@tencent-weixin/openclaw-weixin 2.3.1 → 2.4.2

package/dist/src/util/markdown-fences.js

@@ -0,0 +1,54 @@
+export function parseFenceSpans(buffer) {
+    const spans = [];
+    let open;
+    let offset = 0;
+    while (offset <= buffer.length) {
+        const nextNewline = buffer.indexOf("\n", offset);
+        const lineEnd = nextNewline === -1 ? buffer.length : nextNewline;
+        const line = buffer.slice(offset, lineEnd);
+        const match = /^( {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+        if (match) {
+            const marker = match[2];
+            const markerChar = marker[0];
+            const markerLen = marker.length;
+            if (!open) {
+                open = { start: offset, markerChar, markerLen };
+            }
+            else if (open.markerChar === markerChar && markerLen >= open.markerLen) {
+                spans.push({ start: open.start, end: lineEnd });
+                open = undefined;
+            }
+        }
+        if (nextNewline === -1)
+            break;
+        offset = nextNewline + 1;
+    }
+    if (open) {
+        spans.push({ start: open.start, end: buffer.length });
+    }
+    return spans;
+}
+/**
+ * Return the fence span containing `index`, or undefined if `index` is not
+ * inside any fence. Spans are assumed to be sorted by `start` (which is the
+ * natural output of parseFenceSpans).
+ */
+export function findFenceSpanAt(spans, index) {
+    let low = 0;
+    let high = spans.length - 1;
+    while (low <= high) {
+        const mid = (low + high) >>> 1;
+        const span = spans[mid];
+        if (index < span.start) {
+            high = mid - 1;
+            continue;
+        }
+        if (index >= span.end) {
+            low = mid + 1;
+            continue;
+        }
+        return span;
+    }
+    return undefined;
+}
+//# sourceMappingURL=markdown-fences.js.map

package/dist/src/util/markdown-fences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-fences.js","sourceRoot":"","sources":["../../../src/util/markdown-fences.ts"],"names":[],"mappings":"AAoBA,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,IAA0E,CAAC;IAC/E,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAClD,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChD,IAAI,GAAG,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9B,MAAM,GAAG,WAAW,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B,EAAE,KAAa;IACxE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/util/random.js

@@ -0,0 +1,16 @@
+import crypto from "node:crypto";
+/**
+ * Generate a prefixed unique ID using timestamp + crypto random bytes.
+ * Format: `{prefix}:{timestamp}-{8-char hex}`
+ */
+export function generateId(prefix) {
+    return `${prefix}:${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
+}
+/**
+ * Generate a temporary file name with random suffix.
+ * Format: `{prefix}-{timestamp}-{8-char hex}{ext}`
+ */
+export function tempFileName(prefix, ext) {
+    return `${prefix}-${Date.now()}-${crypto.randomBytes(4).toString("hex")}${ext}`;
+}
+//# sourceMappingURL=random.js.map

package/dist/src/util/random.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"random.js","sourceRoot":"","sources":["../../../src/util/random.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACtD,OAAO,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;AAClF,CAAC"}

