openclaw-quiubo 2.6.16 → 2.6.18

package/README.md

@@ -10,34 +10,26 @@ npm install openclaw-quiubo
 
 ## Setup
 
-Quiubo is configured with:
-
 ```bash
 openclaw channels add --channel quiubo
 ```
 
-This launches the interactive setup wizard which will:
+The interactive wizard will:
 
 1. Prompt for your **SDK API Key** (starts with `qub_`)
 2. Authenticate against the Quiubo API
-3. List your existing bot identities or create a new one
+3. List existing bot identities or create a new one
 4. Save the configuration
 
-## Prerequisites
-
-You need a Quiubo SDK app with an API key. Get one from the Developer section in the Quiubo app settings.
-
-### What you'll need
+### Prerequisites
 
 | Item | Where to get it |
 |------|----------------|
-| SDK API Key | Quiubo app → Settings → Developer → API Keys |
+| SDK API Key | Quiubo app > Settings > Developer > API Keys |
 | Bot Identity | Created during setup wizard, or pre-create in Developer console |
 
 ## Configuration
 
-After running `channels add`, your OpenClaw config will contain:
-
 ```yaml
 channels:
   quiubo:
@@ -50,8 +42,6 @@ channels:
         pollIntervalMs: 5000
 ```
 
-### Config fields
-
 | Field | Required | Default | Description |
 |-------|----------|---------|-------------|
 | `apiKey` | Yes | — | SDK API key (starts with `qub_`) |
@@ -62,21 +52,96 @@ channels:
 
 ### Multiple accounts
 
-You can configure multiple accounts by running the setup wizard again:
+Run the setup wizard again and enter a different Account ID when prompted (e.g., `support-bot`, `sales-bot`). Each account gets its own gateway instance, cursor file, and bot config cache.
 
