openclaw-weixin 3.0.2 → 3.1.1

package/docs/backend-api_EN.md

@@ -0,0 +1,347 @@
+# Backend API Protocol
+
+[Back to detailed guide](./guide_EN.md) |
+[简体中文](./backend-api.md)
+
+This document covers every Weixin backend endpoint used by the plugin for QR
+login, lifecycle notifications, messaging, and media. The two QR login requests
+always use Tencent's fixed service. A backend selected by the account's
+post-login `baseurl` must implement the lifecycle, messaging, and media
+endpoints.
+
+QR creation and all post-login endpoints use `POST`; QR status polling uses
+`GET`. All requests include:
+
+| Header | Description |
+|--------|-------------|
+| `iLink-App-Id` | Plugin application ID |
+| `iLink-App-ClientVersion` | Plugin version encoded as an unsigned integer |
+| `SKRouteTag` | Optional configured route tag |
+
+`POST` requests additionally include `Content-Type: application/json`,
+`AuthorizationType: ilink_bot_token`, and a random base64-encoded
+`X-WECHAT-UIN`. Authenticated post-login requests also include
+`Authorization: Bearer <bot-token>`; QR status `GET` requests do not include
+these `POST`-specific headers.
+
+Authenticated post-login `POST` bodies include `base_info`; QR creation does
+not. The message examples below omit it for readability.
+
+```json
+{
+  "base_info": {
+    "channel_version": "<plugin version>",
+    "bot_agent": "OpenClaw"
+  }
+}
+```
+
+`bot_agent` is for observability only. Its supported format and configuration
+are documented in the [detailed guide](./guide_EN.md#custom-botagent-optional).
+
+## Endpoint List
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `POST` | `/ilink/bot/get_bot_qrcode?bot_type=3` | Create a QR login session |
+| `GET` | `/ilink/bot/get_qrcode_status?qrcode=<opaque-id>` | Poll QR login status; accepts optional `verify_code` |
+| `POST` | `/ilink/bot/msg/notifystart` | Notify backend that the channel started |
+| `POST` | `/ilink/bot/msg/notifystop` | Notify backend that the channel stopped |
+| `POST` | `/ilink/bot/getupdates` | Long-poll for new messages |
+| `POST` | `/ilink/bot/sendmessage` | Send a message (text/image/video/file) |
+| `POST` | `/ilink/bot/getuploadurl` | Get CDN upload pre-signed parameters |
+| `POST` | `/ilink/bot/getconfig` | Get account config (typing ticket, etc.) |
+| `POST` | `/ilink/bot/sendtyping` | Send/cancel typing status |
+
+The first two rows describe the fixed QR login service. They are not sent to the
+account's post-login `baseurl`.
+
+## QR Login and Lifecycle
+
+Create a QR session with:
+
+```http
+POST /ilink/bot/get_bot_qrcode?bot_type=3
+Content-Type: application/json
+```
+
+```json
+{
+  "local_token_list": []
+}
+```
+
+The response contains an opaque `qrcode` identifier and
+`qrcode_img_content`, the URL rendered as the QR code. Poll
+`GET /ilink/bot/get_qrcode_status?qrcode=<opaque-id>` until it reaches a
+terminal state. The optional `verify_code` query parameter handles verification
+challenges.
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `status` | `string` | `wait`, `scaned`, `need_verifycode`, `verify_code_blocked`, `expired`, `scaned_but_redirect`, `binded_redirect`, or `confirmed` |
+| `bot_token` | `string?` | Bot credential returned after confirmation |
+| `ilink_bot_id` | `string?` | Required account ID after confirmation |
+| `baseurl` | `string?` | Account API base URL |
+| `ilink_user_id` | `string?` | ID of the user who scanned the QR code |
+| `redirect_host` | `string?` | New polling host for `scaned_but_redirect` |
+
+After authentication, call `/ilink/bot/msg/notifystart` when the channel starts
+and `/ilink/bot/msg/notifystop` when it stops. Both receive the standard
+`base_info` body and return:
+
+```json
+{
+  "ret": 0,
+  "errmsg": ""
+}
+```
+
+QR identifiers, verification codes, bot tokens, account IDs, user IDs, and
+context tokens are sensitive. Never place real values in logs or examples.
+
+## getUpdates
+
