ylib-wecom-openclaw-plugin 2026.4.29

package/dist/src/utils.d.ts

@@ -0,0 +1,148 @@
+/**
+ * 企业微信公共工具函数
+ */
+import type { OpenClawConfig } from "ylib-openclaw/plugin-sdk";
+import type { ResolvedAgentAccount } from "./types/account.js";
+import type { WecomAgentConfig, WecomNetworkConfig, WecomMediaConfig, WecomDynamicAgentsConfig } from "./types/config.js";
+/**
+ * 企业微信群组配置
+ */
+export interface WeComGroupConfig {
+    /** 群组内发送者白名单（仅列表中的成员消息会被处理） */
+    allowFrom?: Array<string | number>;
+}
+/**
+ * 企业微信配置类型
+ */
+export interface WeComConfig {
+    /** 是否启用该账号。false 时账号不会启动连接与收发。 */
+    enabled?: boolean;
+    /** Bot WebSocket 地址。默认官方 `wss://openws.work.weixin.qq.com`。 */
+    websocketUrl?: string;
+    /** Bot 模式凭证：机器人 ID。 */
+    botId?: string;
+    /** Bot 模式凭证：机器人 Secret。 */
+    secret?: string;
+    /** Python/Gateway 基础地址（例如 `http://127.0.0.1:8000`）。 */
+    gatewayBaseUrl?: string;
+    /** Gateway 鉴权令牌；用于 endpoint 请求与媒体上传下载鉴权。 */
+    gatewayToken?: string;
+    /** 调用 Python endpoint 时使用的模型名（默认 `main`）。 */
+    modelName?: string;
+    /** 调用 Python endpoint 时使用的 agentId（默认 `main`）。 */
+    agentId?: string;
+    /** 媒体上传基址；入站附件上传到 `{uploadHost}/api/media/upload`。 */
+    uploadHost?: string;
+    /** 作用域类型（camelCase，只读，运行时注入）。 */
+    scopeType?: string;
+    /** 作用域类型（snake/camel 历史兼容字段，只读，运行时注入）。 */
+    scope_kind?: string;
+    /** 作用域类型（snake/camel 历史兼容字段，只读，运行时注入）。 */
+    scopeKind?: string;
+    /** 作用域类型（snake/camel 历史兼容字段，只读，运行时注入）。 */
+    scope_type?: string;
+    /** 是否按单聊/群聊区分 session（固定值，默认 true） */
+    separateSessionByConversation?: boolean;
+    /** 群聊会话隔离策略（固定值，默认 group_sender） */
+    groupSessionScope?: "group" | "group_sender";
+    /** Workspace ID（camelCase，只读，运行时注入）。 */
+    workspaceId?: string;
+    /** Workspace ID（snake_case 兼容字段，只读，运行时注入）。 */
+    workspace_id?: string;
+    /** 项目 ID（camelCase 兼容字段，只读，运行时注入）。 */
+    projectId?: string;
+    /** 项目 ID（snake_case 兼容字段，只读，运行时注入）。 */
+    project_id?: string;
+    /** 账号展示名称（用于列表显示与日志标识）。 */
+    name?: string;
+    /** 私聊发送者白名单（与 dmPolicy 联动）。 */
+    allowFrom?: Array<string | number>;
+    /** 私聊访问策略。 */
+    dmPolicy?: "open" | "allowlist" | "pairing" | "disabled";
+    /** 群组访问策略："open" = 允许所有群组（默认），"allowlist" = 仅允许 groupAllowFrom 中的群组，"disabled" = 禁用群组消息 */
+    groupPolicy?: "open" | "allowlist" | "disabled";
+    /** 群组白名单（仅 groupPolicy="allowlist" 时生效） */
+    groupAllowFrom?: Array<string | number>;
+    /** 每个群组的详细配置（如群组内发送者白名单） */
+    groups?: Record<string, WeComGroupConfig>;
+    /** 是否发送"思考中"消息，默认为 true */
+    sendThinkingMessage?: boolean;
+    /**
+     * 默认 false，保持完整过程输出；开启后只展示 final_answer，