-```bash
-openclaw channels add --channel quiubo
+## Architecture
+
+### Message delivery
+
+The plugin uses a dual-mode real-time gateway:
+
+```
+Pusher WebSocket (primary)  ─┐
+                             ├──→ dedup ──→ onMessage() ──→ OpenClaw agent pipeline
+Polling fallback (safety)   ─┘
 ```
 
-When prompted for Account ID, enter a new name (e.g., `support-bot`, `sales-bot`).
+- **Pusher WebSocket**: Real-time push delivery via `private-user-{botIdentityId}` channel
+- **Polling**: Runs concurrently as a safety net (catches messages Pusher may silently miss)
+- **Dedup**: Both paths pass through cursor + in-memory dedup — no double-processing
+
+Outbound messages are sent via the Quiubo SDK REST API.
+
+### Replay prevention
+
+Four layers prevent old messages from being reprocessed on restart:
+
+1. **Cursor persistence**: Per-account cursor files at `~/.openclaw/cron/quiubo-cursors-{accountId}.json` survive restarts
+2. **seekToLatest()**: On cold start (no cursor for a group), paginates to the latest message without processing — only subsequent messages are treated as new
+3. **FIFO dedup set**: In-memory `dispatched` set (capped at 500 entries with FIFO eviction) catches duplicates across Pusher and poll paths within a session
+4. **Dedup guard on all delivery paths**: Pusher plaintext, Pusher E2EE, and poll paths all check the dedup set before dispatching
+
+### Resilience
+
+- **Exponential backoff**: Poll failures increase delay (5s > 10s > 20s > 40s > 60s cap), resets on success
+- **Poll concurrency limiter**: Groups polled in batches of 5 via `Promise.allSettled` to avoid API burst
+- **Gateway lifecycle safety**: `startAccount()` stops any existing gateway before creating a new one (prevents orphaned timers on config reload)
+- **Pusher timeout management**: 15s connection timeout is properly cancelled on stop/restart
+
+### End-to-end encryption (E2EE)
+
+The plugin supports Quiubo's E2EE protocol for groups that require it:
+
+- **Key generation**: Deterministic Ed25519 + X25519 keypairs derived from a 32-byte seed (persisted in config)
+- **Auto-enrollment**: On first startup, generates keypair and enrolls via challenge-response (`requestKeyChallenge` > `signChallenge` > `verifyKeyChallenge`)
+- **Inbound decryption**: GroupEnvelopeV2 messages decrypted using XChaCha20-Poly1305 with epoch keys
+- **Outbound encryption**: Plaintext encrypted before sending when E2EE is granted for the group
+- **Epoch key management**: Dual-layer cache (active key + historical keys per epoch) with 30-min TTL and automatic refresh
+- **Pusher events**: Handles `e2ee-granted`, `e2ee-revoked`, `epoch-rotated` for real-time key lifecycle
+
+### Directory agents
+
+Agents can be listed in Quiubo's public agent directory, allowing any group to add them:
+
+- **Auto-registration**: If no agent record exists for the bot identity, one is created automatically on startup
+- **Directory groups**: Discovered via `listAgentGroups()` (refreshed every 60s) and polled alongside partner groups
+- **Mention filtering**: In directory groups, polled messages are only processed if they contain an `@mention` of the agent (Pusher path is pre-filtered server-side by `triggerMode`)
+- **Scope enforcement**: Outbound messages check `grantedScopes` — agent won't attempt to send if `send_messages` isn't granted
+- **Real-time membership**: Pusher events `agent:group-added` and `agent:group-removed` update the cache immediately
+
+### Bot-enabled gating
+
+Every incoming message passes through a multi-step gating pipeline:
+
+1. **Self-echo skip** — Bot's own messages ignored
+2. **Agent channel bypass** — `agent_channel` groups always process (1:1 bot channels)
+3. **Cache miss resolution** — Unknown groups fetched via API with 5s timeout (fail-closed)
+4. **Bot-enabled check** — `settings.bot.enabled` must be `true`
+5. **Security mode check** — `PLAINTEXT_SDK` or E2EE-granted groups only
+6. **Owner takeover** — Owner sends a message > bot suppressed for `suppressionMinutes`
+7. **Suppression check** — Skipped while suppressed (stale entries evicted after 1 hour)
+
+### Inbound routing
+
+Messages are routed through OpenClaw's agent pipeline:
+
+```
+finalizeInboundContext() → dispatchReplyWithBufferedBlockDispatcher()
+```
+
+Session keys: `quiubo:{groupId}` for the main agent, `agent:{agentId}:quiubo:{groupId}` for non-main agents.
+
+### Auto-provisioning
+
+On first gateway startup, if the bot has no groups, the plugin automatically creates a welcome `agent_channel` group, adds the bot as a member, and sends a welcome message.
 
 ## Multi-Agent Setup
 
-Run multiple AI agents on a single OpenClaw gateway — each with their own Quiubo chat, workspace, model, and cron jobs. For example: a personal assistant on Opus and an autonomous project manager on Sonnet, each in their own chat.
+Run multiple AI agents on a single OpenClaw gateway — each with their own Quiubo chat, workspace, model, and cron jobs.
 
 ### Step 1: Add the agent
 
-In `~/.openclaw/openclaw.json`, add a new agent to the list:
+In `~/.openclaw/openclaw.json`:
 
 ```json
 {
@@ -93,11 +158,9 @@ In `~/.openclaw/openclaw.json`, add a new agent to the list:
 }
 ```
 
-Each agent can use a different model — useful for cost control when running autonomous agents.
-
 ### Step 2: Add a Quiubo account for the agent
 
-Add a second account under the Quiubo plugin config. You can reuse the same SDK API key — each account just needs its own bot identity:
+Each account needs its own bot identity (can share the same API key):
 