+Long-polling endpoint. The server responds when new messages arrive or on
+timeout.
+
+**Request body:**
+
+```json
+{
+  "get_updates_buf": ""
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `get_updates_buf` | `string` | Sync cursor from the previous response; empty string for the first request |
+
+**Response body:**
+
+```json
+{
+  "ret": 0,
+  "msgs": [],
+  "get_updates_buf": "<new cursor>",
+  "longpolling_timeout_ms": 35000
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `ret` | `number` | Return code, `0` = success |
+| `errcode` | `number?` | Error code (e.g., `-14` = stale token) |
+| `errmsg` | `string?` | Error description |
+| `msgs` | `WeixinMessage[]` | Message list (structure below) |
+| `get_updates_buf` | `string` | New sync cursor to pass in the next request |
+| `longpolling_timeout_ms` | `number?` | Server-suggested long-poll timeout for the next request (ms) |
+
+## sendMessage
+
+Send a message to a user.
+
+**Request body:**
+
+```json
+{
+  "msg": {
+    "to_user_id": "<target user ID>",
+    "context_token": "<conversation context token>",
+    "item_list": [
+      {
+        "type": 1,
+        "text_item": { "text": "Hello" }
+      }
+    ]
+  }
+}
+```
+
+**Response body:**
+
+```json
+{
+  "ret": 0,
+  "errmsg": ""
+}
+```
+
+## getUploadUrl
+
+Get CDN upload pre-signed parameters. Call this endpoint before uploading a file
+to obtain `upload_param` and `thumb_upload_param`.
+
+**Request body:**
+
+```json
+{
+  "filekey": "<file identifier>",
+  "media_type": 1,
+  "to_user_id": "<target user ID>",
+  "rawsize": 12345,
+  "rawfilemd5": "<plaintext MD5>",
+  "filesize": 12352,
+  "no_need_thumb": true,
+  "aeskey": "<32-character hex AES key>"
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `filekey` | `string` | Per-upload file identifier |
+| `media_type` | `number` | `1` = IMAGE, `2` = VIDEO, `3` = FILE, `4` = VOICE |
+| `to_user_id` | `string` | Target user ID |
+| `rawsize` | `number` | Original file plaintext size |
+| `rawfilemd5` | `string` | Original file plaintext MD5 |
+| `filesize` | `number` | Ciphertext size after AES-128-ECB encryption |
+| `no_need_thumb` | `boolean?` | Set `true` to omit thumbnail upload parameters |
+| `aeskey` | `string?` | AES-128 key as 32 hexadecimal characters |
+| `thumb_rawsize` | `number?` | Thumbnail plaintext size when a thumbnail is requested |
+| `thumb_rawfilemd5` | `string?` | Thumbnail plaintext MD5 when requested |
+| `thumb_filesize` | `number?` | Thumbnail ciphertext size when requested |
+
+**Response body:**
+
+```json
+{
+  "upload_param": "<original image upload encrypted parameters>",
+  "upload_full_url": "https://cdn.example.test/upload",
+  "thumb_upload_param": "<optional thumbnail upload parameters>"
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `upload_param` | `string?` | Parameters used to construct the CDN upload URL |
+| `upload_full_url` | `string?` | Complete CDN upload URL; takes precedence over `upload_param` |
+| `thumb_upload_param` | `string?` | Optional thumbnail upload parameters |
+
+## getConfig
+
+Get account configuration, including the typing ticket.
+
+**Request body:**
+
+```json
+{
+  "ilink_user_id": "<user ID>",
+  "context_token": "<optional, conversation context token>"
+}
+```
+
+**Response body:**
+
+```json
+{
+  "ret": 0,
+  "errmsg": "",
+  "typing_ticket": "<base64-encoded typing ticket>"
+}
+```
+
+## sendTyping
+
+Send or cancel the typing status indicator.
+
+**Request body:**
+
+```json
+{
+  "ilink_user_id": "<user ID>",
+  "typing_ticket": "<obtained from getConfig>",
+  "status": 1
+}
+```
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `status` | `number` | `1` = typing, `2` = cancel typing |
+
+**Response body:**
+
+```json
+{
+  "ret": 0,
+  "errmsg": ""
+}
+```
+
+## Message Structure
+
+### WeixinMessage
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `seq` | `number?` | Message sequence number |
