openclaw-plugin-yuanbao 2.13.5 → 2.14.0

package/dist/src/access/ws/biz-codec.d.ts

@@ -1,6 +1,6 @@
 /** Business-layer Protobuf codec — encode/decode for business messages. */
 import type { YuanbaoInboundMessage, YuanbaoMsgBodyElement } from "../../types.js";
-import type { WsSendC2CMessageData, WsSendGroupMessageData, WsSendMessageResponse, WsSendPrivateHeartbeatData, WsSendGroupHeartbeatData, WsHeartbeatResponse, WsQueryGroupInfoData, WsQueryGroupInfoResponse, WsGetGroupMemberListData, WsGetGroupMemberListResponse, WsSyncInformationData, WsSyncInformationResponse } from "./types.js";
+import type { WsSendC2CMessageData, WsSendGroupMessageData, WsSendMessageResponse, WsSendPrivateHeartbeatData, WsSendGroupHeartbeatData, WsHeartbeatResponse, WsQueryGroupInfoData, WsQueryGroupInfoResponse, WsGetGroupMemberListData, WsGetGroupMemberListResponse, WsSyncInformationData, WsSyncInformationResponse, WsQueryBotInfoResponse } from "./types.js";
 export declare const BIZ_MSG_TYPES: {
     readonly MsgContent: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.MsgContent";
     readonly MsgBodyElement: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.MsgBodyElement";
@@ -19,6 +19,8 @@ export declare const BIZ_MSG_TYPES: {
     readonly SendGroupHeartbeatRsp: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.SendGroupHeartbeatRsp";
     readonly SyncInformationReq: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.SyncInformationReq";
     readonly SyncInformationRsp: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.SyncInformationRsp";
+    readonly QueryBotInfoReq: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.QueryBotInfoReq";
+    readonly QueryBotInfoRsp: "trpc.yuanbao.yuanbao_conn.yuanbao_openclaw_proxy.QueryBotInfoRsp";
 };
 export declare function encodeBizPB(key: string, value: Record<string, unknown>): Uint8Array | null;
 export declare function decodeBizPB(key: string, data: Uint8Array | ArrayBuffer): unknown;
@@ -64,3 +66,7 @@ export declare function decodeSendGroupHeartbeatRsp(data: Uint8Array | ArrayBuff
 export declare function encodeSyncInformationReq(data: WsSyncInformationData): Uint8Array | null;
 /** Decode SyncInformationRsp. */
 export declare function decodeSyncInformationRsp(data: Uint8Array | ArrayBuffer, msgId: string): WsSyncInformationResponse | null;
+/** Encode QueryBotInfoReq. */
+export declare function encodeQueryBotInfoReq(botId: string): Uint8Array | null;
+/** Decode QueryBotInfoRsp. */
+export declare function decodeQueryBotInfoRsp(data: Uint8Array | ArrayBuffer, msgId: string): WsQueryBotInfoResponse | null;

package/dist/src/access/ws/biz-codec.js

@@ -29,6 +29,8 @@ export const BIZ_MSG_TYPES = {
     SendGroupHeartbeatRsp: `${PKG}.SendGroupHeartbeatRsp`,
     SyncInformationReq: `${PKG}.SyncInformationReq`,
     SyncInformationRsp: `${PKG}.SyncInformationRsp`,
+    QueryBotInfoReq: `${PKG}.QueryBotInfoReq`,
+    QueryBotInfoRsp: `${PKG}.QueryBotInfoRsp`,
 };
 export function encodeBizPB(key, value) {
     try {
@@ -366,3 +368,21 @@ export function decodeSyncInformationRsp(data, msgId) {
         msg: decoded.msg || "",
     };
 }
+/** Encode QueryBotInfoReq. */
+export function encodeQueryBotInfoReq(botId) {
+    return encodeBizPB(BIZ_MSG_TYPES.QueryBotInfoReq, { botId });
+}
+/** Decode QueryBotInfoRsp. */
+export function decodeQueryBotInfoRsp(data, msgId) {
+    const decoded = decodeBizPB(BIZ_MSG_TYPES.QueryBotInfoRsp, data);
+    if (!decoded) {
+        return null;
+    }
+    return {
+        msgId,
+        code: decoded.code || 0,
+        msg: decoded.message || "",
+        botId: decoded.botInfo?.botId || "",
+        ownerId: decoded.botInfo?.encryptOwnerId || "",
+    };
+}

