@ryantest/openclaw-qqbot 0.0.3 → 1.6.6-alpha.0

package/src/utils/ssrf-guard.ts

@@ -0,0 +1,102 @@
+/**
+ * 远程 URL 安全校验
+ *
+ * 下载外部资源前，确保目标地址不会命中内部网络或云元数据端点，
+ * 避免模型输出的恶意链接触达内网服务。
+ */
+
+import net from "node:net";
+import dns from "node:dns/promises";
+
+/* ---------- 内网 / 保留地址判定 ---------- */
+
+/** IPv4 保留网段前缀（覆盖 RFC 1918、链路本地、回环等） */
+const RESERVED_V4_PREFIXES = [
+  "127.",       // loopback
+  "10.",        // class-A private
+  "192.168.",   // class-C private
+  "169.254.",   // link-local / cloud metadata
+] as const;
+
+/** 172.16.0.0 – 172.31.255.255 需要单独用正则匹配 */
+const PRIVATE_172_RE = /^172\.(1[6-9]|2\d|3[01])\./;
+
+/**
+ * 检查给定 IP 是否落在不可路由 / 私有网段内。
+ *
+ * 覆盖：
+ * - IPv4: 127/8, 10/8, 172.16/12, 192.168/16, 169.254/16, 0.0.0.0
+ * - IPv6: ::1, ::, fe80 (link-local), fc/fd (ULA)
+ */
+export function isReservedAddr(ip: string): boolean {
+  // --- IPv4 ---
+  if (ip === "0.0.0.0") return true;
+  for (const pfx of RESERVED_V4_PREFIXES) {
+    if (ip.startsWith(pfx)) return true;
+  }
+  if (PRIVATE_172_RE.test(ip)) return true;
+
+  // --- IPv6 ---
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fe80:")) return true;           // link-local
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true; // unique local
+  return false;
+}
+
+/* ---------- URL 合法性校验 ---------- */
+
+const ALLOWED_SCHEMES = new Set(["http:", "https:"]);
+
+/**
+ * 校验远程 URL 是否可安全请求。
+ *
+ * 规则：
+ * 1. 仅放行 http / https 协议
+ * 2. 若 URL 直接携带 IP 则即时判定
+ * 3. 若为域名则先做 DNS 解析，逐条检查解析结果
+ *
+ * @throws {Error} 当 URL 指向受限地址时
+ */
+export async function validateRemoteUrl(raw: string): Promise<void> {
+  const url = new URL(raw);
+
+  if (!ALLOWED_SCHEMES.has(url.protocol)) {
+    throw new Error(
+      `不支持的协议 "${url.protocol}"，仅允许 http/https（URL: ${raw}）`,
+    );
+  }
+
+  // 去掉 IPv6 方括号
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+
+  if (net.isIP(host)) {
+    assertPublicAddr(host, raw);
+    return;
+  }
+
+  // 域名 → 解析后逐条检查
+  try {
+    const ips = await dns.resolve(host);
+    for (const ip of ips) {
+      assertPublicAddr(ip, raw, host);
+    }
+  } catch (err) {
+    // 已经是我们自己抛的安全错误，继续向上传播
+    if (err instanceof Error && err.message.includes("内网")) throw err;
+    // DNS 查询失败不阻塞，后续 fetch 会产生网络错误
+    console.warn(`[url-check] DNS 解析 "${host}" 失败: ${err}`);
+  }
+}
+
+/* ---------- 内部辅助 ---------- */
+
+/** 断言 IP 为公网地址，否则抛出错误 */
+function assertPublicAddr(ip: string, originalUrl: string, domain?: string): void {
+  if (!isReservedAddr(ip)) return;
+
+  const target = domain ? `域名 "${domain}" 解析到内网地址 "${ip}"` : `内网地址 "${ip}"`;
+  throw new Error(
+    `禁止访问${target}，已拦截潜在的 SSRF 请求（URL: ${originalUrl}）`,
+  );
+}

