@soimy/dingtalk 3.5.1 → 3.5.3

package/src/send-service.ts

@@ -1,5 +1,5 @@
 import * as path from "node:path";
-import axios from "axios";
+import axios from "./http-client";
 import { getAccessToken } from "./auth";
 import {
   isCardInTerminalState,
@@ -37,6 +37,53 @@ import type {
 
 export { detectMediaTypeFromExtension } from "./media-utils";
 
+const MARKDOWN_LOCAL_IMAGE_RE =
+  /!\[([^\]]*)\]\((file:\/\/\/[^)]+|\/(?:tmp|var|private|Users|home|root)[^)]+|[A-Za-z]:[\\/][^)]+)\)/g;
+
+function decodeMarkdownLocalImagePath(rawPath: string): string {
+  const unescapedPath = rawPath.replace(/\\ /g, " ");
+  if (unescapedPath.startsWith("file://")) {
+    try {
+      return decodeURIComponent(unescapedPath.replace("file://", ""));
+    } catch {
+      return unescapedPath.replace("file://", "");
+    }
+  }
+  return unescapedPath;
+}
+
+async function replaceMarkdownLocalImages(params: {
+  config: DingTalkConfig;
+  text: string;
+  log?: Logger;
+  mediaLocalRoots?: string[];
+}): Promise<string> {
+  const matches = [...params.text.matchAll(MARKDOWN_LOCAL_IMAGE_RE)];
+  if (matches.length === 0) {
+    return params.text;
+  }
+
+  let result = params.text;
+  for (const match of matches) {
+    const [fullMatch, altText, rawPath] = match;
+    const mediaPath = decodeMarkdownLocalImagePath(rawPath);
+    const uploadResult = await uploadMedia(params.config, mediaPath, "image", params.log, {
+      mediaLocalRoots: params.mediaLocalRoots,
+    });
+
+    if (!uploadResult?.mediaId) {
+      params.log?.warn?.(
+        `[DingTalk] Markdown local image upload failed, keep original reference: ${mediaPath}`,
+      );
+      continue;
+    }
+
+    result = result.replace(fullMatch, () => `![${altText}](${uploadResult.mediaId})`);
+  }
+
+  return result;
+}
+
 type ProactiveTextSendResult = AxiosResponse | { tracking: DingTalkTrackingMetadata };
 
 function isTrackingResult(result: ProactiveTextSendResult): result is { tracking: DingTalkTrackingMetadata } {
@@ -165,6 +212,14 @@ function extractErrorCodeFromResponseData(data: unknown): string | null {
   }
 
   const payload = data as Record<string, unknown>;
+  const errcode = payload.errcode;
+  if (typeof errcode === "number" && Number.isFinite(errcode)) {
+    return String(errcode);
+  }
+  if (typeof errcode === "string" && errcode.trim()) {
+    return errcode.trim();
+  }
+
   const code = payload.code;
   if (typeof code === "string" && code.trim()) {
     return code.trim();
@@ -178,6 +233,62 @@ function extractErrorCodeFromResponseData(data: unknown): string | null {
   return null;
 }
 
+function summarizeSessionWebhookResponse(data: unknown): string {
+  if (!data || typeof data !== "object") {
+    return `type=${typeof data}`;
+  }
+  const payload = data as Record<string, unknown>;
+  const code = extractErrorCodeFromResponseData(payload) || "(none)";
+  const message = firstTrimmedString(
+    payload.message,
+    payload.errmsg,
+    payload.msg,
+    payload.errorMessage,
+  ) || "(none)";
+  const success =
+    typeof payload.success === "boolean"
+      ? String(payload.success)
+      : typeof payload.result === "boolean"
+        ? String(payload.result)
+        : "(none)";
+  const delivery = extractOutboundDeliveryMetadata(payload);
+  return (
+    `success=${success} code=${code} message=${message} ` +
+    `messageId=${delivery.messageId || "(none)"} ` +
+    `processQueryKey=${delivery.processQueryKey || "(none)"} ` +
+    `outTrackId=${delivery.outTrackId || "(none)"}`
+  );
+}
+
+function ensureSessionWebhookBusinessSuccess(
+  data: unknown,
+  context: { msgtype: string },
+): void {
+  if (!data || typeof data !== "object") {
+    return;
+  }
+  const payload = data as Record<string, unknown>;
+  const code = extractErrorCodeFromResponseData(payload);
+  const message = firstTrimmedString(
+    payload.message,
+    payload.errmsg,
+    payload.msg,
+    payload.errorMessage,
+  ) || "unknown error";
+
+  const hasFailureSuccessFlag = payload.success === false || payload.result === false;
+  const hasFailureCode = typeof code === "string" && code !== "" && code !== "0";
+  if (!hasFailureSuccessFlag && !hasFailureCode) {
+    return;
+  }
+
+  const reason = [
+    code && code !== "0" ? `code=${code}` : "",
+    message !== "unknown error" ? `message=${message}` : "",
+  ].filter(Boolean).join(" ");
+  throw new Error(`Session webhook ${context.msgtype} send failed${reason ? `: ${reason}` : ""}`);
+}
+
 function isProactivePermissionOrScopeError(code: string | null): boolean {
   if (!code) {
     return false;
@@ -252,7 +363,16 @@ export async function sendProactiveTextOrMarkdown(
     ? "https://api.dingtalk.com/v1.0/robot/groupMessages/send"
     : "https://api.dingtalk.com/v1.0/robot/oToMessages/batchSend";
 
