@zxh126/pi-qqbot 2.0.1 → 2.2.1

package/CHANGELOG.md

@@ -3,6 +3,87 @@
 本文件记录 pi-qqbot 的版本变更。格式遵循 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，
 版本号遵循 [SemVer](https://semver.org/lang/zh-CN/)。
 
+## [2.2.1] - 2026-02-11
+
+### Fixed
+
+- **把「文案」当成了「指令」**：用户把审批提示整段引回来（或以「你这句话里说『取消自动同意』」这种句子讨论），
+  旧代码用**未锚定**的正则，句子里出现「取消自动同意」「以后都同意」就会被当成真的审批动作（日志里能看到
+  回了一句「当前没有开启自动同意」）。现在 `parseReply` 先去掉空白与标点做**整句匹配**，并卡长度上限（≤ 12 字），
+  引用提示、长句、感叹句一律不解析，当普通聊天交给 pi。
+- **审批提示太啰嗦**：从 3 行（含「停止」「以后都同意」「取消自动同意」三句）压到 2 行：
+  `[审批 #N] <摘要>` + `回「同意 N」或「拒绝 N」；想全部放行回「以后都同意」。`；
+  发文件这类每次都要确认的工具改用 strict 文案（不提「以后都同意」）。
+
+### Tests
+
+- 新增 `test/approver.test.mjs`（6 个用例：批/拒的各种写法、停止/以后都同意/取消自动同意、
+  引用提示不解析、句中关键词不解析、「停止汇报」不算指令、超长句不解析、提示文案≤两行）。
+- `test/queue.test.mjs` 同步 strict 文案断言（19 个用例）。
+
+## [2.2.0] - 2026-02-11
+
+### Added
+
+- **把本机文件发到 QQ**：新增工具 `qq_send_file(path, name?)` 与命令 `/sendfile <路径>`。按官方富媒体接口走
+  分片上传（`upload_prepare` → 分片 `PUT` → `upload_part_finish` → 合并拿 `file_info`），再用
+  `msg_type=7` + `media.file_info` 以**被动回复**发出（`srv_send_msg:false`，不烧主动额度）。
+  本地文件没有公网 URL，而二进制直传只有 5MB 上限，所以统一走分片，不依赖中转。
+- **`file_type` 判定**：png/jpg/jpeg → 图片(1)、mp4 → 视频(2)、silk → 语音(3)、其余 → 文件(4)；
+  否则 QQ 报 `850019`。图片/视频/语音直接展示，其他格式对方收到可下载的文件卡片。
+- **外发文件强制审批（每次都要问）**：`qq_send_file` 被加入 `FORCE_APPROVAL_TOOLS`，无论 `approve.tools` 怎么配都
+  必须先回 QQ 审批；并且**跳过会话级「以后都同意」与记住的决策**，每个文件单独确认，也不会写入 remember。
+  审批文案会显示文件路径与显示名，并注明「需单独确认」。
+- **配置 `files`**：`enabled`（默认 true）、`maxBytes`（默认 30MB；QQ 硬限 200MB），可按 bot 逐键覆盖。
+- **错误码翻译**：`850031` 超大、`850019` 格式不支持、`40093002` 今日容量上限、`850027` 超时、
+  `850018` 禁言/限频、`40093001` 转存失败，都转成中文回执。
+
+### Changed
+
+- `qq/api.ts`：新增 `sendC2CMedia(openid, fileInfo, { msgId })`，复用已有的发送队列与 `msg_seq` 计数。
+- `slash.ts`：新增可接管命令 `sendfile`（不受 `commands.allowSession` 限制，由 `files.enabled` + 审批把关）。
+- `index.ts`：`State` 记录 `restBase`；`/help` 增加 `/sendfile` 说明。
+- `package.json`：新增 peer 依赖 `typebox`（工具参数 schema，pi 运行时已内置别名）。
+
+### Tests
+
+- 新增 `test/upload.test.mjs`（9 个用例：file_type 映射、md5/sha1/md5_10m、分片全链路与字节回拼、
+  图片类型、分片失败重试、本地校验（不存在/目录/空文件/超限）、合并缺 `file_info`、错误码翻译、
+  `sendC2CMedia` 的 `msg_type=7` 请求体）。
+- `npm test` 新增该文件；全套 130 → 140 个用例全绿（queue 18 → 19，新增「发送文件每次都审批」）。
+
+## [2.1.0] - 2026-02-11
+
+### Added
+
+- **接收 QQ 附件（图片 / 语音 / 视频 / 文档 / 压缩包 / 普通文件）**：收到的附件马上下载到临时文件，
+  再把路径以标记行交给 pi——图片是 `图片路径 <path>`，其余按类型是 `语音路径` / `视频路径` /
+  `文档路径` / `压缩包路径` / `文件路径`。原有文字保持在第一行，与路径同属一轮对话；pi 的 `read` 工具
+  可以直接打开图片，`bash` 可以处理文件。（v2.1.0 之前只保留图片且完全没落盘，纯图片消息会给 pi 送空串。）
+- **QQ 回执**：落盘后先回一条「已收到 N 个附件（图片 ×1、文档 ×1），已存为临时文件并交给 pi：」+ 各条路径；
+  下载失败会列出原因，文字部分照常执行。
+- **临时文件自动清理**：落盘目录按日期分子目录（`<系统临时目录>/pi-qqbot/<bot>/<YYYY-MM-DD>/`），
+  每次会话启动时按 `attachments.retentionHours`（默认 24 小时）与 `attachments.maxFiles`（默认 200）