package/dist/src/access/ws/client.d.ts

@@ -1,6 +1,6 @@
 /** WebSocket client — connection management, auth, heartbeat, and auto-reconnect. */
 import type { LogSink } from "../../logger.js";
-import type { WsClientCallbacks, WsClientConfig, WsClientState, WsConnectionConfig, WsSendMessageResponse, WsSendC2CMessageData, WsSendGroupMessageData, WsSendPrivateHeartbeatData, WsSendGroupHeartbeatData, WsHeartbeatResponse, WsQueryGroupInfoData, WsQueryGroupInfoResponse, WsGetGroupMemberListData, WsGetGroupMemberListResponse, WsSyncInformationData, WsSyncInformationResponse } from "./types.js";
+import type { WsClientCallbacks, WsClientConfig, WsClientState, WsConnectionConfig, WsSendMessageResponse, WsSendC2CMessageData, WsSendGroupMessageData, WsSendPrivateHeartbeatData, WsSendGroupHeartbeatData, WsHeartbeatResponse, WsQueryGroupInfoData, WsQueryGroupInfoResponse, WsGetGroupMemberListData, WsGetGroupMemberListResponse, WsSyncInformationData, WsSyncInformationResponse, WsQueryBotInfoResponse } from "./types.js";
 /** Outbound business commands */
 export declare const BIZ_CMD: {
     /** Send C2C message */
@@ -12,6 +12,7 @@ export declare const BIZ_CMD: {
     readonly SendPrivateHeartbeat: "send_private_heartbeat";
     readonly SendGroupHeartbeat: "send_group_heartbeat";
     readonly SyncInformation: "sync_information";
+    readonly QueryBotInfo: "query_bot_info";
 };
 /**
  * Yuanbao WebSocket client.
@@ -66,6 +67,8 @@ export declare class YuanbaoWsClient {
     sendGroupHeartbeat(data: WsSendGroupHeartbeatData): Promise<WsHeartbeatResponse>;
     /** Sync information to the backend (command list, etc.). */
     syncInformation(data: WsSyncInformationData): Promise<WsSyncInformationResponse>;
+    /** Query bot info (owner id, etc.) from the backend. */
+    queryBotInfo(botId: string): Promise<WsQueryBotInfoResponse>;
     /** Establish WebSocket connection and bind event handlers. */
     private doConnect;
     private onMessage;

package/dist/src/access/ws/client.js

@@ -4,7 +4,7 @@ import WebSocket from "ws";
 import { msgBodyDesensitization } from "../../business/utils/utils.js";
 import { getPluginVersion, getOpenclawVersion, getOperationSystem } from "../../infra/env.js";
 import { createLog } from "../../logger.js";
-import { encodeSendC2CMessageReq, encodeSendGroupMessageReq, decodeSendMessageRsp, encodeSendPrivateHeartbeatReq, encodeSendGroupHeartbeatReq, decodeSendPrivateHeartbeatRsp, decodeSendGroupHeartbeatRsp, encodeQueryGroupInfoReq, decodeQueryGroupInfoRsp, encodeGetGroupMemberListReq, decodeGetGroupMemberListRsp, encodeSyncInformationReq, decodeSyncInformationRsp, } from "./biz-codec.js";
+import { encodeSendC2CMessageReq, encodeSendGroupMessageReq, decodeSendMessageRsp, encodeSendPrivateHeartbeatReq, encodeSendGroupHeartbeatReq, decodeSendPrivateHeartbeatRsp, decodeSendGroupHeartbeatRsp, encodeQueryGroupInfoReq, decodeQueryGroupInfoRsp, encodeGetGroupMemberListReq, decodeGetGroupMemberListRsp, encodeSyncInformationReq, decodeSyncInformationRsp, encodeQueryBotInfoReq, decodeQueryBotInfoRsp, } from "./biz-codec.js";
 import { decodeConnMsg, decodePB, buildAuthBindMsg, buildPingMsg, buildPushAck, buildBusinessConnMsg, PB_MSG_TYPES, CMD_TYPE, CMD, } from "./conn-codec.js";
 const DEFAULT_RECONNECT_DELAYS = [1_000, 2_000, 5_000, 10_000, 30_000, 60_000];
 const NO_RECONNECT_CLOSE_CODES = new Set([
@@ -42,6 +42,7 @@ export const BIZ_CMD = {
     SendPrivateHeartbeat: "send_private_heartbeat",
     SendGroupHeartbeat: "send_group_heartbeat",
     SyncInformation: "sync_information",
+    QueryBotInfo: "query_bot_info",
 };
 const BIZ_MODULE = "yuanbao_openclaw_proxy";
 /**
@@ -241,6 +242,15 @@ export class YuanbaoWsClient {
         }
         return this.sendAndWaitWith(BIZ_CMD.SyncInformation, BIZ_MODULE, encoded, decodeSyncInformationRsp);
     }
+    /** Query bot info (owner id, etc.) from the backend. */
+    queryBotInfo(botId) {
+        this.log.debug("[bot-info] querying bot info", { botId });
+        const encoded = encodeQueryBotInfoReq(botId);
+        if (!encoded) {
+            return Promise.reject(new Error("Failed to encode QueryBotInfoReq"));
+        }
+        return this.sendAndWaitWith(BIZ_CMD.QueryBotInfo, BIZ_MODULE, encoded, decodeQueryBotInfoRsp);
+    }
     /** Establish WebSocket connection and bind event handlers. */
     doConnect() {
         if (this.disposed) {