package/clawdbot.plugin.json

@@ -1,16 +0,0 @@
-{
-  "id": "openclaw-qqbot",
-  "name": "OpenClaw QQ Bot",
-  "description": "QQ Bot channel plugin with message support, cron jobs, and proactive messaging",
-  "channels": ["qqbot"],
-  "skills": ["skills/qqbot-channel", "skills/qqbot-remind", "skills/qqbot-media"],
-  "capabilities": {
-    "proactiveMessaging": true,
-    "cronJobs": true
-  },
-  "configSchema": {
-    "type": "object",
-    "additionalProperties": false,
-    "properties": {}
-  }
-}

package/dist/src/user-messages.d.ts

@@ -1,8 +0,0 @@
-export {};
-/**
- * 用户面向的提示文案 — 已清空
- *
- * 设计原则（对齐飞书插件）：
- * QQBot 插件层不生成额外的用户提示信息。
- * 所有运行时错误仅写日志，不面向用户展示。
- */

package/dist/src/user-messages.js

@@ -1,8 +0,0 @@
-export {};
-/**
- * 用户面向的提示文案 — 已清空
- *
- * 设计原则（对齐飞书插件）：
- * QQBot 插件层不生成额外的用户提示信息。
- * 所有运行时错误仅写日志，不面向用户展示。
- */

package/moltbot.plugin.json

@@ -1,16 +0,0 @@
-{
-  "id": "openclaw-qqbot",
-  "name": "OpenClaw QQ Bot",
-  "description": "QQ Bot channel plugin with message support, cron jobs, and proactive messaging",
-  "channels": ["qqbot"],
-  "skills": ["skills/qqbot-channel", "skills/qqbot-remind", "skills/qqbot-media"],
-  "capabilities": {
-    "proactiveMessaging": true,
-    "cronJobs": true
-  },
-  "configSchema": {
-    "type": "object",
-    "additionalProperties": false,
-    "properties": {}
-  }
-}

