@workclaw/openclaw-workclaw 1.0.18 → 1.0.19

package/{src/channel.ts → dist/src/channel.js}

@@ -1,225 +1,198 @@
-import type {
-    ChannelGatewayContext,
-    ChannelPlugin,
-    OpenClawConfig,
-} from "openclaw/plugin-sdk";
-import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
-import { formatPairingApproveHint } from "openclaw/plugin-sdk/core";
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
-import type { ResolvedWorkclawAccount, WorkclawConfig } from "./types.js";
-import {
-    isWorkclawAccountConfigured,
-    listWorkclawAccountIds,
-    resolveWorkclawAccount,
-} from "./accounts.js";
-import { WorkclawConfigSchema } from "./config-schema.js";
-import { sendMessageWorkclaw } from "./outbound/index.js";
-import { setWorkclawRuntime, getWorkclawRuntime, getWorkclawWsConnection, getLastInboundAt, getLastOutboundAt } from "./runtime.js";
-import { startWorkclawGateway, stopWorkclawGateway } from "./gateway/workclaw-gateway.js";
-import { appendFileSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-
-const meta = {
-    id: "openclaw-workclaw",
-    label: "智小途",
-    selectionLabel: "智小途",
-    docsPath: "/channels/openclaw-workclaw",
-    docsLabel: "智小途",
-    blurb: "智小途 OpenClaw通道",
-    aliases: [],
-    order: 90,
-};
-
-/**
- * 写入文件日志到磁盘
- * @param message 日志消息
- */
-function writeFileLog(message: string): void {
-    const timestamp = new Date().toISOString();
-    const logLine = `[${timestamp}] ${message}\n`;
-    const logDir = join(homedir(), ".openclaw", "logs");
-    const logFile = join(logDir, "sendtext-outbound.log");
-
-    try {
-        appendFileSync(logFile, logLine);
-    } catch (err) {
-        console.error(`[writeFileLog] Failed to write log: ${err}`);
-    }
-}
-
-export const workclawDock = {
-    id: "openclaw-workclaw",
-    capabilities: {
-        chatTypes: ["direct", "group"],
-        media: true,
-        blockStreaming: true,
-    },
-};
-
-export const workclawPlugin: ChannelPlugin<ResolvedWorkclawAccount> = {
-    id: "openclaw-workclaw",
-    meta,
-    capabilities: {
-        chatTypes: ["direct", "group"],
-        media: true,
-        reactions: false,
-        threads: false,
-        polls: false,
-        nativeCommands: false,
-        blockStreaming: true,
-    },
-    reload: { configPrefixes: ["channels.openclaw-workclaw"] },
-    configSchema: buildChannelConfigSchema(WorkclawConfigSchema),
-    config: {
-        listAccountIds: (cfg) => listWorkclawAccountIds(cfg as OpenClawConfig),
-        resolveAccount: (cfg, accountId) =>
-            resolveWorkclawAccount({ cfg: cfg as OpenClawConfig, accountId }),
-        isConfigured: (account) => isWorkclawAccountConfigured(account.config),
-        describeAccount: (account) => ({
-            accountId: account.accountId,
-            name: account.name,
-            enabled: account.enabled,
-            configured: isWorkclawAccountConfigured(account.config),
-        }),
-    },
-    outbound: {
-        deliveryMode: "direct",
-        chunker: (text: string, _limit: number) => [text],
-        textChunkLimit: 4096,
-        sendText: async ({ to, text, accountId, cfg, replyToId }) => {
-            writeFileLog(`outbound sendText called: replyToId=${replyToId}, accountId=${accountId}, to=${to}, text=${text.substring(0, 100)}`);
-            const result = await sendMessageWorkclaw({
-                accountId: accountId ?? undefined,
-                cfg: cfg as OpenClawConfig,
-                to,
-                text,
-            });
-            return {
-                channel: "openclaw-workclaw",
-                ok: true,
-                messageId: result.messageId,
-            };
-        },
-        sendMedia: async ({ to, text, mediaUrl, accountId, cfg }) => {
-            if (!mediaUrl && !text.trim()) {
-                throw new Error("mediaUrl is required for outbound media");
-            }
-            const log = (getWorkclawRuntime() as any).log ?? console.log;
-            if (typeof log === "function") {
-                log(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`);
-            }
-            else if (log?.info) {
-                log.info(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`);
-            }
-            const messageText = text.trim() ? text : mediaUrl ?? "";
-            const result = await sendMessageWorkclaw({
-                accountId: accountId ?? undefined,
-                cfg: cfg as OpenClawConfig,
-                to,
-                text: messageText,
-                mediaUrl: mediaUrl ?? undefined,
-            });
-            return {
-                channel: "openclaw-workclaw",