package/dist/src/access/ws/gateway.js

@@ -35,6 +35,12 @@ export async function startYuanbaoWsGateway(params) {
                         error: String(err),
                     });
                 });
+                // Query and cache bot owner id (non-blocking)
+                queryAndCacheBotOwner(client, account, gwlog).catch((err) => {
+                    gwlog.warn(`[${account.accountId}] failed to query bot owner (non-blocking)`, {
+                        error: String(err),
+                    });
+                });
             },
             onDispatch: (pushEvent) => {
                 gwlog.debug(`[${account.accountId}] WS push: cmd=${pushEvent.cmd}, type=${pushEvent.type}`);
@@ -325,6 +331,28 @@ function handleWsDispatchEvent(params) {
         dlog.error(`[${account.accountId}][dispatch] WS ${isGroup ? "group " : ""} message handler failed: ${String(err)}`);
     });
 }
+/**
+ * Query bot info (owner id) from the backend after connection is established,
+ * and cache the result on the account object for use in owner-gating middleware.
+ *
+ * Called once after auth-bind succeeds. Failures are non-fatal.
+ */
+async function queryAndCacheBotOwner(client, account, log) {
+    const botId = account.botId;
+    if (!botId) {
+        log.warn(`[${account.accountId}] queryAndCacheBotOwner: botId not set, skipping`);
+        return;
+    }
+    const rsp = await client.queryBotInfo(botId);
+    if (rsp.code !== 0) {
+        log.warn(`[${account.accountId}] queryBotInfo returned non-zero code: ${rsp.code}`);
+        return;
+    }
+    if (rsp.ownerId) {
+        account.botOwnerId = rsp.ownerId;
+        log.info(`[${account.accountId}] bot owner cached: ownerId=${rsp.ownerId}`);
+    }
+}
 /**
  * Sync the command list to the backend after connection is established.
  *

package/dist/src/access/ws/proto/biz.json

@@ -539,6 +539,42 @@
                                                     "id": 2
                                                 }
                                             }
+                                        },
+                                        "BotInfo": {
+                                            "fields": {
+                                                "botId": {
+                                                    "type": "string",
+                                                    "id": 1
+                                                },
+                                                "encryptOwnerId": {
+                                                    "type": "string",
+                                                    "id": 2
+                                                }
+                                            }
+                                        },
+                                        "QueryBotInfoReq": {
+                                            "fields": {
+                                                "botId": {
+                                                    "type": "string",
+                                                    "id": 1
+                                                }
+                                            }
+                                        },
+                                        "QueryBotInfoRsp": {
+                                            "fields": {
+                                                "code": {
+                                                    "type": "int32",
+                                                    "id": 1
+                                                },
+                                                "message": {
+                                                    "type": "string",
+                                                    "id": 2
+                                                },
+                                                "botInfo": {
+                                                    "type": "BotInfo",
+                                                    "id": 3
+                                                }
+                                            }
                                         }
                                     }
                                 }

package/dist/src/access/ws/types.d.ts

@@ -173,3 +173,15 @@ export type WsSyncInformationResponse = {
     code: number;
     msg: string;
 };
+/** Query bot info request */
+export type WsQueryBotInfoData = {
+    bot_id: string;
+};
+/** Query bot info response */
+export type WsQueryBotInfoResponse = {
+    msgId: string;
+    code: number;
+    msg: string;
+    botId: string;
+    ownerId: string;
+};