package/scripts/upgrade-via-alt-pkg.sh

@@ -1,307 +0,0 @@
-#!/bin/bash
-
-# qqbot 测试脚本：自由切换不同的 QQBot npm 包
-#
-# 支持从任意 npm 包安装指定版本到 openclaw extensions 目录。
-# 可用于在不同包之间切换测试，如 @sliverp/qqbot、@tencent-connect/openclaw-qqbot 等。
-#
-# 用法:
-#   upgrade-via-alt-pkg.sh --pkg <包名> --version <version>   # 指定包+版本
-#   upgrade-via-alt-pkg.sh --pkg <包名>                        # 指定包，安装 latest
-#   upgrade-via-alt-pkg.sh --appid <appid> --secret <secret>   # 首次安装时配置
-#   upgrade-via-alt-pkg.sh --no-restart                        # 只做文件替换，不重启
-#
-# 示例:
-#   bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot --version 1.5.1
-#   bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot --version 1.5.4
-#   bash scripts/upgrade-via-alt-pkg.sh --pkg @tencent-connect/openclaw-qqbot --version 1.6.4
-#   bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot
-#   bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot --version 1.5.4 --appid 12345 --secret abc123
-
-set -eo pipefail
-
-PKG_NAME=""
-VERSION=""
-INSTALL_SRC=""
-APPID=""
-SECRET=""
-NO_RESTART=false
-
-print_usage() {
-    echo "用法:"
-    echo "  upgrade-via-alt-pkg.sh --pkg <包名> --version <版本号>"
-    echo "  upgrade-via-alt-pkg.sh --pkg <包名>                      # 安装 latest"
-    echo ""
-    echo "选项:"
-    echo "  --pkg <name>          npm 包名（必填，如 @sliverp/qqbot、@tencent-connect/openclaw-qqbot）"
-    echo "  --version <version>   指定版本号（如 1.5.1, 1.5.4, 1.6.4）"
-    echo "  --appid <appid>       QQ机器人 appid（首次安装时必填）"
-    echo "  --secret <secret>     QQ机器人 secret（首次安装时必填）"
-    echo "  --no-restart          只做文件替换，不重启 gateway"
-    echo "  -h, --help            显示帮助信息"
-    echo ""
-    echo "环境变量:"
-    echo "  QQBOT_APPID           QQ机器人 appid"
-    echo "  QQBOT_SECRET          QQ机器人 secret"
-    echo "  QQBOT_TOKEN           QQ机器人 token (appid:secret)"
-    echo ""
-    echo "示例:"
-    echo "  # 从 @sliverp/qqbot 包安装 v1.5.1"
-    echo "  bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot --version 1.5.1"
-    echo ""
-    echo "  # 从 @sliverp/qqbot 包安装 v1.5.4"
-    echo "  bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot --version 1.5.4"
-    echo ""
-    echo "  # 从官方包安装 v1.6.4"
-    echo "  bash scripts/upgrade-via-alt-pkg.sh --pkg @tencent-connect/openclaw-qqbot --version 1.6.4"
-    echo ""
-    echo "  # 切回 @sliverp/qqbot 包的 latest"
-    echo "  bash scripts/upgrade-via-alt-pkg.sh --pkg @sliverp/qqbot"
-}
-
-while [[ $# -gt 0 ]]; do
-    case "$1" in
-        --pkg|--package)