+     * error 和主流程确认兜底仍保留，避免失败信息丢失或确认流程卡住。
+     */
+    showFinalAnswerOnly?: boolean;
+    /** 额外允许访问的本地媒体路径白名单（支持 ~ 表示 home 目录），如 ["~/Downloads", "~/Documents"] */
+    mediaLocalRoots?: string[];
+    /** Agent 模式配置（自建应用） */
+    agent?: WecomAgentConfig;
+    /** 网络配置 */
+    network?: WecomNetworkConfig;
+    /** 媒体处理配置 */
+    media?: WecomMediaConfig;
+    /** 动态 Agent 配置 */
+    dynamicAgents?: WecomDynamicAgentsConfig;
+    /** 连接模式：固定 websocket（管理端只读；保留 webhook 仅用于历史兼容数据解析）。 */
+    connectionMode?: "webhook" | "websocket";
+    /** Bot Webhook 验证 token（connectionMode=webhook 时使用）。 */
+    token?: string;
+    /** Bot Webhook AES Key（43 字符 Base64，connectionMode=webhook 时使用）。 */
+    encodingAESKey?: string;
+    /** Bot Webhook 接收方 ID（receive_id）。 */
+    receiveId?: string;
+    /** `enter_chat` 事件欢迎语。 */
+    welcomeText?: string;
+    /** 流式占位提示文案（用于 stream 首帧前占位）。 */
+    streamPlaceholderContent?: string;
+}
+export declare type WecomChatType = "direct" | "group";
+export declare type WecomGroupSessionScope = "group" | "group_sender";
+export declare function resolveWecomSessionPeerId(params: {
+    chatType: WecomChatType;
+    chatId: string;
+    senderId: string;
+    separateSessionByConversation?: boolean;
+    groupSessionScope?: WecomGroupSessionScope;
+}): string;
+/**
+ * 单个企业微信账号的配置类型（用于 accounts 字段下的每个账号）。
+ * 与 WeComConfig 字段完全一致，账号级字段会覆盖顶层同名字段。
+ */
+export declare type WeComAccountConfig = Partial<WeComConfig>;
+export declare const DefaultWsUrl = "wss://openws.work.weixin.qq.com";
+export interface ResolvedWeComAccount {
+    accountId: string;
+    name: string;
+    enabled: boolean;
+    websocketUrl: string;
+    botId: string;
+    secret: string;
+    /** 是否发送"思考中"消息，默认为 true */
+    sendThinkingMessage: boolean;
+    /** 运行时解析后的 final-only 开关，false 时保持完整过程输出。 */
+    showFinalAnswerOnly: boolean;
+    config: WeComConfig;
+    /** Agent 模式能力（自建应用） */
+    agent?: ResolvedAgentAccount;
+    /** Webhook 模式配置 */
+    token?: string;
+    encodingAESKey?: string;
+    receiveId?: string;
+    setupWizard?: any;
+}
+/**
+ * 解析企业微信账户配置
+ */
+export declare function resolveWeComAccount(cfg: OpenClawConfig): ResolvedWeComAccount;
+/**
+ * 设置企业微信账户配置
+ */
+export declare function setWeComAccount(cfg: OpenClawConfig, account: Partial<WeComConfig>): OpenClawConfig;
+/**
+ * 解析出口代理 URL（对齐原版 resolveWecomEgressProxyUrl）
+ *
+ * 优先级：
+ * 1. config.channels.wecom.network.egressProxyUrl
+ * 2. 环境变量：OPENCLAW_WECOM_EGRESS_PROXY_URL → WECOM_EGRESS_PROXY_URL → HTTPS_PROXY → ALL_PROXY → HTTP_PROXY
+ */
+export declare function resolveWecomEgressProxyUrl(cfg: OpenClawConfig): string | undefined;

