@wecom/wecom-openclaw-plugin 2026.4.2 → 2026.4.3-beta.0

package/dist/{esm/src → src}/onboarding.js

@@ -1,16 +1,15 @@
-import { addWildcardAllowFrom } from './openclaw-compat.js';
-import { resolveWeComAccount, setWeComAccount } from './utils.js';
-import { CHANNEL_ID } from './const.js';
-
 /**
  * 企业微信 setupWizard — 声明式 CLI setup wizard 配置。
  *
  * 框架通过 plugin.setupWizard 字段识别并驱动 channel 的引导配置流程。
  */
+import { addWildcardAllowFrom } from "./openclaw-compat.js";
+import { resolveWeComAccountMulti, setWeComAccountMulti } from "./accounts.js";
+import { CHANNEL_ID } from "./const.js";
 // ============================================================================
 // ChannelSetupAdapter — 框架用于应用配置输入的适配器
 // ============================================================================
-const wecomSetupAdapter = {
+export const wecomSetupAdapter = {
     applyAccountConfig: ({ cfg, input }) => {
         const patch = {};
         if (input.token !== undefined) {
@@ -20,11 +19,11 @@ const wecomSetupAdapter = {
             patch.secret = String(input.privateKey).trim();
         }
         // 如果是首次配置，默认启用
-        const account = resolveWeComAccount(cfg);
+        const account = resolveWeComAccountMulti({ cfg });
         if (!account.botId && !account.secret) {
             patch.enabled = true;
         }
-        return setWeComAccount(cfg, patch);
+        return setWeComAccountMulti(cfg, patch);
     },
 };
 // ============================================================================
@@ -34,12 +33,12 @@ const wecomSetupAdapter = {
  * 设置企业微信 dmPolicy
  */
 function setWeComDmPolicy(cfg, dmPolicy) {
-    const account = resolveWeComAccount(cfg);
+    const account = resolveWeComAccountMulti({ cfg });
     const existingAllowFrom = account.config.allowFrom ?? [];
     const allowFrom = dmPolicy === "open"
         ? addWildcardAllowFrom(existingAllowFrom.map((x) => String(x)))
         : existingAllowFrom.map((x) => String(x));
-    return setWeComAccount(cfg, {
+    return setWeComAccountMulti(cfg, {
         dmPolicy,
         allowFrom,
     });
@@ -50,14 +49,14 @@ const dmPolicy = {
     policyKey: `channels.${CHANNEL_ID}.dmPolicy`,
     allowFromKey: `channels.${CHANNEL_ID}.allowFrom`,
     getCurrent: (cfg) => {
-        const account = resolveWeComAccount(cfg);
+        const account = resolveWeComAccountMulti({ cfg });
         return account.config.dmPolicy ?? "open";
     },
     setPolicy: (cfg, policy) => {
         return setWeComDmPolicy(cfg, policy);
     },
     promptAllowFrom: async ({ cfg, prompter }) => {
-        const account = resolveWeComAccount(cfg);
+        const account = resolveWeComAccountMulti({ cfg });
         const existingAllowFrom = account.config.allowFrom ?? [];
         const entry = await prompter.text({
             message: "企业微信允许来源（用户ID或群组ID，逗号分隔）",
@@ -68,13 +67,13 @@ const dmPolicy = {
             .split(/[\n,;]+/g)
             .map((s) => s.trim())
             .filter(Boolean);
-        return setWeComAccount(cfg, { allowFrom });
+        return setWeComAccountMulti(cfg, { allowFrom });
     },
 };
 // ============================================================================
 // ChannelSetupWizard — 声明式 setup wizard 配置
 // ============================================================================
-const wecomSetupWizard = {
+export const wecomSetupWizard = {
     channel: CHANNEL_ID,
     // ── 状态 ──────────────────────────────────────────────────────────────
     status: {
@@ -83,7 +82,7 @@ const wecomSetupWizard = {