-            [ -z "$2" ] && echo "❌ --pkg 需要参数" && exit 1
-            PKG_NAME="$2"
-            shift 2
-            ;;
-        --version)
-            [ -z "$2" ] && echo "❌ --version 需要参数" && exit 1
-            VERSION="$2"
-            shift 2
-            ;;
-        --tag)
-            [ -z "$2" ] && echo "❌ --tag 需要参数" && exit 1
-            VERSION="$2"
-            shift 2
-            ;;
-        --appid)
-            [ -z "$2" ] && echo "❌ --appid 需要参数" && exit 1
-            APPID="$2"
-            shift 2
-            ;;
-        --secret)
-            [ -z "$2" ] && echo "❌ --secret 需要参数" && exit 1
-            SECRET="$2"
-            shift 2
-            ;;
-        --no-restart)
-            NO_RESTART=true
-            shift 1
-            ;;
-        -h|--help)
-            print_usage
-            exit 0
-            ;;
-        *) echo "未知选项: $1"; print_usage; exit 1 ;;
-    esac
-done
-
-# --pkg 必填
-if [ -z "$PKG_NAME" ]; then
-    echo "❌ 必须指定 --pkg 参数"
-    echo ""
-    print_usage
-    exit 1
-fi
-
-if [ -n "$VERSION" ]; then
-    INSTALL_SRC="${PKG_NAME}@${VERSION}"
-else
-    INSTALL_SRC="${PKG_NAME}@latest"
-fi
-
-# 环境变量 fallback
-APPID="${APPID:-$QQBOT_APPID}"
-SECRET="${SECRET:-$QQBOT_SECRET}"
-if [ -z "$APPID" ] && [ -z "$SECRET" ] && [ -n "$QQBOT_TOKEN" ]; then
-    APPID="${QQBOT_TOKEN%%:*}"
-    SECRET="${QQBOT_TOKEN#*:}"
-fi
-
-# 检测 CLI（仅用于确定 extensions 目录路径）
-CMD=""
-for name in openclaw clawdbot moltbot; do
-    command -v "$name" &>/dev/null && CMD="$name" && break
-done
-[ -z "$CMD" ] && echo "❌ 未找到 openclaw / clawdbot / moltbot" && exit 1
-
-EXTENSIONS_DIR="$HOME/.$CMD/extensions"
-
-echo "==========================================="
-echo "  qqbot 测试升级: $INSTALL_SRC"
-echo "==========================================="
-echo ""
-
-# [1/3] 下载并安装新版本到临时目录
-echo "[1/3] 下载新版本..."
-TMPDIR_PACK=$(mktemp -d)
-EXTRACT_DIR=$(mktemp -d)
-trap "rm -rf '$TMPDIR_PACK' '$EXTRACT_DIR'" EXIT
-
-cd "$TMPDIR_PACK"
-# 多 registry fallback：npmjs.org → npmmirror（国内镜像）→ 默认 registry
-PACK_OK=false
-for _registry in "https://registry.npmjs.org/" "https://registry.npmmirror.com/" ""; do
-    if [ -n "$_registry" ]; then
-        echo "  尝试 registry: $_registry"
-        npm pack "$INSTALL_SRC" --registry "$_registry" --quiet 2>&1 && PACK_OK=true && break
-    else
-        echo "  尝试默认 registry..."
-        npm pack "$INSTALL_SRC" --quiet 2>&1 && PACK_OK=true && break
-    fi
-done
-$PACK_OK || { echo "❌ npm pack 失败（所有 registry 均不可用）"; exit 1; }
-TGZ_FILE=$(ls -1 *.tgz 2>/dev/null | head -1)