+| `message_id` | `number?` | Unique message ID |
+| `from_user_id` | `string?` | Sender ID |
+| `to_user_id` | `string?` | Receiver ID |
+| `client_id` | `string?` | Client-generated message ID |
+| `create_time_ms` | `number?` | Creation timestamp (ms) |
+| `update_time_ms` | `number?` | Update timestamp (ms) |
+| `delete_time_ms` | `number?` | Deletion timestamp (ms) |
+| `session_id` | `string?` | Session ID |
+| `group_id` | `string?` | Group ID |
+| `message_type` | `number?` | `1` = USER, `2` = BOT |
+| `message_state` | `number?` | `0` = NEW, `1` = GENERATING, `2` = FINISH |
+| `item_list` | `MessageItem[]?` | Message content list |
+| `context_token` | `string?` | Conversation context token, must be passed back when replying |
+| `run_id` | `string?` | OpenClaw run ID for generated replies |
+
+### MessageItem
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `type` | `number` | `1` TEXT, `2` IMAGE, `3` VOICE, `4` FILE, `5` VIDEO, `11` TOOL_CALL_START, `12` TOOL_CALL_RESULT |
+| `create_time_ms` | `number?` | Item creation timestamp |
+| `update_time_ms` | `number?` | Item update timestamp |
+| `is_completed` | `boolean?` | Whether a progress item is complete |
+| `msg_id` | `string?` | Item message ID |
+| `text_item` | `{ text: string }?` | Text content |
+| `image_item` | `ImageItem?` | Image (with CDN reference and AES key) |
+| `voice_item` | `VoiceItem?` | Voice (SILK encoded) |
+| `file_item` | `FileItem?` | File attachment |
+| `video_item` | `VideoItem?` | Video |
+| `ref_msg` | `RefMessage?` | Referenced message |
+| `tool_call_start_item` | `{ tool_name?: string; tool_call_id?: string }?` | Tool invocation metadata |
+| `tool_call_result_item` | `{ tool_name?: string; tool_call_id?: string; status?: string }?` | Tool completion metadata |
+
+### Nested Item Structures
+
+| Structure | Fields |
+|-----------|--------|
+| `RefMessage` | `message_item?: MessageItem`, `title?: string` |
+| `ImageItem` | `media?: CDNMedia`, `thumb_media?: CDNMedia`, `aeskey?: string`, `url?: string`, `mid_size?: number`, `thumb_size?: number`, `thumb_height?: number`, `thumb_width?: number`, `hd_size?: number` |
+| `VoiceItem` | `media?: CDNMedia`, `encode_type?: number`, `bits_per_sample?: number`, `sample_rate?: number`, `playtime?: number`, `text?: string` |
+| `FileItem` | `media?: CDNMedia`, `file_name?: string`, `md5?: string`, `len?: string` |
+| `VideoItem` | `media?: CDNMedia`, `video_size?: number`, `play_length?: number`, `video_md5?: string`, `thumb_media?: CDNMedia`, `thumb_size?: number`, `thumb_height?: number`, `thumb_width?: number` |
+| `ToolCallStartItem` | `tool_name?: string`, `tool_call_id?: string` |
+| `ToolCallResultItem` | `tool_name?: string`, `tool_call_id?: string`, `status?: string` |
+
+### CDN Media Reference (CDNMedia)
+
+All media types (image/voice/file/video) are transferred via CDN using
+AES-128-ECB encryption:
+
+| Field | Type | Description |
+|-------|------|-------------|
+| `encrypt_query_param` | `string?` | Encrypted parameters for CDN download/upload |
+| `aes_key` | `string?` | Base64-encoded AES-128 key |
+| `encrypt_type` | `number?` | Encryption metadata mode |
+| `full_url` | `string?` | Complete download URL returned by the backend |
+
+## CDN Upload Flow
+
+1. Calculate the file's plaintext size, MD5, and ciphertext size after
+   AES-128-ECB encryption
+2. If a thumbnail is needed (image/video), calculate the thumbnail's plaintext
+   and ciphertext parameters as well
+3. Call `getUploadUrl` to get `upload_full_url` or `upload_param` (and optional
+   `thumb_upload_param`)
+4. Encrypt the file content with AES-128-ECB and `POST` it to the CDN URL as
+   `application/octet-stream`
+5. Encrypt and upload the thumbnail in the same way when requested
+6. Read `x-encrypted-param` from the CDN response and use it as
+   `encrypt_query_param` in the `CDNMedia` reference
+7. Include the reference in the `MessageItem` and send