+  清理；目录里不是本插件建的 `<日期>` 子目录一律不动。
+- **配置 `attachments`**：`enabled` / `dir` / `maxBytes` / `maxPerMessage` / `retentionHours` / `maxFiles`，
+  支持像 `queue` / `progress` 一样在 `qqbots[]` 里逐 bot 覆盖。`enabled: false` 时回一句忽略提示、只处理文字。
+- **新的 `attachment.ts`**：六类判定、文件名规整（只保留 `[0-9a-zA-Z._-]`）、并发下载（默认 3）、
+  单个 25 MB 上限、下载超时 30 秒、401/403 带凭据重试一次、失败不影响其它附件。
+
+### Changed
+
+- `qq/gateway.ts`：`QQMessage.attachments` 改为 `{ url, contentType, filename?, size? }[]`，
+  **不再丢弃非图片附件**；语音消息的消息体只有 `voice_wav_url` 时也取它当下载地址。
+- 网关日志不再打整包 JSON（里面带 `rkey` 临时凭据），改为 openid / content 摘要 / 附件数量 / 来源主机。
+- `handleMessage()`：带附件的消息**绕过**斜杠命令、审批解析、编号选择与内置指令，一律当普通内容（忙碌时照旧入队）。
+
+### Tests
+
+- 新增 `test/attachment.test.mjs`（12 个用例：六类判定、扩展名、落盘内容、超限、401 重试、部分失败、
+  单条上限、回执文案、目录清理）。
+- `test/queue.test.mjs` 12 → 18 个用例（纯图片派发、文字+文档拼行、忙碌入队、`enabled=false` 忽略提示、
+  绕过 `/status`、下载失败照发正文）。
+
 ## [2.0.1] - 2026-10-25
 
 ### Fixed

package/README.md

@@ -20,7 +20,9 @@ Bridge the **[Pi](https://pi.dev) coding agent** into QQ private (C2C) chats: se
 | **Progress reports** | While a run is in progress the bot posts a short progress summary (turns, tool calls, the tool currently running, tokens) every `progress.intervalMs` (default **15 s**). Ask at any time with `/progress` (aliases `/p`, 「进度」). `/progress off` pauses the automatic reports for the rest of the session, `/progress on` brings them back. If a report cannot be delivered the automatic reports stay quiet until you ask again. |
 | **Secret redaction** | Anything leaving the machine is scrubbed first — progress reports, approval prompts, queue previews and the log file: `Authorization` headers (incl. QQ bot tokens), `sk-…` / `ghp_…` / `npm_…` / `AKIA…` / JWTs / PEM blocks, `token=` / `password=` / `--api-key` values, URL `user:pass@`, and long high-entropy strings. |
 | **Multi-bot on one machine** | Put several QQ bots in one config (`qqbots: [...]`, see [docs/accounts.md](./docs/accounts.md)). Each pi process, in config order, claims the first bot that is not online yet and then verifies its credentials (a wrong secret releases the lock instead of squatting the slot); a process that finds every bot taken stays idle and rescans every 5 s, taking over as soon as one goes offline. A bot whose owner is merely reloading is never snatched (a 20 s reservation is left behind). The bot name is logged, shown in `/status` and prepended to the first QQ reply; taking over from another process also tells you the new working directory. |
-| **Built-in commands** | `/status`, `/queue`, `/progress` (+ `/progress off` / `on`), `/reset`, `/cancel`, `/help`. |
