feat: QQ bridge channel + SDK crash resilience fixes

QQ Bridge Adapter (new):
- qq-api.ts: AppAccessToken, WebSocket Gateway, heartbeat, passive reply,
  msg_seq auto-increment — pure QQ protocol layer
- qq-adapter.ts: BaseChannelAdapter impl with WebSocket lifecycle,
  C2C_MESSAGE_CREATE handling, image download (base64), dedup, reconnect
- Settings UI (QqBridgeSection.tsx) + API routes (/api/settings/qq)
- i18n keys for en/zh, PLATFORM_LIMITS qq: 2000

replyToMessageId threading:
- bridge-manager.ts: thread msg.messageId through all deliver/command/
  permission paths — required for QQ passive reply (msg_id mandatory)
- permission-broker.ts: accept and forward replyToMessageId

SDK crash resilience (bug fix):
- bridge-manager.ts: check hasError BEFORE saving sdkSessionId — the SDK
  may emit a session_id before crashing, and saving that broken ID caused
  ALL subsequent messages to fail by repeatedly resuming a corrupted session
- claude-client.ts: always clear sdk_session_id on crash, even for fresh
  sessions (SDK can persist a new ID via status event before dying)
- conversation-engine.ts: attach filePath to file objects after disk write
  so streamClaude() reuses on-disk copies (prevents duplicate writes,
  matches desktop route behavior)

QQ permission handling (P1 fix):
- permission-broker.ts: for channels without inline button support (QQ),
  render text-based /perm allow|deny|allow_session commands instead of
  invisible inlineButtons that would deadlock the stream

QQ passive reply budget (P2 fix):
- bridge-manager.ts: QQ-specific delivery limits chunks to 3 max,
  truncates with notice to avoid exhausting passive reply quota
- delivery-layer.ts: export chunkText for reuse

Error message improvement:
- claude-client.ts: when exit code 1 with image files, hint "Provider may
  not support image/vision input" instead of generic auth/network message

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 7418

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "codepilot",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "private": true,
   "author": {
     "name": "op7418",
@@ -73,6 +73,7 @@
     "tailwind-merge": "^3.4.0",
     "use-stick-to-bottom": "^1.1.2",
     "uuid": "^13.0.0",
+    "ws": "^8.19.0",
     "zlib-sync": "^0.1.10"
   },
   "devDependencies": {
@@ -85,6 +86,7 @@
     "@types/react-dom": "^19",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/uuid": "^10.0.0",
+    "@types/ws": "^8.18.1",
     "concurrently": "^9.2.1",
     "electron": "^40.2.1",
     "electron-builder": "^26.7.0",

package.json

@@ -35,6 +35,12 @@ const BRIDGE_SETTING_KEYS = [
   'bridge_discord_stream_max_chars',
   'bridge_discord_max_attachment_size',
   'bridge_discord_image_enabled',
+  'bridge_qq_enabled',
+  'bridge_qq_app_id',
+  'bridge_qq_app_secret',
+  'bridge_qq_allowed_users',
+  'bridge_qq_image_enabled',
+  'bridge_qq_max_image_size',
 ] as const;
 
 export async function GET() {

src/app/api/bridge/settings/route.ts

@@ -0,0 +1,66 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getSetting, setSetting } from '@/lib/db';
+
+/**
+ * QQ Bot bridge settings.
+ * Stored in the SQLite settings table (same as other app settings).
+ */
+
+const QQ_KEYS = [
+  'bridge_qq_enabled',
+  'bridge_qq_app_id',
+  'bridge_qq_app_secret',
+  'bridge_qq_allowed_users',
+  'bridge_qq_image_enabled',
+  'bridge_qq_max_image_size',
+] as const;
+
+export async function GET() {
+  try {
+    const result: Record<string, string> = {};
+    for (const key of QQ_KEYS) {
+      const value = getSetting(key);
+      if (value !== undefined) {
+        // Mask app secret for security
+        if (key === 'bridge_qq_app_secret' && value.length > 8) {
+          result[key] = '***' + value.slice(-8);
+        } else {
+          result[key] = value;
+        }
+      }
+    }
+
+    return NextResponse.json({ settings: result });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Failed to read QQ settings';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const { settings } = body;
+
+    if (!settings || typeof settings !== 'object') {
+      return NextResponse.json({ error: 'Invalid settings data' }, { status: 400 });
+    }
+
+    for (const [key, value] of Object.entries(settings)) {
+      if (!QQ_KEYS.includes(key as typeof QQ_KEYS[number])) continue;
+      const strValue = String(value ?? '').trim();
+
+      // Don't overwrite secret if user sent the masked version back
+      if (key === 'bridge_qq_app_secret' && strValue.startsWith('***')) {
+        continue;
+      }
+
+      setSetting(key, strValue);
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Failed to save QQ settings';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