-  const normalizedText = config.convertMarkdownTables !== false ? convertMarkdownTablesToPlainText(text) : text;
+  const textWithUploadedLocalImages = await replaceMarkdownLocalImages({
+    config,
+    text,
+    log,
+    mediaLocalRoots: options.mediaLocalRoots,
+  });
+  const normalizedText =
+    config.convertMarkdownTables !== false
+      ? convertMarkdownTablesToPlainText(textWithUploadedLocalImages)
+      : textWithUploadedLocalImages;
   const { useMarkdown, title } = detectMarkdownAndExtractTitle(normalizedText, options, "OpenClaw 提醒");
 
   log?.debug?.(
@@ -344,7 +464,7 @@ export async function sendProactiveMedia(
     if (!uploadResult) {
       return { ok: false, error: "Failed to upload media" };
     }
-    const { mediaId, buffer } = uploadResult;
+    const { mediaId, buffer, durationMs: uploadedDurationMs } = uploadResult;
 
     const token = await getAccessToken(config, log);
     const { targetId, isExplicitUser } = stripTargetPrefix(target);
@@ -365,7 +485,8 @@ export async function sendProactiveMedia(
       msgParam = JSON.stringify({ photoURL: mediaId });
     } else if (mediaType === "voice") {
       msgKey = "sampleAudio";
-      const durationMs = await getVoiceDurationMs(mediaPath, mediaType, log, { preReadBuffer: buffer });
+      const durationMs = uploadedDurationMs
+        ?? await getVoiceDurationMs(mediaPath, mediaType, log, { preReadBuffer: buffer });
       msgParam = JSON.stringify({ mediaId, duration: String(durationMs) });
     } else {
       // sampleVideo requires picMediaId; fallback to sampleFile for broader compatibility.
@@ -499,14 +620,18 @@ export async function sendBySession(
       mediaLocalRoots: options.mediaLocalRoots,
     });
     if (uploadResult) {
-      const { mediaId, buffer } = uploadResult;
+      const { mediaId, buffer, durationMs: uploadedDurationMs } = uploadResult;
       let body: any;
 
       if (options.mediaType === "image") {
         body = { msgtype: "image", image: { media_id: mediaId } };
       } else if (options.mediaType === "voice") {
-        const durationMs = await getVoiceDurationMs(options.mediaPath, options.mediaType, log, { preReadBuffer: buffer });
+        const durationMs = uploadedDurationMs
+          ?? await getVoiceDurationMs(options.mediaPath, options.mediaType, log, { preReadBuffer: buffer });
         body = { msgtype: "voice", voice: { media_id: mediaId, duration: String(durationMs) } };
+        log?.debug?.(
+          `[DingTalk] Sending session voice message mediaId=${mediaId} durationMs=${durationMs}`,
+        );
       } else if (options.mediaType === "video") {
         body = { msgtype: "video", video: { media_id: mediaId } };
       } else if (options.mediaType === "file") {
@@ -521,6 +646,17 @@ export async function sendBySession(
           headers: { "x-acs-dingtalk-access-token": token, "Content-Type": "application/json" },
           ...getProxyBypassOption(config),
         });
+        log?.debug?.(
+          `[DingTalk] Session webhook response msgtype=${body.msgtype} ${summarizeSessionWebhookResponse(result.data)}`,
+        );
+        ensureSessionWebhookBusinessSuccess(result.data, { msgtype: body.msgtype });
+        const delivery = extractOutboundDeliveryMetadata(result.data);
+        if (!delivery.messageId && !delivery.processQueryKey && !delivery.outTrackId) {
+          log?.warn?.(
+            `[DingTalk] Session webhook ${body.msgtype} response missing delivery metadata; ` +
+            summarizeSessionWebhookResponse(result.data),
+          );
+        }
         return result.data;
       }
     } else {
@@ -531,7 +667,16 @@ export async function sendBySession(
   }
 