 ```json
 {
@@ -118,12 +181,8 @@ Add a second account under the Quiubo plugin config. You can reuse the same SDK
 }
 ```
 
-Create additional bot identities through the Quiubo developer console or the setup wizard.
-
 ### Step 3: Bind accounts to agents
 
-Bindings tell OpenClaw which Quiubo account routes to which agent:
-
 ```json
 {
   "bindings": [
@@ -139,7 +198,7 @@ Bindings tell OpenClaw which Quiubo account routes to which agent:
 }
 ```
 
-Without bindings, all messages route to the first agent. This is the most common setup issue — don't skip this step.
+Without bindings, all messages route to the first agent.
 
 ### Step 4: Create the agent's workspace
 
@@ -147,31 +206,14 @@ Without bindings, all messages route to the first agent. This is the most common
 mkdir -p ~/.openclaw/workspace-project-manager/memory
 ```
 
-Seed it with the standard OpenClaw agent files:
-
-- `SOUL.md` — personality and purpose
-- `AGENTS.md` — operating instructions
-- `USER.md` — info about the human
-- `IDENTITY.md` — name, emoji, avatar
-- `MEMORY.md` — long-term memory (starts empty)
-
-### Step 5: Copy auth profiles (optional)
-
-If the new agent needs access to the same services (web search, APIs, etc.):
-
-```bash
-mkdir -p ~/.openclaw/agents/project-manager/agent/
-cp ~/.openclaw/agents/main/agent/auth-profiles.json ~/.openclaw/agents/project-manager/agent/
-```
+Seed it with: `SOUL.md`, `AGENTS.md`, `USER.md`, `IDENTITY.md`, `MEMORY.md`.
 
-### Step 6: Restart
+### Step 5: Restart
 
 ```bash
 openclaw gateway restart
 ```
 
-The new agent is live. Messages to the PM bot identity route to `project-manager`, use Sonnet, and read from its own workspace.
-
 ### How routing works
 
 ```
@@ -179,72 +221,21 @@ Quiubo Chat (You + Main Bot)  → account: default → binding → agent: main
 Quiubo Chat (You + PM Bot)    → account: pm      → binding → agent: project-manager
 ```
 
-- **Messages:** The plugin passes `AccountId` to OpenClaw, which resolves the agent from bindings
-- **Cron jobs:** Filtered by `agentId` — each agent's chat only shows its own jobs
-- **Sessions:** Each agent gets its own session namespace, no cross-talk
-- **Workspaces:** Fully isolated — agents can't see or edit each other's files
-
-### Full config example
-
-```json
-{
-  "agents": {
-    "list": [
-      { "id": "main" },
-      {
-        "id": "project-manager",
-        "model": "anthropic/claude-sonnet-4-5",
-        "workspace": "~/.openclaw/workspace-project-manager"
-      }
-    ]
-  },
-  "bindings": [
-    {
-      "match": { "channel": "quiubo", "accountId": "default" },
-      "agentId": "main"
-    },
-    {
-      "match": { "channel": "quiubo", "accountId": "pm" },
-      "agentId": "project-manager"
-    }
-  ],
-  "plugins": {
-    "quiubo": {
-      "accounts": {
-        "default": {
-          "sdkApiKey": "qub_...",
-          "botIdentityId": "<main-bot-uuid>"
-        },
-        "pm": {
-          "sdkApiKey": "qub_...",
-          "botIdentityId": "<pm-bot-uuid>"
-        }
-      }
-    }
-  }
-}
-```
-
-### Tips
-
-- **Cost control:** Use cheaper models for autonomous agents that run frequently
-- **Workspace isolation:** Agents should never edit each other's files — enforce this in their `AGENTS.md`
-- **Permissions:** Add rules about what agents can/can't do (e.g., "ask before spending money")
-- **Scaling:** Same pattern for any number of agents — new ID, new bot identity, new binding, new workspace
+- **Messages**: AccountId resolves the agent via bindings
+- **Cron jobs**: Filtered by agentId — each agent's chat shows only its own
+- **Sessions**: Isolated session namespaces per agent, no cross-talk
+- **Workspaces**: Fully isolated — agents can't see each other's files
+- **Cursors**: Each account has its own cursor file — no clobbering
 
 ## Markdown Attachments
 
-Agents can send `.md` file attachments alongside their messages. Attachments appear as tappable cards in the Quiubo app with a full markdown viewer.
-
-### How it works
+Agents can send `.md` file attachments alongside messages. Attachments appear as tappable cards in the Quiubo app with a full markdown viewer.
 
