@wu529778790/open-im 1.11.8-beta.9 → 1.11.8

package/README.md

@@ -88,12 +88,30 @@ open-im start
 | `/review` | 代码审查 |
 | `/explain` | 解释项目结构 |
 
-### 权限控制
+### 权限与确认
 
-| 命令 | 说明 |
-|------|------|
-| `/allow` `/y` | 允许操作 |
-| `/deny` `/n` | 拒绝操作 |
+Claude 使用 Agent SDK 集成，open-im 默认不替 Claude 做额外的允许/拒绝协议。Claude 需要用户确认时，会按它自己的原生交互语义发问；你在 IM 里回复选项、确认或补充说明即可继续同一个会话。
+
+如果你希望 Claude 也进入自动执行模式，可以在 Web 控制台的 **AI 工具配置 → Claude Code → 跳过 Claude 权限确认** 打开，或在配置文件里设置：
+
+```json
+{
+  "tools": {
+    "claude": {
+      "skipPermissions": true
+    }
+  }
+}
+```
+
+也可以用环境变量临时覆盖：
+
+```bash
+OPEN_IM_SKIP_PERMISSIONS=true open-im start   # 跳过权限确认
+OPEN_IM_SKIP_PERMISSIONS=false open-im start  # 使用 Claude 原生确认
+```
+
+Codex、CodeBuddy、OpenCode 仍保持原来的自动执行默认行为。
 
 ## 会话接力
 

package/dist/adapters/claude-sdk-adapter.d.ts

@@ -21,6 +21,7 @@ interface ClaudeSessionMeta {
 export declare function findLatestClaudeSession(workDir: string): Promise<ClaudeSessionMeta | undefined>;
 export declare class ClaudeSDKAdapter implements ToolAdapter {
     readonly toolId = "claude-sdk";
+    readonly interactionMode = "native";
     /**
      * 清理所有活跃的查询
      */

package/dist/adapters/claude-sdk-adapter.js

@@ -205,6 +205,7 @@ function enrichClaudeErrorMessage(message, stderr) {
 }
 export class ClaudeSDKAdapter {
     toolId = 'claude-sdk';
+    interactionMode = 'native';
     /**
      * 清理所有活跃的查询
      */

package/dist/adapters/codebuddy-adapter.d.ts

@@ -2,6 +2,7 @@ import type { RunCallbacks, RunHandle, RunOptions, ToolAdapter } from './tool-ad
 export declare class CodeBuddyAdapter implements ToolAdapter {
     private cliPath;
     readonly toolId = "codebuddy";
+    readonly interactionMode = "open";
     constructor(cliPath: string);
     run(prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: RunOptions): RunHandle;
 }

package/dist/adapters/codebuddy-adapter.js

@@ -3,6 +3,7 @@ import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
 export class CodeBuddyAdapter {
     cliPath;
     toolId = 'codebuddy';
+    interactionMode = 'open';
     constructor(cliPath) {
         this.cliPath = cliPath;
     }

package/dist/adapters/codex-adapter.d.ts

@@ -5,6 +5,7 @@ import type { RunCallbacks, RunHandle, RunOptions, ToolAdapter } from "./tool-ad
 export declare class CodexAdapter implements ToolAdapter {
     private cliPath;
     readonly toolId = "codex";
+    readonly interactionMode = "open";
     constructor(cliPath: string);
     run(prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: RunOptions): RunHandle;
 }

package/dist/adapters/codex-adapter.js

@@ -6,6 +6,7 @@ import { isSessionInvalidMessage } from "../shared/session-invalid-detector.js";
 export class CodexAdapter {
     cliPath;
     toolId = "codex";
+    interactionMode = "open";
     constructor(cliPath) {
         this.cliPath = cliPath;
     }

package/dist/adapters/opencode-adapter.d.ts

@@ -1,5 +1,6 @@
 import type { RunCallbacks, RunHandle, RunOptions, ToolAdapter } from './tool-adapter.interface.js';
 export declare class OpenCodeAdapter implements ToolAdapter {
     readonly toolId = "opencode";
+    readonly interactionMode = "open";
     run(prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: RunOptions): RunHandle;
 }