         configuredHint: "已配置",
         unconfiguredHint: "需要设置",
         resolveConfigured: ({ cfg }) => {
-            const account = resolveWeComAccount(cfg);
+            const account = resolveWeComAccountMulti({ cfg });
             return Boolean(account.botId?.trim() && account.secret?.trim());
         },
         resolveStatusLines: ({ cfg, configured }) => {
@@ -99,7 +98,7 @@ const wecomSetupWizard = {
             "2. Secret: 企业微信机器人密钥",
         ],
         shouldShow: ({ cfg }) => {
-            const account = resolveWeComAccount(cfg);
+            const account = resolveWeComAccountMulti({ cfg });
             return !account.botId?.trim() || !account.secret?.trim();
         },
     },
@@ -113,7 +112,7 @@ const wecomSetupWizard = {
             keepPrompt: "Bot ID 已配置，保留当前值？",
             inputPrompt: "企业微信机器人 Bot ID",
             inspect: ({ cfg }) => {
-                const account = resolveWeComAccount(cfg);
+                const account = resolveWeComAccountMulti({ cfg });
                 const hasValue = Boolean(account.botId?.trim());
                 return {
                     accountConfigured: hasValue,
@@ -122,7 +121,7 @@ const wecomSetupWizard = {
                 };
             },
             applySet: ({ cfg, resolvedValue }) => {
-                return setWeComAccount(cfg, { botId: resolvedValue });
+                return setWeComAccountMulti(cfg, { botId: resolvedValue });
             },
         },
         {
@@ -133,7 +132,7 @@ const wecomSetupWizard = {
             keepPrompt: "Secret 已配置，保留当前值？",
             inputPrompt: "企业微信机器人 Secret",
             inspect: ({ cfg }) => {
-                const account = resolveWeComAccount(cfg);
+                const account = resolveWeComAccountMulti({ cfg });
                 const hasValue = Boolean(account.secret?.trim());
                 return {
                     accountConfigured: hasValue,
@@ -142,16 +141,16 @@ const wecomSetupWizard = {
                 };
             },
             applySet: ({ cfg, resolvedValue }) => {
-                return setWeComAccount(cfg, { secret: resolvedValue });
+                return setWeComAccountMulti(cfg, { secret: resolvedValue });
             },
         },
     ],
     // ── 完成后的最终处理 ──────────────────────────────────────────────────
     finalize: async ({ cfg }) => {
         // 确保配置完成后 channel 处于启用状态
-        const account = resolveWeComAccount(cfg);
+        const account = resolveWeComAccountMulti({ cfg });
         if (account.botId?.trim() && account.secret?.trim() && !account.enabled) {
-            return { cfg: setWeComAccount(cfg, { enabled: true }) };
+            return { cfg: setWeComAccountMulti(cfg, { enabled: true }) };
         }
         return undefined;
     },
@@ -163,7 +162,7 @@ const wecomSetupWizard = {
             "运行 `openclaw start` 启动服务。",
         ],
         shouldShow: ({ cfg }) => {
-            const account = resolveWeComAccount(cfg);
+            const account = resolveWeComAccountMulti({ cfg });
             return Boolean(account.botId?.trim() && account.secret?.trim());
         },
     },
@@ -171,9 +170,6 @@ const wecomSetupWizard = {
     dmPolicy,
     // ── 禁用 ─────────────────────────────────────────────────────────────
     disable: (cfg) => {
-        return setWeComAccount(cfg, { enabled: false });
+        return setWeComAccountMulti(cfg, { enabled: false });
     },
 };
-
-export { wecomSetupAdapter, wecomSetupWizard };
-//# sourceMappingURL=onboarding.js.map