package/docs/guide.md

@@ -1,40 +1,35 @@
-# Detailed Guide
+# 详细指南
 
-[Back to README](../README_EN.md) | [简体中文](./guide.zh_CN.md)
+[返回 README](../README.md) | [English](./guide_EN.md)
 
-## Installation Details
+## 安装说明
 
-### Package Names and State
+### 包名与状态兼容性
 
-The npm package, plugin id, and channel id are all `openclaw-weixin`. The
-[install command](../README_EN.md#install-or-replace) preserves the existing
-`channels.openclaw-weixin`, `plugins.entries.openclaw-weixin`, and
-`~/.openclaw/openclaw-weixin/` state paths.
+npm 包、插件 ID 和 channel ID 均为 `openclaw-weixin`。README 中的
+[安装命令](../README.md#connect-wechat)会保留
+`channels.openclaw-weixin`、`plugins.entries.openclaw-weixin` 和
+`~/.openclaw/openclaw-weixin/` 状态路径。
 
-`--force` confirms the npm source and allows OpenClaw to replace a plugin with
-the same internal id. OpenClaw rotates backups of its config automatically; do
-not copy the entire state directory for this replacement.
+`--force` 允许 OpenClaw 覆盖内部 ID 相同的现有插件安装；它不会改变来源信任或
+安全策略。OpenClaw 会自动轮换配置备份；此次替换无需复制整个状态目录。
 
-### Limitations
+### 安装限制
 
-- Use the CLI for this community npm package. OpenClaw's Control UI does not
-  install arbitrary npm, git, or local-path plugin sources.
-- In Nix mode (`OPENCLAW_NIX_MODE=1`), plugin install, update, uninstall,
-  enable, and disable commands are intentionally disabled. Add the package and
-  config to the Nix source, then rebuild instead.
-- OpenClaw installs plugin dependencies with lifecycle scripts disabled. This
-  package therefore ships its compiled `dist/index.js` runtime and does not
-  build on the user's machine.
+- 此社区 npm 包需通过 CLI 安装；OpenClaw Control UI 不能安装任意 npm、git
+  或本地路径来源的插件。
+- Nix 模式（`OPENCLAW_NIX_MODE=1`）会禁止插件安装、更新、卸载、启用和停用
+  命令；请改动 Nix 配置源后重新构建。
+- OpenClaw 安装插件依赖时会禁用生命周期脚本，因此本包直接携带编译后的
+  `dist/index.js`，无需在用户机器上构建。
 
-## Custom BotAgent (optional)
+## 自定义 BotAgent（可选）
 
-Every authenticated post-login request to the WeChat backend carries a
-self-declared `bot_agent` identifier — analogous to an HTTP `User-Agent` — used
-for log attribution and monitoring aggregation. The default is `OpenClaw`.
-Declaring your own app name makes it much easier to trace your traffic in
-backend logs.
+登录后的每条鉴权请求会带一个自我声明的 `bot_agent` 字段——类似 HTTP
+`User-Agent`——用于后台日志归因和监控聚合。**默认值为 `OpenClaw`**。声明自己的
+应用名能让你的流量在后台日志中更容易识别。
 
-Add one line to `openclaw.json`:
+在 `openclaw.json` 中加一行即可：
 
 ```json
 {
@@ -46,64 +41,59 @@ Add one line to `openclaw.json`:
 }
 ```
 
-**Format** (UA-style):
+**格式规范**（UA 风格）：
 
-- One or more `Name/Version` tokens, space-separated
-- Each token may optionally be followed by ` (comment)`
-- ASCII only; total length ≤ 256 bytes
-- Invalid tokens are silently dropped during sanitization; falls back to
-  `OpenClaw` if nothing valid remains
+- 一个或多个 `Name/Version` token，空格分隔
+- 每个 token 可选地跟一个 ` (comment)`
+- 仅允许 ASCII 字符；总长 ≤ 256 字节
+- 不合规的 token 在清洗时静默丢弃；如果最终为空，回退到 `OpenClaw`
 
-Examples that pass through unchanged:
+可直接使用的示例：
 
 - `MyBot/1.2.0`
 - `MyBot/1.2.0 (region=cn;env=prod)`
 - `MyBot/1.2.0 LangChain/0.3.5`
 - `MyBot/1.2.0-rc.1+build.5`
 
-**Note**: `bot_agent` is for observability only — it is not used for
-authentication or routing. All registered agents on this plugin instance
-currently share the same `botAgent` declaration; per-agent overrides may be
-added in a future version if needed.
+**注意**：`bot_agent` 仅用于观测，**不参与鉴权或路由**。当前本插件实例下所有
+已注册的 agent 共享同一个 `botAgent` 声明；如有需要按 agent 单独标识的场景，
+可在后续版本扩展配置。
 
