fix: support channel-message API and normalize context-token peer IDs

[starship863]

修复内容

1. OpenClaw SDK 入口兼容：createTypingCallbacks 改从 openclaw/plugin-sdk/channel-message 导入，兼容仍提供旧入口的最低宿主，以及已经移除 channel-runtime 的新版宿主。
2. context token 用户 ID 大小写规范化：账号级 context-token 内存键和持久化键统一对用户 ID 做小写规范化，覆盖 mixed-case 入站 ID、lowercase 会话目标、重启恢复及旧格式持久化文件（refs WeChat Context Token: User ID Case-Sensitivity Causes ret=-3 After Gateway Restart Tencent/openclaw-weixin#243）。

兼容性覆盖

• 单元测试 mock 与生产 import 使用同一 channel-message 子路径，并断言 typing callbacks 实际传入 dispatcher。
• CI 对最低支持 SDK、lockfile SDK 和通过 npm tag 选择的 modern API profile 运行同一无 mock 边界检查。
• 每个 compatibility profile 都使用实际安装的 SDK 构建并导入 process-message；modern profile 还验证旧 channel-runtime 已不可用，避免测试落回旧 API。
• fresh Node 进程调用 createTypingCallbacks、导入完整插件并验证 openclaw-weixin 注册结果。

调整

• 保留 3.0.2，不修改 package、lockfile 或插件版本；中英文说明放入 Unreleased。
• 移除缺乏可靠依据的 ret=-2 prepare failed 特判，避免对服务端 bot 状态问题给出误导性恢复建议。
• context-token 日志不再输出原始账号/用户复合 key。

验证

• npm run test:unit -- src/messaging/process-message.test.ts src/messaging/context-token-store.test.ts src/api/api.test.ts
• npm run typecheck / npm run typecheck:tests / npm run test:coverage / npm run build
• minimum、lockfile、modern 三类 SDK compatibility smoke
• npm run pack:check
• npm test --prefix docs/site / npm run build --prefix docs/site

[Copilot]

Pull request overview

Improves OpenClaw beta compatibility, context-token lookup reliability, and outbound failure diagnostics.

Changes:

• Moves typing callbacks to the supported SDK entry point.
• Normalizes context-token user IDs.
• Adds diagnostics and bumps the release to 3.0.3.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/messaging/process-message.ts	Updates the SDK import.
src/messaging/inbound.ts	Normalizes token lookup keys.
src/api/api.ts	Expands failure diagnostics.
src/api/api.test.ts	Tests the diagnostic hint.
package.json	Bumps package version.
package-lock.json	Synchronizes package version.
openclaw.plugin.json	Synchronizes plugin version.
CHANGELOG.md	Documents the release in Chinese.
CHANGELOG_EN.md	Documents the release in English.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ericcaiwx-star]

生产侧复核（OpenClaw 2026.7.2-beta.6 · 多账号个微）

我们当前生产仍钉 @tencent-weixin/openclaw-weixin@2.4.6，并用本地 sed 把 plugin-sdk/channel-runtime → channel-message（否则 beta 宿主上通道起不来、restart-loop）。所以对本 PR 的第 1 点修复方向 强烈同意——这正是官方包在 7.2-beta 上的阻断问题。

本地拉了 head 29f0ad9 跑了 npm test：

• 570 passed / 1 failed：失败在 inbound-dedupe.test.ts → persists committed claims across restart（期望 duplicate，得到 claimed）。看起来更像 fix(messaging): persist getUpdates replay claims on both admission lanes #41 去重持久化路径的环境/时序问题，不是本 PR 三处改动的直接回归；但作者描述的「571/571」与当前 head 不完全一致，合并前建议再跑一遍确认。
• CI 矩阵目前是 2026.6.1 / 2026.7.1，没有 2026.7.2-beta.x。本机装到的 openclaw@2026.7.1 上 channel-runtime 仍能 import，所以单靠 7.1 CI 证明不了「beta 崩溃循环已修」。同意维护者 @NewFuture 的要求：加兼容性矩阵 / 导入冒烟（最低支持 SDK + 新 SDK），仅改 vi.mock 不够。