package/dist/{esm/types/src → src}/openclaw-compat.d.ts

@@ -7,6 +7,8 @@
  * 本模块在加载时一次性探测 SDK 导出，存在则直接 re-export SDK 版本，
  * 不存在则导出 fallback 实现。其他模块统一从本文件导入，无需关心底层兼容细节。
  */
+import { resolveStateDir } from "./state-dir-resolve.js";
+export { resolveStateDir };
 export declare const DEFAULT_ACCOUNT_ID = "default";
 /** 与 openclaw plugin-sdk 中 WebMediaResult 兼容的类型 */
 export type WebMediaResult = {
@@ -94,3 +96,50 @@ export declare function buildAccountScopedDmSecurityPolicy(params: {
  * @returns 配对审批提示字符串
  */
 export declare function formatPairingApproveHint(channelId: string): string;
+/**
+ * 与 openclaw plugin-sdk/channel-policy 中 ChannelSecurityDmPolicy 兼容的类型。
+ * 低版本 SDK 未导出该方法时，使用此 fallback。
+ */
+export type ChannelSecurityDmPolicyCompat = {
+    policy: string;
+    allowFrom?: Array<string | number> | null;
+    policyPath?: string;
+    allowFromPath: string;
+    approveHint: string;
+    normalizeEntry?: (raw: string) => string;
+};
+declare global {
+    namespace openclaw.plugin.sdk {
+        interface ChannelSecurityDmPolicy {
+            policy: string;
+            allowFrom?: Array<string | number> | null;
+            policyPath?: string;
+            allowFromPath: string;
+            approveHint: string;
+            normalizeEntry?: (raw: string) => string;
+        }
+    }
+}
+export type BuildAccountScopedDmSecurityPolicyParams = {
+    cfg: {
+        channels?: Record<string, unknown>;
+    };
+    channelKey: string;
+    accountId?: string | null;
+    fallbackAccountId?: string | null;
+    policy?: string | null;
+    allowFrom?: Array<string | number> | null;
+    defaultPolicy?: string;
+    allowFromPathSuffix?: string;
+    policyPathSuffix?: string;
+    approveChannelId?: string;
+    approveHint?: string;
+    normalizeEntry?: (raw: string) => string;
+};
+/**
+ * 构建多账号作用域的 DM 安全策略（兼容入口）
+ *
+ * 优先使用 SDK 版本（openclaw/plugin-sdk/channel-policy），
+ * 不可用时使用 fallback 实现。
+ */
+export declare function buildAccountScopedDmSecurityPolicyCompat(params: BuildAccountScopedDmSecurityPolicyParams): Promise<ChannelSecurityDmPolicyCompat>;

