msgSeqMap.get(msgId) ?? 0) + 1 : 0;
+      if (msgId) {
+        this.msgSeqMap.set(msgId, nextSeq);
+        body["msg_id"] = msgId;
+        body["msg_seq"] = nextSeq;
+      }
+      const resp = await sendQQMessage(route.base, route.path, this.accessToken, body);
+      if (!resp.ok) {
+        const errBody = await resp.text().catch(() => "");
+        process.stderr.write(`[QQ:${this.name}] Send failed (HTTP ${resp.status}: ${sanitizeLogText(errBody, 200)})
+`);
+        if (resp.status === 429) {
+          process.stderr.write(`[QQ:${this.name}] MESSAGE DROPPED: rate-limited (429) on markdown attempt for ${sanitizeLogText(chatId, 64)}
 `);
-          const plainBody = {
-            content: chunk,
-            msg_type: 0
-          };
           if (msgId) {
-            plainBody["msg_id"] = msgId;
-            plainBody["msg_seq"] = nextSeq;
+            this.msgSeqMap.set(msgId, nextSeq - 1);
+            this.saveQQState();
           }
-          resp = await sendQQMessage(route.base, route.path, this.accessToken, plainBody);
+          return;
         }
-        if (!resp.ok) {
-          const errBody = await resp.text().catch(() => "");
-          process.stderr.write(`[QQ:${this.name}] Send HTTP ${resp.status} (msg_seq=${body["msg_seq"] ?? "-"}): ${errBody.slice(0, 200)}
+        if (msgId) {
+          this.msgSeqMap.set(msgId, nextSeq - 1);
+          rollbackApplied = true;
+          const activeBody = {
+            content: text,
+            msg_type: 0,
+            msg_id: msgId,
+            msg_seq: nextSeq
+          };
+          const activeResp = await sendQQMessage(route.base, route.path, this.accessToken, activeBody);
+          if (activeResp.ok) {
+            process.stderr.write(`[QQ:${this.name}] Active retry succeeded for ${sanitizeLogText(chatId, 64)}
 `);
-          break;
+            const current = this.replyMsgId.get(chatId);
+            if (current?.msgId === msgId) {
+              this.msgSeqMap.set(msgId, nextSeq);
+            }
+            this.saveQQState();
+            await activeResp.text().catch(() => "");
+            return;
+          }
+          process.stderr.write(`[QQ:${this.name}] Active retry also failed (HTTP ${activeResp.status}: ${sanitizeLogText(await activeResp.text().catch(() => ""), 200)})
+`);
+          if (activeResp.status === 429) {
+            process.stderr.write(`[QQ:${this.name}] MESSAGE DROPPED: active retry rate-limited (HTTP 429) for ${sanitizeLogText(chatId, 64)}
+`);
+            this.saveQQState();
+            return;
+          }
+          process.stderr.write(`[QQ:${this.name}] MESSAGE DROPPED: both passive and active send failed for ${sanitizeLogText(chatId, 64)}
+`);
+          this.saveQQState();
+          return;
         }
-        if (msgId)
-          this.msgSeqMap.set(msgId, nextSeq);
-      } catch (e) {
-        process.stderr.write(`[QQ:${this.name}] Send error: ${e}
+        const plainBody = {
+          content: text,
+          msg_type: 0
+        };
+        const fallbackRes = await sendQQMessage(route.base, route.path, this.accessToken, plainBody);
+        if (!fallbackRes.ok) {
+          const fbErrBody = await fallbackRes.text().catch(() => "");
+          if (fallbackRes.status === 429) {
+            process.stderr.write(`[QQ:${this.name}] MESSAGE DROPPED: rate-limited (429) on plain-text fallback for ${sanitizeLogText(chatId, 64)}
 `);
-        break;
+            return;
+          }
+          process.stderr.write(`[QQ:${this.name}] MESSAGE DROPPED: plain-text fallback failed (HTTP ${fallbackRes.status}: ${sanitizeLogText(fbErrBody, 200)}) for ${sanitizeLogText(chatId, 64)}
+`);
+          return;
+        }
+        process.stderr.write(`[QQ:${this.name}] Plain-text fallback succeeded for ${sanitizeLogText(chatId, 64)}
+`);