-                ok: true,
-                messageId: result.messageId,
-            };
-        },
-    },
-    security: {
-        resolveDmPolicy: ({ cfg, accountId, account }) => {
-            const resolvedAccountId = accountId ?? account.accountId ?? DEFAULT_ACCOUNT_ID;
-            const channelConfig = cfg.channels?.["openclaw-workclaw"] as WorkclawConfig | undefined;
-            const useAccountPath = Boolean(channelConfig?.accounts?.[resolvedAccountId]);
-            const basePath = useAccountPath
-                ? `channels.openclaw-workclaw.accounts.${resolvedAccountId}.`
-                : "channels.openclaw-workclaw.";
-            return {
-                policy: account.config.dmPolicy ?? "pairing",
-                allowFrom: account.config.allowFrom ?? [],
-                policyPath: `${basePath}dmPolicy`,
-                allowFromPath: `${basePath}allowFrom`,
-                approveHint: formatPairingApproveHint("openclaw-workclaw"),
-                normalizeEntry: (raw) => raw.replace(/^openclaw-workclaw:/i, ""),
-            };
-        },
-    },
-    status: {
-        buildAccountSnapshot: async ({ account, cfg }) => {
-            // per-appKey 模式下 WebSocket 用 appKey 存储，per-account 用 accountId
-            const wsKey = account.config.wsConnectionStrategy === "per-appKey"
-                ? account.config.appKey
-                : account.accountId;
-            const ws = wsKey ? getWorkclawWsConnection(wsKey) : undefined;
-            const isConnected = ws && ws.readyState === 1; // WebSocket.OPEN = 1
-            const lastInboundAt = account.accountId ? getLastInboundAt(account.accountId) : undefined;
-            const lastOutboundAt = account.accountId ? getLastOutboundAt(account.accountId) : undefined;
-
-            return {
-                accountId: account.accountId,
-                name: account.name,
-                enabled: account.enabled,
-                configured: account.configured,
-                connected: isConnected,
-                running: account.enabled && account.configured,
-                mode: account.config.wsConnectionStrategy || "per-account",
-                lastInboundAt: lastInboundAt ?? null,
-                lastOutboundAt: lastOutboundAt ?? null,
-            };
-        },
-    },
-    gateway: {
-        startAccount: async (ctx: ChannelGatewayContext<ResolvedWorkclawAccount>) => {
-            const { setStatus, getStatus, account, accountId, cfg, log } = ctx;
-            log?.info?.(`startAccount called for ${accountId}`);
-
-            await startWorkclawGateway({
-                accountId,
-                account,
-                cfg,
-                log,
-            });
-
-            setStatus({
-                ...getStatus(),
-                running: true,
-                lastStartAt: Date.now(),
-                lastError: null,
-            });
-            log?.info?.(`startAccount completed for ${accountId}, keeping pending until abort`);
-
-            // 保持 pending 状态直到 abortSignal 触发（防止 OpenClaw 3.8 认为启动立即退出）
-            await new Promise<void>((resolve) => {
-                if (ctx.abortSignal.aborted) {
-                    resolve();
-                    return;
-                }
-                ctx.abortSignal.addEventListener("abort", () => resolve(), { once: true });
-            });
-
-            // abort 触发后，清理资源
-            log?.info?.(`startAccount abort signal received for ${accountId}`);
-            const wsStrategy = (account.config as any)?.wsConnectionStrategy || "per-account";
-            stopWorkclawGateway(accountId, wsStrategy);
-            setStatus({
-                ...getStatus(),
-                running: false,
-                lastStopAt: Date.now(),
-            });
-        },
-        stopAccount: async (ctx: ChannelGatewayContext<ResolvedWorkclawAccount>) => {
-            const { setStatus, getStatus, accountId, account } = ctx;
-
-            // Stop WorkClaw gateway
-            const wsStrategy = (account.config as any)?.wsConnectionStrategy || "per-account";
-            stopWorkclawGateway(accountId, wsStrategy);
-
-            setStatus({
-                ...getStatus(),
-                running: false,
-                lastStopAt: Date.now(),
-            });
-        },
-    },
-};
+import { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+import { formatPairingApproveHint } from "openclaw/plugin-sdk/core";
+import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { isWorkclawAccountConfigured, listWorkclawAccountIds, resolveWorkclawAccount, } from "./accounts.js";