package/dist/src/utils.js

@@ -0,0 +1,92 @@
+"use strict";
+/**
+ * 企业微信公共工具函数
+ */
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+exports.__esModule = true;
+exports.resolveWecomEgressProxyUrl = exports.setWeComAccount = exports.resolveWeComAccount = exports.DefaultWsUrl = exports.resolveWecomSessionPeerId = void 0;
+var openclaw_compat_js_1 = require("./openclaw-compat.js");
+var const_js_1 = require("./const.js");
+function resolveWecomSessionPeerId(params) {
+    var chatType = params.chatType;
+    var chatId = String(params.chatId || "").trim();
+    var senderId = String(params.senderId || "").trim();
+    var separateSessionByConversation = params.separateSessionByConversation !== false;
+    var groupSessionScope = params.groupSessionScope === "group" ? "group" : "group_sender";
+    if (!separateSessionByConversation) {
+        return senderId || chatId;
+    }
+    if (chatType !== "group") {
+        return senderId || chatId;
+    }
+    if (groupSessionScope === "group_sender") {
+        if (chatId && senderId)
+            return chatId + ":" + senderId;
+        return chatId || senderId;
+    }
+    return chatId || senderId;
+}
+exports.resolveWecomSessionPeerId = resolveWecomSessionPeerId;
+exports.DefaultWsUrl = "wss://openws.work.weixin.qq.com";
+/**
+ * 解析企业微信账户配置
+ */
+function resolveWeComAccount(cfg) {
+    var _a, _b, _c, _d, _e, _f;
+    var wecomConfig = ((_b = (_a = cfg.channels) === null || _a === void 0 ? void 0 : _a[const_js_1.CHANNEL_ID]) !== null && _b !== void 0 ? _b : {});
+    return {
+        accountId: openclaw_compat_js_1.DEFAULT_ACCOUNT_ID,
+        name: (_c = wecomConfig.name) !== null && _c !== void 0 ? _c : "企业微信",
+        enabled: wecomConfig.enabled !== false,
+        websocketUrl: wecomConfig.websocketUrl || exports.DefaultWsUrl,
+        botId: (_d = wecomConfig.botId) !== null && _d !== void 0 ? _d : "",
+        secret: (_e = wecomConfig.secret) !== null && _e !== void 0 ? _e : "",
+        sendThinkingMessage: (_f = wecomConfig.sendThinkingMessage) !== null && _f !== void 0 ? _f : true,
+        showFinalAnswerOnly: wecomConfig.showFinalAnswerOnly === true,
+        config: wecomConfig
+    };
+}
+exports.resolveWeComAccount = resolveWeComAccount;
+/**
+ * 设置企业微信账户配置
+ */
+function setWeComAccount(cfg, account) {
+    var _a;
+    var _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
+    var existing = ((_c = (_b = cfg.channels) === null || _b === void 0 ? void 0 : _b[const_js_1.CHANNEL_ID]) !== null && _c !== void 0 ? _c : {});
+    var merged = __assign(__assign(__assign(__assign({ enabled: (_e = (_d = account.enabled) !== null && _d !== void 0 ? _d : existing === null || existing === void 0 ? void 0 : existing.enabled) !== null && _e !== void 0 ? _e : true, botId: (_g = (_f = account.botId) !== null && _f !== void 0 ? _f : existing === null || existing === void 0 ? void 0 : existing.botId) !== null && _g !== void 0 ? _g : "", secret: (_j = (_h = account.secret) !== null && _h !== void 0 ? _h : existing === null || existing === void 0 ? void 0 : existing.secret) !== null && _j !== void 0 ? _j : "", allowFrom: (_k = account.allowFrom) !== null && _k !== void 0 ? _k : existing === null || existing === void 0 ? void 0 : existing.allowFrom, dmPolicy: (_l = account.dmPolicy) !== null && _l !== void 0 ? _l : existing === null || existing === void 0 ? void 0 : existing.dmPolicy }, (account.websocketUrl || (existing === null || existing === void 0 ? void 0 : existing.websocketUrl)
+        ? { websocketUrl: (_m = account.websocketUrl) !== null && _m !== void 0 ? _m : existing === null || existing === void 0 ? void 0 : existing.websocketUrl }
+        : {})), (account.name || (existing === null || existing === void 0 ? void 0 : existing.name)
+        ? { name: (_o = account.name) !== null && _o !== void 0 ? _o : existing === null || existing === void 0 ? void 0 : existing.name }
+        : {})), (account.sendThinkingMessage !== undefined || (existing === null || existing === void 0 ? void 0 : existing.sendThinkingMessage) !== undefined
+        ? { sendThinkingMessage: (_p = account.sendThinkingMessage) !== null && _p !== void 0 ? _p : existing === null || existing === void 0 ? void 0 : existing.sendThinkingMessage }
+        : {})), (account.showFinalAnswerOnly !== undefined || (existing === null || existing === void 0 ? void 0 : existing.showFinalAnswerOnly) !== undefined
+        ? { showFinalAnswerOnly: (_q = account.showFinalAnswerOnly) !== null && _q !== void 0 ? _q : existing === null || existing === void 0 ? void 0 : existing.showFinalAnswerOnly }
+        : {}));
+    return __assign(__assign({}, cfg), { channels: __assign(__assign({}, cfg.channels), (_a = {}, _a[const_js_1.CHANNEL_ID] = merged, _a)) });
+}
+exports.setWeComAccount = setWeComAccount;
+/**
+ * 解析出口代理 URL（对齐原版 resolveWecomEgressProxyUrl）
+ *
+ * 优先级：
+ * 1. config.channels.wecom.network.egressProxyUrl
+ * 2. 环境变量：OPENCLAW_WECOM_EGRESS_PROXY_URL → WECOM_EGRESS_PROXY_URL → HTTPS_PROXY → ALL_PROXY → HTTP_PROXY
+ */
+function resolveWecomEgressProxyUrl(cfg) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var wecom = ((_b = (_a = cfg.channels) === null || _a === void 0 ? void 0 : _a[const_js_1.CHANNEL_ID]) !== null && _b !== void 0 ? _b : {});
+    var proxyUrl = (_j = (_h = (_g = (_f = (_e = (_d = (_c = wecom.network) === null || _c === void 0 ? void 0 : _c.egressProxyUrl) !== null && _d !== void 0 ? _d : process.env.OPENCLAW_WECOM_EGRESS_PROXY_URL) !== null && _e !== void 0 ? _e : process.env.WECOM_EGRESS_PROXY_URL) !== null && _f !== void 0 ? _f : process.env.HTTPS_PROXY) !== null && _g !== void 0 ? _g : process.env.ALL_PROXY) !== null && _h !== void 0 ? _h : process.env.HTTP_PROXY) !== null && _j !== void 0 ? _j : "";
+    return proxyUrl.trim() || undefined;
+}
+exports.resolveWecomEgressProxyUrl = resolveWecomEgressProxyUrl;