   // Fallback to text/markdown reply payload.
-  const normalizedText = config.convertMarkdownTables !== false ? convertMarkdownTablesToPlainText(text) : text;
+  const textWithUploadedLocalImages = await replaceMarkdownLocalImages({
+    config,
+    text,
+    log,
+    mediaLocalRoots: options.mediaLocalRoots,
+  });
+  const normalizedText =
+    config.convertMarkdownTables !== false
+      ? convertMarkdownTablesToPlainText(textWithUploadedLocalImages)
+      : textWithUploadedLocalImages;
   const { useMarkdown, title } = detectMarkdownAndExtractTitle(normalizedText, options, "Clawdbot 消息");
   const chunks = splitMarkdownChunks(normalizedText, DINGTALK_TEXT_CHUNK_LIMIT);
 
@@ -559,6 +704,10 @@ export async function sendBySession(
       headers: { "x-acs-dingtalk-access-token": token, "Content-Type": "application/json" },
       ...getProxyBypassOption(config),
     });
+    log?.debug?.(
+      `[DingTalk] Session webhook response msgtype=${body.msgtype} ${summarizeSessionWebhookResponse(result.data)}`,
+    );
+    ensureSessionWebhookBusinessSuccess(result.data, { msgtype: body.msgtype });
     lastResult = result.data;
   }
   return lastResult;
@@ -597,6 +746,28 @@ export async function sendMessage(
       }
     }
 
+    if (options.sessionWebhook && options.mediaPath && options.mediaType === "voice") {
+      log?.debug?.(
+        "[DingTalk] Session webhook does not support voice replies reliably; " +
+        "using proactive media API for this voice response",
+      );
+      const proactiveVoiceResult = await sendProactiveMedia(
+        config,
+        conversationId,
+        options.mediaPath,
+        options.mediaType,
+        options,
+      );
+      if (!proactiveVoiceResult.ok) {
+        return { ok: false, error: proactiveVoiceResult.error || "Voice reply send failed" };
+      }
+      return {
+        ok: true,
+        data: proactiveVoiceResult.data,
+        messageId: proactiveVoiceResult.messageId,
+      };
+    }
+
     if (options.sessionWebhook) {
       const data = await sendBySession(config, options.sessionWebhook, text, options);
       const delivery = extractOutboundDeliveryMetadata(data);

package/src/targeting/agent-routing.ts

@@ -8,16 +8,26 @@
  */
 
 import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
+import { maybeResolveTextAlias } from "openclaw/plugin-sdk/command-auth";
 import { resolveAtAgents } from "./agent-name-matcher";
 import { resolveRobotCode } from "../config";
 import { parseLearnCommand } from "../learning-command-service";
 import { getDingTalkRuntime } from "../runtime";
 import { sendBySession } from "../send-service";
+import { getErrorMessage } from "../utils";
 import type { AgentNameMatch, DingTalkConfig, DingTalkInboundMessage, HandleDingTalkMessageParams, Logger, MessageContent } from "../types";
 