+import { WorkclawConfigSchema } from "./config-schema.js";
+import { sendMessageWorkclaw } from "./outbound/index.js";
+import { getWorkclawRuntime, getWorkclawWsConnection, getLastInboundAt, getLastOutboundAt } from "./runtime.js";
+import { startWorkclawGateway, stopWorkclawGateway } from "./gateway/workclaw-gateway.js";
+import { appendFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+const meta = {
+    id: "openclaw-workclaw",
+    label: "智小途",
+    selectionLabel: "智小途",
+    docsPath: "/channels/openclaw-workclaw",
+    docsLabel: "智小途",
+    blurb: "智小途 OpenClaw通道",
+    aliases: [],
+    order: 90,
+};
+/**
+ * 写入文件日志到磁盘
+ * @param message 日志消息
+ */
+function writeFileLog(message) {
+    const timestamp = new Date().toISOString();
+    const logLine = `[${timestamp}] ${message}\n`;
+    const logDir = join(homedir(), ".openclaw", "logs");
+    const logFile = join(logDir, "sendtext-outbound.log");
+    try {
+        appendFileSync(logFile, logLine);
+    }
+    catch (err) {
+        console.error(`[writeFileLog] Failed to write log: ${err}`);
+    }
+}
+export const workclawDock = {
+    id: "openclaw-workclaw",
+    capabilities: {
+        chatTypes: ["direct", "group"],
+        media: true,
+        blockStreaming: true,
+    },
+};
+export const workclawPlugin = {
+    id: "openclaw-workclaw",
+    meta,
+    capabilities: {
+        chatTypes: ["direct", "group"],
+        media: true,
+        reactions: false,
+        threads: false,
+        polls: false,
+        nativeCommands: false,
+        blockStreaming: true,
+    },
+    reload: { configPrefixes: ["channels.openclaw-workclaw"] },
+    configSchema: buildChannelConfigSchema(WorkclawConfigSchema),
+    config: {
+        listAccountIds: (cfg) => listWorkclawAccountIds(cfg),
+        resolveAccount: (cfg, accountId) => resolveWorkclawAccount({ cfg: cfg, accountId }),
+        isConfigured: (account) => isWorkclawAccountConfigured(account.config),
+        describeAccount: (account) => ({
+            accountId: account.accountId,
+            name: account.name,
+            enabled: account.enabled,
+            configured: isWorkclawAccountConfigured(account.config),
+        }),
+    },
+    outbound: {
+        deliveryMode: "direct",
+        chunker: (text, _limit) => [text],
+        textChunkLimit: 4096,
+        sendText: async ({ to, text, accountId, cfg, replyToId }) => {
+            writeFileLog(`outbound sendText called: replyToId=${replyToId}, accountId=${accountId}, to=${to}, text=${text.substring(0, 100)}`);
+            const result = await sendMessageWorkclaw({
+                accountId: accountId ?? undefined,
+                cfg: cfg,
+                to,
+                text,
+            });
+            return {
+                channel: "openclaw-workclaw",
+                ok: true,
+                messageId: result.messageId,
+            };
+        },
+        sendMedia: async ({ to, text, mediaUrl, accountId, cfg }) => {
+            if (!mediaUrl && !text.trim()) {
+                throw new Error("mediaUrl is required for outbound media");
+            }
+            const log = getWorkclawRuntime().log ?? console.log;
+            if (typeof log === "function") {
+                log(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`);
+            }
+            else if (log?.info) {
+                log.info(`outbound sendMedia called for ${to} with text ${text} and mediaUrl ${mediaUrl}`);
+            }
+            const messageText = text.trim() ? text : mediaUrl ?? "";
+            const result = await sendMessageWorkclaw({
+                accountId: accountId ?? undefined,
+                cfg: cfg,
+                to,
+                text: messageText,
+                mediaUrl: mediaUrl ?? undefined,
+            });
+            return {
+                channel: "openclaw-workclaw",
+                ok: true,
+                messageId: result.messageId,
+            };
+        },
+    },
+    security: {
+        resolveDmPolicy: ({ cfg, accountId, account }) => {
+            const resolvedAccountId = accountId ?? account.accountId ?? DEFAULT_ACCOUNT_ID;
+            const channelConfig = cfg.channels?.["openclaw-workclaw"];
+            const useAccountPath = Boolean(channelConfig?.accounts?.[resolvedAccountId]);
+            const basePath = useAccountPath
+                ? `channels.openclaw-workclaw.accounts.${resolvedAccountId}.`
+                : "channels.openclaw-workclaw.";
+            return {
+                policy: account.config.dmPolicy ?? "open",
+                allowFrom: account.config.allowFrom ?? ["*"],
+                policyPath: `${basePath}dmPolicy`,