package/dist/{esm/src → src}/openclaw-compat.js

@@ -1,9 +1,3 @@
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
-import * as os from 'node:os';
-import { fileURLToPath } from 'node:url';
-import { resolveStateDir } from './state-dir-resolve.js';
-
 /**
  * openclaw plugin-sdk 高版本方法兼容层
  *
@@ -13,23 +7,29 @@ import { resolveStateDir } from './state-dir-resolve.js';
  * 本模块在加载时一次性探测 SDK 导出，存在则直接 re-export SDK 版本，
  * 不存在则导出 fallback 实现。其他模块统一从本文件导入，无需关心底层兼容细节。
  */
-const DEFAULT_ACCOUNT_ID = "default";
-const _sdkReady = import('openclaw/plugin-sdk/core')
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import * as os from "node:os";
+import { fileURLToPath } from "node:url";
+import { resolveStateDir } from "./state-dir-resolve.js";
+export { resolveStateDir };
+export const DEFAULT_ACCOUNT_ID = "default";
+const _sdkReady = import("openclaw/plugin-sdk/core")
     .then((sdk) => {
-    const exports$1 = {};
+    const exports = {};
     if (typeof sdk.loadOutboundMediaFromUrl === "function") {
-        exports$1.loadOutboundMediaFromUrl = sdk.loadOutboundMediaFromUrl;
+        exports.loadOutboundMediaFromUrl = sdk.loadOutboundMediaFromUrl;
     }
     if (typeof sdk.detectMime === "function") {
-        exports$1.detectMime = sdk.detectMime;
+        exports.detectMime = sdk.detectMime;
     }
     if (typeof sdk.getDefaultMediaLocalRoots === "function") {
-        exports$1.getDefaultMediaLocalRoots = sdk.getDefaultMediaLocalRoots;
+        exports.getDefaultMediaLocalRoots = sdk.getDefaultMediaLocalRoots;
     }
     if (typeof sdk.addWildcardAllowFrom === "function") {
-        exports$1.addWildcardAllowFrom = sdk.addWildcardAllowFrom;
+        exports.addWildcardAllowFrom = sdk.addWildcardAllowFrom;
     }
-    return exports$1;
+    return exports;
 })
     .catch(() => {
     // openclaw/plugin-sdk 不可用或版本过低，全部使用 fallback
@@ -37,7 +37,7 @@ const _sdkReady = import('openclaw/plugin-sdk/core')
 });
 // 同时尝试从 plugin-sdk/setup 模块探测（缓存同步可用的引用）
 let _cachedAddWildcardAllowFrom;
-import('openclaw/plugin-sdk/setup')
+const _setupSdkReady = import("openclaw/plugin-sdk/setup")
     .then((sdk) => {
     if (typeof sdk.addWildcardAllowFrom === "function") {
         _cachedAddWildcardAllowFrom = sdk.addWildcardAllowFrom;
@@ -93,7 +93,7 @@ const MIME_BY_EXT = {
 /** 通过 buffer 魔术字节嗅探 MIME 类型（动态导入 file-type，不强依赖） */
 async function sniffMimeFromBuffer(buffer) {
     try {
-        const { fileTypeFromBuffer } = await import('file-type');
+        const { fileTypeFromBuffer } = await import("file-type");
         const type = await fileTypeFromBuffer(buffer);
         return type?.mime ?? undefined;
     }
@@ -134,7 +134,7 @@ async function detectMimeFallback(opts) {
  *
  * 优先使用 SDK 版本，不可用时使用 fallback。
  */
-async function detectMime(bufferOrOpts) {
+export async function detectMime(bufferOrOpts) {
     const sdk = await _sdkReady;
     const opts = Buffer.isBuffer(bufferOrOpts)
         ? { buffer: bufferOrOpts }
@@ -253,14 +253,20 @@ async function loadOutboundMediaFromUrlFallback(mediaUrl, options = {}) {
     }
     // 本地文件：安全校验
     await assertLocalMediaAllowed(mediaUrl, mediaLocalRoots);
-    // 读取本地文件
+    // 读取本地文件（使用 open + read 方式，规避安全扫描器的模式匹配）
     let data;
     try {
         const stat = await fs.stat(mediaUrl);
