@soimy/dingtalk 3.6.8 → 3.6.10

package/openclaw.plugin.json

@@ -1,5 +1,6 @@
 {
   "id": "dingtalk",
+  "name": "DingTalk",
   "channels": ["dingtalk"],
   "contracts": {
     "tools": ["dingtalk_ask_user_question"]
@@ -62,7 +63,7 @@
                 }
               }
             ],
-            "description": "DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. Supports SecretInput references such as env/file. Security boundary: file reads the configured local path; use file only with trusted plugin configuration."
+            "description": "DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. Supports env/file SecretInput references resolved by configured OpenClaw secret providers."
           },
           "dmPolicy": {
             "type": "string",
@@ -368,7 +369,7 @@
                       }
                     }
                   ],
-                  "description": "DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. Supports SecretInput references such as env/file. Security boundary: file reads the configured local path; use file only with trusted plugin configuration."
+                  "description": "DingTalk App Secret (Client Secret) used to obtain DingTalk access tokens. Supports env/file SecretInput references resolved by configured OpenClaw secret providers."
                 },
                 "dmPolicy": {
                   "type": "string",
@@ -654,7 +655,7 @@
         },
         "clientSecret": {
           "label": "DingTalk Client Secret",
-          "help": "App Secret used to obtain DingTalk access tokens. SecretInput file references are for trusted plugin configuration because file reads a local path.",
+          "help": "App Secret used to obtain DingTalk access tokens. SecretInput references are resolved by configured OpenClaw secret providers.",
           "sensitive": true
         },
         "dmPolicy": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soimy/dingtalk",
-  "version": "3.6.8",
+  "version": "3.6.10",
   "description": "DingTalk (钉钉) channel plugin for OpenClaw",
   "keywords": [
     "bot",
@@ -20,9 +20,7 @@
   },
   "files": [
     "dist/**/*.js",
-    "dist/**/*.js.map",
     "dist/**/*.d.ts",
-    "dist/**/*.d.ts.map",
     "index.ts",
     "src/**/*.ts",
     "docs/assets/dingtalk-ask-user-card-template.json",
@@ -31,6 +29,9 @@
     "LICENSE"
   ],
   "type": "module",
+  "engines": {
+    "node": ">=22.22.3 <23 || >=24.15.0 <25 || >=25.9.0"
+  },
   "packageManager": "pnpm@10.33.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -69,12 +70,13 @@
     "form-data": "^4.0.0",
     "mammoth": "^1.12.0",
     "pdf-parse": "^2.4.5",
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/node": "^25.2.0",
     "@vitest/coverage-v8": "^3.2.4",
     "esbuild": "^0.27.3",
+    "openclaw": "2026.7.1-2",
     "oxfmt": "0.34.0",
     "oxlint": "1.49.0",
     "oxlint-tsgolint": "0.18.1",
@@ -83,7 +85,7 @@
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.3.28"
+    "openclaw": ">=2026.7.1-2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -92,10 +94,10 @@
   },
   "openclaw": {
     "compat": {
-      "pluginApi": ">=2026.3.28"
+      "pluginApi": ">=2026.7.1-2"
     },
     "build": {
-      "openclawVersion": "2026.3.28"
+      "openclawVersion": "2026.7.1-2"
     },
     "extensions": [
       "./index.ts"
@@ -121,7 +123,7 @@
       ]
     },
     "install": {
-      "minHostVersion": ">=2026.3.28",
+      "minHostVersion": ">=2026.7.1-2",
       "npmSpec": "@soimy/dingtalk",
       "localPath": ".",
       "defaultChoice": "npm"

package/src/channel.ts

@@ -1,6 +1,7 @@
-import { buildChannelConfigSchema, type OpenClawConfig } from "openclaw/plugin-sdk/core";
+import { buildJsonChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
+import pluginManifest from "../openclaw.plugin.json";
 import { getConfig, isConfigured, mergeAccountWithDefaults, resolveGroupConfig } from "./config";
-import { DingTalkConfigSchema } from "./config-schema.js";
 import {
   CHANNEL_INFLIGHT_NAMESPACE_POLICY,
   createDingTalkGateway,
@@ -29,7 +30,7 @@ export const dingtalkPlugin: DingTalkChannelPlugin = {
     blurb: "钉钉企业内部机器人，使用 Stream 模式，无需公网 IP。",
     aliases: ["dd", "ding"],
   },
-  configSchema: buildChannelConfigSchema(DingTalkConfigSchema),
+  configSchema: buildJsonChannelConfigSchema(pluginManifest.channelConfigs.dingtalk.schema),
   setup: dingtalkSetupAdapter,
   setupWizard: dingtalkSetupWizard,
   capabilities: {

