hermes - 💡(How to fix) Fix QQ Bot private chat (C2C) button approvals always rejected as unauthorized due to chat_type mismatch (dm vs c2c) [1 pull requests]

Bug Description

QQ Bot private chat (C2C) inline approval keyboard buttons are always rejected as "unauthorized" and silently dropped. The agent never receives the user's decision — commands either time out or (if auto-approved) execute despite clicking "deny".

Gateway log shows:

WARNING Rejected unauthorized approval click for session agent:main:qqbot:dm:<OPENID> (operator=<OPENID>)

Steps to Reproduce

1. Configure QQ Bot gateway and start a private chat with the bot
2. Send a command that triggers dangerous-command approval (e.g., rm ~/Desktop/test.txt)
3. Click any of the three approval buttons (allow-once / always / deny)
4. The button click is silently dropped; the agent never receives the decision

Expected Behavior

Button clicks should resolve correctly: the agent thread should be unblocked with the corresponding choice (once/always/deny).

Actual Behavior

All button clicks are rejected with "Rejected unauthorized approval click" in the gateway log, regardless of which button is pressed.

Affected Component

Messaging Platform (if gateway-related)

Messaging Platform

QQ Bot

Debug Report

https://paste.rs/MAAHP

Note: The debug report was generated after a temporary local fix was applied, so the gateway log may not contain the error. The log evidence shown in the Bug Description was captured before the fix.

Operating System

Fedora 44 (KDE Plasma 6.6.4, Wayland)

Python Version

Python 3.14.4

Hermes Version

v0.14.0

Root Cause Analysis

When handling C2C (private chat) messages, the QQ Bot adapter creates the session with chat_type="dm", producing session keys like agent:main:qqbot:dm:<OPENID>. However, the interaction authorization check in _is_authorized_interaction_for_session() does not handle chat_type="dm" — it only checks for "c2c", "group", and "guild". The "dm" type falls through to return False, causing every button click to be rejected.

Code references:

• gateway/platforms/qqbot/adapter.py — _handle_c2c_message sets chat_type="dm"
• gateway/platforms/qqbot/adapter.py — _is_authorized_interaction_for_session only handles "c2c", "group", "guild"
• gateway/session.py — build_session_key uses chat_type="dm" for private messages