fix(qqofficial): bound outbound HTTP concurrency

[whatevertogo]

QQ Official outbound requests could amplify plugin-triggered traffic because qq-botpy disabled connection reuse, retried connection resets internally, and allowed a closed HTTP session to be recreated by pending retry tasks. Large failed image payloads could also be copied into logs.

This change gives the WebSocket and webhook adapters one managed outbound lifecycle with bounded concurrency, one retry owner, reusable connections, and fail-closed shutdown behavior.

Modifications / 改动点

• Add QQOfficialHttp, a shared transport for both QQ Official adapter modes:
  • reuse a 32-connection keep-alive pool with a per-host limit of 16;
  • run at most 16 active attempts and bound active plus queued work to 64 requests;
  • reject queue waits after 5 seconds instead of accumulating unbounded tasks;
  • cancel owned active/queued requests during shutdown and prevent session recreation;
  • execute one transport attempt so qq-botpy retry recursion cannot multiply AstrBot retries.
• Consolidate QQ send retries into one jittered three-attempt logical budget shared by passive/proactive and markdown fallbacks.
• Reduce upload retries from five to three and route chunked COS uploads through the same request slots.
• Remove message-chain and Base64 payload contents from send failure logs; retain component type, count, and encoded size only.
• Document that plugins should reuse bounded async network clients, close them in terminate(), and avoid stacked retry layers.
• Add regression coverage for connection reuse, error mapping, queue overload, shutdown cancellation, token-refresh shutdown races, adapter integration, retry budgets, chunked upload slots, and Base64 log redaction.

flowchart LR
    P[Plugin-triggered reply] --> B[Bounded request queue]
    B --> R[Three-attempt retry budget]
    R --> K[Reusable keep-alive pool]
    K --> Q[QQ API]
    S[Adapter shutdown] --> C[Cancel owned requests]
    C --> X[Close pool permanently]

Loading

Changed files: 11 total (2 added, 9 modified, 0 deleted).

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

Verification steps:

uv run ruff format .
uv run ruff check .
uv run pytest -q tests/test_qqofficial_http.py \
  tests/test_qqofficial_group_message_create.py \
  tests/test_qqofficial_stream_buffer_copy.py \
  tests/test_qqofficial_chunked_upload.py \
  tests/test_qqofficial_webhook_signature.py \
  tests/test_rate_limit_stage.py
uv run pytest -q

Results:

• Ruff formatting: 502 files unchanged.
• Ruff check: passed.
• QQ Official and rate-limit regression suite: 41 passed.
• Full test suite: 2236 passed, 27 existing warnings.

---

Checklist / 检查清单

• 😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
  / 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。

• 👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
  / 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。

• 🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
  / 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到 requirements.txt 和 pyproject.toml 文件相应位置。

• 😮 My changes do not introduce malicious code.
  / 我的更改没有引入恶意代码。

Summary by Sourcery

Bound QQ Official outbound traffic with a shared reusable transport, coordinated retries, fail-closed shutdown, and safer error logging.

New Features:

• Add a managed QQ Official HTTP transport shared by WebSocket and webhook adapters with reusable connections and bounded outbound concurrency.
• Apply a single three-attempt retry budget across QQ message sends, semantic fallbacks, and chunked upload requests.

Bug Fixes:

• Prevent outbound request amplification, session recreation during shutdown, and retry-task races after the HTTP transport closes.
• Redact message-chain and Base64 image contents from send and upload failure logs.

Enhancements:

• Route chunked uploads through the shared request capacity controls and improve shutdown behavior by cancelling owned work and permanently closing the transport.

Documentation:

• Document bounded, reusable async network clients, explicit resource limits, lifecycle cleanup, and avoiding stacked retry policies for plugins.

Tests:

• Add regression coverage for transport reuse, overload handling, shutdown races, retry budgets, adapter integration, upload slot usage, and payload redaction.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/platform/sources/qqofficial/qqofficial_message_event.py" line_range="529" />
<code_context>
+                    "QQ send retry budget is exhausted"
+                )
+
+            @_qqofficial_retry(
+                max_attempts=attempts_remaining,
+                retry_errors=_QQOFFICIAL_NETWORK_ERRORS,
+            )
+            async def send_attempt():
+                nonlocal attempts_remaining
</code_context>
<issue_to_address>
**issue (broader_impact):** The logical send retry wrapper retries only `_QQOFFICIAL_NETWORK_ERRORS`, so `botpy.errors.ServerError` and `SequenceNumberError` are no longer retried even though both are classified as retryable send API errors and were handled by the previous `_qqofficial_retry` policy. A transient QQ 5xx or sequence error therefore consumes one budget attempt and immediately falls through to semantic fallback or failure.

**Triggers:** When QQ returns a transient ServerError or SequenceNumberError for a send.

**Suggested fix:** Include the retryable API errors in `retry_errors`, while preserving the shared remaining-attempt budget.

```suggestion
                retry_errors=(*_QQOFFICIAL_NETWORK_ERRORS, botpy.errors.ServerError, botpy.errors.SequenceNumberError),
```
</issue_to_address>

### Comment 2
<location path="astrbot/core/platform/sources/qqofficial/qqofficial_platform_adapter.py" line_range="186-190" />
<code_context>
 class botClient(Client):
     def __init__(self, *args: Any, **kwargs: Any) -> None:
         super().__init__(*args, **kwargs)
+        self.http = QQOfficialHttp(
+            timeout=self.http.timeout,
+            is_sandbox=self.http.is_sandbox,
+        )
+        self.api = BotAPI(http=self.http)
         self._shutting_down = False
         self._active_websockets: set[ManagedBotWebSocket] = set()
</code_context>
<issue_to_address>
**issue (bug_risk):** Both adapters replace the botpy HTTP client with a new `QQOfficialHttp`, but the shown adapter shutdown paths do not close that transport. The aiohttp session and keep-alive connector therefore remain open after adapter shutdown, producing unclosed-session warnings and retaining sockets until garbage collection.

**Triggers:** When either QQ Official adapter is stopped after the managed HTTP session has been created.

**Suggested fix:** Explicitly await `self.http.close()` during each adapter's shutdown/termination path before returning.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 2 findings to address first, and if the transport limits or shared retry budget are wrong, QQ API requests can be rejected or messages can be missed or duplicated; requests already sent and externally delivered cannot be undone by reverting. Reverting restores the previous transport and retry behavior for future requests.

Blocking findings: astrbot/core/platform/sources/qqofficial/qqofficial_message_event.py:529, astrbot/core/platform/sources/qqofficial/qqofficial_platform_adapter.py:190

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4e91079ba

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ebfe1e511

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".