+| **Images & files** | Anything you attach in QQ is downloaded to a temp file and handed to pi as a marked line — `图片路径 <path>` for images, `语音路径` / `视频路径` / `文档路径` / `压缩包路径` / `文件路径` for the rest — and QQ gets a receipt with the counts and paths. pi's `read` tool can open the image, `bash` can process the file. |
+| **Send files to your QQ** | Ask the agent to send a file from the machine (`把 D:\docs\report.pdf 发给我`) or run `/sendfile <path>`; the bot uploads it in 5 MB chunks (QQ rich media) and sends it as an image / video / voice / file card. Images (png/jpg), videos (mp4) and voice (silk) render natively; everything else arrives as a downloadable file card. **Always approved in QQ first.** |
+| **Built-in commands** | `/status`, `/queue`, `/progress` (+ `/progress off` / `on`), `/reset`, `/cancel`, `/sendfile`, `/help`. |
 
 ## Install
 
@@ -50,6 +52,18 @@ Then create `~/.pi/agent/pi-qqbot.json`:
   "queue": {
     "max": 20,
     "ack": true
+  },
+  "attachments": {
+    "enabled": true,
+    "dir": "",
+    "maxBytes": 26214400,
+    "maxPerMessage": 10,
+    "retentionHours": 24,
+    "maxFiles": 200
+  },
+  "files": {
+    "enabled": true,
+    "maxBytes": 31457280
   }
 }
 ```
@@ -68,6 +82,14 @@ Then create `~/.pi/agent/pi-qqbot.json`:
 | `progress.intervalMs` | `15000` | Interval of those reports (env override: `PI_QQBOT_PROGRESS_MS`) |
 | `queue.max` | `20` | How many messages may wait while a task runs; `0` disables queueing (busy messages are refused as before) |
 | `queue.ack` | `true` | Reply to QQ when a queued [message](#queueing-while-busy) starts (the "queued" ack is always sent) |
+| `attachments.enabled` | `true` | Download attachments to temp files and pass their paths to pi; `false` = answer with an "ignored" notice and process the text only |
+| `attachments.dir` | `""` | Where to save them; empty = `<system temp>/pi-qqbot/<bot>` (Windows: `%LOCALAPPDATA%\Temp\pi-qqbot\…`) |
+| `attachments.maxBytes` | `26214400` | Per-attachment size limit (25 MB); larger ones are reported as failed, not downloaded |
+| `attachments.maxPerMessage` | `10` | How many attachments of one message are processed |
+| `attachments.retentionHours` | `24` | Files older than this are swept at session start |
+| `attachments.maxFiles` | `200` | Keep at most this many files in the directory (oldest are deleted) |
+| `files.enabled` | `true` | Allow sending local files to QQ (both the tool and `/sendfile`); `false` refuses |
+| `files.maxBytes` | `31457280` | Per-file limit for sending (30 MB; QQ hard limit is 200 MB) |
 
 Credentials can also come from the `QQ_BOT_APPID` / `QQ_BOT_APPSECRET` environment variables (single-bot setup only).
 
@@ -101,8 +123,72 @@ Start pi, then message the bot in QQ; pi handles it and replies.