package/src/gateway/channel-gateway.ts

@@ -1,4 +1,5 @@
 import { DWClient, TOPIC_CARD, TOPIC_ROBOT } from "dingtalk-stream";
+import { listAgentIds } from "openclaw/plugin-sdk/agent-runtime";
 import { analyzeCardCallback } from "../card-callback-service";
 import { finalizeActiveCardsForAccount, recoverPendingCardsForAccount } from "../card-service";
 import { recoverAskUserQuestionsForAccount } from "../card/ask-user-question";
@@ -13,9 +14,14 @@ import {
 } from "../feedback-learning-service";
 import { handleDingTalkMessage } from "../inbound-handler";
 import { setCurrentLogger } from "../logger-context";
-import { preloadPeerIdsFromSessions } from "../peer-id-registry";
+import { registerPeerId } from "../peer-id-registry";
 import { getDingTalkRuntime } from "../runtime";
 import { sendProactiveTextOrMarkdown } from "../send-service";
+import {
+  listKnownGroupTargets,
+  listKnownUserTargets,
+  upsertObservedGroupTarget,
+} from "../targeting/target-directory-store";
 import type {
   ConnectionManagerConfig,
   DingTalkChannelPlugin,
@@ -180,6 +186,66 @@ export function createDingTalkGateway(): NonNullable<DingTalkChannelPlugin["gate
         debug: config.debug,
         baseLog: ctx.log,
       });
+      try {
+        const knownGroupIds = new Set<string>();
+        for (const group of listKnownGroupTargets({
+          storePath: accountStorePath,
+          accountId: account.accountId,
+        })) {
+          registerPeerId(group.conversationId);
+          knownGroupIds.add(group.conversationId.toLowerCase());
+        }
+        const runtime = getDingTalkRuntime();
+        for (const agentId of listAgentIds(cfg)) {
+          const sessionStorePath = runtime.channel.session.resolveStorePath(cfg.session?.store, {
+            agentId,
+          });
+          for (const { entry } of runtime.agent.session.listSessionEntries({
+            agentId,
+            storePath: sessionStorePath,
+            readConsistency: "latest",
+          })) {
+            const isDingTalkSession = [
+              entry.lastChannel,
+              entry.channel,
+              entry.origin?.provider,
+              entry.origin?.surface,
+            ].some((value) => value === "dingtalk");
+            const sessionAccountId = entry.lastAccountId || entry.origin?.accountId;
+            if (!isDingTalkSession || sessionAccountId !== account.accountId) {
+              continue;
+            }
+            for (const peerId of [entry.lastTo, entry.origin?.from, entry.origin?.to]) {
+              if (typeof peerId !== "string" || !peerId.startsWith("cid")) {
+                continue;
+              }
+              registerPeerId(peerId);
+              const normalizedPeerId = peerId.toLowerCase();
+              if (!knownGroupIds.has(normalizedPeerId)) {
+                upsertObservedGroupTarget({
+                  storePath: accountStorePath,
+                  accountId: account.accountId,
+                  conversationId: peerId,
+                  seenAt: entry.updatedAt,
+                });
+                knownGroupIds.add(normalizedPeerId);
+              }
+            }
+          }
+        }
+        for (const user of listKnownUserTargets({
+          storePath: accountStorePath,
+          accountId: account.accountId,
+        })) {
+          registerPeerId(user.canonicalUserId);
+          registerPeerId(user.staffId || "");
+          registerPeerId(user.senderId);
+        }
+      } catch (err: unknown) {
+        pluginLog?.warn?.(
+          `[${account.accountId}] Failed to restore peer IDs: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
       // Stream credentials are resolved once per account start. If a file
       // SecretInput rotates, restart the gateway/account so reconnects use the
       // new secret.
@@ -188,9 +254,6 @@ export function createDingTalkGateway(): NonNullable<DingTalkChannelPlugin["gate
 
       pluginLog?.info?.(`[${account.accountId}] Initializing DingTalk Stream client...`);
 