src/app/api/settings/qq/route.ts

@@ -0,0 +1,72 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { getSetting } from '@/lib/db';
+
+/**
+ * POST /api/settings/qq/verify
+ *
+ * Verifies QQ Bot credentials by:
+ * 1. Getting an access token via appId + appSecret
+ * 2. Fetching the WebSocket gateway URL
+ *
+ * If both succeed, credentials are valid.
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    let { app_id, app_secret } = body;
+
+    // Fall back to stored values if not provided or masked
+    if (!app_id) {
+      app_id = getSetting('bridge_qq_app_id') || '';
+    }
+    if (!app_secret || app_secret.startsWith('***')) {
+      app_secret = getSetting('bridge_qq_app_secret') || '';
+    }
+
+    if (!app_id || !app_secret) {
+      return NextResponse.json(
+        { verified: false, error: 'App ID and App Secret are required' },
+        { status: 400 },
+      );
+    }
+
+    // Step 1: Get access token
+    const tokenRes = await fetch('https://bots.qq.com/app/getAppAccessToken', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ appId: app_id, clientSecret: app_secret }),
+      signal: AbortSignal.timeout(10_000),
+    });
+
+    const tokenData = await tokenRes.json();
+    if (!tokenData.access_token) {
+      return NextResponse.json({
+        verified: false,
+        error: tokenData.message || 'Failed to get access token',
+      });
+    }
+
+    // Step 2: Verify gateway is reachable
+    const gatewayRes = await fetch('https://api.sgroup.qq.com/gateway', {
+      method: 'GET',
+      headers: { Authorization: `QQBot ${tokenData.access_token}` },
+      signal: AbortSignal.timeout(10_000),
+    });
+
+    const gatewayData = await gatewayRes.json();
+    if (!gatewayData.url) {
+      return NextResponse.json({
+        verified: false,
+        error: 'Failed to get gateway URL',
+      });
+    }
+
+    return NextResponse.json({
+      verified: true,
+      gatewayUrl: gatewayData.url,
+    });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Verification failed';
+    return NextResponse.json({ verified: false, error: message }, { status: 500 });
+  }
+}

src/app/api/settings/qq/verify/route.ts

@@ -3,16 +3,17 @@
 import { useState, useCallback, useSyncExternalStore } from "react";
 import { HugeiconsIcon } from "@hugeicons/react";
 import type { IconSvgElement } from "@hugeicons/react";
-import { Wifi01Icon, TelegramIcon, BubbleChatIcon, GameController01Icon } from "@hugeicons/core-free-icons";
+import { Wifi01Icon, TelegramIcon, BubbleChatIcon, GameController01Icon, MessageMultiple02Icon } from "@hugeicons/core-free-icons";
 import { cn } from "@/lib/utils";
 import { BridgeSection } from "./BridgeSection";
 import { TelegramBridgeSection } from "./TelegramBridgeSection";
 import { FeishuBridgeSection } from "./FeishuBridgeSection";
 import { DiscordBridgeSection } from "./DiscordBridgeSection";
+import { QqBridgeSection } from "./QqBridgeSection";
 import { useTranslation } from "@/hooks/useTranslation";
 import type { TranslationKey } from "@/i18n";
 