package/dist/adapters/opencode-adapter.js

@@ -2,6 +2,7 @@ import { runOpenCodeSdk } from '../opencode/sdk-runner.js';
 import { isSessionInvalidMessage } from '../shared/session-invalid-detector.js';
 export class OpenCodeAdapter {
     toolId = 'opencode';
+    interactionMode = 'open';
     run(prompt, sessionId, workDir, callbacks, options) {
         const handle = runOpenCodeSdk(prompt, sessionId, workDir, {
             onText: callbacks.onText,

package/dist/adapters/tool-adapter.interface.d.ts

@@ -40,7 +40,9 @@ export interface RunOptions {
 export interface RunHandle {
     abort: () => void;
 }
+export type InteractionMode = 'native' | 'open';
 export interface ToolAdapter {
     readonly toolId: string;
+    readonly interactionMode: InteractionMode;
     run(prompt: string, sessionId: string | undefined, workDir: string, callbacks: RunCallbacks, options?: RunOptions): RunHandle;
 }

package/dist/clawbot/client.js

@@ -331,7 +331,7 @@ function extractTextContent(msg) {
             case 3 /* MessageItemType.VOICE */: {
                 const transcript = item.voice_item?.text;
                 if (transcript)
-                    return `[语音转文字] ${transcript}`;
+                    return transcript;
                 return '[语音消息（无文字转录）]';
             }
             case 2 /* MessageItemType.IMAGE */:

package/dist/clawbot/qr-login.d.ts

@@ -8,6 +8,7 @@ export interface QRLoginSession {
     sessionKey: string;
     qrcode: string;
     qrcodeUrl: string;
+    qrcodeImage?: string;
     startedAt: number;
 }
 export interface QRLoginResult {

package/dist/clawbot/qr-login.js

@@ -5,6 +5,7 @@
  * Returns bot_token on success.
  */
 import { randomUUID } from 'node:crypto';
+import QRCode from 'qrcode';
 import { createLogger } from '../logger.js';
 const log = createLogger('ClawBotQR');
 const ILINK_BASE_URL = 'https://ilinkai.weixin.qq.com';
@@ -64,10 +65,16 @@ export async function startQRLogin() {
     log.info('Starting ClawBot QR login...');
     const { qrcode, qrcodeUrl } = await fetchQRCode();
     log.info(`QR code received, url=${qrcodeUrl}`);
+    // iLink 返回的 qrcodeUrl 是一个 HTML 中转页（X-Frame-Options: SAMEORIGIN，
+    // Content-Type: text/html），前端无法用 <img> 或 iframe 直接展示。
+    // 把这个 URL 本身编码成二维码 PNG——用户扫码后微信打开中转页完成绑定。
+    const qrcodeImage = await QRCode.toDataURL(qrcodeUrl, { width: 280, margin: 1 });
+    log.info('QR code PNG generated (base64)');
     return {
         sessionKey: randomUUID(),
         qrcode,
         qrcodeUrl,
+        qrcodeImage,
         startedAt: Date.now(),
     };
 }