逐项意见

改动	看法
createTypingCallbacks → channel-message	✅ 必要；与我们生产热补丁同路径。请同步改 process-message.test.ts 的 mock（仍 mock channel-runtime，测不到这条边界）。
contextTokenKey 统一 userId.toLowerCase()	✅ 高价值。多账号个微也见过出站 ret=-2/-3 / token 对不上。请补 mixed-case 写入 / lowercase 读出（含重启恢复） 回归（Copilot 已点）。
ret=-2 prepare failed 文案	⚠️ 方向同意，但「对方再发一条就能好」对 服务端 bot 状态异常 / getUpdates 空（#244 一类）会误导。建议拆成：有 token 仍 -2 → 偏服务端；无/疑似过期 token → 再提示 inbound 刷新。
版本撞到 3.0.3	同意维护者：别在功能 PR 里改 version，交给自动 release。

我们愿意做的实测（维护窗）

若本 PR 按上面补齐测试且不带版本号 bump，我们计划在旁路/金丝雀上：

1. openclaw plugins install npm:openclaw-weixin --force（或装本分支 pack）到 2026.7.2-beta.6 宿主
2. 确认 无需 再跑 channel-runtime sed 补丁
3. 多账号：入站 → 出站、gateway 重启后出站（验证 token 大小写）、长工具回合不丢轮询

结论：该合，但建议先按 CHANGES_REQUESTED 补测试矩阵 + changelog/版本约定，再合。 修复点本身是社区 fork 相对官方停更包的关键差异。

[ericcaiwx-star]

Collaborator follow-up (no merge from me)

Head is still 29f0ad9; none of the previously requested changes have landed yet. From a production-operator + collaborator view, I’d keep this blocked until the following are addressed (overlap with @NewFuture / Copilot / my earlier thread comment):

Still blocking

1. Drop the 3.0.3 version bump (package.json / lockfile / openclaw.plugin.json / dated changelog section). Put the notes under 未发布 / Unreleased and let the maintainer release flow own the version.
2. Real host-compat evidence for channel-message, not only a mock swap — matrix / import smoke on min host (2026.6.1) and a 2026.7.2-beta.x (or newest SDK that dropped channel-runtime). Our deploy still sed-patches official 2.4.6 for exactly this crash loop; CI today cannot prove the beta path.
3. Regression for mixed-case OpenID → lowercase lookup (store + restart restore) in context-token-store tests — this is the #243 class failure.
4. Soften the ret=-2 prepare failed hint so it does not claim “fresh inbound always fixes it” when #244-style empty getUpdates / server bot state is in play.

Non-blocking / process

• Changelog section order: keep 未发布 / Unreleased first.
• Update process-message.test.ts mock path when the import moves (still useful, but insufficient alone).

Happy to re-check and help canary on 2026.7.2-beta.6 multi-account once the above is pushed. Merge decision stays with @NewFuture.

[NewFuture]

已基于最新 main 完成重写：保留自动 release 版本管理，补齐 mixed-case/restart/legacy persistence 回归，并用最低、lockfile 与 modern API profile 的真实 SDK 完成 channel-message 构建和无 mock import/registration smoke。全部 CI 与 review threads 已处理。

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/messaging/context-token-store.test.ts:115

• This assertion does not exercise the new path redaction: a JSON parse error contains neither the account ID nor the state-file path, so the test still passes if formatContextTokenStoreError is removed. Add a filesystem failure whose message embeds filePath, then assert that the warning contains <state-file> and omits both the raw path and account ID.

    expect(mocks.logger.warn.mock.calls.flat().join(" ")).not.toContain("account-invalid");

.github/workflows/ci.yml:138

• The modern profile builds dist/index.js before installing openclaw@beta, so the later registration smoke imports output compiled against the lockfile SDK. Only the isolated process-message graph is compiled after the modern SDK is installed; this does not verify that the full plugin typechecks and builds against the host it claims to support. Install the compatibility SDK first, then run the full typecheck/build for this profile too.

      - name: Build lockfile runtime for modern API smoke
        if: matrix.compatibility_profile == 'channel-message-only'
        run: npm run build