+                allowFromPath: `${basePath}allowFrom`,
+                approveHint: formatPairingApproveHint("openclaw-workclaw"),
+                normalizeEntry: (raw) => raw.replace(/^openclaw-workclaw:/i, ""),
+            };
+        },
+    },
+    status: {
+        buildAccountSnapshot: async ({ account, cfg }) => {
+            // WebSocket 用 appKey 存储
+            const wsKey = account.config.appKey;
+            const ws = wsKey ? getWorkclawWsConnection(wsKey) : undefined;
+            const isConnected = ws && ws.readyState === 1; // WebSocket.OPEN = 1
+            const lastInboundAt = account.accountId ? getLastInboundAt(account.accountId) : undefined;
+            const lastOutboundAt = account.accountId ? getLastOutboundAt(account.accountId) : undefined;
+            return {
+                accountId: account.accountId,
+                name: account.name,
+                enabled: account.enabled,
+                configured: account.configured,
+                connected: isConnected,
+                running: account.enabled && account.configured,
+                lastInboundAt: lastInboundAt ?? null,
+                lastOutboundAt: lastOutboundAt ?? null,
+            };
+        },
+    },
+    gateway: {
+        startAccount: async (ctx) => {
+            const { setStatus, getStatus, account, accountId, cfg, log } = ctx;
+            log?.info?.(`startAccount called for ${accountId}`);
+            await startWorkclawGateway({
+                accountId,
+                account,
+                cfg,
+                log,
+            });
+            setStatus({
+                ...getStatus(),
+                running: true,
+                lastStartAt: Date.now(),
+                lastError: null,
+            });
+            log?.info?.(`startAccount completed for ${accountId}, keeping pending until abort`);
+            // 保持 pending 状态直到 abortSignal 触发（防止 OpenClaw 3.8 认为启动立即退出）
+            await new Promise((resolve) => {
+                if (ctx.abortSignal.aborted) {
+                    resolve();
+                    return;
+                }
+                ctx.abortSignal.addEventListener("abort", () => resolve(), { once: true });
+            });
+            // abort 触发后，清理资源
+            log?.info?.(`startAccount abort signal received for ${accountId}`);
+            stopWorkclawGateway(accountId);
+            setStatus({
+                ...getStatus(),
+                running: false,
+                lastStopAt: Date.now(),
+            });
+        },
+        stopAccount: async (ctx) => {
+            const { setStatus, getStatus, accountId, account } = ctx;
+            // Stop WorkClaw gateway
+            stopWorkclawGateway(accountId);
+            setStatus({
+                ...getStatus(),
+                running: false,
+                lastStopAt: Date.now(),
+            });
+        },
+    },
+};

package/dist/src/config-schema.d.ts

@@ -0,0 +1,93 @@
+import { z } from 'zod';
+export { z };
+export declare const workclawAccountConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    name: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    userId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    openConversationId: z.ZodOptional<z.ZodString>;
+    dmPolicy: z.ZodOptional<z.ZodEnum<{
+        open: "open";
+    }>>;
+    allowFrom: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    mediaMaxMb: z.ZodOptional<z.ZodNumber>;
+    allowInsecureTls: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const WorkclawConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    connectionMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        websocket: "websocket";
+    }>>>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    websocketUrl: z.ZodOptional<z.ZodString>;
+    appKey: z.ZodOptional<z.ZodString>;
+    appSecret: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    localIp: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    requestTimeout: z.ZodOptional<z.ZodNumber>;
+    allowInsecureTls: z.ZodOptional<z.ZodBoolean>;
+    allowRawJsonPayload: z.ZodOptional<z.ZodBoolean>;
+    uploadUrl: z.ZodOptional<z.ZodString>;
+    uploadFieldName: z.ZodOptional<z.ZodString>;
+    uploadHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    uploadFormFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    uploadResponseUrlPath: z.ZodOptional<z.ZodString>;
+    dmPolicy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        open: "open";
+    }>>>;
+    allowFrom: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    mediaMaxMb: z.ZodOptional<z.ZodNumber>;