package/dist/codex/cli-runner.js

@@ -217,22 +217,27 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
         const event = parseCodexEvent(line);
         if (!event)
             return;
-        const type = event.type;
-        log.debug(`[Codex event] type=${type}`);
-        if (type === 'thread.started') {
-            const threadId = event.thread_id ?? '';
+        // Codex CLI JSONL 格式是嵌套的：顶层 type 为 "event_msg" / "response_item"，
+        // 真正的子类型在 payload.type 里。旧版扁平格式也兼容。
+        const topType = event.type;
+        const payload = event.payload ?? event;
+        const type = payload.type ?? topType;
+        log.debug(`[Codex event] topType=${topType} type=${type}`);
+        // thread.started / session_meta → 拿 session ID
+        if (type === 'thread.started' || type === 'session_meta') {
+            const threadId = payload.thread_id ?? payload.session_id ?? event.thread_id ?? '';
             if (threadId)
                 callbacks.onSessionId?.(threadId);
             return;
         }
         if (type === 'turn.failed') {
             completed = true;
-            const err = event.error;
+            const err = payload.error ?? event.error;
             callbacks.onError(err?.message ?? 'Codex turn failed');
             return;
         }
         if (type === 'error') {
-            const msg = event.message;
+            const msg = payload.message ?? event.message;
             if (msg?.includes('Reconnecting')) {
                 return;
             }
@@ -240,12 +245,12 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
             callbacks.onError(msg ?? 'Codex stream error');
             return;
         }
-        if (type === 'item.started' || type === 'item.updated' || type === 'item.completed') {
-            const item = event.item;
-            if (!item)
-                return;
-            const itemType = item.type;
-            if (itemType === 'reasoning' && type === 'item.completed') {
+        // item 事件：payload 里可能有 item 字段，或者 payload 本身就是 item
+        if (topType === 'response_item' || type === 'item.started' || type === 'item.updated' || type === 'item.completed') {
+            const item = payload.item ?? payload;
+            const itemType = item.type ?? type;
+            if (itemType === 'reasoning') {
+                // Codex 的 reasoning 可能是 encrypted_content（不可读），只在有 text 时累加
                 const text = item.text;
                 if (text) {
                     accumulatedThinking += (accumulatedThinking ? '\n\n' : '') + text;
@@ -253,23 +258,41 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
                 }
                 return;
             }
+            // function_call（Codex 新格式：response_item.type=function_call）
+            if (itemType === 'function_call') {
+                const name = item.name ?? 'unknown';
+                const args = item.arguments;
+                const toolName = name === 'exec_command' ? 'Bash' : name === 'apply_patch' ? 'Edit' : name;
+                toolStats[toolName] = (toolStats[toolName] || 0) + 1;
+                callbacks.onToolUse?.(toolName, args ? { arguments: args } : {});
+                return;
+            }
+            // custom_tool_call（apply_patch 等）
+            if (itemType === 'custom_tool_call') {
+                const name = item.name ?? 'unknown';
+                const toolName = name === 'apply_patch' ? 'Edit' : name;
+                toolStats[toolName] = (toolStats[toolName] || 0) + 1;
+                callbacks.onToolUse?.(toolName, { input: item.input });
+                return;
+            }
+            // command_execution（旧格式）
             if (itemType === 'command_execution') {
                 const cmd = item.command;
-                if (cmd && type === 'item.started') {
-                    const toolName = 'Bash';
-                    toolStats[toolName] = (toolStats[toolName] || 0) + 1;
-                    callbacks.onToolUse?.(toolName, { command: cmd });
+                if (cmd) {
+                    toolStats['Bash'] = (toolStats['Bash'] || 0) + 1;
+                    callbacks.onToolUse?.('Bash', { command: cmd });
                 }
                 return;
             }
-            if (itemType === 'file_change' && type === 'item.completed') {
+            // file_change（旧格式）
+            if (itemType === 'file_change') {
                 const changes = item.changes;
-                const toolName = 'Edit';
-                toolStats[toolName] = (toolStats[toolName] || 0) + 1;
-                callbacks.onToolUse?.(toolName, { changes });
+                toolStats['Edit'] = (toolStats['Edit'] || 0) + 1;
+                callbacks.onToolUse?.('Edit', { changes });
                 return;
             }
-            if (itemType === 'mcp_tool_call' && type === 'item.started') {
+            // mcp_tool_call（旧格式）
+            if (itemType === 'mcp_tool_call') {
                 const tool = item.tool;
                 const server = item.server;
                 if (tool) {
@@ -279,16 +302,41 @@ export function runCodex(cliPath, prompt, sessionId, workDir, callbacks, options
                 }
                 return;
             }
-            if (itemType === 'agent_message' && type === 'item.completed') {
-                const text = item.text;
+            // agent_message / message — 最终回复文本
+            // Codex 新格式：event_msg.payload.type=agent_message, payload.message=文本
+            //              response_item.payload.type=message, payload.content=[{type:output_text,text:...}]
+            if (itemType === 'agent_message' || itemType === 'message') {
+                let text;
+                if (itemType === 'agent_message') {
+                    text = item.message ?? item.text;
+                }
+                else {
+                    // message 类型，content 是数组
+                    const content = item.content;
+                    if (Array.isArray(content)) {
+                        text = content
+                            .filter((c) => c.type === 'output_text' && c.text)
+                            .map((c) => c.text)
+                            .join('\n');
+                    }
+                }
                 if (text) {
+                    // 只累加 final_answer 或 commentary，避免重复
+                    const phase = item.phase ?? payload.phase;
                     accumulated += (accumulated ? '\n\n' : '') + text;
                     callbacks.onText(accumulated);
                 }
                 return;
             }
         }
-        if (type === 'turn.completed') {
+        // task_complete / turn.completed
+        if (type === 'task_complete' || type === 'turn.completed') {
+            // task_complete 里可能有 last_agent_message
+            const lastMsg = payload.last_agent_message;
+            if (lastMsg && !accumulated) {
+                accumulated = lastMsg;
+                callbacks.onText(accumulated);
+            }
             completed = true;
             callbacks.onComplete({
                 success: true,