package/dist/src/util/redact.js

@@ -0,0 +1,54 @@
+const DEFAULT_BODY_MAX_LEN = 200;
+const DEFAULT_TOKEN_PREFIX_LEN = 6;
+/**
+ * Truncate a string, appending a length indicator when trimmed.
+ * Returns `""` for empty/undefined input.
+ */
+export function truncate(s, max) {
+    if (!s)
+        return "";
+    if (s.length <= max)
+        return s;
+    return `${s.slice(0, max)}…(len=${s.length})`;
+}
+/**
+ * Redact a token/secret: show only the first few chars + total length.
+ * Returns `"(none)"` when absent.
+ */
+export function redactToken(token, prefixLen = DEFAULT_TOKEN_PREFIX_LEN) {
+    if (!token)
+        return "(none)";
+    if (token.length <= prefixLen)
+        return `****(len=${token.length})`;
+    return `${token.slice(0, prefixLen)}…(len=${token.length})`;
+}
+/** Field names whose values should be masked in logged JSON bodies. */
+const SENSITIVE_FIELDS = /\b(context_token|bot_token|token|authorization|Authorization)\b/;
+/**
+ * Truncate a JSON body string to `maxLen` chars for safe logging.
+ * Redacts known sensitive fields before truncating.
+ */
+export function redactBody(body, maxLen = DEFAULT_BODY_MAX_LEN) {
+    if (!body)
+        return "(empty)";
+    // Mask values of known sensitive JSON keys: "key":"value" → "key":"<redacted>"
+    const redacted = body.replace(/"(context_token|bot_token|token|authorization|Authorization)"\s*:\s*"[^"]*"/g, '"$1":"<redacted>"');
+    if (redacted.length <= maxLen)
+        return redacted;
+    return `${redacted.slice(0, maxLen)}…(truncated, totalLen=${redacted.length})`;
+}
+/**
+ * Strip query string (which often contains signatures/tokens) from a URL,
+ * keeping only origin + pathname.
+ */
+export function redactUrl(rawUrl) {
+    try {
+        const u = new URL(rawUrl);
+        const base = `${u.origin}${u.pathname}`;
+        return u.search ? `${base}?<redacted>` : base;
+    }
+    catch {
+        return truncate(rawUrl, 80);
+    }
+}
+//# sourceMappingURL=redact.js.map

package/dist/src/util/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/util/redact.ts"],"names":[],"mappings":"AAAA,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAqB,EAAE,GAAW;IACzD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAyB,EAAE,SAAS,GAAG,wBAAwB;IACzF,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,YAAY,KAAK,CAAC,MAAM,GAAG,CAAC;IAClE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,KAAK,CAAC,MAAM,GAAG,CAAC;AAC9D,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,iEAAiE,CAAC;AAE3F;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAwB,EAAE,MAAM,GAAG,oBAAoB;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,8EAA8E,EAC9E,mBAAmB,CACpB,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,yBAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/index.ts

@@ -4,7 +4,6 @@ import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-sch
 import { weixinPlugin } from "./src/channel.js";
 import { assertHostCompatibility } from "./src/compat.js";
 import { WeixinConfigSchema } from "./src/config/config-schema.js";
-import { setWeixinRuntime } from "./src/runtime.js";
 
 export default {
   id: "openclaw-weixin",
@@ -15,10 +14,6 @@ export default {
     // Fail-fast: reject incompatible host versions before any side-effects.
     assertHostCompatibility(api.runtime?.version);
 
-    if (api.runtime) {
-      setWeixinRuntime(api.runtime);
-    }
-
     api.registerChannel({ plugin: weixinPlugin });
   },
 };

package/openclaw.plugin.json

@@ -1,9 +1,19 @@
 {
   "id": "openclaw-weixin",
-  "version": "2.3.1",
+  "version": "2.4.2",
   "channels": [
     "openclaw-weixin"
   ],
+  "channelConfigs": {
+    "openclaw-weixin": {
+      "schema": {
+        "type": "object",
+        "additionalProperties": true
+      },
+      "label": "openclaw-weixin",
+      "description": "Weixin channel configuration."
+    }
+  },
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tencent-weixin/openclaw-weixin",
-  "version": "2.3.1",
+  "version": "2.4.2",
   "description": "OpenClaw Weixin channel",
   "license": "MIT",
   "author": "Tencent",
@@ -11,6 +11,7 @@
     "!src/**/node_modules/",
     "index.ts",
     "openclaw.plugin.json",
+    "dist/",
     "README.md",
     "README.zh_CN.md",
     "CHANGELOG.md",
@@ -27,7 +28,10 @@
   },
   "dependencies": {
     "qrcode-terminal": "0.12.0",
-    "zod": "4.3.6"
+    "zod": "^4.3.6"
+  },
+  "peerDependencies": {
+    "openclaw": ">=2026.3.22"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^3.1.0",
@@ -40,6 +44,9 @@
     "extensions": [
       "./index.ts"
     ],
+    "runtimeExtensions": [
+      "./dist/index.js"
+    ],
     "channel": {
       "id": "openclaw-weixin",
       "label": "openclaw-weixin",

package/src/api/api.ts

@@ -201,11 +201,10 @@ function buildCommonHeaders(): Record<string, string> {
   return headers;
 }
 
