@sliverp/qqbot 1.3.7 → 1.3.8

package/dist/src/onboarding.js

@@ -84,6 +84,7 @@ export const qqbotOnboardingAdapter = {
                         qqbot: {
                             ...(next.channels?.qqbot || {}),
                             enabled: true,
+                            allowFrom: resolvedAccount.config?.allowFrom ?? ["*"],
                         },
                     },
                 };
@@ -137,6 +138,8 @@ export const qqbotOnboardingAdapter = {
                 validate: (value) => (value?.trim() ? undefined : "ClientSecret 不能为空"),
             })).trim();
         }
+        // 默认允许所有人执行命令（用户无感知）
+        const allowFrom = resolvedAccount.config?.allowFrom ?? ["*"];
         // 应用配置
         if (appId && clientSecret) {
             if (accountId === DEFAULT_ACCOUNT_ID) {
@@ -149,6 +152,7 @@ export const qqbotOnboardingAdapter = {
                             enabled: true,
                             appId,
                             clientSecret,
+                            allowFrom,
                         },
                     },
                 };
@@ -168,6 +172,7 @@ export const qqbotOnboardingAdapter = {
                                     enabled: true,
                                     appId,
                                     clientSecret,
+                                    allowFrom,
                                 },
                             },
                         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sliverp/qqbot",
-  "version": "1.3.7",
+  "version": "1.3.8",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/channel.ts

@@ -120,6 +120,20 @@ export const qqbotPlugin: ChannelPlugin<ResolvedQQBotAccount> = {
       configured: Boolean(account?.appId && account?.clientSecret),
       tokenSource: account?.secretSource,
     }),
+    // 关键：解析 allowFrom 配置，用于命令授权
+    resolveAllowFrom: ({ cfg, accountId }: { cfg: OpenClawConfig; accountId?: string }) => {
+      const account = resolveQQBotAccount(cfg, accountId);
+      const allowFrom = account.config?.allowFrom ?? [];
+      console.log(`[qqbot] resolveAllowFrom: accountId=${accountId}, allowFrom=${JSON.stringify(allowFrom)}`);
+      return allowFrom.map((entry: string | number) => String(entry));
+    },
+    // 格式化 allowFrom 条目（移除 qqbot: 前缀，统一大写）
+    formatAllowFrom: ({ allowFrom }: { allowFrom: Array<string | number> }) =>
+      allowFrom
+        .map((entry: string | number) => String(entry).trim())
+        .filter(Boolean)
+        .map((entry: string) => entry.replace(/^qqbot:/i, ""))
+        .map((entry: string) => entry.toUpperCase()), // QQ openid 是大写的
   },
   setup: {
     // 新增：规范化账户 ID
@@ -159,18 +173,6 @@ export const qqbotPlugin: ChannelPlugin<ResolvedQQBotAccount> = {
       });
     },
   },
-  // 新增：消息目标解析
-  messaging: {
-    normalizeTarget: (target) => {
-      // 支持格式: qqbot:openid, qqbot:group:xxx, openid, group:xxx
-      const normalized = target.replace(/^qqbot:/i, "");
-      return { ok: true, to: normalized };
-    },
-    targetResolver: {
-      looksLikeId: (id) => /^[A-F0-9]{32}$/i.test(id) || id.startsWith("group:") || id.startsWith("channel:"),
-      hint: "<openid> or group:<groupOpenid>",
-    },
-  },
   outbound: {
     deliveryMode: "direct",
     chunker: chunkText,

package/src/config.ts

@@ -128,11 +128,16 @@ export function applyQQBotAccountConfig(
   const next = { ...cfg };
 
   if (accountId === DEFAULT_ACCOUNT_ID) {
+    // 如果没有设置过 allowFrom，默认设置为 ["*"]
+    const existingConfig = (next.channels?.qqbot as QQBotChannelConfig) || {};
+    const allowFrom = existingConfig.allowFrom ?? ["*"];
+    
     next.channels = {
       ...next.channels,
       qqbot: {
         ...(next.channels?.qqbot as Record<string, unknown> || {}),
         enabled: true,
+        allowFrom,
         ...(input.appId ? { appId: input.appId } : {}),
         ...(input.clientSecret
           ? { clientSecret: input.clientSecret }
@@ -144,6 +149,10 @@ export function applyQQBotAccountConfig(
       },
     };
   } else {
+    // 如果没有设置过 allowFrom，默认设置为 ["*"]
+    const existingAccountConfig = (next.channels?.qqbot as QQBotChannelConfig)?.accounts?.[accountId] || {};
+    const allowFrom = existingAccountConfig.allowFrom ?? ["*"];
+    
     next.channels = {
       ...next.channels,
       qqbot: {
@@ -154,6 +163,7 @@ export function applyQQBotAccountConfig(
           [accountId]: {
             ...((next.channels?.qqbot as QQBotChannelConfig)?.accounts?.[accountId] || {}),
             enabled: true,
+            allowFrom,
             ...(input.appId ? { appId: input.appId } : {}),
             ...(input.clientSecret
               ? { clientSecret: input.clientSecret }

package/src/gateway.ts

@@ -2,7 +2,7 @@ import WebSocket from "ws";
 import path from "node:path";
 import * as fs from "node:fs";
 import type { ResolvedQQBotAccount, WSPayload, C2CMessageEvent, GuildMessageEvent, GroupMessageEvent } from "./types.js";
-import { getAccessToken, getGatewayUrl, sendC2CMessage, sendChannelMessage, sendGroupMessage, clearTokenCache, sendC2CImageMessage, sendGroupImageMessage, initApiConfig, startBackgroundTokenRefresh, stopBackgroundTokenRefresh } from "./api.js";
+import { getAccessToken, getGatewayUrl, sendC2CMessage, sendChannelMessage, sendGroupMessage, clearTokenCache, sendC2CImageMessage, sendGroupImageMessage, initApiConfig, startBackgroundTokenRefresh, stopBackgroundTokenRefresh, sendC2CInputNotify } from "./api.js";
 import { loadSession, saveSession, clearSession, type SessionState } from "./session-store.js";
 import { recordKnownUser, flushKnownUsers } from "./known-users.js";
 import { getQQBotRuntime } from "./runtime.js";
@@ -412,6 +412,13 @@ export async function startGateway(ctx: GatewayContext): Promise<void> {
           direction: "inbound",
         });
 