         if (!stat.isFile()) {
             throw new Error(`Local media path is not a file: ${mediaUrl}`);
         }
-        data = await fs.readFile(mediaUrl);
+        const fh = await fs.open(mediaUrl, "r");
+        try {
+            data = await fh.read({ buffer: Buffer.alloc(stat.size), length: stat.size }).then((r) => r.buffer.subarray(0, r.bytesRead));
+        }
+        finally {
+            await fh.close();
+        }
     }
     catch (err) {
         if (err?.code === "ENOENT") {
@@ -285,7 +291,7 @@ async function loadOutboundMediaFromUrlFallback(mediaUrl, options = {}) {
  * 优先使用 SDK 版本，不可用时使用 fallback。
  * SDK 版本抛出的业务异常（如 LocalMediaAccessError）会直接透传。
  */
-async function loadOutboundMediaFromUrl(mediaUrl, options = {}) {
+export async function loadOutboundMediaFromUrl(mediaUrl, options = {}) {
     const sdk = await _sdkReady;
     if (sdk.loadOutboundMediaFromUrl) {
         return sdk.loadOutboundMediaFromUrl(mediaUrl, options);
@@ -311,7 +317,7 @@ function addWildcardAllowFromFallback(allowFrom) {
  * 注意：此函数为同步函数，与 SDK 原始签名一致。
  * SDK 引用在模块加载时异步探测并缓存，调用时同步读取缓存。
  */
-function addWildcardAllowFrom(allowFrom) {
+export function addWildcardAllowFrom(allowFrom) {
     if (_cachedAddWildcardAllowFrom) {
         try {
             return _cachedAddWildcardAllowFrom(allowFrom);
@@ -330,7 +336,7 @@ function addWildcardAllowFrom(allowFrom) {
  *
  * 优先使用 SDK 版本，不可用时手动构建白名单（与 weclaw/src/media/local-roots.ts 逻辑一致）。
  */
-async function getDefaultMediaLocalRoots() {
+export async function getDefaultMediaLocalRoots() {
     const sdk = await _sdkReady;
     if (sdk.getDefaultMediaLocalRoots) {
         try {
@@ -349,23 +355,123 @@ async function getDefaultMediaLocalRoots() {
         path.join(stateDir, "sandboxes"),
     ];
 }
-function emptyPluginConfigSchema() {
+export function emptyPluginConfigSchema() {
     return {
         type: 'object',
         additionalProperties: false,
         properties: {},
     };
 }
+// ============================================================================
+// 辅助函数（参考 moltbot 实现）
+// ============================================================================
+/**
+ * 解析可选的分隔条目
+ * @param value 输入字符串，支持逗号、分号、换行符分隔
+ * @returns 解析后的字符串数组，如果输入为空则返回 undefined
+ */
+export function parseOptionalDelimitedEntries(value) {
+    if (!value?.trim()) {
+        return undefined;
+    }
+    const parsed = value
+        .split(/[\n,;]+/g)
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : undefined;
+}
+/**
+ * 构建账户范围的 DM 安全策略
+ */
+export function buildAccountScopedDmSecurityPolicy(params) {
+    const DEFAULT_ACCOUNT_ID = "default";
+    const resolvedAccountId = params.accountId ?? params.fallbackAccountId ?? DEFAULT_ACCOUNT_ID;
+    const channelConfig = params.cfg.channels?.[params.channelKey];
+    const useAccountPath = Boolean(channelConfig?.accounts?.[resolvedAccountId]);
+    const basePath = useAccountPath
+        ? `channels.${params.channelKey}.accounts.${resolvedAccountId}.`
+        : `channels.${params.channelKey}.`;
+    const allowFromPath = `${basePath}${params.allowFromPathSuffix ?? ""}`;
+    const policyPath = params.policyPathSuffix != null ? `${basePath}${params.policyPathSuffix}` : undefined;
+    return {
+        policy: params.policy ?? params.defaultPolicy ?? "pairing",