-function buildHeaders(opts: { token?: string; body: string }): Record<string, string> {
+function buildHeaders(opts: { token?: string }): Record<string, string> {
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
     AuthorizationType: "ilink_bot_token",
-    "Content-Length": String(Buffer.byteLength(opts.body, "utf-8")),
     "X-WECHAT-UIN": randomWechatUin(),
     ...buildCommonHeaders(),
   };
@@ -277,7 +276,7 @@ export async function apiPostFetch(params: {
 }): Promise<string> {
   const base = ensureTrailingSlash(params.baseUrl);
   const url = new URL(params.endpoint, base);
-  const hdrs = buildHeaders({ token: params.token, body: params.body });
+  const hdrs = buildHeaders({ token: params.token });
   logger.debug(`POST ${redactUrl(url.toString())} body=${redactBody(params.body)}`);
 
   const controller =

package/src/auth/accounts.ts

@@ -4,7 +4,6 @@ import path from "node:path";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/core";
 
-import { getWeixinRuntime } from "../runtime.js";
 import { resolveStateDir } from "../storage/state-dir.js";
 import { resolveFrameworkAllowFromPath } from "./pairing.js";
 import { logger } from "../util/logger.js";

package/src/channel.ts

@@ -1,6 +1,6 @@
 import path from "node:path";
 
-import type { ChannelPlugin, OpenClawConfig } from "openclaw/plugin-sdk/core";
+import type { ChannelPlugin, OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk/core";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/infra-runtime";
 
@@ -428,6 +428,17 @@ export const weixinPlugin: ChannelPlugin<ResolvedWeixinAccount> = {
       const logPath = aLog.getLogFilePath();
       ctx.log?.info?.(`[${account.accountId}] weixin logs: ${logPath}`);
 
+      // The gateway injects the channel runtime surface per-call (task-scoped). We require it:
+      // it carries reply/routing/session/media/commands helpers used by processOneMessage.
+      // Available on hosts >= 2026.2.19 (our peerDependency is >= 2026.3.22).
+      if (!ctx.channelRuntime) {
+        const msg = `ctx.channelRuntime missing — host too old or plugin SDK contract violated`;
+        aLog.error(msg);
+        ctx.log?.error?.(`[${account.accountId}] ${msg}`);
+        ctx.setStatus?.({ accountId: account.accountId, running: false });
+        throw new Error(msg);
+      }
+
       const { monitorWeixinProvider } = await import("./monitor/monitor.js");
       return monitorWeixinProvider({
         baseUrl: account.baseUrl,
@@ -436,6 +447,7 @@ export const weixinPlugin: ChannelPlugin<ResolvedWeixinAccount> = {
         accountId: account.accountId,
         config: ctx.cfg,
         runtime: ctx.runtime,
+        channelRuntime: ctx.channelRuntime as unknown as PluginRuntime["channel"],
         abortSignal: ctx.abortSignal,
         setStatus: ctx.setStatus,
       });

package/src/monitor/monitor.ts

@@ -5,7 +5,6 @@ import { getUpdates } from "../api/api.js";
 import { WeixinConfigManager } from "../api/config-cache.js";
 import { SESSION_EXPIRED_ERRCODE, pauseSession, getRemainingPauseMs } from "../api/session-guard.js";
 import { processOneMessage } from "../messaging/process-message.js";
-import { getWeixinRuntime, waitForWeixinRuntime } from "../runtime.js";
 import { getSyncBufFilePath, loadGetUpdatesBuf, saveGetUpdatesBuf } from "../storage/sync-buf.js";
 import { logger } from "../util/logger.js";
 import type { Logger } from "../util/logger.js";
@@ -25,6 +24,11 @@ export type MonitorWeixinOpts = {
   allowFrom?: string[];
   config: import("openclaw/plugin-sdk/core").OpenClawConfig;
   runtime?: { log?: (msg: string) => void; error?: (msg: string) => void };
+  /**
+   * Gateway-injected channel runtime surface (reply/routing/session/media/commands/...).
+   * Required for inbound message processing; provided by `ChannelGatewayContext.channelRuntime`.
+   */
+  channelRuntime: PluginRuntime["channel"];
   abortSignal?: AbortSignal;
   longPollTimeoutMs?: number;
   /** Gateway status callback — called on each successful poll and inbound message. */
@@ -42,6 +46,7 @@ export async function monitorWeixinProvider(opts: MonitorWeixinOpts): Promise<vo
     token,
     accountId,
     config,
+    channelRuntime,
     abortSignal,
     longPollTimeoutMs,
     setStatus,
@@ -50,15 +55,11 @@ export async function monitorWeixinProvider(opts: MonitorWeixinOpts): Promise<vo
   const errLog = opts.runtime?.error ?? ((m: string) => log(m));
   const aLog: Logger = logger.withAccount(accountId);
 