-OpenClaw uses the `MEDIA:` token protocol. When an agent writes a file and includes a `MEDIA: /path/to/file.md` line in its response text, the dispatcher extracts it and passes the path to the plugin. The plugin reads the file from disk and sends it as an attachment via the Quiubo API.
+OpenClaw's `MEDIA:` token protocol is used: when an agent writes a file and includes `MEDIA: /path/to/file.md` in its response, the plugin reads the file and sends it as a structured attachment.
 
-**Supported:** `.md` files only, max 1MB each, max 5 per message.
+**Supported:** `.md` files only, max 1MB each. Source tracking distinguishes `agent` vs `subagent` attachments.
 
-### Agent instructions
-
-Add this to your agent's `AGENTS.md` so it knows how to send attachments:
+Add this to your agent's `AGENTS.md`:
 
 ```markdown
 ## Sending File Attachments
@@ -262,133 +253,69 @@ The file will be delivered as a tappable attachment card in the chat.
 Only `.md` files are supported. Files over 1MB are skipped.
 ```
 
-### Cron job attachments
-
-Cron jobs with `delivery.channel` already target the correct group. To send attachments from a cron job, the cron agent just needs to follow the same `MEDIA:` token protocol — write the `.md` file, then include the `MEDIA:` line in the output.
-
-### What the user sees
+## Operational Notes
 
-- **In chat:** A compact card below the message text showing the filename, size, and source badge (agent/subagent/cron)
-- **On tap:** Full-screen markdown viewer with rendered content
-- **In group details:** A "Documents" tab listing all attachments in the group, filterable by source
+### Cursor files
 
-## How it works
+Cursors are persisted at:
 
-### Message delivery
-
-The plugin uses a dual-mode gateway for receiving messages:
-
-- **Primary:** Pusher WebSocket — real-time push delivery
-- **Fallback:** Polling — automatic fallback when Pusher is unavailable
-
-Outbound messages are sent via the Quiubo SDK REST API.
-
-### Auto-provisioning
-
-On first gateway startup, if the bot has no groups, the plugin automatically:
-
-1. Creates a welcome group (type: `agent_channel`)
-2. Adds the bot as a member
-3. Sends a welcome message
-
-This means users can start chatting immediately after setup — no manual group creation needed.
-
-### Inbound routing
-
-Messages are routed through OpenClaw's agent pipeline using the standard `finalizeInboundContext()` → `dispatchReplyWithBufferedBlockDispatcher()` pattern (same as openclaw-mqtt).
-
-Session keys use the format `quiubo:<groupId>`. The `AccountId` field in the context payload tells OpenClaw which agent to route to via the bindings config.
-
-## Bot-Enabled Gating
-
-The extension implements a multi-step gating pipeline to determine whether to respond to a message. This runs for every incoming message (both Pusher and polling paths).
-
-### Gating Pipeline
-
-1. **Self-echo skip** — Messages from the bot's own identity are ignored
-2. **Agent channel bypass** — `agent_channel` groups always process messages (1:1 bot channels)
-3. **Security mode check** — Only `PLAINTEXT_SDK` groups are processed; E2EE groups are skipped
-4. **Bot-enabled check** — `settings.bot.enabled` must be `true` (with cache-miss fallback)
-5. **Owner takeover** — If the sender is the group owner, suppress bot for `suppressionMinutes`
-6. **Suppression check** — If currently suppressed, skip the message
-
-### Bot Config Cache
-
-The extension maintains an in-memory cache of bot configuration per group:
-
-```typescript
-interface BotConfig {
-  enabled: boolean;
-  suppressionMinutes: number;
-  ownerIdentityId: string;
-  groupType: string; // 'standard' | 'agent_channel'
-}
+```
+~/.openclaw/cron/quiubo-cursors-{accountId}.json
 ```
 
-- **Populated at startup** from `listGroups()` + `listGroupMembers()` for each group
-- **Updated on cache miss** via `onCacheMiss` callback (5s timeout, fail-closed)
-- **Hydrated from polls** when Pusher is unavailable
-
-### Suppression Map
-
-Owner takeover suppression uses a `Map<groupId, suppressedUntil>`:
-- When the group owner sends a message, `suppressedUntil` is set to `now + suppressionMinutes * 60_000`
-- Entries older than 1 hour are periodically evicted via `clearStaleSuppression()`
+Each account writes to its own file to avoid clobbering in multi-account setups. Safe to delete — the gateway will `seekToLatest()` on next start (no replay).
 
-### Cache-Miss Strategy
+### Heartbeat
 
-When a message arrives for a group not in the cache (e.g., newly created):
-- Extension calls `onCacheMiss(groupId)` which fetches group details + members from the API
-- 5-second timeout — if the fetch fails or times out, the message is skipped (fail-closed)
-- This is safer than fail-open: better to miss a message than respond incorrectly
+If an agent is registered, the gateway sends a heartbeat every 60s to report `connectionStatus: online`. Heartbeat stops on Pusher disconnect and resumes on reconnect.
 
----
+### Typing indicators
 
-## Managing accounts
+A typing indicator is sent immediately when processing begins, then repeated every 4s until the response is delivered.
 
-### Disable an account
+## Managing Accounts
 