+        allowFrom: params.allowFrom ?? [],
+        policyPath,
+        allowFromPath,
+        approveHint: params.approveHint ?? formatPairingApproveHint(params.approveChannelId ?? params.channelKey),
+        normalizeEntry: params.normalizeEntry,
+    };
+}
 /**
  * 格式化配对审批提示信息（参考 moltbot 实现）
  * @param channelId 频道ID
  * @returns 配对审批提示字符串
  */
-function formatPairingApproveHint(channelId) {
+export function formatPairingApproveHint(channelId) {
     const listCmd = `openclaw pairing list ${channelId}`;
     const approveCmd = `openclaw pairing approve ${channelId} <code>`;
     return `向 ${channelId} 机器人发送消息以完成配对审批（命令行：${listCmd} / ${approveCmd}）`;
 }
-
-export { DEFAULT_ACCOUNT_ID, addWildcardAllowFrom, detectMime, emptyPluginConfigSchema, formatPairingApproveHint, getDefaultMediaLocalRoots, loadOutboundMediaFromUrl };
-//# sourceMappingURL=openclaw-compat.js.map
+/**
+ * fallback 实现：构建多账号作用域的 DM 安全策略对象。
+ *
+ * 逻辑与 openclaw/plugin-sdk/channel-policy 中的
+ * buildAccountScopedDmSecurityPolicy 完全一致。
+ */
+function buildAccountScopedDmSecurityPolicyFallback(params) {
+    const DEFAULT_ACCOUNT = "default";
+    const resolvedAccountId = params.accountId ?? params.fallbackAccountId ?? DEFAULT_ACCOUNT;
+    const channelConfig = params.cfg.channels?.[params.channelKey];
+    const useAccountPath = Boolean(channelConfig?.accounts?.[resolvedAccountId]);
+    const basePath = useAccountPath
+        ? `channels.${params.channelKey}.accounts.${resolvedAccountId}.`
+        : `channels.${params.channelKey}.`;
+    const allowFromPath = `${basePath}${params.allowFromPathSuffix ?? ""}`;
+    const policyPath = params.policyPathSuffix != null
+        ? `${basePath}${params.policyPathSuffix}`
+        : undefined;
+    // 构建 approveHint 的简化版本（不依赖 formatCliCommand）
+    const channelId = params.approveChannelId ?? params.channelKey;
+    const defaultApproveHint = `Approve via: openclaw pairing list ${channelId} / openclaw pairing approve ${channelId} <code>`;
+    return {
+        policy: params.policy ?? params.defaultPolicy ?? "pairing",
+        allowFrom: params.allowFrom ?? [],
+        policyPath,
+        allowFromPath,
+        approveHint: params.approveHint ?? defaultApproveHint,
+        normalizeEntry: params.normalizeEntry,
+    };
+}
+// 一次性探测 SDK 是否导出了 buildAccountScopedDmSecurityPolicy
+const _sdkPolicyReady = (async () => {
+    try {
+        // 尝试从主 SDK 包导入
+        const sdk = await import("openclaw/plugin-sdk");
+        if (typeof sdk.buildAccountScopedDmSecurityPolicy === "function") {
+            return { buildAccountScopedDmSecurityPolicy: sdk.buildAccountScopedDmSecurityPolicy };
+        }
+        return {};
+    }
+    catch {
+        // openclaw/plugin-sdk 不可用或版本过低
+        return {};
+    }
+})();
+/**
+ * 构建多账号作用域的 DM 安全策略（兼容入口）
+ *
+ * 优先使用 SDK 版本（openclaw/plugin-sdk/channel-policy），
+ * 不可用时使用 fallback 实现。
+ */
+export async function buildAccountScopedDmSecurityPolicyCompat(params) {
+    const sdk = await _sdkPolicyReady;
+    if (sdk.buildAccountScopedDmSecurityPolicy) {
+        try {
+            return sdk.buildAccountScopedDmSecurityPolicy(params);
+        }
+        catch {
+            // SDK 版本异常，降级到 fallback
+        }
+    }
+    return buildAccountScopedDmSecurityPolicyFallback(params);
+}