package/dist/src/business/pipeline/middlewares/build-context.js

@@ -8,7 +8,7 @@ import { YUANBAO_MARKDOWN_HINT } from "../../messaging/context.js";
 export const buildContext = {
     name: "build-context",
     handler: async (ctx, next) => {
-        const { core, account, isGroup, fromAccount, senderNickname, groupCode, rewrittenBody, mediaPaths, mediaTypes, commandAuthorized, route, storePath, envelopeOptions, previousTimestamp, raw, } = ctx;
+        const { core, account, isGroup, fromAccount, senderNickname, groupCode, rewrittenBody, commandParts, mediaPaths, mediaTypes, commandAuthorized, route, storePath, envelopeOptions, previousTimestamp, raw, } = ctx;
         if (!route || !storePath || !envelopeOptions) {
             ctx.log.error("[build-context] prerequisite middleware not ready");
             return;
@@ -55,7 +55,7 @@ export const buildContext = {
             BodyForAgent: rewrittenBody,
             ...(isGroup ? { InboundHistory: inboundHistory } : {}),
             RawBody: rewrittenBody,
-            CommandBody: rewrittenBody,
+            CommandBody: commandParts?.length > 0 ? commandParts.join(" ") : rewrittenBody,
             From: `yuanbao:${label}`,
             To: `yuanbao:${label}`,
             SessionKey: route.sessionKey,

package/dist/src/business/pipeline/middlewares/guard-command.js

@@ -3,16 +3,34 @@
  * Checks for control commands and applies DM allowFrom + useAccessGroups policies.
  */
 import { resolveControlCommandGate } from "openclaw/plugin-sdk/command-auth";
+/** Extract pure text content from msg_body (TIMTextElem only, skipping @mention custom elements). */
+function extractTextOnly(ctx) {
+    if (!ctx.raw.msg_body)
+        return ctx.rawBody;
+    return ctx.raw.msg_body
+        .filter(e => e.msg_type === "TIMTextElem")
+        .map(e => e.msg_content?.text ?? "")
+        .join("")
+        .trim() || ctx.rawBody;
+}
 export const guardCommand = {
     name: "guard-command",
     handler: async (ctx, next) => {
         const { core, config, rawBody, fromAccount, account } = ctx;
+        // Group chat: extract TIMTextElem-only text for command detection
+        // (rawBody includes @mention custom elements which break command matching).
+        const commandText = ctx.isGroup ? extractTextOnly(ctx) : rawBody;
         const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
             cfg: config,
             surface: "yuanbao",
         });
-        const hasControlCommand = core.channel.text.hasControlCommand(rawBody, config);
+        const rawHasControlCommand = core.channel.text.hasControlCommand(commandText, config);
+        const hasControlCommand = ctx.isGroup ? rawHasControlCommand && ctx.isAtBot : rawHasControlCommand;
         ctx.hasControlCommand = hasControlCommand;
+        if (!hasControlCommand) {
+            await next();
+            return;
+        }
         // Build DM policy allowFrom
         const dmPolicy = account.config.dm?.policy ?? "open";
         const rawAllowFrom = (account.config.dm?.allowFrom ?? []).map(String);
@@ -28,8 +46,9 @@ export const guardCommand = {
         ctx.commandAuthorized = commandAuthorized;
         if (shouldBlock) {
             ctx.log.info(`[guard-command] control command unauthorized, discarding <- ${ctx.isGroup ? `group:${ctx.groupCode}` : ""} from: ${fromAccount}`);
-            return; // Abort pipeline
+            return;
         }
+        ctx.commandParts = commandText.trim().split(/\s+/);
         await next();
     },
 };

