Merge branch 'feat/changelog' into 'main' (merge request !16)

feat: update 1.6.6 changelog

CHANGELOG.md

@@ -8,33 +8,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Added
 
-- **Group message support**: Receive, process, and reply to messages in QQ groups with access control and per-group configuration.
-- **Group history context**: Cache non-@messages per group and inject as conversational context when the bot is @mentioned, with configurable history limit.
-- **Group message gating**: Unified three-layer gate logic for @mention filtering and message blocking.
-- **Group message merging**: Merge queued group messages into a single request with sender prefixes and deduplicated mentions.
-- **@mention detection**: Adapters supporting mentions list, event type, and regex patterns.
-- **Interaction event handling**: API for button interaction events (config query, config update).
-- **Per-group config resolution**: Group-specific → wildcard → default fallback chain for all group settings.
-- **Agent-aware mention patterns**: Per-agent @-detection keywords with priority resolution.
-- **Streaming messages (C2C)**: New `StreamingController` delivers AI responses as real-time typing-effect chunks in private chat. Includes throttle control (default 500ms, min 300ms), automatic media-tag pause/resume, long-gap batch window, state-machine lifecycle (`idle → streaming → completed/aborted`), and graceful fallback to static mode when the streaming API is unavailable.
-- **Stream message API `sendC2CStreamMessage`**: Low-level wrapper for QQ Open Platform `/v2/users/{openid}/stream_messages` endpoint, with `replace` input mode, incremental `msg_seq`/`index`, and `GENERATING`/`DONE` state signaling.
-- **`ApiError` structured error class**: API request errors now carry `status` (HTTP code) and `path`, enabling callers (e.g. streaming controller) to branch on status for retry vs. fallback decisions.
-- **Media send queue module `media-send.ts`**: Extracted media-tag parsing, path-encoding fix, and send-queue execution into a shared utility used by both `outbound.ts` (static mode) and `streaming.ts` (streaming mode), eliminating ~100 lines of duplication.
-- **Streaming configuration**: New `streaming` (boolean, default `false`) option in account config for per-account streaming control. Set `streaming: true` to enable.
-- **Unit tests**: Added `strip-incomplete-media-tag.test.ts` and `streaming-controller.test.ts`.
+- **Large file chunked upload**: New `chunked-upload.ts` module that automatically splits large files into parallel uploads with per-part retry, progress callback, and timeout control. Supports both C2C and group scenarios.
+- **`/bot-clear-storage` command**: New storage cleanup command for clearing plugin local cache data.
+- **SSRF guard module `ssrf-guard.ts`**: Standalone SSRF protection utility that performs DNS resolution and IP validation before downloading remote files, blocking internal/reserved network addresses to prevent malicious URLs from reaching internal services.
 
 ### Changed
 
-- **Message queue**: Refactored from user-only to peer-based keys with separate queue size limits for group and private chat.
-- **Group message sending**: Added message reference support and outbound hooks.
-- **Upgrade script**: Adapted for deferred config restore (openclaw 3.23+ compatibility).
-- **Outbound media handling refactored**: `sendText` in `outbound.ts` now delegates media-tag parsing and queue execution to the shared `media-send.ts` module instead of inline regex + switch logic.
-- **Audio convert log level**: Downgraded `console.log` → `console.debug` for SILK detection, ffmpeg conversion, and WASM fallback logs in `audio-convert.ts`, reducing noise in production.
-- **Gateway streaming integration**: `gateway.ts` creates a `StreamingController` per inbound message when streaming is enabled; registers `onPartialReply` callback to feed incremental text into the controller; finalizes or aborts the stream after dispatch completes.
-
-### Removed
-
-- **`user-messages.ts`**: Deleted the already-emptied module (design: plugin layer does not generate user-facing error text).
+- **Download directory isolated by account/conversation**: Attachment download path changed from a shared `~/.openclaw/media/qqbot/downloads/` to `downloads/{appId}/{peerId}/`, isolating files by account and conversation to prevent multi-account file overwrites.
+- **Attachment download failure messages improved**: Download failures now distinguish "timeout" vs. "failure", providing clearer context hints to the model.
 
