@sunnoy/wecom 1.5.1 → 1.6.0

package/README.md

@@ -37,7 +37,7 @@
 
 ## 前置要求
 
-- 已安装 [OpenClaw](https://github.com/openclaw/openclaw) (版本 2026.1.30+)
+- 已安装 [OpenClaw](https://github.com/openclaw/openclaw) (版本 2026.3.2+)
 - 企业微信管理后台权限，可创建智能机器人应用或自建应用
 - 可从企业微信访问的服务器地址（HTTP/HTTPS）
 
@@ -124,6 +124,9 @@ npm run test:e2e
         "enabled": true,
         "allowlist": ["/new", "/status", "/help", "/compact"]
       },
+      "network": {
+        "egressProxyUrl": "http://your-proxy-host:8080"
+      },
       "agent": {
         "corpId": "企业 CorpID",
         "corpSecret": "应用 Secret",
@@ -186,6 +189,15 @@ npm run test:e2e
 | `channels.wecom.agent.token` | string | 是 | 回调 Token (用于验证签名) |
 | `channels.wecom.agent.encodingAesKey` | string | 是 | 回调 EncodingAESKey (43 位) |
 
+#### 网络代理配置 (可选)
+
+用于 Agent / Webhook 等外发请求走固定出口代理（适用于企业微信固定 IP 白名单场景）。
+
+| 配置项 | 类型 | 必填 | 说明 |
+|--------|------|------|------|
+| `channels.wecom.network.egressProxyUrl` | string | 否 | 外发 HTTP(S) 代理地址，例如 `http://proxy:8080` |
+| `WECOM_EGRESS_PROXY_URL` | env | 否 | 环境变量方式配置代理，优先级高于 `channels.wecom.network.egressProxyUrl` |
+
 #### Webhook 配置 (可选)
 
 配置 Webhook Bot 用于群通知：

package/index.js

@@ -38,16 +38,18 @@ const plugin = {
     api.registerChannel({ plugin: wecomChannelPlugin });
     logger.info("WeCom channel registered");
 
-    // Register HTTP handler for webhooks.
-    // OpenClaw 2026.3.2+ removed registerHttpHandler; the primary route
-    // registration now happens in gateway.startAccount via registerPluginHttpRoute.
-    // Keep the legacy handler for backward compatibility with older versions.
-    if (typeof api.registerHttpHandler === "function") {
-      api.registerHttpHandler(wecomHttpHandler);
-      logger.info("WeCom HTTP handler registered (legacy wildcard)");
-    } else {
-      logger.info("WeCom: registerHttpHandler unavailable, routes registered via gateway lifecycle");
-    }
+    // Register webhook HTTP route with auth: "plugin" so gateway does NOT
+    // enforce Bearer-token auth. WeCom callbacks use msg_signature verification
+    // which the plugin handles internally.
+    // OpenClaw 3.2 removed registerHttpHandler; use registerHttpRoute with
+    // auth: "plugin" + match: "prefix" to handle all /webhooks/* paths.
+    api.registerHttpRoute({
+      path: "/webhooks",
+      handler: wecomHttpHandler,
+      auth: "plugin",
+      match: "prefix",
+    });
+    logger.info("WeCom HTTP route registered (auth: plugin, match: prefix)");
   },
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sunnoy/wecom",
-    "version": "1.5.1",
+    "version": "1.6.0",
     "description": "Enterprise WeChat AI Bot channel plugin for OpenClaw",
     "type": "module",
     "main": "index.js",

package/wecom/channel-plugin.js

@@ -13,7 +13,7 @@ import { resolveWecomTarget } from "./target.js";
 import { webhookSendImage, webhookSendText, webhookUploadFile, webhookSendFile } from "./webhook-bot.js";
 import { normalizeWebhookPath, registerWebhookTarget } from "./webhook-targets.js";
 import { wecomFetch, setConfigProxyUrl } from "./http.js";
-import { createWecomRouteHandler } from "./http-handler.js";
+
 
 const AGENT_IMAGE_EXTS = new Set(["jpg", "jpeg", "png", "gif", "bmp"]);
 
@@ -726,30 +726,15 @@ export const wecomChannelPlugin = {
         config: ctx.cfg,
       });
 