package/dist/src/business/pipeline/middlewares/guard-group-command.js

@@ -7,33 +7,36 @@
 import { getMember } from "../../../infra/cache/member.js";
 import { sendGroupMsgBody } from "../../../infra/transport.js";
 import { prepareOutboundContent, buildOutboundMsgBody } from "../../messaging/handlers/index.js";
-/** Public commands available to all group members */
-const GROUP_PUBLIC_COMMANDS = new Set([]);
+/** Commands allowed in group chat (owner-only) */
+const GROUP_ALLOWED_COMMANDS = new Set([
+    "/new", "/reset", "/retry", "/undo", "/stop",
+    "/approve", "/btw", "/queue",
+]);
 export const guardGroupCommand = {
     name: "guard-group-command",
-    when: ctx => ctx.isGroup,
+    when: ctx => ctx.isGroup && ctx.hasControlCommand,
     handler: async (ctx, next) => {
-        const { core, config, rawBody, raw, account, groupCode, fromAccount } = ctx;
-        const q = rawBody.trim().split(/\s+/)
-            .find(part => !part.trim().startsWith("@")) || rawBody;
-        const hasRegisteredCommand = core.channel.text.hasControlCommand(q, config);
-        const isOwner = Boolean(raw.bot_owner_id && raw.from_account === raw.bot_owner_id);
-        const cmdMatch = q.trim().match(/^\/([a-z_-]+)/i);
-        ctx.log.info('[guard-group-command] come in', { hasRegisteredCommand, isOwner, isCmd: !!cmdMatch });
-        if (hasRegisteredCommand && cmdMatch) {
-            const cmdName = cmdMatch[1].toLowerCase();
-            if (!GROUP_PUBLIC_COMMANDS.has(cmdName) && !isOwner) {
-                await sendGroupMsgBody({
-                    account,
-                    groupCode: groupCode,
-                    msgBody: buildOutboundMsgBody(prepareOutboundContent(`⚠️ /${cmdName} 仅限创建者${!raw?.bot_owner_id ? "并且在私聊模式下" : ""}使用哦~`, groupCode, getMember(account.accountId))),
-                    fromAccount: account.botId,
-                    refMsgId: raw.msg_id || raw.msg_key || undefined,
-                    refFromAccount: fromAccount,
-                    wsClient: ctx.wsClient,
-                });
-                return; // Abort pipeline
-            }
+        const { commandParts, raw, account, groupCode, fromAccount } = ctx;
+        const cmd = commandParts?.[0]?.toLowerCase() ?? "";
+        const ownerId = account.botOwnerId || raw.bot_owner_id;
+        const isOwner = Boolean(ownerId && raw.from_account === ownerId);
+        ctx.log.info('[guard-group-command] come in', { isOwner, cmd });
+        const allowed = GROUP_ALLOWED_COMMANDS.has(cmd);
+        const rejected = !allowed || !isOwner;
+        if (rejected) {
+            const rejectReason = !allowed
+                ? `⚠️ ${cmd} 暂不支持在群聊中使用，请在私聊中发送`
+                : `⚠️ ${cmd} 仅限创建者使用哦~`;
+            await sendGroupMsgBody({
+                account,
+                groupCode: groupCode,
+                msgBody: buildOutboundMsgBody(prepareOutboundContent(rejectReason, groupCode, getMember(account.accountId))),
+                fromAccount: account.botId,
+                refMsgId: raw.msg_id || raw.msg_key || undefined,
+                refFromAccount: fromAccount,
+                wsClient: ctx.wsClient,
+            });
+            return;
         }
         await next();
     },