 ```bash
-openclaw channels disable --channel quiubo
+openclaw channels disable --channel quiubo  # Disable
+openclaw channels add --channel quiubo      # Re-configure
 ```
 
-### Remove an account
-
-Delete the account entry from your OpenClaw config, or use the config editor.
-
 ## Development
 
 ```bash
 npm run build       # Compile TypeScript
 npm run typecheck   # Type-check without emitting
+npm run release     # Bump version + publish
 ```
 
 ### Project structure
 
 ```
+index.ts             # Entry point + exports
 src/
-  api.ts               # REST API client (QuiuboApiClient)
-  channel.ts           # Channel plugin (config, setup, onboarding, outbound, gateway)
-  realtime-gateway.ts  # Pusher WebSocket + polling fallback
-  polling-gateway.ts   # Polling-only gateway
-  webhook-handler.ts   # HTTP webhook server (alternative inbound)
-  runtime.ts           # Plugin runtime singleton
-  types.ts             # TypeScript type definitions
+  api.ts             # REST API client (QuiuboApiClient)
+  channel.ts         # Channel plugin (config, setup, onboarding, outbound, gateway)
+  realtime-gateway.ts  # Pusher WebSocket + polling fallback + replay prevention
+  crypto.ts          # E2EE: key generation, envelope decrypt/encrypt, Ed25519 signing
+  key-manager.ts     # Dual-layer epoch key cache with auto-fetch
+  runtime.ts         # Plugin runtime singleton
+  types.ts           # TypeScript type definitions
 ```
 
-## API coverage
-
-The `QuiuboApiClient` wraps these SDK endpoints:
+### API coverage
 
 | Category | Methods |
 |----------|---------|
 | Auth | `authenticate()` |
-| Messages | `sendMessage()`, `listMessages()` |
+| Messages | `sendMessage()`, `listMessages()`, `sendTypingIndicator()` |
 | Groups | `createGroup()`, `listGroups()`, `getGroup()`, `addMembers()`, `removeMembers()`, `listGroupMembers()`, `updateGroupSettings()` |
 | Identities | `createIdentity()`, `listIdentities()`, `deleteIdentity()` |
 | Join Tokens | `createJoinToken()`, `listJoinTokens()`, `deleteJoinToken()` |
-| Webhooks | `configureWebhook()` |
+| Agents | `listAgents()`, `createAgent()`, `updateAgent()`, `sendHeartbeat()`, `listAgentGroups()`, `getGroupAgent()` |
+| E2EE | `requestKeyChallenge()`, `verifyKeyChallenge()`, `getEpochKey()`, `getEpochKeys()` |
 | Pusher | `pusherAuth()` |
+| OpenClaw | `sendOpenclawResponse()` |
+| Webhooks | `configureWebhook()` |
 
 ## License
 

package/dist/index.js

@@ -13289,6 +13289,7 @@ async function readMdAttachments(mediaUrls, source, log, accountId) {
 var gateways = /* @__PURE__ */ new Map();
 var clients = /* @__PURE__ */ new Map();
 var accounts = /* @__PURE__ */ new Map();
+var loggers = /* @__PURE__ */ new Map();
 var CHANNEL_ID = "quiubo";
 var DEFAULT_API_URL = "https://api.quiubo.io";
 var DEFAULT_ACCOUNT_ID = "default";
@@ -13585,11 +13586,13 @@ var quiuboPlugin = {
     async sendText(ctx) {
       const { text, cfg } = ctx;
       const accountId = ctx.accountId ?? DEFAULT_ACCOUNT_ID;
+      const log = loggers.get(accountId);
       let client = clients.get(accountId);
       let account = accounts.get(accountId);
       if (!client || !account) {
         const acct = getChannelConfig(cfg)?.accounts?.[accountId];