-[ -z "$TGZ_FILE" ] && echo "❌ 未找到下载的 tgz 文件" && exit 1
-echo "  已下载: $TGZ_FILE"
-
-tar xzf "$TGZ_FILE" -C "$EXTRACT_DIR"
-PACKAGE_DIR="$EXTRACT_DIR/package"
-[ ! -d "$PACKAGE_DIR" ] && echo "❌ 解压失败，未找到 package 目录" && exit 1
-
-# 准备 staging 目录
-STAGING_DIR="$(dirname "$EXTENSIONS_DIR")/.qqbot-upgrade-staging"
-rm -rf "$STAGING_DIR"
-mkdir -p "$STAGING_DIR"
-cp -R "$PACKAGE_DIR/." "$STAGING_DIR/"
-
-# 依赖处理
-if [ -d "$STAGING_DIR/node_modules" ]; then
-    BUNDLED_COUNT=$(find "$STAGING_DIR/node_modules" -mindepth 1 -maxdepth 2 -type d | wc -l | tr -d ' ')
-    echo "  bundled 依赖已就绪（${BUNDLED_COUNT} 个包）"
-else
-    echo "  ⚠️  未找到 bundled node_modules，尝试安装依赖..."
-    NPM_TMP_CACHE=$(mktemp -d)
-    (cd "$STAGING_DIR" && npm install --omit=dev --omit=peer --ignore-scripts --cache="$NPM_TMP_CACHE" --quiet 2>&1) || echo "  ⚠️  依赖安装失败"
-    rm -rf "$NPM_TMP_CACHE"
-fi
-
-# 清理下载临时文件
-rm -rf "$TMPDIR_PACK" "$EXTRACT_DIR"
-cd "$HOME"
-
-# [2/3] 原子替换插件目录
-echo ""
-echo "[2/3] 原子替换插件目录..."
-TARGET_DIR="$EXTENSIONS_DIR/openclaw-qqbot"
-OLD_DIR="$(dirname "$EXTENSIONS_DIR")/.qqbot-upgrade-old"
-
-rm -rf "$OLD_DIR"
-
-STAGING_IN_EXT="$EXTENSIONS_DIR/.openclaw-qqbot-new"
-rm -rf "$STAGING_IN_EXT"
-mv "$STAGING_DIR" "$STAGING_IN_EXT"
-
-if [ -d "$TARGET_DIR" ]; then
-    mv "$TARGET_DIR" "$OLD_DIR" && mv "$STAGING_IN_EXT" "$TARGET_DIR"
-else
-    mv "$STAGING_IN_EXT" "$TARGET_DIR"
-fi
-rm -rf "$OLD_DIR"
-
-# 清理可能残留的旧版 staging 目录
-rm -rf "$EXTENSIONS_DIR/openclaw-qqbot.staging"
-rm -rf "$EXTENSIONS_DIR/.qqbot-upgrade-staging"
-rm -rf "$EXTENSIONS_DIR/.qqbot-upgrade-old"
-
-# 清理历史遗留的其他目录名
-for dir_name in qqbot openclaw-qq; do
-    [ -d "$EXTENSIONS_DIR/$dir_name" ] && rm -rf "$EXTENSIONS_DIR/$dir_name"
-done
-echo "  已安装到: $TARGET_DIR"
-
-# [3/3] 输出新版本号和升级报告
-echo ""
-echo "[3/3] 验证安装..."
-NEW_VERSION="$(node -e "
-  try {
-    const fs = require('fs');
-    const path = require('path');
-    const p = path.join('$EXTENSIONS_DIR', 'openclaw-qqbot', 'package.json');
-    if (fs.existsSync(p)) {
-      const v = JSON.parse(fs.readFileSync(p, 'utf8')).version;
-      if (v) { process.stdout.write(v); process.exit(0); }
-    }
-  } catch {}
-" 2>/dev/null || true)"
-echo "QQBOT_NEW_VERSION=${NEW_VERSION:-unknown}"
-
-if [ -n "$NEW_VERSION" ] && [ "$NEW_VERSION" != "unknown" ]; then
-    echo "QQBOT_REPORT=✅ QQBot 升级完成 ($PKG_NAME): v${NEW_VERSION}"
-else
-    echo "QQBOT_REPORT=⚠️ QQBot 升级异常，无法确认新版本"
-fi
-
-echo ""
-echo "==========================================="
-echo "  ✅ 文件安装完成"