+        await fallbackRes.text().catch(() => "");
+        return;
       }
+      await resp.text().catch(() => "");
+      if (msgId)
+        this.saveQQState();
+    } catch (e) {
+      if (msgId && !rollbackApplied) {
+        this.msgSeqMap.set(msgId, nextSeq - 1);
+      }
+      if (msgId)
+        this.saveQQState();
+      process.stderr.write(`[QQ:${this.name}] Send error: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
+`);
+      throw e;
     }
-    if (msgId)
-      this.saveQQState();
   }
   /**
    * Resolve API routing: handles disposed check, token refresh, chatId validation,
@@ -1594,6 +1675,7 @@ var QQChannel = class extends ChannelBase {
     this.disposed = true;
     this.stopHeartbeat();
     this.stopTokenRefresh();
+    this.stopReplyMsgIdCleanup();
     if (this.seenCleanupTimer) {
       clearInterval(this.seenCleanupTimer);
       this.seenCleanupTimer = null;
@@ -1602,6 +1684,10 @@ var QQChannel = class extends ChannelBase {
       clearTimeout(this.reconnectTimer);
       this.reconnectTimer = null;
     }
+    if (this.beforeExitHook) {
+      process.off("beforeExit", this.beforeExitHook);
+      this.beforeExitHook = null;
+    }
     this.flushQQState();
     this.backupGlobalSessions();
     if (this.ws) {
@@ -1628,18 +1714,31 @@ var QQChannel = class extends ChannelBase {
   // ── State Persistence (cross-server context continuation) ──────
   /** Debounced state persistence to avoid blocking event loop. */
   saveQQState() {
+    if (this.disposed)
+      return;
     if (this.saveTimer)
       clearTimeout(this.saveTimer);
+    const tmpPath = this.qqStatePath + ".tmp";
     this.saveTimer = setTimeout(() => {
+      if (this.disposed)
+        return;
       try {
-        writeFileSync2(this.qqStatePath, JSON.stringify({
+        writeFileSync2(tmpPath, JSON.stringify({
           chatTypeMap: Array.from(this.chatTypeMap.entries()),
           replyMsgId: Array.from(this.replyMsgId.entries()),
           msgSeqMap: Array.from(this.msgSeqMap.entries())
         }), { mode: 384 });
-      } catch {
+        renameSync(tmpPath, this.qqStatePath);
+      } catch (e) {
+        try {
+          unlinkSync(tmpPath);
+        } catch {
+        }
+        process.stderr.write(`[QQ:${this.name}] saveQQState write failed: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
+`);
       }
     }, 500);
+    this.saveTimer.unref();
   }
   /** Flush pending state writes immediately (called on disconnect). */
   flushQQState() {
@@ -1647,35 +1746,78 @@ var QQChannel = class extends ChannelBase {
       clearTimeout(this.saveTimer);
       this.saveTimer = null;
     }
+    const tmpPath = this.qqStatePath + ".tmp";
     try {
-      writeFileSync2(this.qqStatePath, JSON.stringify({
+      writeFileSync2(tmpPath, JSON.stringify({
         chatTypeMap: Array.from(this.chatTypeMap.entries()),
         replyMsgId: Array.from(this.replyMsgId.entries()),
         msgSeqMap: Array.from(this.msgSeqMap.entries())
-      }));
-    } catch {
+      }), { mode: 384 });
+      renameSync(tmpPath, this.qqStatePath);
+    } catch (e) {
+      try {
+        unlinkSync(tmpPath);
+      } catch {
+      }
+      process.stderr.write(`[QQ:${this.name}] flushQQState write failed: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
+`);
     }
   }
   /**
    * Restore QQ routing state from disk.
-   * Trusts persisted JSON — if the file is corrupt, new Map() may create
-   * entries with undefined values, causing get()===undefined to fall through
-   * to default routing (C2C). This is acceptable for a rare edge case.
+   * Validates and filters every entry on restore — corrupt or unexpected
+   * entries (e.g. unknown chat types, oversized replyMsgIds, negative seqs)
+   * are silently dropped so they don't propagate into runtime routing.