package/dist/config/types.d.ts

@@ -38,7 +38,7 @@ export interface Config {
      */
     claudeSessionIdleTtlMinutes: number;
     claudeModel?: string;
-    /** 是否跳过 AI 工具的权限确认（默认 true） */
+    /** 是否跳过 AI 工具的权限确认。未配置时由具体工具决定默认行为。 */
     skipPermissions?: boolean;
     logDir: string;
     logLevel: LogLevel;
@@ -180,6 +180,7 @@ export interface FilePlatformClawbot {
 export interface FileToolClaude {
     cliPath?: string;
     workDir?: string;
+    /** Claude SDK 是否跳过原生权限确认。默认 false，保留 Claude 自身确认流程。 */
     skipPermissions?: boolean;
     /** 空闲会话回收间隔（分钟），0 表示关闭 */
     sessionIdleTtlMinutes?: number;

package/dist/config-web-page-i18n.d.ts

@@ -66,6 +66,19 @@ export declare const PAGE_TEXTS: {
         readonly qrLoginFailed: "Login failed";
         readonly qrLoginExpired: "QR code expired, please try again";
         readonly qrScanHint: "Use WeChat to scan the QR code";
+        readonly configure: "Configure";
+        readonly rebind: "Rebind";
+        readonly platformBound: "Bound";
+        readonly platformUnbound: "Not bound";
+        readonly qrModalTitle: "Scan to Bind";
+        readonly qrModalHint: "Scan the QR code below with WeChat to bind.";
+        readonly qrModalGenerating: "Generating QR code...";
+        readonly qrModalScanning: "Waiting for scan...";
+        readonly qrModalSuccess: "Bound successfully";
+        readonly qrModalExpired: "QR code expired";
+        readonly qrModalRetry: "Scan again";
+        readonly qrModalClose: "Close";
+        readonly qrModalError: "Binding failed";
         readonly platformCredentialsTitle: "Credentials";
         readonly platformAccessTitle: "Routing and access";
         readonly platformTestNote: "Checks required credentials against the platform.";
@@ -117,6 +130,8 @@ export declare const PAGE_TEXTS: {
         readonly claudeAuthToken: "ANTHROPIC_AUTH_TOKEN";
         readonly claudeBaseUrl: "ANTHROPIC_BASE_URL";
         readonly claudeModel: "ANTHROPIC_MODEL";
+        readonly claudeSkipPermissions: "Skip Claude permission prompts";
+        readonly claudeSkipPermissionsTip: "Off by default. Claude SDK will ask for permission in its native flow; open-im just forwards the conversation. Turn this on only if you want bypassPermissions-style automation.";
         readonly claudeProxy: "Proxy (optional)";
         readonly hookPort: "Hook port";
         readonly logLevel: "Log level";
@@ -282,6 +297,19 @@ export declare const PAGE_TEXTS: {
         readonly qrLoginFailed: "登录失败";
         readonly qrLoginExpired: "二维码已过期，请重试";
         readonly qrScanHint: "请使用微信扫描二维码";
+        readonly configure: "配置";
+        readonly rebind: "重新绑定";
+        readonly platformBound: "已绑定";
+        readonly platformUnbound: "未绑定";
+        readonly qrModalTitle: "扫码绑定";
+        readonly qrModalHint: "请用微信扫描下方二维码完成绑定";
+        readonly qrModalGenerating: "正在生成二维码...";
+        readonly qrModalScanning: "等待扫码...";
+        readonly qrModalSuccess: "绑定成功";
+        readonly qrModalExpired: "二维码已过期";
+        readonly qrModalRetry: "重新扫码";
+        readonly qrModalClose: "关闭";
+        readonly qrModalError: "绑定失败";
         readonly platformCredentialsTitle: "凭证";
         readonly platformAccessTitle: "路由与访问";
         readonly platformTestNote: "只会检查该平台的必填凭证是否可用。";
@@ -329,6 +357,8 @@ export declare const PAGE_TEXTS: {
         readonly codexApiKey: "OPENAI_API_KEY";
         readonly codexApiKeyTip: "设置 Codex 使用的 OpenAI API Key。也可以在下方编辑 auth 文件。";
         readonly claudeConfigPath: "配置文件位置";
+        readonly claudeSkipPermissions: "跳过 Claude 权限确认";
+        readonly claudeSkipPermissionsTip: "默认关闭。Claude SDK 会按自己的原生流程请求权限，open-im 只负责转发对话。只有你想要 bypassPermissions 式自动执行时才打开。";
         readonly claudeProxy: "代理（可选）";
         readonly hookPort: "Hook 端口";
         readonly logLevel: "日志级别";