-echo "==========================================="
-
-# --no-restart 模式
-if [ "$NO_RESTART" = "true" ]; then
-    echo ""
-    echo "[跳过重启] --no-restart 已指定，脚本立即退出以便调用方触发 gateway restart"
-    exit 0
-fi
-
-# [4/4] 配置 appid/secret（仅在提供了参数时执行）
-if [ -n "$APPID" ] && [ -n "$SECRET" ]; then
-    echo ""
-    echo "[配置] 写入 qqbot 通道配置..."
-    DESIRED_TOKEN="${APPID}:${SECRET}"
-
-    CURRENT_TOKEN=""
-    for _app in openclaw clawdbot moltbot; do
-        _cfg="$HOME/.$_app/$_app.json"
-        if [ -f "$_cfg" ]; then
-            CURRENT_TOKEN=$(node -e "
-                const cfg = JSON.parse(require('fs').readFileSync('$_cfg', 'utf8'));
-                const keys = ['qqbot', 'openclaw-qqbot', 'openclaw-qq'];
-                for (const key of keys) {
-                    const ch = cfg.channels && cfg.channels[key];
-                    if (!ch) continue;
-                    if (ch.token) { process.stdout.write(ch.token); process.exit(0); }
-                    if (ch.appId && ch.clientSecret) { process.stdout.write(ch.appId + ':' + ch.clientSecret); process.exit(0); }
-                }
-            " 2>/dev/null || true)
-            [ -n "$CURRENT_TOKEN" ] && break
-        fi
-    done
-
-    if [ "$CURRENT_TOKEN" = "$DESIRED_TOKEN" ]; then
-        echo "  ✅ 当前配置已是目标值，跳过写入"
-    elif $CMD channels add --channel qqbot --token "$DESIRED_TOKEN" 2>&1; then
-        echo "  ✅ 通道配置写入成功"
-    else
-        echo "  ⚠️  $CMD channels add 失败，尝试直接编辑配置文件..."
-        CONFIG_FILE="$HOME/.$CMD/$CMD.json"
-        if [ -f "$CONFIG_FILE" ] && node -e "
-            const fs = require('fs');
-            const cfg = JSON.parse(fs.readFileSync('$CONFIG_FILE', 'utf8'));
-            if (!cfg.channels) cfg.channels = {};
-            if (!cfg.channels.qqbot) cfg.channels.qqbot = {};
-            cfg.channels.qqbot.appId = '$APPID';
-            cfg.channels.qqbot.clientSecret = '$SECRET';
-            fs.writeFileSync('$CONFIG_FILE', JSON.stringify(cfg, null, 4) + '\n');
-        " 2>&1; then
-            echo "  ✅ 通道配置写入成功（直接编辑配置文件）"
-        else
-            echo "  ❌ 配置写入失败，请手动配置:"
-            echo "     $CMD channels add --channel qqbot --token \"${APPID}:${SECRET}\""
-        fi
-    fi
-elif [ -n "$APPID" ] || [ -n "$SECRET" ]; then
-    echo ""
-    echo "⚠️  --appid 和 --secret 必须同时提供"
-fi
-
-# [5/5] 重启 gateway 使新版本生效
-echo ""
-echo "[重启] 重启 gateway 使新版本生效..."
-if $CMD gateway restart 2>&1; then
-    echo "  ✅ gateway 已重启"
-else
-    echo "  ⚠️  gateway 重启失败，请手动执行: $CMD gateway restart"
-fi