 ## [1.6.5] - 2026-03-24
 

CHANGELOG.zh.md

@@ -8,33 +8,14 @@
 
 ### 新增
 
-- **群消息支持**：接收、处理和回复 QQ 群消息，支持群消息策略和按群独立配置。
-- **群历史消息上下文**：缓存非@消息，被@时注入为对话上下文，支持按群配置历史消息上限。
-- **群消息门控**：统一三层门控逻辑，处理 @提及过滤和消息拦截。
-- **群消息合并**：agent 忙碌时自动合并排队消息，附带发送者前缀和去重提及。
-- **@提及检测**：支持 mentions 列表、事件类型和正则模式匹配。
-- **按钮交互事件**：处理按钮交互事件（配置查询、配置更新）。
-- **按群配置解析**：具体群 → 通配符 → 默认值的三级回退链。
-- **Agent 级别提及模式**：支持按 agent 配置不同的 @检测关键词。
-- **流式消息（C2C 私聊）**：新增 `StreamingController` 流式控制器，AI 回复以打字机效果实时逐步推送到 QQ 私聊。支持节流控制（默认 500ms，最小 300ms）、媒体标签自动暂停/恢复流式会话、长间隔批处理窗口、状态机生命周期管理（`idle → streaming → completed/aborted`），流式 API 不可用时自动降级为静态消息模式。
-- **流式消息 API `sendC2CStreamMessage`**：封装 QQ 开放平台 `/v2/users/{openid}/stream_messages` 接口，支持 `replace` 输入模式、递增 `msg_seq`/`index` 序号、`GENERATING`/`DONE` 状态信令。
-- **`ApiError` 结构化错误类**：API 请求错误现在携带 `status`（HTTP 状态码）和 `path`，使调用方（如流式控制器）可根据状态码决定重试或降级策略。
-- **媒体发送队列模块 `media-send.ts`**：将媒体标签解析、路径编码修复、发送队列执行器抽取为公共工具模块，供 `outbound.ts`（静态模式）和 `streaming.ts`（流式模式）共用，消除约 100 行重复代码。
-- **流式消息配置项**：账户配置新增 `streaming`（布尔值，默认 `false`）选项，设置为 `true` 可开启流式消息。
-- **单元测试**：新增 `strip-incomplete-media-tag.test.ts` 和 `streaming-controller.test.ts`。
+- **大文件分片上传**：新增 `chunked-upload.ts` 模块，支持对大文件自动分片并行上传，包含分片级重试、进度回调和超时控制。同时支持 C2C 和群聊场景。
+- **`/bot-clear-storage` 指令**：新增存储清理指令，可清理插件本地缓存数据。
+- **文件下载 SSRF 防护**：新增 `ssrf-guard.ts` 模块，下载远程文件前对 URL 做 DNS 解析并校验 IP，拒绝内网/保留网段地址，防止模型输出的恶意链接触达内网服务。
 
 ### 变更
 
-- **消息队列**：从用户维度改为对端维度，群聊和私聊独立队列上限。
-- **群消息发送**：新增消息引用支持和出站钩子。
-- **升级脚本**：延迟恢复通道配置以兼容 openclaw 3.23+。
-- **出站媒体处理重构**：`outbound.ts` 中 `sendText` 的媒体标签解析和发送队列逻辑重构为调用公共 `media-send.ts` 模块，替代原有的内联正则 + switch 分支。
-- **音频转换日志降级**：`audio-convert.ts` 中 SILK 检测、ffmpeg 转换、WASM 降级等日志从 `console.log` 降为 `console.debug`，减少生产环境日志噪音。
-- **Gateway 流式集成**：`gateway.ts` 在流式启用时为每条入站消息创建 `StreamingController`；注册 `onPartialReply` 回调将增量文本馈入控制器；dispatch 完成后终结或中止流式会话。
-
-### 移除
-
-- **`user-messages.ts`**：删除已清空的模块（设计原则：插件层不生成面向用户的错误提示）。
+- **下载目录按账户/对话隔离**：附件下载路径从统一的 `~/.openclaw/media/qqbot/downloads/` 改为 `downloads/{appId}/{peerId}/`，按账户和对话隔离，避免多账户文件互相覆盖。
+- **附件下载失败提示优化**：下载失败时区分"超时"和"失败"，给模型更明确的上下文提示。
 
 ## [1.6.5] - 2026-03-24
 

README.md

@@ -46,6 +46,7 @@ Scan to join the QQ group chat
 | 📝 **Markdown** | Full Markdown formatting support |
 | 🛠️ **Commands** | Native OpenClaw command integration |
 | 💬 **Quoted Context** | Resolve QQ `REFIDX_*` quoted messages and inject quote body into AI context |
+| 📦 **Large File Support** | Auto chunked upload for large files (parallel upload with retry), up to 100 MB |
 
 ---
 
@@ -211,6 +212,10 @@ All commands support a `?` suffix to show usage:
 >
 > **QQBot**: 📖 /bot-upgrade usage: …
 
+#### `/bot-clear-storage` — Clear files generated through QQBot conversations and downloaded resources (stored on the host running OpenClaw)
+
+`/bot-clear-storage` lists files generated by the conversation and files in the downloaded resources directory. Use `/bot-clear-storage --force` to confirm deletion.
+
 ---
 
 ## 🚀 Getting Started

README.zh.md

@@ -41,6 +41,7 @@
 | 📝 **Markdown** | 完整支持 Markdown 格式消息 |
 | 🛠️ **原生命令** | 支持 OpenClaw 原生命令 |
 | 💬 **引用上下文** | 解析 QQ `REFIDX_*` 引用消息，并将引用内容注入 AI 上下文 |
+| 📦 **大文件支持** | 大文件自动分片并行上传，最大支持 100 MB |
 
 ---
 
@@ -206,6 +207,10 @@ AI 可直接发送视频，支持本地文件和公网 URL。
 >
 > **QQBot**：📖 /bot-upgrade 用法：…
 
+#### `/bot-clear-storage` — 清理通过 QQBot 对话产生的文件以及下载的资源（保存在 OpenClaw 运行环境的主机上）
+
+`/bot-clear-storage` 列出对话产生的文件以及下载的资源目录里的文件，使用`/bot-clear-storage -- force`确定删除。
+
 ---
 
 ## 🚀 快速开始