-## Uninstall
+## 卸载
 
 > [!WARNING]
-> Do not uninstall when replacing Tencent's package. Use the
-> [install command](../README_EN.md#install-or-replace) instead.
+> 替换腾讯版时不要卸载，请使用 README 中的
+> [安装命令](../README.md#connect-wechat)原位替换。
 
-Back up `~/.openclaw/openclaw.json` first if you may want to reinstall: current
-OpenClaw versions remove the plugin entry and owned
-`channels.openclaw-weixin` configuration during uninstall.
+如果以后可能重装，请先备份 `~/.openclaw/openclaw.json`：新版 OpenClaw
+卸载时会删除插件条目及其拥有的 `channels.openclaw-weixin` 配置。
 
 ```bash
 openclaw plugins uninstall openclaw-weixin
 ```
 
-## Troubleshooting
+## 故障排查
 
-### "requires OpenClaw >=2026.6.1" error
+### "requires OpenClaw >=2026.6.1" 报错
 
-Your OpenClaw version is too old for this plugin version. Check with:
+你的 OpenClaw 版本太旧，不兼容当前插件版本。检查版本：
 
 ```bash
 openclaw --version
 ```
 
-Upgrade OpenClaw before installing this package. The community package does not
-publish a legacy compatibility line.
+请先升级 OpenClaw。社区包不发布旧宿主兼容版本线。
 
-### Channel shows "OK" but doesn't connect
+### Channel 显示 "OK" 但未连接
 
-Enable the plugin, reload or restart the actual unit that runs OpenClaw, and
-probe the channel again:
+启用插件，重载或重启实际承载 OpenClaw 的运行单元，然后再次探测：
 
 ```bash
 openclaw plugins enable openclaw-weixin
 openclaw channels status --probe
 ```
 
-## Developer Documentation
+## 开发者文档
 
-- [Backend API protocol](./backend-api.md)
-- [Architecture](./architecture.md)
+- [后端 API 协议](./backend-api.md)
+- [架构说明](./architecture.md)

package/docs/guide_EN.md

@@ -0,0 +1,110 @@
+# Detailed Guide
+
+[Back to README](../README_EN.md) | [简体中文](./guide.md)
+
+## Installation Details
+
+### Package Names and State
+
+The npm package, plugin id, and channel id are all `openclaw-weixin`. The
+[install command](../README_EN.md#connect-wechat) preserves the existing
+`channels.openclaw-weixin`, `plugins.entries.openclaw-weixin`, and
+`~/.openclaw/openclaw-weixin/` state paths.
+
+`--force` allows OpenClaw to overwrite an existing plugin installation with the
+same internal id; it does not change source-trust or security policy. OpenClaw
+rotates backups of its config automatically; do not copy the entire state
+directory for this replacement.
+
+### Limitations
+
+- Use the CLI for this community npm package. OpenClaw's Control UI does not
+  install arbitrary npm, git, or local-path plugin sources.
+- In Nix mode (`OPENCLAW_NIX_MODE=1`), plugin install, update, uninstall,
+  enable, and disable commands are intentionally disabled. Add the package and
+  config to the Nix source, then rebuild instead.
+- OpenClaw installs plugin dependencies with lifecycle scripts disabled. This
+  package therefore ships its compiled `dist/index.js` runtime and does not
+  build on the user's machine.
+
+## Custom BotAgent (optional)
+
+Every authenticated post-login request to the WeChat backend carries a
+self-declared `bot_agent` identifier — analogous to an HTTP `User-Agent` — used
+for log attribution and monitoring aggregation. The default is `OpenClaw`.
+Declaring your own app name makes it much easier to trace your traffic in
+backend logs.
+
+Add one line to `openclaw.json`:
+
+```json
+{
+  "channels": {
+    "openclaw-weixin": {
+      "botAgent": "MyBot/1.2.0"
+    }
+  }
+}
+```
+
+**Format** (UA-style):
+
+- One or more `Name/Version` tokens, space-separated
+- Each token may optionally be followed by ` (comment)`
+- ASCII only; total length ≤ 256 bytes
+- Invalid tokens are silently dropped during sanitization; falls back to
+  `OpenClaw` if nothing valid remains
+
+Examples that pass through unchanged:
+
+- `MyBot/1.2.0`
+- `MyBot/1.2.0 (region=cn;env=prod)`
+- `MyBot/1.2.0 LangChain/0.3.5`
+- `MyBot/1.2.0-rc.1+build.5`
+
+**Note**: `bot_agent` is for observability only — it is not used for
+authentication or routing. All registered agents on this plugin instance
+currently share the same `botAgent` declaration; per-agent overrides may be
+added in a future version if needed.
+
+## Uninstall
+
+> [!WARNING]
+> Do not uninstall when replacing Tencent's package. Use the
+> [install command](../README_EN.md#connect-wechat) instead.
+
+Back up `~/.openclaw/openclaw.json` first if you may want to reinstall: current
+OpenClaw versions remove the plugin entry and owned
+`channels.openclaw-weixin` configuration during uninstall.
+
+```bash
+openclaw plugins uninstall openclaw-weixin
+```
+
+## Troubleshooting
+
+### "requires OpenClaw >=2026.6.1" error
+
+Your OpenClaw version is too old for this plugin version. Check with:
+
+```bash
+openclaw --version
+```
+
+Upgrade OpenClaw before installing this package. The community package does not
+publish a legacy compatibility line.
+
+### Channel shows "OK" but doesn't connect
+
+Enable the plugin, reload or restart the actual unit that runs OpenClaw, and
+probe the channel again:
+
+```bash
+openclaw plugins enable openclaw-weixin
+openclaw channels status --probe
+```
+
+## Developer Documentation
+
+- [Backend API protocol](./backend-api_EN.md)
+- [Architecture](./architecture_EN.md)