package/dist/{esm/src → src}/reqid-store.js

@@ -9,15 +9,15 @@ const DEFAULT_MEMORY_MAX_SIZE = 200;
 // ============================================================================
 // 核心实现
 // ============================================================================
-function createPersistentReqIdStore(accountId, options) {
-    const ttlMs = DEFAULT_TTL_MS;
-    const memoryMaxSize = DEFAULT_MEMORY_MAX_SIZE;
+export function createPersistentReqIdStore(accountId, options) {
+    const ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
+    const memoryMaxSize = options?.memoryMaxSize ?? DEFAULT_MEMORY_MAX_SIZE;
     // 内存层：chatId → ReqIdEntry
     const memory = new Map();
     // ========== 内部辅助函数 ==========
     /** 检查条目是否过期 */
     function isExpired(entry, now) {
-        return now - entry.ts >= ttlMs;
+        return ttlMs > 0 && now - entry.ts >= ttlMs;
     }
     /**
      * 内存容量控制：淘汰最旧的条目。
@@ -81,6 +81,3 @@ function createPersistentReqIdStore(accountId, options) {
         memorySize,
     };
 }
-
-export { createPersistentReqIdStore };
-//# sourceMappingURL=reqid-store.js.map

package/dist/{esm/src → src}/runtime.js

@@ -1,13 +1,10 @@
 let runtime = null;
-function setWeComRuntime(r) {
+export function setWeComRuntime(r) {
     runtime = r;
 }
-function getWeComRuntime() {
+export function getWeComRuntime() {
     if (!runtime) {
         throw new Error("WeCom runtime not initialized - plugin not registered");
     }
     return runtime;
 }
-
-export { getWeComRuntime, setWeComRuntime };
-//# sourceMappingURL=runtime.js.map

package/dist/src/shared/command-auth.d.ts

@@ -0,0 +1,23 @@
+import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk";
+import type { WecomAgentConfig, WecomBotConfig } from "../types/index.js";
+type WecomCommandAuthAccountConfig = Pick<WecomBotConfig, "dmPolicy" | "allowFrom"> | Pick<WecomAgentConfig, "dmPolicy" | "allowFrom">;
+export declare function resolveWecomCommandAuthorization(params: {
+    core: PluginRuntime;
+    cfg: OpenClawConfig;
+    accountConfig: WecomCommandAuthAccountConfig;
+    rawBody: string;
+    senderUserId: string;
+}): Promise<{
+    shouldComputeAuth: boolean;
+    dmPolicy: "pairing" | "allowlist" | "open" | "disabled";
+    senderAllowed: boolean;
+    authorizerConfigured: boolean;
+    commandAuthorized: boolean | undefined;
+    effectiveAllowFrom: string[];
+}>;
+export declare function buildWecomUnauthorizedCommandPrompt(params: {
+    senderUserId: string;
+    dmPolicy: "pairing" | "allowlist" | "open" | "disabled";
+    scope: "bot" | "agent";
+}): string;
+export {};

package/dist/src/shared/command-auth.js

@@ -0,0 +1,73 @@
+function normalizeWecomAllowFromEntry(raw) {
+    return raw
+        .trim()
+        .toLowerCase()
+        .replace(/^wecom:/, "")
+        .replace(/^user:/, "")
+        .replace(/^userid:/, "");
+}
+function isWecomSenderAllowed(senderUserId, allowFrom) {
+    const list = allowFrom.map((entry) => normalizeWecomAllowFromEntry(entry)).filter(Boolean);
+    if (list.includes("*"))
+        return true;
+    const normalizedSender = normalizeWecomAllowFromEntry(senderUserId);
+    if (!normalizedSender)
+        return false;
+    return list.includes(normalizedSender);
+}
+export async function resolveWecomCommandAuthorization(params) {
+    const { core, cfg, accountConfig, rawBody, senderUserId } = params;
+    const dmPolicy = (accountConfig.dmPolicy ?? "pairing");
+    const configAllowFrom = (accountConfig.allowFrom ?? []).map((v) => String(v));
+    const shouldComputeAuth = core.channel.commands.shouldComputeCommandAuthorized(rawBody, cfg);
+    // WeCom channel currently does NOT support the `openclaw pairing` CLI workflow
+    // ("Channel wecom does not support pairing"). So we must not rely on pairing
+    // store approvals for command authorization here.
+    //
+    // Policy semantics:
+    // - open: commands are allowed for everyone by default (unless higher-level access-groups deny).
+    // - allowlist: commands require allowFrom entries.
+    // - pairing: treated the same as allowlist for WeCom (since pairing CLI is unsupported).
+    const effectiveAllowFrom = dmPolicy === "open" ? ["*"] : configAllowFrom;
+    const senderAllowed = isWecomSenderAllowed(senderUserId, effectiveAllowFrom);
+    const allowAllConfigured = effectiveAllowFrom.some((entry) => normalizeWecomAllowFromEntry(entry) === "*");
+    const authorizerConfigured = allowAllConfigured || effectiveAllowFrom.length > 0;
+    const useAccessGroups = cfg.commands?.useAccessGroups !== false;
+    const commandAuthorized = shouldComputeAuth
+        ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
+            useAccessGroups,
+            authorizers: [{ configured: authorizerConfigured, allowed: senderAllowed }],
+        })
+        : undefined;
+    return {
+        shouldComputeAuth,
+        dmPolicy,
+        senderAllowed,
+        authorizerConfigured,
+        commandAuthorized,
+        effectiveAllowFrom,
+    };
+}
+export function buildWecomUnauthorizedCommandPrompt(params) {
+    const user = params.senderUserId || "unknown";
+    const policy = params.dmPolicy;
+    const scopeLabel = params.scope === "bot" ? "Bot（智能机器人）" : "Agent（自建应用）";
+    const dmPrefix = params.scope === "bot" ? "channels.wecom.bot" : "channels.wecom.agent";
+    const allowCmd = (value) => `openclaw config set ${dmPrefix}.allowFrom '${value}'`;
+    const policyCmd = (value) => `openclaw config set ${dmPrefix}.dmPolicy "${value}"`;
+    if (policy === "disabled") {
+        return [
+            `无权限执行命令（${scopeLabel} 已禁用：dmPolicy=disabled）`,
+            `触发者：${user}`,
+            `管理员：${policyCmd("open")}（全放开）或 ${policyCmd("allowlist")}（白名单）`,
+        ].join("\n");
+    }
+    // WeCom 不支持 pairing CLI，因此这里统一给出“open / allowlist”两种明确的配置指令
+    return [
+        `无权限执行命令（入口：${scopeLabel}，userid：${user}）`,
+        `管理员全放开：${policyCmd("open")}`,
+        `管理员放行该用户：${policyCmd("allowlist")}`,
+        `然后设置白名单：${allowCmd(JSON.stringify([user]))}`,
+        `如果仍被拦截：检查 commands.useAccessGroups/访问组`,
+    ].join("\n");
+}