    */
   restoreQQState() {
     try {
       if (!existsSync2(this.qqStatePath))
         return false;
       const raw = JSON.parse(readFileSync2(this.qqStatePath, "utf-8"));
-      if (raw.chatTypeMap)
-        this.chatTypeMap = new Map(raw.chatTypeMap);
-      if (raw.replyMsgId)
-        this.replyMsgId = new Map(raw.replyMsgId);
-      if (raw.msgSeqMap)
-        this.msgSeqMap = new Map(raw.msgSeqMap);
+      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        process.stderr.write(`[QQ:${this.name}] Invalid QQ state file (not an object), ignoring
+`);
+        return false;
+      }
+      if (raw.chatTypeMap && Array.isArray(raw.chatTypeMap)) {
+        const rawCT = raw.chatTypeMap;
+        this.chatTypeMap = new Map(rawCT.filter(([k, v]) => typeof k === "string" && k.length <= 256 && (v === "c2c" || v === "group")));
+        const dropped = rawCT.length - this.chatTypeMap.size;
+        if (dropped > 0)
+          process.stderr.write(`[QQ:${this.name}] Dropped ${dropped} invalid chatTypeMap entries during restore
+`);
+      }
+      if (raw.replyMsgId && Array.isArray(raw.replyMsgId)) {
+        const now = Date.now();
+        const rawRM = raw.replyMsgId;
+        this.replyMsgId = new Map(rawRM.map(([k, v]) => (
+          // Old format: string -> { msgId: v, timestamp: now }
+          // New format: { msgId, timestamp } -> pass through
+          typeof v === "string" ? [k, { msgId: v, timestamp: now }] : [k, v]
+        )).filter(([k, v]) => {
+          if (typeof k !== "string" || k.length > 256)
+            return false;
+          if (typeof v !== "object" || v === null)
+            return false;
+          const entry = v;
+          return typeof entry.msgId === "string" && entry.msgId.length <= 128 && typeof entry.timestamp === "number" && Number.isFinite(entry.timestamp) && entry.timestamp <= now + _QQChannel.REPLY_MSG_ID_TTL_MS;
+        }));
+        const dropped = rawRM.length - this.replyMsgId.size;
+        if (dropped > 0)
+          process.stderr.write(`[QQ:${this.name}] Dropped ${dropped} invalid replyMsgId entries during restore
+`);
+      }
+      if (raw.msgSeqMap && Array.isArray(raw.msgSeqMap)) {
+        const rawMS = raw.msgSeqMap;
+        this.msgSeqMap = new Map(rawMS.filter(([k, v]) => typeof k === "string" && k.length <= 256 && typeof v === "number" && Number.isSafeInteger(v) && v >= 0));
+        const dropped = rawMS.length - this.msgSeqMap.size;
+        if (dropped > 0)
+          process.stderr.write(`[QQ:${this.name}] Dropped ${dropped} invalid msgSeqMap entries during restore
+`);
+      }
       return true;
     } catch (e) {
-      process.stderr.write(`[QQ:${this.name}] Failed to restore QQ state: ${e instanceof Error ? e.message : String(e)}
+      process.stderr.write(`[QQ:${this.name}] Failed to restore QQ state: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
 `);
       return false;
     }
@@ -1744,6 +1886,47 @@ var QQChannel = class extends ChannelBase {
     } catch {
     }
   }
+  // ── ReplyMsgId helpers ────────────────────────────────────────
+  /**
+   * Set replyMsgId for a chat, cleaning up the previous entry's msgSeqMap
+   * to prevent orphaned entries accumulating over time.
+   */
+  setReplyMsgId(chatId, msgId) {
+    const oldEntry = this.replyMsgId.get(chatId);
+    if (oldEntry && oldEntry.msgId !== msgId) {
+      this.msgSeqMap.delete(oldEntry.msgId);
+    }
+    this.replyMsgId.set(chatId, { msgId, timestamp: Date.now() });
+    this.saveQQState();
+  }
+  /**
+   * Start periodic cleanup of expired replyMsgId entries.
+   * Evicts entries older than 5 minutes every 60 seconds, and cascades
+   * to msgSeqMap.
+   */
+  startReplyMsgIdCleanup() {
+    this.stopReplyMsgIdCleanup();
+    this.replyMsgIdCleanupTimer = setInterval(() => {
+      const cutoff = Date.now() - _QQChannel.REPLY_MSG_ID_TTL_MS;
+      let dirty = false;
+      for (const [chatId, entry] of this.replyMsgId) {
+        if (entry.timestamp < cutoff) {
+          this.msgSeqMap.delete(entry.msgId);
+          this.replyMsgId.delete(chatId);
+          dirty = true;
+        }
+      }
+      if (dirty)
+        this.saveQQState();
+    }, 6e4);
+    this.replyMsgIdCleanupTimer.unref();
+  }
+  stopReplyMsgIdCleanup() {
+    if (this.replyMsgIdCleanupTimer) {
+      clearInterval(this.replyMsgIdCleanupTimer);
+      this.replyMsgIdCleanupTimer = null;
+    }
+  }
   // ── Token ──────────────────────────────────────────────────────
   async fetchToken() {
     const safeName = this.name.replace(/[^A-Za-z0-9_-]/g, "_");
@@ -1785,7 +1968,7 @@ var QQChannel = class extends ChannelBase {
         this.fetchToken().catch((e) => {
           if (this.disposed)
             return;
-          process.stderr.write(`[QQ:${this.name}] Token refresh failed: ${e}, retrying in 60s