         if (!acct?.apiKey) {
+          log?.warn?.(`[${accountId}] [outbound:sendText] no account config found`);
           return { ok: false, error: "No account config found" };
         }
         const apiUrl = acct.apiUrl ?? DEFAULT_API_URL;
@@ -13598,8 +13601,13 @@ var quiuboPlugin = {
         clients.set(accountId, client);
         accounts.set(accountId, account);
       }
-      const groupId = resolveOutboundGroupId(ctx);
+      let groupId = resolveOutboundGroupId(ctx);
       if (!groupId) {
+        groupId = await resolveAnnounceGroupId(accountId, log);
+      }
+      log?.info?.(`[${accountId}] [outbound:sendText] groupId=${groupId}, text=${text?.length ?? 0} chars, ctx.to=${ctx.to}, ConversationLabel=${ctx.target?.raw?.ConversationLabel ?? ctx.ConversationLabel}, SessionKey=${ctx.target?.raw?.SessionKey ?? ctx.SessionKey}`);
+      if (!groupId) {
+        log?.error?.(`[${accountId}] [outbound:sendText] no groupId \u2014 ctx keys=${Object.keys(ctx).join(",")}, target=${ctx.target ? JSON.stringify(Object.keys(ctx.target)) : "none"}, raw=${ctx.target?.raw ? JSON.stringify(Object.keys(ctx.target.raw)) : "none"}`);
         return { ok: false, error: "No groupId in outbound context" };
       }
       const senderId = account.botIdentityId;
@@ -13607,14 +13615,16 @@ var quiuboPlugin = {
         return { ok: false, error: "No botIdentityId configured" };
       }
       try {
-        await client.sendMessage(groupId, {
+        const apiResp = await client.sendMessage(groupId, {
           senderIdentityId: senderId,
           plaintext: text,
           metadata: { format: "markdown" }
         });
+        log?.info?.(`[${accountId}] [outbound:sendText] sent to group ${groupId} (realtime=${apiResp?.realtimeDelivered})`);
         return { ok: true };
       } catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
+        log?.error?.(`[${accountId}] [outbound:sendText] failed: ${msg}`);
         return { ok: false, error: msg };
       }
     },
@@ -13624,14 +13634,16 @@ var quiuboPlugin = {
       const urls = [];
       if (ctx.mediaUrl) urls.push(ctx.mediaUrl);
       if (Array.isArray(ctx.mediaUrls)) urls.push(...ctx.mediaUrls);
-      const mdAttachments = await readMdAttachments(urls, "agent", void 0, "sendMedia");
-      const plaintext = text || (mdAttachments.length === 0 ? "[Media attachment]" : "");
       const accountId = ctx.accountId ?? DEFAULT_ACCOUNT_ID;
+      const log = loggers.get(accountId);
+      const mdAttachments = await readMdAttachments(urls, "agent", log, accountId);
+      const plaintext = text || (mdAttachments.length === 0 ? "[Media attachment]" : "");
       let client = clients.get(accountId);
       let account = accounts.get(accountId);
       if (!client || !account) {
         const acct = getChannelConfig(ctx.cfg)?.accounts?.[accountId];
         if (!acct?.apiKey) {
+          log?.warn?.(`[${accountId}] [outbound:sendMedia] no account config found`);
           return { ok: false, error: "No account config found" };
         }
         const apiUrl = acct.apiUrl ?? DEFAULT_API_URL;
@@ -13640,8 +13652,13 @@ var quiuboPlugin = {
         clients.set(accountId, client);
         accounts.set(accountId, account);