-  aLog.info(`waiting for Weixin runtime...`);
-  let channelRuntime: PluginRuntime["channel"];
-  try {
-    const pluginRuntime = await waitForWeixinRuntime();
-    channelRuntime = pluginRuntime.channel;
-    aLog.info(`Weixin runtime acquired, channelRuntime type: ${typeof channelRuntime}`);
-  } catch (err) {
-    aLog.error(`waitForWeixinRuntime() failed: ${String(err)}`);
-    throw err;
+  if (!channelRuntime) {
+    const msg =
+      "channelRuntime missing on monitor opts; gateway must inject ChannelGatewayContext.channelRuntime";
+    aLog.error(msg);
+    throw new Error(msg);
   }
 
   log(`weixin monitor started (${baseUrl}, account=${accountId})`);

package/src/runtime.ts

@@ -1,70 +0,0 @@
-import type { PluginRuntime } from "openclaw/plugin-sdk/core";
-
-import { logger } from "./util/logger.js";
-
-let pluginRuntime: PluginRuntime | null = null;
-
-export type PluginChannelRuntime = PluginRuntime["channel"];
-
-/**
- * Sets the global Weixin runtime (called from plugin register).
- */
-export function setWeixinRuntime(next: PluginRuntime): void {
-  pluginRuntime = next;
-  logger.info(`[runtime] setWeixinRuntime called, runtime set successfully`);
-}
-
-/**
- * Gets the global Weixin runtime (throws if not initialized).
- */
-export function getWeixinRuntime(): PluginRuntime {
-  if (!pluginRuntime) {
-    throw new Error("Weixin runtime not initialized");
-  }
-  return pluginRuntime;
-}
-
-const WAIT_INTERVAL_MS = 100;
-const DEFAULT_TIMEOUT_MS = 10_000;
-
-/**
- * Waits for the Weixin runtime to be initialized (async polling).
- */
-export async function waitForWeixinRuntime(
-  timeoutMs = DEFAULT_TIMEOUT_MS,
-): Promise<PluginRuntime> {
-  const start = Date.now();
-  while (!pluginRuntime) {
-    if (Date.now() - start > timeoutMs) {
-      throw new Error("Weixin runtime initialization timeout");
-    }
-    await new Promise((resolve) => setTimeout(resolve, WAIT_INTERVAL_MS));
-  }
-  return pluginRuntime;
-}
-
-/**
- * Resolves `PluginRuntime["channel"]` for the long-poll monitor.
- *
- * Prefer the gateway-injected `channelRuntime` on `ChannelGatewayContext` when present (avoids
- * races with the module-global from `register()`). Fall back to the global set by `setWeixinRuntime()`,
- * then to a short wait for legacy hosts.
- */
-export async function resolveWeixinChannelRuntime(params: {
-  channelRuntime?: PluginChannelRuntime;
-  waitTimeoutMs?: number;
-}): Promise<PluginChannelRuntime> {
-  if (params.channelRuntime) {
-    logger.debug("[runtime] channelRuntime from gateway context");
-    return params.channelRuntime;
-  }
-  if (pluginRuntime) {
-    logger.debug("[runtime] channelRuntime from register() global");
-    return pluginRuntime.channel;
-  }
-  logger.warn(
-    "[runtime] no channelRuntime on ctx and no global runtime yet; waiting for register()",
-  );
-  const pr = await waitForWeixinRuntime(params.waitTimeoutMs ?? DEFAULT_TIMEOUT_MS);
-  return pr.channel;
-}