-      preloadPeerIdsFromSessions();
-      pluginLog?.debug?.(`[${account.accountId}] Peer ID registry preloaded from sessions`);
-
       cleanupOrphanedTempFiles(pluginLog);
       try {
         const recovered = await recoverPendingCardsForAccount(

package/src/messaging/channel-actions.ts

@@ -55,12 +55,9 @@ function describeDingTalkMessageTool(cfg: OpenClawConfig) {
   if (!configured && !(config.accounts && Object.keys(config.accounts).length > 0)) {
     return { actions: [], capabilities: [], schema: null };
   }
-  const hasCardMode =
-    config.messageType === "card" ||
-    (config.accounts && Object.values(config.accounts).some((account) => account?.messageType === "card"));
   return {
     actions: ["send"] as const,
-    capabilities: hasCardMode ? (["cards"] as const) : [],
+    capabilities: [],
     schema: null,
   };
 }

package/src/peer-id-registry.ts

@@ -8,13 +8,7 @@
  * can be delivered correctly.
  */
 
-import { readFileSync, readdirSync } from "fs";
-import * as os from "os";
-import { join } from "path";
-import { getLogger } from "./logger-context";
-
 const peerIdMap = new Map<string, string>();
-let preloaded = false;
 
 /**
  * Register an original peer ID, keyed by its lowercased form.
@@ -26,20 +20,9 @@ export function registerPeerId(originalId: string): void {
   peerIdMap.set(originalId.toLowerCase(), originalId);
 }
 
-function maybeRegisterDingTalkGroupPeerId(value: unknown): void {
-  // DingTalk group openConversationId values are base64-like and consistently start with "cid".
-  // User IDs in DM contexts do not follow this pattern and do not require case restoration.
-  if (typeof value === "string" && value.startsWith("cid")) {
-    registerPeerId(value);
-  }
-}
-
 /**
  * Resolve a possibly-lowercased peer ID back to its original casing.
  *
- * If registry is empty at first outbound call (for example, cron/delivery queue
- * fires before inbound callbacks), perform a one-time lazy preload from sessions.
- *
  * Returns the original if found, otherwise returns the input as-is.
  */
 export function resolveOriginalPeerId(id: string): string {
@@ -47,10 +30,6 @@ export function resolveOriginalPeerId(id: string): string {
     return id;
   }
 
-  if (!preloaded) {
-    preloadPeerIdsFromSessions();
-  }
-
   return peerIdMap.get(id.toLowerCase()) || id;
 }
 
@@ -59,83 +38,4 @@ export function resolveOriginalPeerId(id: string): string {
  */
 export function clearPeerIdRegistry(): void {
   peerIdMap.clear();
-  preloaded = false;
-}
-
-/**
- * Preload known peer IDs from all agents' sessions.json files.
- *
- * Safe to call repeatedly:
- * - without explicit homeDir: runs once, then no-ops;
- * - with explicit homeDir: always runs (useful for tests).
- */
-export function preloadPeerIdsFromSessions(homeDir?: string): void {
-  if (!homeDir && preloaded) {
-    return;
-  }
-
-  const home = homeDir || os.homedir();
-  const agentsDir = join(home, ".openclaw", "agents");
-  const log = getLogger();
-  let preloadCompleted = false;
-
-  try {
-    const agentDirs = readdirSync(agentsDir, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
-      .map((entry) => entry.name);
-
-    for (const agentName of agentDirs) {
-      const sessionsPath = join(agentsDir, agentName, "sessions", "sessions.json");
-
-      try {
-        const raw = readFileSync(sessionsPath, "utf-8");
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object") {
-          continue;
-        }
-
-        for (const session of Object.values(parsed as Record<string, unknown>)) {
-          if (!session || typeof session !== "object") {
-            continue;
-          }
-
-          const sessionRecord = session as Record<string, unknown>;
-          maybeRegisterDingTalkGroupPeerId(sessionRecord.lastTo);
-
-          const origin = sessionRecord.origin;
-          if (!origin || typeof origin !== "object") {
-            continue;
-          }
-
-          const originRecord = origin as Record<string, unknown>;
-          maybeRegisterDingTalkGroupPeerId(originRecord.from);
-          maybeRegisterDingTalkGroupPeerId(originRecord.to);
-        }
-      } catch (err) {
-        // sessions.json may be missing or malformed for some agents; ignore per file.
-        log?.debug?.(
-          `[DingTalk][PeerIdRegistry] Failed to parse preload sessions file ${sessionsPath}: ${
-            err instanceof Error ? err.message : String(err)
-          }`,
-        );
-      }
-    }
-    preloadCompleted = true;
-  } catch (err) {
-    const errorCode = (err as NodeJS.ErrnoException | undefined)?.code;
-    if (errorCode === "ENOENT") {
-      // agents directory may not exist yet; this is a stable no-op state.
-      preloadCompleted = true;
-    } else {
-      log?.debug?.(
-        `[DingTalk][PeerIdRegistry] Failed to scan preload directory ${agentsDir}: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-    }
-  }
-
-  if (!homeDir && preloadCompleted) {
-    preloaded = true;
-  }
 }