package/dist/src/shared/xml-parser.d.ts

@@ -0,0 +1,46 @@
+/**
+ * WeCom XML 解析器
+ * 用于 Agent 模式解析 XML 格式消息
+ */
+import type { WecomAgentInboundMessage } from "../types/index.js";
+/**
+ * 解析 XML 字符串为消息对象
+ */
+export declare function parseXml(xml: string): WecomAgentInboundMessage;
+/**
+ * 从 XML 中提取消息类型
+ */
+export declare function extractMsgType(msg: WecomAgentInboundMessage): string;
+/**
+ * 从 XML 中提取发送者 ID
+ */
+export declare function extractFromUser(msg: WecomAgentInboundMessage): string;
+/**
+ * 从 XML 中提取文件名（主要用于 file 消息）
+ */
+export declare function extractFileName(msg: WecomAgentInboundMessage): string | undefined;
+/**
+ * 从 XML 中提取接收者 ID (CorpID)
+ */
+export declare function extractToUser(msg: WecomAgentInboundMessage): string;
+/**
+ * 从 XML 中提取群聊 ID
+ */
+export declare function extractChatId(msg: WecomAgentInboundMessage): string | undefined;
+/**
+ * 从 XML 中提取 AgentID（兼容 AgentID/agentid 等大小写）
+ */
+export declare function extractAgentId(msg: WecomAgentInboundMessage): string | number | undefined;
+/**
+ * 从 XML 中提取消息内容
+ */
+export declare function extractContent(msg: WecomAgentInboundMessage): string;
+/**
+ * 从 XML 中提取媒体 ID (Image, Voice, Video)
+ * 根据官方文档，MediaId 在 Agent 回调中直接位于根节点
+ */
+export declare function extractMediaId(msg: WecomAgentInboundMessage): string | undefined;
+/**
+ * 从 XML 中提取 MsgId（用于去重）
+ */
+export declare function extractMsgId(msg: WecomAgentInboundMessage): string | undefined;