-      // Register HTTP route with OpenClaw route framework.
-      // Uses registerPluginHttpRoute (new API in OpenClaw 2026.3.2+) for explicit
-      // path-based routing.  Falls back gracefully when the SDK is unavailable
-      // (older OpenClaw uses the legacy wildcard handler registered in index.js).
-      let unregisterBotRoute;
+      // HTTP routing is handled by the wildcard handler registered in
+      // index.js via api.registerHttpHandler. That handler bypasses gateway
+      // auth, which is required for WeCom webhook callbacks (they carry
+      // msg_signature, not Bearer tokens).
       const botPath = account.webhookPath || "/webhooks/wecom";
-      try {
-        const { registerPluginHttpRoute } = await import("openclaw/plugin-sdk");
-        unregisterBotRoute = registerPluginHttpRoute({
-          path: botPath,
-          pluginId: "wecom",
-          accountId: account.accountId,
-          log: (msg) => logger.info(msg),
-          handler: createWecomRouteHandler(normalizeWebhookPath(botPath)),
-        });
-        logger.info("WeCom Bot HTTP route registered", { path: botPath });
-      } catch {
-        // openclaw/plugin-sdk not available — rely on legacy registerHttpHandler.
-        logger.debug("registerPluginHttpRoute unavailable, using legacy handler", { path: botPath });
-      }
+      logger.info("WeCom Bot webhook path active", { path: botPath });
 
       // Register Agent inbound webhook if agent inbound is fully configured.
       let unregisterAgent;
-      let unregisterAgentRoute;
       // Per-account agent path: /webhooks/app for default, /webhooks/app/{accountId} for others.
       const agentInboundPath = account.accountId === DEFAULT_ACCOUNT_ID
         ? "/webhooks/app"
@@ -778,22 +763,6 @@ export const wecomChannelPlugin = {
             config: ctx.cfg,
           });
           logger.info("WeCom Agent inbound webhook registered", { path: agentInboundPath });
-
-          // Register agent inbound HTTP route (new API).
-          try {
-            const { registerPluginHttpRoute } = await import("openclaw/plugin-sdk");
-            unregisterAgentRoute = registerPluginHttpRoute({
-              path: agentInboundPath,
-              pluginId: "wecom",
-              accountId: account.accountId,
-              source: "agent-inbound",
-              log: (msg) => logger.info(msg),
-              handler: createWecomRouteHandler(normalizeWebhookPath(agentInboundPath)),
-            });
-            logger.info("WeCom Agent inbound HTTP route registered", { path: agentInboundPath });
-          } catch {
-            logger.debug("registerPluginHttpRoute unavailable for agent inbound, using legacy handler");
-          }
         }
       }
 
@@ -805,9 +774,7 @@ export const wecomChannelPlugin = {
         }
         messageBuffers.clear();
         unregister();
-        if (unregisterBotRoute) unregisterBotRoute();
         if (unregisterAgent) unregisterAgent();
-        if (unregisterAgentRoute) unregisterAgentRoute();
       };
 
       // Backward compatibility: older runtime may not pass abortSignal.

package/wecom/http-handler-state.js

@@ -0,0 +1,23 @@
+/**
+ * Shared flag that tracks whether the legacy wildcard HTTP handler was
+ * successfully registered via api.registerHttpHandler().
+ *
+ * When true, gateway.startAccount must NOT also register via
+ * registerPluginHttpRoute — the latter places the path into
+ * registry.httpRoutes which causes shouldEnforceGatewayAuthForPluginPath
+ * → isRegisteredPluginHttpRoutePath to return true → gateway auth
+ * enforcement runs → WeCom webhook callbacks (which carry msg_signature,
+ * not Bearer tokens) get blocked with 401.
+ *
+ * This module is intentionally separate from index.js to avoid circular
+ * ESM imports (index.js ↔ wecom/channel-plugin.js).
+ */
+let _wildcardHttpHandlerRegistered = false;
+
+export function markWildcardHttpHandlerRegistered() {
+  _wildcardHttpHandlerRegistered = true;
+}
+
+export function isWildcardHttpHandlerRegistered() {
+  return _wildcardHttpHandlerRegistered;
+}