+export class HostRoutingHelperUnavailableError extends Error {
+  constructor(message = "DingTalk sub-agent routing requires runtime.channel.routing.buildAgentSessionKey from the host runtime.") {
+    super(message);
+    this.name = "HostRoutingHelperUnavailableError";
+  }
+}
+
 /**
  * Build a session key for a specific agent using the runtime API.
- * Falls back to framework's resolveAgentRoute if buildAgentSessionKey is unavailable.
+ * On supported host versions, sub-agent routing must use the shared helper
+ * instead of synthesizing plugin-local fallback keys.
  */
 export function buildAgentSessionKey(params: {
   rt: ReturnType<typeof getDingTalkRuntime>;
@@ -29,31 +39,19 @@ export function buildAgentSessionKey(params: {
 }): string {
   const { rt, cfg, accountId, agentId, peerKind, peerId } = params;
   const routing = rt.channel.routing as Record<string, unknown>;
-  if (typeof routing.buildAgentSessionKey === "function") {
-    return (
-      (routing.buildAgentSessionKey as (p: unknown) => string)({
-        agentId,
-        channel: "dingtalk",
-        accountId,
-        peer: { kind: peerKind, id: peerId },
-        dmScope: cfg.session?.dmScope,
-        identityLinks: cfg.session?.identityLinks,
-      })
-    ).toLowerCase();
+  if (typeof routing.buildAgentSessionKey !== "function") {
+    throw new HostRoutingHelperUnavailableError();
   }
-  // Fallback: derive a session key with agentId suffix to ensure isolation.
-  // resolveAgentRoute routes to the default agent, so we append the target
-  // agentId to prevent session key collisions between sub-agents.
-  // @migration-note: When SDK exposes buildAgentSessionKey in type definitions,
-  // sessions created via this fallback path will become orphaned. Remove this
-  // fallback and the typeof check once the SDK is updated.
-  const fallbackRoute = rt.channel.routing.resolveAgentRoute({
-    cfg,
-    channel: "dingtalk",
-    accountId,
-    peer: { kind: peerKind, id: peerId },
-  });
-  return `${fallbackRoute.sessionKey}:subagent:${agentId}`;
+  return (
+    (routing.buildAgentSessionKey as (p: unknown) => string)({
+      agentId,
+      channel: "dingtalk",
+      accountId,
+      peer: { kind: peerKind, id: peerId },
+      dmScope: cfg.session?.dmScope,
+      identityLinks: cfg.session?.identityLinks,
+    })
+  ).toLowerCase();
 }
 
 /**
@@ -93,16 +91,22 @@ export async function resolveSubAgentRoute(params: {
   const atMentions = extractedContent.atMentions || [];
   // DM has no @picker list from DingTalk; only group chats provide atUsers for real-user hints.
   const atUserDingtalkIds = isGroup ? extractedContent.atUserDingtalkIds : undefined;
-  // Strip quoted prefix before checking /learn to avoid false positives
-  // when the quoted message itself contains a /learn command.
+  // Strip quoted prefix before checking commands to avoid false positives
+  // when the quoted message itself contains a command.
   const textForCommandCheck = extractedContent.text.replace(/^\[引用[^\]]*\]\s*/, "");
   const isLearnCommand = parseLearnCommand(textForCommandCheck).scope !== "unknown";
+  // Slash commands like /new, /stop, /reasoning etc. must bypass sub-agent
+  // routing so they reach the framework's own command handling layer.
+  // Strip leading @mention tokens first since DM text may look like "@Agent /new".
+  const textWithoutMentions = textForCommandCheck.replace(/^(?:@\S+\s+)*/u, "").trim();
+  const isSlashCommand = maybeResolveTextAlias(textWithoutMentions, cfg) !== null;
 
   if (
     atMentions.length === 0 ||
     !cfg.agents?.list ||
     cfg.agents.list.length === 0 ||
-    isLearnCommand
+    isLearnCommand ||
+    isSlashCommand
   ) {
     return null;
   }
@@ -124,8 +128,8 @@ export async function resolveSubAgentRoute(params: {
       await sendBySession(dingtalkConfig, sessionWebhook, `⚠️ ${fallbackReason}`, {
         ...sendOptions,
       });
-    } catch (err: any) {
-      log?.debug?.(`[DingTalk] Failed to send fallback notice: ${err.message}`);
+    } catch (err: unknown) {
+      log?.debug?.(`[DingTalk] Failed to send fallback notice: ${getErrorMessage(err)}`);
     }
   }
 