package/src/bot-logs-2026-03-21T11-21-47(2).txt

@@ -1,46 +0,0 @@
-
-========== gateway.log (last 44 of 44 lines) ==========
-from: C:\Users\v_qachchen\.openclaw
-[2026-03-20T15:55:33.816Z] state: stopped → starting
-[2026-03-20T15:55:33.819Z] [extract] 检测到 runtime.tar.gz，开始解压...
-[2026-03-20T15:55:37.282Z] [extract] runtime.tar.gz 解压完成 (3.5s)
-[2026-03-20T15:55:37.286Z] [extract] 检测到 gateway.tar.gz，开始解压...
-[2026-03-20T15:56:05.916Z] [extract] gateway.tar.gz 解压完成 (28.6s)
-[2026-03-20T15:56:05.924Z] --- gateway start ---
-[2026-03-20T15:56:05.926Z] platform=win32 arch=x64 packaged=true
-[2026-03-20T15:56:05.927Z] resourcesPath=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources
-[2026-03-20T15:56:05.928Z] nodeBin=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\runtime\node.exe exists=true
-[2026-03-20T15:56:05.928Z] entry=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\gateway\node_modules\openclaw\openclaw.mjs exists=true
-[2026-03-20T15:56:05.929Z] cwd=C:\Users\v_qachchen\.openclaw\workspace exists=true
-[2026-03-20T15:56:05.929Z] token=a98d...06c4 port=19789
-[2026-03-20T15:56:05.978Z] TTS 未配置，使用默认 SiliconFlow URL
-[2026-03-20T15:56:05.979Z] spawn: C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\runtime\node.exe C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\gateway\node_modules\openclaw\openclaw.mjs gateway run --port 19789 --bind loopback
-[2026-03-20T15:56:14.259Z] stdout: |
-o  Doctor warnings ------------------------------------------------------+
-|                                                                        |
-|  - channels.imessage.groupPolicy is "allowlist" but groupAllowFrom is  |
-|    empty — this channel does not fall back to allowFrom, so all group  |
-|    messages will be silently dropped. Add sender IDs to                |
-|    channels.imessage.groupAllowFrom, or set groupPolicy to "open".     |
-|                                                                        |
-+------------------------------------------------------------------------+
-[2026-03-20T15:56:44.457Z] stdout: 2026-03-20T15:56:44.457Z [canvas] host mounted at http://127.0.0.1:19789/__openclaw__/canvas/ (root C:\Users\v_qachchen\.openclaw\canvas)
-[2026-03-20T15:56:44.786Z] stdout: 2026-03-20T15:56:44.784Z [heartbeat] started
-[2026-03-20T15:56:44.791Z] stdout: 2026-03-20T15:56:44.791Z [health-monitor] started (interval: 300s, startup-grace: 60s, channel-connect-grace: 120s)
-[2026-03-20T15:56:44.804Z] stdout: 2026-03-20T15:56:44.802Z [gateway] agent model: custom/hy-hunyuan-instruct
-[2026-03-20T15:56:44.806Z] stdout: 2026-03-20T15:56:44.806Z [gateway] listening on ws://127.0.0.1:19789, ws://[::1]:19789 (PID 224544)
-[2026-03-20T15:56:44.812Z] stdout: 2026-03-20T15:56:44.812Z [gateway] log file: \tmp\openclaw\openclaw-2026-03-20.log
-[2026-03-20T15:56:44.929Z] stdout: 2026-03-20T15:56:44.929Z [browser/server] Browser control listening on http://127.0.0.1:19791/ (auth=token)
-[2026-03-20T15:56:45.150Z] health check passed, child alive
-[2026-03-20T15:56:45.151Z] state: starting → running
-[2026-03-20T15:56:46.272Z] stdout: 2026-03-20T15:56:46.112Z [hooks:loader] Registered hook: boot-md -> gateway:startup
-2026-03-20T15:56:46.179Z [hooks:loader] Registered hook: bootstrap-extra-files -> agent:bootstrap
-2026-03-20T15:56:46.247Z [hooks:loader] Registered hook: command-logger -> command
-[2026-03-20T15:56:46.273Z] stderr: 2026-03-20T15:56:46.166Z [ws] closed before connect conn=bd4ae208-a072-4475-8c6b-63daad0e7025 remote=127.0.0.1 fwd=n/a origin=file:// host=127.0.0.1:19789 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HoldClaw/1.0.14 Chrome/144.0.7559.225 Electron/40.7.0 Safari/537.36 code=1006 reason=n/a
-2026-03-20T15:56:46.235Z [ws] unauthorized conn=723433fc-d3d5-4065-b919-924e0992dcfe remote=127.0.0.1 client=openclaw-control-ui webchat vdev reason=token_mismatch
-2026-03-20T15:56:46.252Z [ws] closed before connect conn=723433fc-d3d5-4065-b919-924e0992dcfe remote=127.0.0.1 fwd=n/a origin=file:// host=127.0.0.1:19789 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HoldClaw/1.0.14 Chrome/144.0.7559.225 Electron/40.7.0 Safari/537.36 code=1008 reason=unauthorized: gateway token mismatch (open the dashboard URL and paste the token in Control UI settings)
-[2026-03-20T15:56:46.318Z] stdout: 2026-03-20T15:56:46.302Z [hooks:loader] Registered hook: session-memory -> command:new, command:reset
-2026-03-20T15:56:46.308Z [hooks] loaded 4 internal hook handlers
-[2026-03-20T15:56:46.637Z] stdout: 2026-03-20T15:56:46.637Z [gateway] update available (latest): v2026.3.13 (current v2026.3.2). Run: openclaw update
-[2026-03-20T15:56:47.076Z] stdout: 2026-03-20T15:56:47.076Z [gateway] device pairing auto-approved device=bd0fa7fe507891dfe0875c53fd38d0582145228b1478b4e62ad102f07d9254df role=operator
-[2026-03-20T15:56:47.081Z] stdout: 2026-03-20T15:56:47.081Z [ws] webchat connected conn=200f754d-9791-4dcc-bfaa-93c839311f65 remote=127.0.0.1 client=openclaw-control-ui webchat vdev