 | `/progress off` | **Pause automatic progress reports for the rest of the session** (aliases: `pause`, `stop`, `暂停`, 「暂停汇报」, 「关闭汇报」). Manual `/progress` still works, it just no longer resumes the timer |
 | `/progress on` | **Resume automatic progress reports** (aliases: `resume`, `start`, `恢复`, 「恢复汇报」, 「继续汇报」) |
 | `/cancel` | **Interrupt the task that is running right now** and empty the queue (aliases: `/stop`, `/abort`, 「取消」, 「停止」, 「中止」, 「终止」, 「算了」, 「停」, 「停下」, 「停一下」, 「别跑了」). Note: a bare 「停」 interrupts the *task*; to silence progress reports say 「别汇报了」/「闭嘴」 or `/progress off` |
+| `/sendfile <path>` | **Send a file from this machine to your QQ** (e.g. `/sendfile D:\docs\a.pdf`); QQ gets an image / video / voice / file card. Requires QQ-side approval when the agent initiates it |
 | `/help` | Show help |
 
+### Images and files from QQ
+
+Send a picture (or a document, an archive, a voice/video message) and the bot downloads it to a temp file,
+then hands pi a line with the path:
+
+```
+图片路径 C:\Users\you\AppData\Local\Temp\pi-qqbot\bot-340143\2026-02-11\msg-abc-1-103045.jpg
+```
+
+| Attachment | Line sent to pi |
+|---|---|
+| image | `图片路径 <path>` |
+| voice / audio | `语音路径 <path>` |
+| video | `视频路径 <path>` |
+| document (pdf, office, text, code… ) | `文档路径 <path>` |
+| archive (zip, rar, 7z, tar…) | `压缩包路径 <path>` |
+| anything else | `文件路径 <path>` |
+
+Your own text is kept as the first line, so `看下这个` + an image becomes
+`看下这个\n图片路径 C:\…\a.jpg` — one pi turn, paths included. QQ also gets a receipt such as
+`已收到 2 个附件（图片 ×1、文档 ×1），已存为临时文件并交给 pi：` followed by the paths; failed downloads are
+listed with the reason and the text is still delivered.
+
+Notes:
+
+- QQ's download URLs carry a short-lived `rkey`, so files are fetched the moment the message arrives.
+- A message that has attachments **bypasses** slash commands, approval parsing and the numbered picker — it is
+  always treated as ordinary content for pi (an attached `/status` is not executed).
+- Files are deleted by the `attachments.retentionHours` / `attachments.maxFiles` sweep at session start, so a
+  path handed to pi stays readable for the rest of the session (and usually a day).
+- On file names: only `[0-9a-zA-Z._-]` are kept, prefixed with the QQ message id.
+
+### Sending files to QQ
+
+Two ways to push a file from the machine to your chat:
+
+| Trigger | How |
+|---|---|
+| Natural language | `把 D:\docs\报告.pdf 发给我` — the agent calls the `qq_send_file` tool with the path |
+| Slash command | `/sendfile D:\docs\报告.pdf` (also `/sendfile "D:\my files\a.zip"`; no agent run needed) |
+
+**Approval is mandatory on every send**: `qq_send_file` is force-gated no matter what `approve.tools` says, and it
+ignores both the session-wide 「以后都同意」 and remembered decisions — sending a file is data leaving the machine, so
+each upload is confirmed on its own. The prompt says so explicitly:
+`[审批 #1] 发送文件到 QQ: D:\docs\a.pdf` + 「需单独确认」.
+
+How it is delivered (QQ rich media, chunked upload):
+
+| File | Delivered as |
+|---|---|
+| `.png` / `.jpg` / `.jpeg` | inline image |
+| `.mp4` | inline video |
+| `.silk` | voice bubble |
+| anything else (pdf, zip, mp3, epub, exe…) | downloadable file card |
+
+Notes:
+
+- The file is uploaded in chunks (`upload_prepare` → `PUT` → `upload_part_finish` → merge) — the only path that works
+  for local files, since URL upload needs a public URL and the one-shot binary upload caps at 5 MB.
+- Passive reply is used (`srv_send_msg: false` + `msg_type: 7` with `msg_id`/`msg_seq`), so it does not burn the active-message quota.
+- Limits on QQ's side: 200 MB hard cap and a **daily total file quota** (`40093002`); the bot turns both into readable replies.
+- The reply also tells you what was sent: `已发送「报告.pdf」（2.31 MB，文件卡片）`.
+
 ### Slash commands from QQ
 
 Any message that starts with `/` is routed before it can become a chat prompt:
@@ -307,7 +393,9 @@ Debug logs are written to `~/.pi/agent/pi-qqbot-<name>.log` (one file per bot, s
 ## Changelog
 
 See [CHANGELOG.md](./CHANGELOG.md) — every release with what changed and why. The progress-report
-pause/resume (`/progress off` / `on`) landed in **1.5.0**; multi-bot auto-claiming in **2.0.0**.
+pause/resume (`/progress off` / `on`) landed in **1.5.0**; multi-bot auto-claiming in **2.0.0**;
+receiving QQ images/files (saved to temp files and handed to pi as `图片路径 <path>`) in **2.1.0**;
+sending local files to QQ (`qq_send_file` / `/sendfile`, chunked rich-media upload) in **2.2.0**.