+          process.stderr.write(`[QQ:${this.name}] Token refresh failed: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}, retrying in 60s
 `);
           this.scheduleTokenRefreshRetry();
         });
@@ -1800,7 +1983,7 @@ var QQChannel = class extends ChannelBase {
       this.fetchToken().catch((e) => {
         if (this.disposed)
           return;
-        process.stderr.write(`[QQ:${this.name}] Token refresh failed: ${e}, retrying in 60s
+        process.stderr.write(`[QQ:${this.name}] Token refresh failed: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}, retrying in 60s
 `);
         this.scheduleTokenRefreshRetry();
       });
@@ -1834,7 +2017,7 @@ var QQChannel = class extends ChannelBase {
         const msg = JSON.parse(data.toString());
         this.handleGatewayMessage(msg, resolve);
       } catch (e) {
-        process.stderr.write(`[QQ:${this.name}] Malformed gateway message: ${e instanceof Error ? e.message : String(e)}
+        process.stderr.write(`[QQ:${this.name}] Malformed gateway message: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
 `);
       }
     });
@@ -1874,7 +2057,7 @@ var QQChannel = class extends ChannelBase {
       }
     });
     this.ws.on("error", (e) => {
-      process.stderr.write(`[QQ:${this.name}] WebSocket error: ${e.message}
+      process.stderr.write(`[QQ:${this.name}] WebSocket error: ${sanitizeLogText(e.message, 200)}
 `);
       if (!this.ws || this.ws.readyState !== wrapper_default.OPEN) {
         reject(e);
@@ -2002,7 +2185,7 @@ var QQChannel = class extends ChannelBase {
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         const backoff = Math.min(1e3 * 2 ** (attempt + 1), 3e4);
-        process.stderr.write(`[QQ:${this.name}] RC: ${msg} (retry in ${backoff}ms, attempt ${attempt + 1}/${maxGwRetries})
+        process.stderr.write(`[QQ:${this.name}] RC: ${sanitizeLogText(msg, 200)} (retry in ${backoff}ms, attempt ${attempt + 1}/${maxGwRetries})
 `);
         if (attempt < maxGwRetries - 1)
           await this.sleep(backoff);
@@ -2051,7 +2234,7 @@ var QQChannel = class extends ChannelBase {
     this.seenMessages.set(eventId, now);
     if (!this.seenCleanupTimer) {
       this.seenCleanupTimer = setInterval(() => {
-        const cutoff = Date.now() - 3e5;
+        const cutoff = Date.now() - _QQChannel.REPLY_MSG_ID_TTL_MS;
         for (const [id, ts] of this.seenMessages) {
           if (ts < cutoff)
             this.seenMessages.delete(id);
@@ -2060,7 +2243,7 @@ var QQChannel = class extends ChannelBase {
           clearInterval(this.seenCleanupTimer);
           this.seenCleanupTimer = null;
         }
-      }, 6e4);
+      }, 6e4).unref();
     }
     return false;
   }
@@ -2071,8 +2254,7 @@ var QQChannel = class extends ChannelBase {
       return;
     const chatId = event.author.user_openid || event.author.id;
     this.chatTypeMap.set(chatId, "c2c");
-    this.replyMsgId.set(chatId, event.id);
-    this.saveQQState();
+    this.setReplyMsgId(chatId, event.id);
     this.handleInbound({
       channelName: this.name,
       senderId: chatId,
@@ -2083,7 +2265,7 @@ var QQChannel = class extends ChannelBase {
       isGroup: false,
       isMentioned: true,
       isReplyToBot: false
-    }).catch((e) => process.stderr.write(`[QQ:${this.name}] C2C handler error: ${e}
+    }).catch((e) => process.stderr.write(`[QQ:${this.name}] C2C handler error: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
 `));
   }
   handleGroup(event) {
@@ -2096,8 +2278,7 @@ var QQChannel = class extends ChannelBase {
     }
     const chatId = event.group_openid;
     this.chatTypeMap.set(chatId, "group");
-    this.replyMsgId.set(chatId, event.id);
-    this.saveQQState();
+    this.setReplyMsgId(chatId, event.id);
     const senderName = event.author.username || event.author.id || "QQ User";
     const cleanText = (event.content || "").replace(/<@[^>]{1,64}>/g, "").trim();
     if (!cleanText)
@@ -2123,7 +2304,7 @@ var QQChannel = class extends ChannelBase {
       // every group message is semantically a reply to the bot.
       isReplyToBot: true,
       ...isSlash ? {} : { alreadyPrefixed: true }
-    }).catch((e) => process.stderr.write(`[QQ:${this.name}] Group handler error: ${e}
+    }).catch((e) => process.stderr.write(`[QQ:${this.name}] Group handler error: ${sanitizeLogText(e instanceof Error ? e.message : String(e), 200)}
 `));
   }
 };

package/chunks/{dist-IZP2VV4C.js → dist-JPSVN367.js}

@@ -12,8 +12,8 @@ import "./chunk-7RYW5LQV.js";
 import {
   ChannelBase,
   isTerminalTaskLifecycleType
-} from "./chunk-7DMQRPC7.js";
-import "./chunk-UFC57OYT.js";
+} from "./chunk-6BEOH4KK.js";
+import "./chunk-VRDMOSQS.js";
 import "./chunk-K5PGHDBN.js";
 import {
   require_minimal2 as require_minimal