package/dist/config-web-page-i18n.js

@@ -66,6 +66,19 @@ export const PAGE_TEXTS = {
         qrLoginFailed: "Login failed",
         qrLoginExpired: "QR code expired, please try again",
         qrScanHint: "Use WeChat to scan the QR code",
+        configure: "Configure",
+        rebind: "Rebind",
+        platformBound: "Bound",
+        platformUnbound: "Not bound",
+        qrModalTitle: "Scan to Bind",
+        qrModalHint: "Scan the QR code below with WeChat to bind.",
+        qrModalGenerating: "Generating QR code...",
+        qrModalScanning: "Waiting for scan...",
+        qrModalSuccess: "Bound successfully",
+        qrModalExpired: "QR code expired",
+        qrModalRetry: "Scan again",
+        qrModalClose: "Close",
+        qrModalError: "Binding failed",
         platformCredentialsTitle: "Credentials",
         platformAccessTitle: "Routing and access",
         platformTestNote: "Checks required credentials against the platform.",
@@ -117,6 +130,8 @@ export const PAGE_TEXTS = {
         claudeAuthToken: "ANTHROPIC_AUTH_TOKEN",
         claudeBaseUrl: "ANTHROPIC_BASE_URL",
         claudeModel: "ANTHROPIC_MODEL",
+        claudeSkipPermissions: "Skip Claude permission prompts",
+        claudeSkipPermissionsTip: "Off by default. Claude SDK will ask for permission in its native flow; open-im just forwards the conversation. Turn this on only if you want bypassPermissions-style automation.",
         claudeProxy: "Proxy (optional)",
         hookPort: "Hook port",
         logLevel: "Log level",
@@ -283,6 +298,19 @@ export const PAGE_TEXTS = {
         qrLoginFailed: "\u767b\u5f55\u5931\u8d25",
         qrLoginExpired: "\u4e8c\u7ef4\u7801\u5df2\u8fc7\u671f\uff0c\u8bf7\u91cd\u8bd5",
         qrScanHint: "\u8bf7\u4f7f\u7528\u5fae\u4fe1\u626b\u63cf\u4e8c\u7ef4\u7801",
+        configure: "\u914d\u7f6e",
+        rebind: "\u91cd\u65b0\u7ed1\u5b9a",
+        platformBound: "\u5df2\u7ed1\u5b9a",
+        platformUnbound: "\u672a\u7ed1\u5b9a",
+        qrModalTitle: "\u626b\u7801\u7ed1\u5b9a",
+        qrModalHint: "\u8bf7\u7528\u5fae\u4fe1\u626b\u63cf\u4e0b\u65b9\u4e8c\u7ef4\u7801\u5b8c\u6210\u7ed1\u5b9a",
+        qrModalGenerating: "\u6b63\u5728\u751f\u6210\u4e8c\u7ef4\u7801...",
+        qrModalScanning: "\u7b49\u5f85\u626b\u7801...",
+        qrModalSuccess: "\u7ed1\u5b9a\u6210\u529f",
+        qrModalExpired: "\u4e8c\u7ef4\u7801\u5df2\u8fc7\u671f",
+        qrModalRetry: "\u91cd\u65b0\u626b\u7801",
+        qrModalClose: "\u5173\u95ed",
+        qrModalError: "\u7ed1\u5b9a\u5931\u8d25",
         platformCredentialsTitle: "\u51ed\u8bc1",
         platformAccessTitle: "\u8def\u7531\u4e0e\u8bbf\u95ee",
         platformTestNote: "\u53ea\u4f1a\u68c0\u67e5\u8be5\u5e73\u53f0\u7684\u5fc5\u586b\u51ed\u8bc1\u662f\u5426\u53ef\u7528\u3002",
@@ -330,6 +358,8 @@ export const PAGE_TEXTS = {
         codexApiKey: "OPENAI_API_KEY",
         codexApiKeyTip: "\u8bbe\u7f6e Codex \u4f7f\u7528\u7684 OpenAI API Key\u3002\u4e5f\u53ef\u4ee5\u5728\u4e0b\u65b9\u7f16\u8f91 auth \u6587\u4ef6\u3002",
         claudeConfigPath: "\u914d\u7f6e\u6587\u4ef6\u4f4d\u7f6e",
+        claudeSkipPermissions: "\u8df3\u8fc7 Claude \u6743\u9650\u786e\u8ba4",
+        claudeSkipPermissionsTip: "\u9ed8\u8ba4\u5173\u95ed\u3002Claude SDK \u4f1a\u6309\u81ea\u5df1\u7684\u539f\u751f\u6d41\u7a0b\u8bf7\u6c42\u6743\u9650\uff0copen-im \u53ea\u8d1f\u8d23\u8f6c\u53d1\u5bf9\u8bdd\u3002\u53ea\u6709\u4f60\u60f3\u8981 bypassPermissions \u5f0f\u81ea\u52a8\u6267\u884c\u65f6\u624d\u6253\u5f00\u3002",
         claudeProxy: "\u4ee3\u7406\uff08\u53ef\u9009\uff09",
         hookPort: "Hook \u7aef\u53e3",
         logLevel: "\u65e5\u5fd7\u7ea7\u522b",