 
 ## License
 

package/approver.ts

@@ -23,17 +23,33 @@ interface PendingApproval {
   resolve: (decision: ApproveDecision) => void;
 }
 
-/** 「以后都同意」类表达 */
+/**
+ * 「以后都同意」类表达。
+ *
+ * 这些正则全部要求**整句匹配**（parseReply 里先归一化再卡长度）：
+ * 用户把审批提示整段引回来、或写了「你这句话里说『取消自动同意』」时，
+ * 不能把文案里的词当成指令执行。
+ */
 const RE_ALWAYS =
-  /(以后|之后|今后|一直|全都|全部|都)\s*(同意|允许|批准|放行)|别再(问|烦|提示)|always\s*(allow|yes)/i;
-/** 「取消自动同意」类表达（含「以后都不同意」） */
+  /^(?:(?:以后|之后|今后|一直|全都|全部|都)\s*(?:都)?\s*(?:同意|允许|批准|放行)|别再(?:问|烦|提示)了?|always\s*(?:allow|yes))$/i;
+/** 「取消自动同意」类表达（含「以后都不同意」），同样要求整句 */
 const RE_REVOKE =
-  /(取消|关闭|结束|停止)\s*自动同意|^恢复审批$|(以后|之后|今后|都|全部)\s*不(同意|允许|批准|放行)/;
+  /^(?:(?:取消|关闭|结束|停止)\s*自动同意|恢复审批|(?:以后|之后|今后|都|全部)\s*(?:都)?\s*不(?:同意|允许|批准|放行))$/;
 /** 「停止」终止本轮（index.ts 里同时会 abort 当前 run） */
 const RE_TERMINATE = /^停止$/;
 /** 带或不带编号的批准/拒绝 */
 const RE_DECIDE = /^(同意|批准|放行|允许|allow|拒绝|驳回|deny)\s*(\d+)?$/i;
 
+/** 整句长度上限：超过它就是聊天（比如引用了审批提示），不是审批回复 */
+const MAX_REPLY_CHARS = 12;
+
+/** 去掉空白与常见标点/引号，把「同意 2。」和「\"同意2\"」归一成「同意2」 */
+function normalizeReply(text: string): string {
+  return String(text ?? "")
+    .replace(/[\s\u3000]+/g, "")
+    .replace(/[，。！？、,.!?;；:：…~～"'“”‘’「」『』()（）\[\]【】]/g, "");
+}
+
 export class Approver {
   private pending = new Map<number, PendingApproval>();
   private rememberMap = new Map<string, ApproveDecision>();
@@ -76,13 +92,16 @@ export class Approver {
     return { seq, done };
   }
 
-  render(seq: number): string {
+  /**
+   * 审批提示。默认两三行就够：用户反馈过「太长」；
+   * strict 用于每次都要单独确认的工具（发文件），所以不提「以后都同意」。
+   */
+  render(seq: number, opts: { strict?: boolean } = {}): string {
     const item = this.pending.get(seq);
-    return [
-      `[审批 #${seq}] ${item?.summary ?? ""}`,
-      `回复「同意 ${seq}」批准，「拒绝 ${seq}」拒绝，「停止」（/cancel）中断本轮任务。`,
-      `要本会话内全部放行，回复「以后都同意」（可用「取消自动同意」关闭）。`,
-    ].join("\n");
+    const hint = opts.strict
+      ? `回「同意 ${seq}」或「拒绝 ${seq}」，需单独确认。`
+      : `回「同意 ${seq}」或「拒绝 ${seq}」；想全部放行回「以后都同意」。`;
+    return [`[审批 #${seq}] ${item?.summary ?? ""}`, hint].join("\n");
   }
 
   /** 最早（编号最小）的待审批请求 */
@@ -95,8 +114,10 @@ export class Approver {
   }
 
   parseReply(text: string): ParsedReply | null {
-    const t = text.trim();
-    if (!t) return null;
+    const raw = String(text ?? "").trim();
+    if (!raw) return null;
+    const t = normalizeReply(raw);
+    if (!t || t.length > MAX_REPLY_CHARS) return null;
     if (RE_REVOKE.test(t)) return { decision: "revoke" };
     if (RE_ALWAYS.test(t)) return { decision: "always" };
     if (RE_TERMINATE.test(t)) return { decision: "terminate" };