-type Section = "bridge" | "telegram" | "feishu" | "discord";
+type Section = "bridge" | "telegram" | "feishu" | "discord" | "qq";
 
 interface SidebarItem {
   id: Section;
@@ -25,6 +26,7 @@ const sidebarItems: SidebarItem[] = [
   { id: "telegram", label: "Telegram", icon: TelegramIcon },
   { id: "feishu", label: "Feishu", icon: BubbleChatIcon },
   { id: "discord", label: "Discord", icon: GameController01Icon },
+  { id: "qq", label: "QQ", icon: MessageMultiple02Icon },
 ];
 
 function getSectionFromHash(): Section {
@@ -53,6 +55,7 @@ export function BridgeLayout() {
     'Telegram': 'bridge.telegramSettings',
     'Feishu': 'bridge.feishuSettings',
     'Discord': 'bridge.discordSettings',
+    'QQ': 'bridge.qqSettings',
   };
 
   const handleSectionChange = useCallback((section: Section) => {
@@ -94,6 +97,7 @@ export function BridgeLayout() {
           {activeSection === "telegram" && <TelegramBridgeSection />}
           {activeSection === "feishu" && <FeishuBridgeSection />}
           {activeSection === "discord" && <DiscordBridgeSection />}
+          {activeSection === "qq" && <QqBridgeSection />}
         </div>
       </div>
     </div>

src/components/bridge/BridgeLayout.tsx

@@ -14,7 +14,7 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { HugeiconsIcon } from "@hugeicons/react";
-import { Loading02Icon, CheckmarkCircle02Icon, Alert02Icon, TelegramIcon, BubbleChatIcon, GameController01Icon } from "@hugeicons/core-free-icons";
+import { Loading02Icon, CheckmarkCircle02Icon, Alert02Icon, TelegramIcon, BubbleChatIcon, GameController01Icon, MessageMultiple02Icon } from "@hugeicons/core-free-icons";
 import { useTranslation } from "@/hooks/useTranslation";
 import type { ProviderModelGroup } from "@/types";
 
@@ -37,6 +37,7 @@ interface BridgeSettings {
   bridge_telegram_enabled: string;
   bridge_feishu_enabled: string;
   bridge_discord_enabled: string;
+  bridge_qq_enabled: string;
   bridge_auto_start: string;
   bridge_default_work_dir: string;
   bridge_default_model: string;
@@ -48,6 +49,7 @@ const DEFAULT_SETTINGS: BridgeSettings = {
   bridge_telegram_enabled: "",
   bridge_feishu_enabled: "",
   bridge_discord_enabled: "",
+  bridge_qq_enabled: "",
   bridge_auto_start: "",
   bridge_default_work_dir: "",
   bridge_default_model: "",
@@ -169,6 +171,10 @@ export function BridgeSection() {
     saveSettings({ bridge_discord_enabled: checked ? "true" : "" });
   };
 
+  const handleToggleQQ = (checked: boolean) => {
+    saveSettings({ bridge_qq_enabled: checked ? "true" : "" });
+  };
+
   const handleSaveDefaults = () => {
     // Split composite "provider_id::model" value
     const parts = model.split("::");
@@ -240,6 +246,7 @@ export function BridgeSection() {
   const isTelegramEnabled = settings.bridge_telegram_enabled === "true";
   const isFeishuEnabled = settings.bridge_feishu_enabled === "true";
   const isDiscordEnabled = settings.bridge_discord_enabled === "true";
+  const isQQEnabled = settings.bridge_qq_enabled === "true";
   const isAutoStart = settings.bridge_auto_start === "true";
   const isRunning = bridgeStatus?.running ?? false;
   const adapterCount = bridgeStatus?.adapters?.length ?? 0;
@@ -409,6 +416,26 @@ export function BridgeSection() {
               />
             </div>
 
+            <div className="flex items-center justify-between border-t border-border/30 pt-3">
+              <div className="flex items-center gap-3">
+                <HugeiconsIcon
+                  icon={MessageMultiple02Icon}
+                  className="h-4 w-4 text-muted-foreground"
+                />
+                <div>
+                  <p className="text-sm">{t("bridge.qqChannel")}</p>
+                  <p className="text-xs text-muted-foreground">
+                    {t("bridge.qqChannelDesc")}
+                  </p>
+                </div>
+              </div>
+              <Switch
+                checked={isQQEnabled}
+                onCheckedChange={handleToggleQQ}
+                disabled={saving}
+              />
+            </div>
+
             <div className="flex items-center justify-between border-t border-border/30 pt-3">
               <div>
                 <p className="text-sm">{t("bridge.autoStart")}</p>