package/dist/src/version.d.ts

@@ -0,0 +1,2 @@
+/** 插件版本号，运行时从 package.json 读取 */
+export declare const PLUGIN_VERSION: string;

package/dist/src/version.js

@@ -0,0 +1,28 @@
+"use strict";
+var _a;
+exports.__esModule = true;
+exports.PLUGIN_VERSION = void 0;
+var node_fs_1 = require("node:fs");
+var node_path_1 = require("node:path");
+var node_url_1 = require("node:url");
+/**
+ * 从当前文件位置向上逐级查找 package.json
+ * - ts 源码直接运行时（tsx/ts-node）：src/version.ts → 向上 1 级
+ * - tsc 编译后运行时：dist/src/version.js → 向上 2 级
+ */
+var findPackageJson = function () {
+    var dir = node_path_1.dirname(node_url_1.fileURLToPath(import.meta.url));
+    while (true) {
+        var candidate = node_path_1.resolve(dir, "package.json");
+        if (node_fs_1.existsSync(candidate))
+            return candidate;
+        var parent = node_path_1.dirname(dir);
+        if (parent === dir)
+            break; // 已到文件系统根目录
+        dir = parent;
+    }
+    throw new Error("找不到 package.json");
+};
+var pkg = JSON.parse(node_fs_1.readFileSync(findPackageJson(), "utf-8"));
+/** 插件版本号，运行时从 package.json 读取 */
+exports.PLUGIN_VERSION = (_a = pkg.version) !== null && _a !== void 0 ? _a : "";

package/dist/src/webhook/command-auth.d.ts

@@ -0,0 +1,47 @@
+/**
+ * 命令授权（Command Authorization）
+ *
+ * 从 lh 版 shared/command-auth.ts 迁移。
+ * 适配新版 WeComConfig（dmPolicy / allowFrom 扁平化在顶层）。
+ */
+import type { OpenClawConfig, PluginRuntime } from "ylib-openclaw/plugin-sdk";
+import type { WeComConfig } from "../utils.js";
+/** 命令授权结果 */
+export interface WecomCommandAuthResult {
+    /** 当前消息是否是需要鉴权的命令 */
+    shouldComputeAuth: boolean;
+    /** 账号配置的私信策略 */
+    dmPolicy: "pairing" | "allowlist" | "open" | "disabled";
+    /** 当前发送者是否在白名单中 */
+    senderAllowed: boolean;
+    /** 是否配置了授权器 */
+    authorizerConfigured: boolean;
+    /** 最终授权结果：true=放行，false=拒绝，undefined=不需要鉴权 */
+    commandAuthorized: boolean | undefined;
+    /** 生效的白名单列表 */
+    effectiveAllowFrom: string[];
+}
+/**
+ * 解析命令授权状态
+ *
+ * 适配新版 WeComConfig 的扁平化字段：
+ * - dmPolicy → accountConfig.dmPolicy
+ * - allowFrom → accountConfig.allowFrom
+ */
+export declare function resolveWecomCommandAuthorization(params: {
+    core: PluginRuntime;
+    cfg: OpenClawConfig;
+    accountConfig: WeComConfig;
+    rawBody: string;
+    senderUserId: string;
+}): Promise<WecomCommandAuthResult>;
+/**
+ * 构建未授权命令的中文提示文案
+ *
+ * @param scope - "bot"（智能机器人）或 "agent"（自建应用）
+ */
+export declare function buildWecomUnauthorizedCommandPrompt(params: {
+    senderUserId: string;
+    dmPolicy: "pairing" | "allowlist" | "open" | "disabled";
+    scope: "bot" | "agent";
+}): string;