package/dist/config-web-payload.d.ts

@@ -64,6 +64,7 @@ export interface WebConfigPayload {
         claudeBaseUrl: string;
         claudeModel: string;
         claudeProxy: string;
+        claudeSkipPermissions: boolean;
         codexCliPath: string;
         codebuddyCliPath: string;
         opencodeCliPath: string;

package/dist/config-web-payload.js

@@ -92,6 +92,7 @@ export function buildInitialPayload(file) {
             claudeBaseUrl: claudeEnv.ANTHROPIC_BASE_URL ?? "",
             claudeModel: claudeEnv.ANTHROPIC_MODEL ?? "",
             claudeProxy: file.tools?.claude?.proxy ?? "",
+            claudeSkipPermissions: file.tools?.claude?.skipPermissions ?? false,
             codexCliPath: file.tools?.codex?.cliPath ?? "codex",
             codebuddyCliPath: file.tools?.codebuddy?.cliPath ?? "codebuddy",
             opencodeCliPath: file.tools?.opencode?.cliPath ?? "opencode",
@@ -177,6 +178,7 @@ export function toFileConfig(payload, existing) {
                 ...existing.tools?.claude,
                 workDir: clean(payload.ai.claudeWorkDir) ?? process.cwd(),
                 proxy: clean(payload.ai.claudeProxy),
+                skipPermissions: payload.ai.claudeSkipPermissions,
                 // model is now saved to ~/.claude/settings.json as env var
             },
             codex: {