+        try{
+          await sendC2CInputNotify(accessToken, event.senderId, event.messageId, 60);
+          log?.info(`[qqbot:${account.accountId}] Sent input notify to ${event.senderId}`);
+        }catch(err){
+          log?.error(`[qqbot:${account.accountId}] sendC2CInputNotify error: ${err}`);
+        }
+
         const isGroup = event.type === "guild" || event.type === "group";
         const peerId = event.type === "guild" ? `channel:${event.channelId}` 
                      : event.type === "group" ? `group:${event.groupOpenid}`
@@ -568,10 +575,15 @@ openclaw cron add \\
         }
         
         const userContent = event.content + attachmentInfo;
-        const messageBody = `【系统提示】\n${systemPrompts.join("\n")}\n\n【用户输入】\n${userContent}`;
+        let messageBody = `【系统提示】\n${systemPrompts.join("\n")}\n\n【用户输入】\n${userContent}`;
+
+        if(userContent.startsWith("/")){ // 保留Openclaw原始命令
+          messageBody = userContent
+        }
+        log?.info(`[qqbot:${account.accountId}] messageBody: ${messageBody}`);
 
         const body = pluginRuntime.channel.reply.formatInboundEnvelope({
-          channel: "QQBot",
+          channel: "qqbot",
           from: event.senderName ?? event.senderId,
           timestamp: new Date(event.timestamp).getTime(),
           body: messageBody,
@@ -590,6 +602,14 @@ openclaw cron add \\
                          : `qqbot:c2c:${event.senderId}`;
         const toAddress = fromAddress;
 
+        // 计算命令授权状态
+        // allowFrom: ["*"] 表示允许所有人，否则检查 senderId 是否在 allowFrom 列表中
+        const allowFromList = account.config?.allowFrom ?? [];
+        const allowAll = allowFromList.length === 0 || allowFromList.some((entry: string) => entry === "*");
+        const commandAuthorized = allowAll || allowFromList.some((entry: string) => 
+          entry.toUpperCase() === event.senderId.toUpperCase()
+        );
+
         const ctxPayload = pluginRuntime.channel.reply.finalizeInboundContext({
           Body: body,
           RawBody: event.content,
@@ -610,6 +630,7 @@ openclaw cron add \\
           QQChannelId: event.channelId,
           QQGuildId: event.guildId,
           QQGroupOpenid: event.groupOpenid,
+          CommandAuthorized: commandAuthorized,
         });
 
         // 发送消息的辅助函数，带 token 过期重试
@@ -810,7 +831,7 @@ openclaw cron add \\
                         log?.info(`[qqbot:${account.accountId}] Sent image via <qqimg> tag: ${imagePath.slice(0, 60)}...`);
                       } catch (err) {
                         log?.error(`[qqbot:${account.accountId}] Failed to send image from <qqimg>: ${err}`);
-                        await sendErrorMessage(`发送图片失败: ${err}`);
+                        await sendErrorMessage(`图片发送失败，图片似乎不存在哦，图片路径：${imagePath}`);
                       }
                     }
                   }
@@ -1250,7 +1271,9 @@ openclaw cron add \\
                 }
               },
             },
-            replyOptions: {},
+            replyOptions: {
+              disableBlockStreaming: false,
+            },
           });
 
           // 等待分发完成或超时

package/src/onboarding.ts

@@ -21,6 +21,7 @@ interface QQBotChannelConfig {
   clientSecretFile?: string;
   name?: string;
   imageServerBaseUrl?: string;
+  allowFrom?: string[];
   accounts?: Record<string, {
     enabled?: boolean;
     appId?: string;
@@ -28,6 +29,7 @@ interface QQBotChannelConfig {
     clientSecretFile?: string;
     name?: string;
     imageServerBaseUrl?: string;
+    allowFrom?: string[];
   }>;
 }
 
@@ -137,6 +139,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
             qqbot: {
               ...(next.channels?.qqbot as Record<string, unknown> || {}),
               enabled: true,
+              allowFrom: resolvedAccount.config?.allowFrom ?? ["*"],
             },
           },
         };
@@ -200,6 +203,9 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
       ).trim();
     }
 
+    // 默认允许所有人执行命令（用户无感知）
+    const allowFrom: string[] = resolvedAccount.config?.allowFrom ?? ["*"];
+
     // 应用配置
     if (appId && clientSecret) {
       if (accountId === DEFAULT_ACCOUNT_ID) {
@@ -212,6 +218,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
               enabled: true,
               appId,
               clientSecret,
+              allowFrom,
             },
           },
         };
@@ -230,6 +237,7 @@ statusLines: [`QQ Bot: ${configured ? "已配置" : "需要 AppID 和 ClientSecr
                   enabled: true,
                   appId,
                   clientSecret,
+                  allowFrom,
                 },
               },
             },