       }
-      const groupId = resolveOutboundGroupId(ctx);
+      let groupId = resolveOutboundGroupId(ctx);
+      if (!groupId) {
+        groupId = await resolveAnnounceGroupId(accountId, log);
+      }
+      log?.info?.(`[${accountId}] [outbound:sendMedia] groupId=${groupId}, urls=${urls.length}, attachments=${mdAttachments.length}`);
       if (!groupId) {
+        log?.error?.(`[${accountId}] [outbound:sendMedia] no groupId \u2014 ctx keys=${Object.keys(ctx).join(",")}`);
         return { ok: false, error: "No groupId in outbound context" };
       }
       const senderId = account.botIdentityId;
@@ -13649,15 +13666,17 @@ var quiuboPlugin = {
         return { ok: false, error: "No botIdentityId configured" };
       }
       try {
-        await client.sendMessage(groupId, {
+        const apiResp = await client.sendMessage(groupId, {
           senderIdentityId: senderId,
           plaintext,
           metadata: { format: "markdown" },
           ...mdAttachments.length > 0 ? { attachments: mdAttachments } : {}
         });
+        log?.info?.(`[${accountId}] [outbound:sendMedia] sent to group ${groupId} (realtime=${apiResp?.realtimeDelivered})`);
         return { ok: true };
       } catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
+        log?.error?.(`[${accountId}] [outbound:sendMedia] failed: ${msg}`);
         return { ok: false, error: msg };
       }
     }
@@ -13693,6 +13712,7 @@ var quiuboPlugin = {
       const client = new QuiuboApiClient(apiUrl, apiKey);
       clients.set(accountId, client);
       accounts.set(accountId, { ...quiuboConfig, accountId });
+      loggers.set(accountId, log);
       let pusherConfig;
       let auth;
       try {
@@ -14024,6 +14044,7 @@ var quiuboPlugin = {
           gateways.delete(accountId);
           clients.delete(accountId);
           accounts.delete(accountId);
+          loggers.delete(accountId);
           resolve();
         };
         if (abortSignal) {
@@ -14049,6 +14070,30 @@ function resolveOutboundGroupId(ctx) {
   if (targetGroupId) return targetGroupId;
   return void 0;
 }
+async function resolveAnnounceGroupId(accountId, log) {
+  try {
+    const { readFile: readFile3 } = await import("node:fs/promises");
+    const { join: join2 } = await import("node:path");
+    const homeDir = process.env.HOME ?? process.env.USERPROFILE ?? "";
+    const cronPath = join2(homeDir, ".openclaw", "cron", "jobs.json");
+    const raw = await readFile3(cronPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const jobs = parsed?.jobs ?? [];
+    for (const job of jobs) {
+      if (job.enabled === false) continue;
+      const delivery = job.delivery;
+      if (!delivery) continue;
+      if (delivery.channel !== "quiubo") continue;
+      if (delivery.to) {
+        log?.info?.(`[${accountId}] [resolveAnnounceGroupId] found cron job ${job.id} \u2192 delivery.to=${delivery.to}`);
+        return delivery.to;
+      }
+    }
+  } catch (err) {
+    log?.warn?.(`[${accountId}] [resolveAnnounceGroupId] failed to read cron jobs: ${err}`);
+  }
+  return void 0;
+}
 async function getActivityData(runtime2, log, agentId) {
   try {
     const { readFile: readFile3 } = await import("node:fs/promises");