package/dist/src/business/pipeline/middlewares/guard-group-command.test.js

@@ -28,95 +28,72 @@ function setupMocks(t) {
         },
     });
 }
-void test("guard-group-command: when guard - executes in group chat", async (t) => {
+void test("guard-group-command: when guard - executes for group command", async (t) => {
     setupMocks(t);
     const { guardGroupCommand } = await import("./guard-group-command.js");
-    const ctx = createMockCtx({ isGroup: true });
+    const ctx = createMockCtx({ isGroup: true, hasControlCommand: true });
     assert.equal(guardGroupCommand.when(ctx), true);
 });
 void test("guard-group-command: when guard - skips in C2C", async (t) => {
     setupMocks(t);
     const { guardGroupCommand } = await import("./guard-group-command.js");
-    const ctx = createMockCtx({ isGroup: false });
+    const ctx = createMockCtx({ isGroup: false, hasControlCommand: true });
     assert.equal(guardGroupCommand.when(ctx), false);
 });
-void test("guard-group-command: non-owner executes registered command -> abort pipeline", async (t) => {
+void test("guard-group-command: when guard - skips non-command in group", async (t) => {
+    setupMocks(t);
+    const { guardGroupCommand } = await import("./guard-group-command.js");
+    const ctx = createMockCtx({ isGroup: true, hasControlCommand: false });
+    assert.equal(guardGroupCommand.when(ctx), false);
+});
+void test("guard-group-command: non-owner + whitelisted command -> reject (owner-only)", async (t) => {
     setupMocks(t);
     const { guardGroupCommand } = await import("./guard-group-command.js");
     const ctx = createMockCtx({
         isGroup: true,
-        rawBody: "/some-registered-cmd",
+        hasControlCommand: true,
+        commandParts: ["/new"],
+        rawBody: "/new",
         groupCode: "group-001",
         fromAccount: "user-001",
         raw: { bot_owner_id: "owner-001", from_account: "user-001", msg_id: "msg-001" },
-        core: {
-            channel: {
-                text: { hasControlCommand: () => true },
-            },
-        },
         config: {},
     });
     const { next, wasCalled } = createMockNext();
     await guardGroupCommand.handler(ctx, next);
     assert.equal(wasCalled(), false, "non-owner should abort pipeline");
 });
-void test("guard-group-command: owner executes registered command -> pass through", async (t) => {
+void test("guard-group-command: owner + whitelisted command -> pass through", async (t) => {
     setupMocks(t);
     const { guardGroupCommand } = await import("./guard-group-command.js");
     const ctx = createMockCtx({
         isGroup: true,
-        rawBody: "/some-registered-cmd",
+        hasControlCommand: true,
+        commandParts: ["/new"],
+        rawBody: "/new",
         groupCode: "group-001",
         fromAccount: "owner-001",
         raw: { bot_owner_id: "owner-001", from_account: "owner-001" },
-        core: {
-            channel: {
-                text: { hasControlCommand: () => true },
-            },
-        },
         config: {},
     });
     const { next, wasCalled } = createMockNext();
     await guardGroupCommand.handler(ctx, next);
     assert.equal(wasCalled(), true, "owner should pass through");
 });
-void test("guard-group-command: unregistered command -> pass through (treated as plain text)", async (t) => {
-    setupMocks(t);
-    const { guardGroupCommand } = await import("./guard-group-command.js");
-    const ctx = createMockCtx({
-        isGroup: true,
-        rawBody: "/random-text",
-        groupCode: "group-001",
-        fromAccount: "user-001",
-        raw: { bot_owner_id: "owner-001", from_account: "user-001" },
-        core: {
-            channel: {
-                text: { hasControlCommand: () => false },
-            },
-        },
-        config: {},
-    });
-    const { next, wasCalled } = createMockNext();
-    await guardGroupCommand.handler(ctx, next);
-    assert.equal(wasCalled(), true, "unregistered command should pass through");
-});
-void test("guard-group-command: plain text message -> pass through", async (t) => {
+void test("guard-group-command: non-whitelisted command -> reject", async (t) => {
     setupMocks(t);
     const { guardGroupCommand } = await import("./guard-group-command.js");
     const ctx = createMockCtx({
         isGroup: true,
-        rawBody: "你好",
+        hasControlCommand: true,
+        commandParts: ["/config"],
+        rawBody: "/config",
         groupCode: "group-001",
         fromAccount: "user-001",
-        raw: { from_account: "user-001" },
-        core: {
-            channel: {
-                text: { hasControlCommand: () => false },
-            },
-        },
+        raw: { bot_owner_id: "owner-001", from_account: "user-001", msg_id: "msg-001" },
         config: {},
     });
     const { next, wasCalled } = createMockNext();
     await guardGroupCommand.handler(ctx, next);
-    assert.equal(wasCalled(), true);
+    assert.equal(wasCalled(), false, "non-whitelisted command should abort pipeline");
 });