package/src/gateway.log

@@ -1,43 +0,0 @@
-[2026-03-20T15:55:33.816Z] state: stopped → starting
-[2026-03-20T15:55:33.819Z] [extract] 检测到 runtime.tar.gz，开始解压...
-[2026-03-20T15:55:37.282Z] [extract] runtime.tar.gz 解压完成 (3.5s)
-[2026-03-20T15:55:37.286Z] [extract] 检测到 gateway.tar.gz，开始解压...
-[2026-03-20T15:56:05.916Z] [extract] gateway.tar.gz 解压完成 (28.6s)
-[2026-03-20T15:56:05.924Z] --- gateway start ---
-[2026-03-20T15:56:05.926Z] platform=win32 arch=x64 packaged=true
-[2026-03-20T15:56:05.927Z] resourcesPath=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources
-[2026-03-20T15:56:05.928Z] nodeBin=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\runtime\node.exe exists=true
-[2026-03-20T15:56:05.928Z] entry=C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\gateway\node_modules\openclaw\openclaw.mjs exists=true
-[2026-03-20T15:56:05.929Z] cwd=C:\Users\v_qachchen\.openclaw\workspace exists=true
-[2026-03-20T15:56:05.929Z] token=a98d...06c4 port=19789
-[2026-03-20T15:56:05.978Z] TTS 未配置，使用默认 SiliconFlow URL
-[2026-03-20T15:56:05.979Z] spawn: C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\runtime\node.exe C:\Users\v_qachchen\AppData\Local\Programs\HoldClaw\resources\resources\gateway\node_modules\openclaw\openclaw.mjs gateway run --port 19789 --bind loopback
-[2026-03-20T15:56:14.259Z] stdout: |
-o  Doctor warnings ------------------------------------------------------+
-|                                                                        |
-|  - channels.imessage.groupPolicy is "allowlist" but groupAllowFrom is  |
-|    empty — this channel does not fall back to allowFrom, so all group  |
-|    messages will be silently dropped. Add sender IDs to                |
-|    channels.imessage.groupAllowFrom, or set groupPolicy to "open".     |
-|                                                                        |
-+------------------------------------------------------------------------+
-[2026-03-20T15:56:44.457Z] stdout: 2026-03-20T15:56:44.457Z [canvas] host mounted at http://127.0.0.1:19789/__openclaw__/canvas/ (root C:\Users\v_qachchen\.openclaw\canvas)
-[2026-03-20T15:56:44.786Z] stdout: 2026-03-20T15:56:44.784Z [heartbeat] started
-[2026-03-20T15:56:44.791Z] stdout: 2026-03-20T15:56:44.791Z [health-monitor] started (interval: 300s, startup-grace: 60s, channel-connect-grace: 120s)
-[2026-03-20T15:56:44.804Z] stdout: 2026-03-20T15:56:44.802Z [gateway] agent model: custom/hy-hunyuan-instruct
-[2026-03-20T15:56:44.806Z] stdout: 2026-03-20T15:56:44.806Z [gateway] listening on ws://127.0.0.1:19789, ws://[::1]:19789 (PID 224544)
-[2026-03-20T15:56:44.812Z] stdout: 2026-03-20T15:56:44.812Z [gateway] log file: \tmp\openclaw\openclaw-2026-03-20.log
-[2026-03-20T15:56:44.929Z] stdout: 2026-03-20T15:56:44.929Z [browser/server] Browser control listening on http://127.0.0.1:19791/ (auth=token)
-[2026-03-20T15:56:45.150Z] health check passed, child alive
-[2026-03-20T15:56:45.151Z] state: starting → running
-[2026-03-20T15:56:46.272Z] stdout: 2026-03-20T15:56:46.112Z [hooks:loader] Registered hook: boot-md -> gateway:startup
-2026-03-20T15:56:46.179Z [hooks:loader] Registered hook: bootstrap-extra-files -> agent:bootstrap
-2026-03-20T15:56:46.247Z [hooks:loader] Registered hook: command-logger -> command
-[2026-03-20T15:56:46.273Z] stderr: 2026-03-20T15:56:46.166Z [ws] closed before connect conn=bd4ae208-a072-4475-8c6b-63daad0e7025 remote=127.0.0.1 fwd=n/a origin=file:// host=127.0.0.1:19789 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HoldClaw/1.0.14 Chrome/144.0.7559.225 Electron/40.7.0 Safari/537.36 code=1006 reason=n/a
-2026-03-20T15:56:46.235Z [ws] unauthorized conn=723433fc-d3d5-4065-b919-924e0992dcfe remote=127.0.0.1 client=openclaw-control-ui webchat vdev reason=token_mismatch
-2026-03-20T15:56:46.252Z [ws] closed before connect conn=723433fc-d3d5-4065-b919-924e0992dcfe remote=127.0.0.1 fwd=n/a origin=file:// host=127.0.0.1:19789 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HoldClaw/1.0.14 Chrome/144.0.7559.225 Electron/40.7.0 Safari/537.36 code=1008 reason=unauthorized: gateway token mismatch (open the dashboard URL and paste the token in Control UI settings)
-[2026-03-20T15:56:46.318Z] stdout: 2026-03-20T15:56:46.302Z [hooks:loader] Registered hook: session-memory -> command:new, command:reset
-2026-03-20T15:56:46.308Z [hooks] loaded 4 internal hook handlers
-[2026-03-20T15:56:46.637Z] stdout: 2026-03-20T15:56:46.637Z [gateway] update available (latest): v2026.3.13 (current v2026.3.2). Run: openclaw update
-[2026-03-20T15:56:47.076Z] stdout: 2026-03-20T15:56:47.076Z [gateway] device pairing auto-approved device=bd0fa7fe507891dfe0875c53fd38d0582145228b1478b4e62ad102f07d9254df role=operator
-[2026-03-20T15:56:47.081Z] stdout: 2026-03-20T15:56:47.081Z [ws] webchat connected conn=200f754d-9791-4dcc-bfaa-93c839311f65 remote=127.0.0.1 client=openclaw-control-ui webchat vdev