@@ -161,6 +165,7 @@ export async function dispatchSubAgents(params: {
       preDownloadedMedia = { mediaPath: media.path, mediaType: media.mimeType };
     }
   }
+  let helperMissingWarningSent = false;
 
   for (const agentMatch of matchedAgents) {
     try {
@@ -173,15 +178,33 @@ export async function dispatchSubAgents(params: {
         dingtalkConfig,
         subAgentOptions: {
           agentId: agentMatch.agentId,
-          responsePrefix: `[${sanitizeAgentName(agentMatch.matchedName)}] `,
+          responsePrefix: `> 🤖 **${sanitizeAgentName(agentMatch.matchedName)}**:\n\n`,
           matchedName: agentMatch.matchedName,
         },
         preDownloadedMedia,
       });
     } catch (error) {
+      const message = getErrorMessage(error);
       log?.error?.(
-        `[DingTalk] Sub-agent ${agentMatch.agentId} failed: ${error instanceof Error ? error.message : String(error)}`,
+        `[DingTalk] Sub-agent ${agentMatch.agentId} failed: ${message}`,
       );
+      if (error instanceof HostRoutingHelperUnavailableError && !helperMissingWarningSent) {
+        helperMissingWarningSent = true;
+        try {
+          const isGroup = data.conversationType !== "1";
+          const sendOptions = isGroup ? { atUserId: data.senderId, log } : { log };
+          await sendBySession(
+            dingtalkConfig,
+            sessionWebhook,
+            "⚠️ 当前宿主版本不支持 DingTalk 子助手路由所需的 session helper，请升级 OpenClaw 后重试。",
+            sendOptions,
+          );
+        } catch (notifyError: unknown) {
+          log?.debug?.(
+            `[DingTalk] Failed to send sub-agent helper-missing notice: ${getErrorMessage(notifyError)}`,
+          );
+        }
+      }
     }
   }
 }

package/src/{group-members-store.ts → targeting/group-members-store.ts}

@@ -1,6 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { readNamespaceJson, writeNamespaceJsonAtomic } from "./persistence-store";
+import { readNamespaceJson, writeNamespaceJsonAtomic } from "../persistence-store";
 
 const GROUP_MEMBERS_NAMESPACE = "members.group-roster";
 

package/src/types.ts

@@ -25,6 +25,8 @@ export type AckReactionMode = "off" | "emoji" | "kaomoji";
 // Accept arbitrary strings for backward compatibility; the recommended
 // explicit modes remain: "off" | "emoji" | "kaomoji".
 export type AckReactionConfigValue = string;
+export type CardStreamingMode = "off" | "answer" | "all";
+export type ContextVisibilityMode = "all" | "allowlist" | "allowlist_quote";
 
 /**
  * DingTalk channel configuration (extends base OpenClaw config)
@@ -39,6 +41,7 @@ export interface DingTalkConfig extends OpenClawConfig {
   allowFrom?: string[];
   groupAllowFrom?: string[];
   displayNameResolution?: "disabled" | "all";
+  contextVisibility?: ContextVisibilityMode;
   mediaUrlAllowlist?: string[];
   journalTTLDays?: number;
   ackReaction?: AckReactionConfigValue;
@@ -71,8 +74,15 @@ export interface DingTalkConfig extends OpenClawConfig {
     enabled?: boolean;
     cooldownHours?: number;
   };
-  /** Enable real-time card streaming (default false, true = 300ms throttled per-token updates) */
+  /** Card streaming mode.
+   *  - off: disable incremental streaming
+   *  - answer: stream answer text
+   *  - all: stream answer + reasoning text */
+  cardStreamingMode?: CardStreamingMode;
+  /** @deprecated Use `cardStreamingMode` instead. */
   cardRealTimeStream?: boolean;
+  /** Throttle interval in ms for card stream updates (default 1000) */
+  cardStreamInterval?: number;
   /** AICard degrade duration in milliseconds after trigger errors (default 30m) */
   aicardDegradeMs?: number;
   /** Enable local learning loop (events/reflections/session notes/global rules) */
@@ -100,6 +110,7 @@ export interface DingTalkChannelConfig {
   allowFrom?: string[];
   groupAllowFrom?: string[];
   displayNameResolution?: "disabled" | "all";
+  contextVisibility?: ContextVisibilityMode;
   mediaUrlAllowlist?: string[];
   journalTTLDays?: number;
   ackReaction?: AckReactionConfigValue;
@@ -131,8 +142,15 @@ export interface DingTalkChannelConfig {
     enabled?: boolean;
     cooldownHours?: number;
   };
-  /** Enable real-time card streaming (default false, true = 300ms throttled per-token updates) */
+  /** Card streaming mode.
+   *  - off: disable incremental streaming
+   *  - answer: stream answer text
+   *  - all: stream answer + reasoning text */
+  cardStreamingMode?: CardStreamingMode;
+  /** @deprecated Use `cardStreamingMode` instead. */
   cardRealTimeStream?: boolean;
+  /** Throttle interval in ms for card stream updates (default 1000) */
+  cardStreamInterval?: number;
   /** AICard degrade duration in milliseconds after trigger errors (default 30m) */
   aicardDegradeMs?: number;
   /** Enable local learning loop (events/reflections/session notes/global rules) */
@@ -234,6 +252,10 @@ export interface DingTalkInboundMessage {
           atName?: string;
           downloadCode?: string;
         }>;
+        /** chatRecord 消息摘要 */
+        summary?: string;
+        /** chatRecord 消息标题 */
+        title?: string;
       };
     };
   };
@@ -243,6 +265,8 @@ export interface DingTalkInboundMessage {
     recognition?: string;
     spaceId?: string;
     fileId?: string;
+    text?: string;
+    title?: string;
     biz_custom_action_url?: string;
     richText?: Array<{
       type: string;
@@ -712,6 +736,33 @@ export interface ConnectionAttemptResult {
 