package/dist/src/webhook/command-auth.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * 命令授权（Command Authorization）
+ *
+ * 从 lh 版 shared/command-auth.ts 迁移。
+ * 适配新版 WeComConfig（dmPolicy / allowFrom 扁平化在顶层）。
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (_) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+exports.__esModule = true;
+exports.buildWecomUnauthorizedCommandPrompt = exports.resolveWecomCommandAuthorization = void 0;
+// ============================================================================
+// 内部工具函数
+// ============================================================================
+/** 归一化白名单条目：去除空格、统一小写、去掉 wecom:/user:/userid: 前缀 */
+function normalizeWecomAllowFromEntry(raw) {
+    return raw
+        .trim()
+        .toLowerCase()
+        .replace(/^wecom:/, "")
+        .replace(/^user:/, "")
+        .replace(/^userid:/, "");
+}
+/** 判断发送者是否在白名单中 */
+function isWecomSenderAllowed(senderUserId, allowFrom) {
+    var list = allowFrom.map(function (entry) { return normalizeWecomAllowFromEntry(entry); }).filter(Boolean);
+    if (list.includes("*"))
+        return true;
+    var normalizedSender = normalizeWecomAllowFromEntry(senderUserId);
+    if (!normalizedSender)
+        return false;
+    return list.includes(normalizedSender);
+}
+/**
+ * 解析命令授权状态
+ *
+ * 适配新版 WeComConfig 的扁平化字段：
+ * - dmPolicy → accountConfig.dmPolicy
+ * - allowFrom → accountConfig.allowFrom
+ */
+function resolveWecomCommandAuthorization(params) {
+    var _a, _b, _c;
+    return __awaiter(this, void 0, void 0, function () {
+        var core, cfg, accountConfig, rawBody, senderUserId, dmPolicy, configAllowFrom, shouldComputeAuth, effectiveAllowFrom, senderAllowed, allowAllConfigured, authorizerConfigured, useAccessGroups, commandAuthorized;
+        return __generator(this, function (_d) {
+            core = params.core, cfg = params.cfg, accountConfig = params.accountConfig, rawBody = params.rawBody, senderUserId = params.senderUserId;
+            dmPolicy = ((_a = accountConfig.dmPolicy) !== null && _a !== void 0 ? _a : "pairing");
+            configAllowFrom = ((_b = accountConfig.allowFrom) !== null && _b !== void 0 ? _b : []).map(function (v) { return String(v); });
+            shouldComputeAuth = core.channel.commands.shouldComputeCommandAuthorized(rawBody, cfg);
+            effectiveAllowFrom = dmPolicy === "open" ? ["*"] : configAllowFrom;
+            senderAllowed = isWecomSenderAllowed(senderUserId, effectiveAllowFrom);
+            allowAllConfigured = effectiveAllowFrom.some(function (entry) { return normalizeWecomAllowFromEntry(entry) === "*"; });
+            authorizerConfigured = allowAllConfigured || effectiveAllowFrom.length > 0;
+            useAccessGroups = ((_c = cfg.commands) === null || _c === void 0 ? void 0 : _c.useAccessGroups) !== false;
+            commandAuthorized = shouldComputeAuth
+                ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
+                    useAccessGroups: useAccessGroups,
+                    authorizers: [{ configured: authorizerConfigured, allowed: senderAllowed }]
+                })
+                : undefined;
+            return [2 /*return*/, {
+                    shouldComputeAuth: shouldComputeAuth,
+                    dmPolicy: dmPolicy,
+                    senderAllowed: senderAllowed,
+                    authorizerConfigured: authorizerConfigured,
+                    commandAuthorized: commandAuthorized,
+                    effectiveAllowFrom: effectiveAllowFrom
+                }];
+        });
+    });
+}
+exports.resolveWecomCommandAuthorization = resolveWecomCommandAuthorization;
+// ============================================================================
+// 未授权提示文案构建
+// ============================================================================
+/**
+ * 构建未授权命令的中文提示文案
+ *
+ * @param scope - "bot"（智能机器人）或 "agent"（自建应用）
+ */
+function buildWecomUnauthorizedCommandPrompt(params) {
+    var user = params.senderUserId || "unknown";
+    var policy = params.dmPolicy;
+    var scopeLabel = params.scope === "bot" ? "Bot（智能机器人）" : "Agent（自建应用）";
+    var dmPrefix = params.scope === "bot" ? "channels.wecom.bot" : "channels.wecom.agent";
+    var allowCmd = function (value) { return "openclaw config set " + dmPrefix + ".allowFrom '" + value + "'"; };
+    var policyCmd = function (value) { return "openclaw config set " + dmPrefix + ".dmPolicy \"" + value + "\""; };
+    if (policy === "disabled") {
+        return [
+            "\u65E0\u6743\u9650\u6267\u884C\u547D\u4EE4\uFF08" + scopeLabel + " \u5DF2\u7981\u7528\uFF1AdmPolicy=disabled\uFF09",
+            "\u89E6\u53D1\u8005\uFF1A" + user,
+            "\u7BA1\u7406\u5458\uFF1A" + policyCmd("open") + "\uFF08\u5168\u653E\u5F00\uFF09\u6216 " + policyCmd("allowlist") + "\uFF08\u767D\u540D\u5355\uFF09",
+        ].join("\n");
+    }
+    return [
+        "\u65E0\u6743\u9650\u6267\u884C\u547D\u4EE4\uFF08\u5165\u53E3\uFF1A" + scopeLabel + "\uFF0Cuserid\uFF1A" + user + "\uFF09",
+        "\u7BA1\u7406\u5458\u5168\u653E\u5F00\uFF1A" + policyCmd("open"),
+        "\u7BA1\u7406\u5458\u653E\u884C\u8BE5\u7528\u6237\uFF1A" + policyCmd("allowlist"),
+        "\u7136\u540E\u8BBE\u7F6E\u767D\u540D\u5355\uFF1A" + allowCmd(JSON.stringify([user])),
+        "\u5982\u679C\u4ECD\u88AB\u62E6\u622A\uFF1A\u68C0\u67E5 commands.useAccessGroups/\u8BBF\u95EE\u7EC4",
+    ].join("\n");
+}
+exports.buildWecomUnauthorizedCommandPrompt = buildWecomUnauthorizedCommandPrompt;