package/index.ts

@@ -7,8 +7,8 @@ import { WeixinConfigSchema } from "./src/config/config-schema.js";
 
 export default {
   id: "openclaw-weixin",
-  name: "Weixin",
-  description: "Weixin channel (getUpdates long-poll + sendMessage)",
+  name: "WeChat",
+  description: "Community-maintained WeChat (Weixin) channel plugin for OpenClaw using the iLink bot API.",
   configSchema: buildChannelConfigSchema(WeixinConfigSchema),
   register(api: OpenClawPluginApi) {
     // Fail-fast: reject incompatible host versions before any side-effects.

package/openclaw.plugin.json

@@ -1,6 +1,9 @@
 {
   "id": "openclaw-weixin",
-  "version": "3.0.2",
+  "name": "WeChat",
+  "description": "Community-maintained WeChat (Weixin) channel plugin for OpenClaw using the iLink bot API.",
+  "icon": "https://openclaw-weixin.newfuture.cc/logo.svg",
+  "version": "3.1.1",
   "channels": ["openclaw-weixin"],
   "channelConfigs": {
     "openclaw-weixin": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "openclaw-weixin",
-  "version": "3.0.2",
-  "description": "Community-maintained OpenClaw WeChat channel plugin",
+  "version": "3.1.1",
+  "description": "Community-maintained WeChat (Weixin) channel plugin for OpenClaw using the iLink bot API.",
   "license": "MIT",
   "author": "Tencent",
   "contributors": [
@@ -49,6 +49,7 @@
     "check:versions": "node scripts/check-versions.mjs",
     "check:static": "npm run check:versions && npm run check:style && npm run typecheck && npm run typecheck:tests",
     "check:fast": "npm run check:static && npm run test:unit",
+    "audit:all": "npm audit --audit-level=moderate",
     "audit:deps": "npm audit --omit=dev --omit=peer --audit-level=moderate",
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "npm run clean && tsc",
@@ -67,23 +68,29 @@
     "openclaw": ">=2026.6.1"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.6",
+    "@biomejs/biome": "2.5.7",
     "@types/node": "^26.1.2",
     "@vitest/coverage-v8": "^4.1.10",
     "openclaw": "2026.7.1",
     "silk-wasm": "^3.7.1",
+    "tar": "7.5.22",
     "typescript": "^7.0.2",
     "vitest": "^4.1.10"
   },
   "overrides": {
-    "@hono/node-server": "2.1.0",
-    "brace-expansion": "5.0.9",
-    "fast-uri": "3.1.5",
-    "hono": "4.13.0",
-    "protobufjs": "7.6.5",
-    "tar": "7.5.22"
+    "openclaw@2026.7.1": {
+      "@hono/node-server": "2.1.0",
+      "tar": "7.5.22",
+      "undici": "8.9.0"
+    }
   },
   "openclaw": {
+    "compat": {
+      "pluginApi": ">=2026.6.1"
+    },
+    "build": {
+      "openclawVersion": "2026.7.1"
+    },
     "extensions": [
       "./index.ts"
     ],