package/dist/src/business/pipeline/middlewares/guard-special-command.js

@@ -6,9 +6,11 @@ import { parseUpgradeCommand } from "../../commands/upgrade/index.js";
 import { performUpgrade } from "../../commands/upgrade/upgrade.js";
 /**
  * Check whether the message is from the bot owner.
+ * Prefers account.botOwnerId (cached via QueryBotInfoReq) over per-message bot_owner_id.
  */
-function isOwnerMessage(raw) {
-    return Boolean(raw.bot_owner_id && raw.from_account === raw.bot_owner_id);
+function isOwnerMessage(raw, accountOwnerId) {
+    const ownerId = accountOwnerId || raw.bot_owner_id;
+    return Boolean(ownerId && raw.from_account === ownerId);
 }
 /**
  * Send a reply message via sendText action + deliver layer.
@@ -34,7 +36,7 @@ export const guardSpecialCommand = {
         const upgradeCmd = parseUpgradeCommand(trimmedBody);
         if (upgradeCmd.matched) {
             ctx.log.info(`[guard-special-command] received ${trimmedBody} command`);
-            if (!isOwnerMessage(raw)) {
+            if (!isOwnerMessage(raw, ctx.account.botOwnerId)) {
                 ctx.log.warn(`[guard-special-command] non-owner attempted ${trimmedBody}, rejected`, {
                     fromAccount,
                 });
@@ -75,7 +77,7 @@ export const guardSpecialCommand = {
         // /issue-log owner guard
         if (trimmedBody.startsWith("/issue-log")) {
             ctx.log.info("[guard-special-command] received /issue-log command");
-            if (!isOwnerMessage(raw)) {
+            if (!isOwnerMessage(raw, ctx.account.botOwnerId)) {
                 ctx.log.warn("[guard-special-command] non-owner attempted /issue-log, rejected", {
                     fromAccount,
                 });

package/dist/src/business/pipeline/test-helpers/mock-ctx.js

@@ -64,6 +64,7 @@ export function createMockCtx(overrides = {}) {
         commandAuthorized: false,
         rewrittenBody: "",
         hasControlCommand: false,
+        commandParts: [],
         mediaPaths: [],
         mediaTypes: [],
         quoteInfo: undefined,

package/dist/src/business/pipeline/types.d.ts

@@ -59,6 +59,8 @@ export interface PipelineContext {
     commandAuthorized: boolean;
     rewrittenBody: string;
     hasControlCommand: boolean;
+    /** Parsed command parts: [command, ...args], e.g. ["/new"] or ["/reset", "arg1"]. Empty when not a command. */
+    commandParts: string[];
     effectiveWasMentioned: boolean;
     mediaPaths: string[];
     mediaTypes: string[];

package/dist/src/dispatcher/debouncer/index.js

@@ -32,10 +32,17 @@ function extractRawText(item) {
         .join("")
         .trim();
 }
+function isOwnerMessage(item) {
+    const ownerId = item.account.botOwnerId || item.msg.bot_owner_id;
+    return Boolean(ownerId && item.msg.from_account === ownerId);
+}
 function buildSessionKey(item) {
     const base = buildBaseSessionKey(item);
-    // Group chat: single queue
     if (item.isGroup) {
+        const rawText = extractRawText(item);
+        if (isAbortRequestText(rawText) && isOwnerMessage(item)) {
+            return `${base}:control`;
+        }
         return base;
     }
     const rawText = extractRawText(item);
@@ -118,6 +125,7 @@ function buildPipelineContext(primary, items) {
         commandAuthorized: false,
         rewrittenBody: "",
         hasControlCommand: false,
+        commandParts: [],
         effectiveWasMentioned: false,
         mediaPaths: [],
         mediaTypes: [],
@@ -167,6 +175,11 @@ export function ensureDebouncer(config) {
                 return;
             }
             const sessionKey = buildSessionKey(primary);
+            // Group owner /stop: invalidate base queue → skip remaining queued tasks
+            if (primary.isGroup && isAbortRequestText(extractRawText(primary)) && isOwnerMessage(primary)) {
+                const baseKey = buildBaseSessionKey(primary);
+                sessionQueue.invalidate(baseKey);
+            }
             // ⭐ Direct normal message: abort old inference + invalidate queued old tasks
             if (isDirectNormalMessage(primary)) {
                 const baseKey = buildBaseSessionKey(primary);

package/dist/src/types.d.ts

@@ -51,6 +51,8 @@ export type ResolvedYuanbaoAccount = {
     appKey?: string;
     appSecret?: string;
     botId?: string;
+    /** Cached after WS connect via QueryBotInfoReq; takes priority over per-message bot_owner_id */
+    botOwnerId?: string;
     apiDomain?: string;
     wsUrl?: string;
     token?: string;

package/openclaw.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "openclaw-plugin-yuanbao",
-  "version": "2.13.5",
+  "version": "2.14.0",
   "name": "YuanBao",
   "description": "YuanBao channel plugin",
   "channels": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-plugin-yuanbao",
-  "version": "2.13.5",
+  "version": "2.14.0",
   "type": "module",
   "private": false,
   "description": "Tencent YuanBao intelligent bot channel plugin",