+    accounts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        name: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        userId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        openConversationId: z.ZodOptional<z.ZodString>;
+        dmPolicy: z.ZodOptional<z.ZodEnum<{
+            open: "open";
+        }>>;
+        allowFrom: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        mediaMaxMb: z.ZodOptional<z.ZodNumber>;
+        allowInsecureTls: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>>;
+}, z.core.$strict>;
+export declare const workclawConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    connectionMode: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        websocket: "websocket";
+    }>>>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    websocketUrl: z.ZodOptional<z.ZodString>;
+    appKey: z.ZodOptional<z.ZodString>;
+    appSecret: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    localIp: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    requestTimeout: z.ZodOptional<z.ZodNumber>;
+    allowInsecureTls: z.ZodOptional<z.ZodBoolean>;
+    allowRawJsonPayload: z.ZodOptional<z.ZodBoolean>;
+    uploadUrl: z.ZodOptional<z.ZodString>;
+    uploadFieldName: z.ZodOptional<z.ZodString>;
+    uploadHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    uploadFormFields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    uploadResponseUrlPath: z.ZodOptional<z.ZodString>;
+    dmPolicy: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        open: "open";
+    }>>>;
+    allowFrom: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+    mediaMaxMb: z.ZodOptional<z.ZodNumber>;
+    accounts: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        name: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        userId: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        openConversationId: z.ZodOptional<z.ZodString>;
+        dmPolicy: z.ZodOptional<z.ZodEnum<{
+            open: "open";
+        }>>;
+        allowFrom: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>>;
+        mediaMaxMb: z.ZodOptional<z.ZodNumber>;
+        allowInsecureTls: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>>;
+}, z.core.$strict>;

package/dist/src/config-schema.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+export { z };
+const DmPolicySchema = z.enum(["open"]);
+const WorkclawConnectionModeSchema = z.enum(["websocket"]);
+export const workclawAccountConfigSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    name: z.string().optional(),
+    agentId: z.union([z.string(), z.number()]).optional(),
+    userId: z.union([z.string(), z.number()]).optional(),
+    openConversationId: z.string().optional(),
+    dmPolicy: DmPolicySchema.optional(),
+    allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    mediaMaxMb: z.number().positive().optional(),
+    allowInsecureTls: z.boolean().optional(),
+})
+    .strict();
+export const WorkclawConfigSchema = z
+    .object({
+    enabled: z.boolean().optional(),
+    connectionMode: WorkclawConnectionModeSchema.optional().default("websocket"),
+    baseUrl: z.string().url().optional(),
+    websocketUrl: z.string().url().optional(),
+    appKey: z.string().optional(),
+    appSecret: z.string().optional(),
+    agentId: z.union([z.string(), z.number()]).optional(),
+    localIp: z.string().optional(),
+    userId: z.union([z.string(), z.number()]).optional(),
+    requestTimeout: z.number().int().positive().optional(),
+    allowInsecureTls: z.boolean().optional(),
+    allowRawJsonPayload: z.boolean().optional(),
+    uploadUrl: z.string().url().optional(),
+    uploadFieldName: z.string().optional(),
+    uploadHeaders: z.record(z.string(), z.string()).optional(),
+    uploadFormFields: z
+        .record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
+        .optional(),
+    uploadResponseUrlPath: z.string().optional(),
+    dmPolicy: DmPolicySchema.optional().default('open'),
+    allowFrom: z.array(z.union([z.string(), z.number()])).optional(),
+    mediaMaxMb: z.number().positive().optional(),
+    accounts: z.record(z.string(), workclawAccountConfigSchema.optional()).optional(),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    const allowFrom = value.allowFrom ?? [];
+    const hasWildcard = allowFrom.some(entry => String(entry).trim() === '*');
+    if (!hasWildcard) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['allowFrom'],
+            message: 'channels.openclaw-workclaw.allowFrom must include "*"',
+        });
+    }
+});
+export const workclawConfigSchema = WorkclawConfigSchema;