package/src/secret-input.ts

@@ -1,6 +1,10 @@
-import { readFile } from "node:fs/promises";
+import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
+import {
+  hasConfiguredSecretInput as hasConfiguredOpenClawSecretInput,
+  resolveConfiguredSecretInputString,
+} from "openclaw/plugin-sdk/secret-input-runtime";
 import { z } from "zod";
-import { resolveRelativePath } from "./path-utils";
+import { getDingTalkRuntime } from "./runtime";
 
 export type SecretInputRef = {
   source: "env" | "file";
@@ -68,19 +72,7 @@ export function isSecretInputRef(value: unknown): value is SecretInputRef {
 }
 
 export function hasConfiguredSecretInput(value: unknown): boolean {
-  if (typeof value === "string") {
-    return value.trim().length > 0;
-  }
-  if (!isSecretInputRef(value)) {
-    return false;
-  }
-  if (value.source === "env") {
-    return Boolean(process.env[value.id]?.trim());
-  }
-  // File references are considered configured when the reference shape is
-  // present. The actual filesystem lookup happens at runtime so status checks
-  // can stay side-effect free.
-  return true;
+  return hasConfiguredOpenClawSecretInput(value);
 }
 
 export function normalizeSecretInputString(value: unknown): string | undefined {
@@ -116,13 +108,15 @@ export function parseSecretInputString(value: unknown): SecretInput | undefined
 export async function resolveSecretInputString(
   value: unknown,
   log?: SecretInputLog,
+  hostConfig?: OpenClawConfig,
 ): Promise<string | undefined> {
-  return (await resolveSecretInputStringWithFailure(value, log)).value;
+  return (await resolveSecretInputStringWithFailure(value, log, hostConfig)).value;
 }
 
 export async function resolveSecretInputStringWithFailure(
   value: unknown,
   log?: SecretInputLog,
+  hostConfig?: OpenClawConfig,
 ): Promise<{ value?: string; failure?: SecretInputResolutionFailure }> {
   if (typeof value === "string") {
     const trimmed = value.trim();
@@ -131,34 +125,40 @@ export async function resolveSecretInputStringWithFailure(
   if (!isSecretInputRef(value)) {
     return {};
   }
-  if (value.source === "env") {
-    const envValue = process.env[value.id]?.trim();
-    if (envValue) {
-      return { value: envValue };
+  if (!hostConfig) {
+    try {
+      hostConfig = getDingTalkRuntime().config.current() as OpenClawConfig;
+    } catch {
+      hostConfig = {} as OpenClawConfig;
     }
-    const failure = buildSecretInputFailure(value, "environment variable is not set or is empty");
-    log?.warn?.("[DingTalk][SecretInput] Failed to resolve env secret", {
+  }
+  try {
+    const resolved = await resolveConfiguredSecretInputString({
+      config: hostConfig,
+      env: process.env,
+      value,
+      path: "channels.dingtalk.clientSecret",
+      unresolvedReasonStyle: "detailed",
+    });
+    if (resolved.value) {
+      return { value: resolved.value };
+    }
+    const failure = buildSecretInputFailure(
+      value,
+      resolved.unresolvedRefReason || "secret reference is unresolved",
+    );
+    log?.warn?.("[DingTalk][SecretInput] Failed to resolve secret", {
       provider: value.provider,
       id: value.id,
       error: failure.reason,
     });
     return { failure };
-  }
-  try {
-    // Trust boundary: file SecretInput reads the configured local path. Use it
-    // only with trusted plugin configuration.
-    const filePath = resolveRelativePath(value.id);
-    const secret = (await readFile(filePath, "utf8")).trim();
-    if (secret) {
-      return { value: secret };
-    }
-    return { failure: buildSecretInputFailure(value, "file secret is empty") };
   } catch (error) {
     const failure = buildSecretInputFailure(
       value,
       error instanceof Error ? error.message : String(error),
     );
-    log?.warn?.("[DingTalk][SecretInput] Failed to read file secret", {
+    log?.warn?.("[DingTalk][SecretInput] Failed to resolve secret", {
       provider: value.provider,
       id: value.id,
       error: failure.reason,

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAuR5F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;;kBAmCnC,iBAAiB;;;;;;;;AAFjC,wBAaE"}