package/dist/config-web.js

@@ -355,7 +355,7 @@ export async function startWebConfigServer(options) {
             try {
                 const { startQRLogin } = await import("./clawbot/qr-login.js");
                 const session = await startQRLogin();
-                json(response, 200, { success: true, qrcodeUrl: session.qrcodeUrl, sessionKey: session.sessionKey }, request);
+                json(response, 200, { success: true, qrcodeUrl: session.qrcodeUrl, qrcodeImage: session.qrcodeImage, qrcode: session.qrcode, sessionKey: session.sessionKey }, request);
             }
             catch (error) {
                 json(response, 500, { success: false, error: toErrorMessage(error) }, request);
@@ -375,6 +375,33 @@ export async function startWebConfigServer(options) {
             }
             return;
         }
+        if (request.method === "POST" && requestUrl.pathname === "/api/workbuddy/qr-login/start") {
+            try {
+                const { WorkBuddyOAuth } = await import("./workbuddy/oauth.js");
+                const QRCode = (await import("qrcode")).default;
+                const oauth = new WorkBuddyOAuth();
+                const { authUrl, state } = await oauth.fetchAuthState();
+                const qrcodeImage = await QRCode.toDataURL(authUrl, { width: 280, margin: 1 });
+                json(response, 200, { success: true, qrcodeImage, state, authUrl }, request);
+            }
+            catch (error) {
+                json(response, 500, { success: false, error: toErrorMessage(error) }, request);
+            }
+            return;
+        }
+        if (request.method === "POST" && requestUrl.pathname === "/api/workbuddy/qr-login/wait") {
+            try {
+                const body = await readJson(request);
+                const { WorkBuddyOAuth } = await import("./workbuddy/oauth.js");
+                const oauth = new WorkBuddyOAuth();
+                const result = await oauth.pollToken(body.state);
+                json(response, 200, { success: true, accessToken: result.accessToken, refreshToken: result.refreshToken, userId: result.userId }, request);
+            }
+            catch (error) {
+                json(response, 500, { success: false, error: toErrorMessage(error) }, request);
+            }
+            return;
+        }
         if (request.method === "GET" && tryServeDashboardStatic(requestUrl, request, response, mergeCors)) {
             return;
         }

package/dist/config.js

@@ -246,9 +246,14 @@ export function loadConfig() {
     const opencodeCliPath = process.env.OPENCODE_CLI_PATH ?? topencode.cliPath ?? resolveWindowsCliPath(AI_TOOL_BY_ID.opencode.cliDefault ?? 'opencode');
     const opencodeModel = process.env.OPENCODE_MODEL ?? topencode.model;
     const claudeWorkDir = process.env.CLAUDE_WORK_DIR ?? tc.workDir ?? process.cwd();
-    const skipPermissions = process.env.OPEN_IM_SKIP_PERMISSIONS === 'false'
-        ? false
-        : (tc.skipPermissions ?? true);
+    const skipPermissions = (() => {
+        const raw = process.env.OPEN_IM_SKIP_PERMISSIONS?.trim().toLowerCase();
+        if (raw === 'true' || raw === '1' || raw === 'yes')
+            return true;
+        if (raw === 'false' || raw === '0' || raw === 'no')
+            return false;
+        return tc.skipPermissions;
+    })();
     const envIdleRaw = process.env.OPEN_IM_CLAUDE_SESSION_IDLE_TTL_MINUTES;
     const envIdleParsed = envIdleRaw !== undefined && envIdleRaw !== '' ? Number.parseInt(envIdleRaw, 10) : NaN;
     const fileIdle = tc.sessionIdleTtlMinutes;