package/dist/src/webhook/gateway.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Webhook Gateway 生命周期管理
+ *
+ * 从 @mocrane/wecom gateway-monitor.ts 部分迁移（仅 Webhook 部分）。
+ * 负责：初始化状态、注册 Target、启停管理。
+ *
+ * 关键设计：
+ * - MonitorState 是全局单例（monitorState），所有账号共享同一个 StreamStore 和 ActiveReplyStore
+ * - Target 注册/注销不影响 monitorState 生命周期，只控制 pruneTimer 的启停
+ * - 每个账号注册多条路径（兼容历史路径 + 推荐路径 + 多账号路径）
+ * - 按 accountId 管理各自的 unregister，stop 时只注销该账号的 Target
+ */
+import type { WebhookGatewayContext } from "./types.js";
+import { WebhookMonitorState } from "./state.js";
+/**
+ * 获取当前的 MonitorState 实例（全局单例）
+ *
+ * 供 monitor.ts 等内部模块调用以访问 StreamStore 和 ActiveReplyStore。
+ */
+export declare function getMonitorState(): WebhookMonitorState;
+/**
+ * 启动 Webhook Gateway
+ *
+ * 1. 验证 Webhook 配置
+ * 2. 确保 pruneTimer 启动
+ * 3. 设置 FlushHandler（仅首次）
+ * 4. 解析并注册多条 Webhook 路径
+ */
+export declare function startWebhookGateway(ctx: WebhookGatewayContext): void;
+/**
+ * 停止 Webhook Gateway
+ *
+ * 1. 注销该账号的 Target（不影响其他账号）
+ * 2. 如果没有任何活跃 Target，停止清理定时器
+ */
+export declare function stopWebhookGateway(ctx: WebhookGatewayContext): void;