 const DEFAULT_ACCOUNT_ID = "default";
 
+function stripRemovedLegacyFieldsFromPublicAccount(
+  config: DingTalkConfig,
+): DingTalkConfig {
+  const {
+    cardStreamReasoning: _cardStreamReasoning,
+    verboseRealtimeStream: _verboseRealtimeStream,
+    accounts,
+    ...rest
+  } = config as DingTalkConfig & {
+    cardStreamReasoning?: unknown;
+    verboseRealtimeStream?: unknown;
+    accounts?: Record<string, DingTalkConfig | undefined>;
+  };
+  const sanitizedAccounts = accounts
+    ? Object.fromEntries(
+        Object.entries(accounts).map(([accountId, accountConfig]) => [
+          accountId,
+          accountConfig ? stripRemovedLegacyFieldsFromPublicAccount(accountConfig) : accountConfig,
+        ]),
+      )
+    : undefined;
+  if (sanitizedAccounts) {
+    return { ...rest, accounts: sanitizedAccounts } as DingTalkConfig;
+  }
+  return rest as DingTalkConfig;
+}
+
 /**
  * List all DingTalk account IDs from config
  */
@@ -756,7 +807,7 @@ export function resolveDingTalkAccount(
 
   // If default account, return top-level config
   if (id === DEFAULT_ACCOUNT_ID) {
-    const config: DingTalkConfig = {
+    const rawConfig: DingTalkConfig = {
       clientId: dingtalk?.clientId ?? "",
       clientSecret: dingtalk?.clientSecret ?? "",
       name: dingtalk?.name,
@@ -766,6 +817,7 @@ export function resolveDingTalkAccount(
       allowFrom: dingtalk?.allowFrom,
       groupAllowFrom: dingtalk?.groupAllowFrom,
       displayNameResolution: dingtalk?.displayNameResolution,
+      contextVisibility: dingtalk?.contextVisibility,
       journalTTLDays: dingtalk?.journalTTLDays,
       ackReaction: dingtalk?.ackReaction,
       debug: dingtalk?.debug,
@@ -785,7 +837,9 @@ export function resolveDingTalkAccount(
       keepAlive: dingtalk?.keepAlive,
       bypassProxyForSend: dingtalk?.bypassProxyForSend,
       proactivePermissionHint: dingtalk?.proactivePermissionHint,
+      cardStreamingMode: dingtalk?.cardStreamingMode,
       cardRealTimeStream: dingtalk?.cardRealTimeStream,
+      cardStreamInterval: dingtalk?.cardStreamInterval,
       aicardDegradeMs: dingtalk?.aicardDegradeMs,
       learningEnabled: dingtalk?.learningEnabled,
       learningAutoApply: dingtalk?.learningAutoApply,
@@ -793,6 +847,7 @@ export function resolveDingTalkAccount(
       convertMarkdownTables: dingtalk?.convertMarkdownTables,
       cardAtSender: dingtalk?.cardAtSender,
     };
+    const config = stripRemovedLegacyFieldsFromPublicAccount(rawConfig);
     return {
       ...config,
       accountId: id,
@@ -807,8 +862,9 @@ export function resolveDingTalkAccount(
       dingtalk as DingTalkConfig,
       accountConfig,
     );
+    const publicMerged = stripRemovedLegacyFieldsFromPublicAccount(merged);
     return {
-      ...merged,
+      ...publicMerged,
       accountId: id,
       configured: Boolean(merged.clientId && merged.clientSecret),
     };