package/dist/shared/ai-task.js

@@ -180,6 +180,22 @@ function buildCompletionNote(result, sessionManager, ctx) {
         parts.push(ctxWarning);
     return parts.join(' | ');
 }
+function buildRunOptions(config, sessionManager, ctx, aiCommand, toolAdapter) {
+    const defaultSkipPermissions = toolAdapter.interactionMode === 'native'
+        ? (config.skipPermissions ?? false)
+        : (config.skipPermissions ?? true);
+    return {
+        model: aiCommand === 'claude'
+            ? (sessionManager.getModel(ctx.userId, ctx.threadId) ?? config.claudeModel)
+            : aiCommand === 'opencode'
+                ? config.opencodeModel
+                : undefined,
+        chatId: ctx.chatId,
+        skipPermissions: defaultSkipPermissions,
+        skipAutoResume: sessionManager.isFreshSession(ctx.userId),
+        ...(aiCommand === 'codex' && config.codexProxy ? { proxy: config.codexProxy } : {}),
+    };
+}
 export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
     const { config, sessionManager } = deps;
     return new Promise((resolve) => {
@@ -295,7 +311,9 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
                     toolLines.push(notification);
                     if (toolLines.length > 5)
                         toolLines.shift();
-                    throttledUpdate(taskState.latestContent, true);
+                    // 不强制发送（force=false），让节流机制合并短时间内的多次工具调用，
+                    // 避免突发大量消息触发平台频率限制（如 ClawBot ret=-2）。
+                    throttledUpdate(taskState.latestContent, false);
                 },
                 onComplete: async (result) => {
                     log.info(`[AITask] onComplete fired: settled=${settled}, success=${result.success}, platform=${ctx.platform}, taskKey=${ctx.taskKey}`);
@@ -457,19 +475,7 @@ export function runAITask(deps, ctx, prompt, toolAdapter, platformAdapter) {
                     cleanup();
                     resolve();
                 },
-            }, {
-                model: aiCommand === 'claude'
-                    ? (sessionManager.getModel(ctx.userId, ctx.threadId) ?? config.claudeModel)
-                    : aiCommand === 'opencode'
-                        ? config.opencodeModel
-                        : undefined,
-                chatId: ctx.chatId,
-                // 默认跳过权限确认，保持全自动执行（可通过 config 或环境变量关闭）
-                skipPermissions: config.skipPermissions ?? true,
-                // /new 后跳过自动恢复 CLI session
-                skipAutoResume: sessionManager.isFreshSession(ctx.userId),
-                ...(aiCommand === 'codex' && config.codexProxy ? { proxy: config.codexProxy } : {}),
-            });
+            }, buildRunOptions(config, sessionManager, ctx, aiCommand, toolAdapter));
             return activeHandle;
         };
         taskState = {

package/dist/telegram/event-handler.js

@@ -61,14 +61,14 @@ async function downloadTelegramFile(bot, fileId, basenameHint, fallbackExtension
 }
 export function setupTelegramHandlers(bot, config, sessionManager) {
     // Create shared platform event context
-    const ctx = createPlatformEventContext({
+    const platformCtx = createPlatformEventContext({
         platform: 'telegram',
         allowedUserIds: config.telegramAllowedUserIds,
         config,
         sessionManager,
         sender: { sendTextReply, sendDirectorySelection },
     });
-    const { accessControl, requestQueue, runningTasks } = ctx;
+    const { accessControl, requestQueue, runningTasks } = platformCtx;
     // Telegram-specific sender callbacks for the factory
     const telegramSender = {
         sendThinkingMessage: async (chatId, replyToMessageId, toolId) => {
@@ -316,24 +316,14 @@ export function setupTelegramHandlers(bot, config, sessionManager) {
             if (parts.length >= 3) {
                 const choiceNum = parts[2];
                 const chatId = String(ctx.chat?.id ?? "");
-                // 将用户选择作为消息发送给 AI
-                const { handleTextFlow } = await import("../platform/handle-text-flow.js");
                 await handleTextFlow({
                     platform: "telegram",
                     userId,
                     chatId,
                     text: choiceNum,
-                    ctx: createPlatformEventContext({
-                        platform: "telegram",
-                        allowedUserIds: config.telegramAllowedUserIds,
-                        config,
-                        sessionManager,
-                        sender: { sendTextReply: async () => { } },
-                    }),
-                    handleAIRequest: async () => { },
-                    sendTextReply: async (c, t) => {
-                        await sendTextReply(c, t);
-                    },
+                    ctx: platformCtx,
+                    handleAIRequest,
+                    sendTextReply,
                     workDir: sessionManager.getWorkDir(userId),
                     convId: sessionManager.getConvId(userId),
                 });
@@ -352,7 +342,7 @@ export function setupTelegramHandlers(bot, config, sessionManager) {
                 userId,
                 chatId,
                 text,
-                ctx,
+                ctx: platformCtx,
                 handleAIRequest,
                 sendTextReply,
                 replyToMessageId: messageId,