fix(security): 硬编码特殊账号改为可配置数组 NAPCAT_SPECIAL_PEER_UINS

- onebot/api/msg.ts(3处)与 core/helper/log.ts(1处)原先写死两个特定
  peerUin, 用于: 回复消息直接返回缓存的 createReplyData / 走合并视频URL
  特殊通道 / 回复元素跳过递归解析 / 临时会话兜底 group_id。
- 改为环境变量 NAPCAT_SPECIAL_PEER_UINS(逗号分隔, 校验纯数字)读取,
  默认为空数组 = 不做任何特殊处理。
- 如需恢复旧行为: NAPCAT_SPECIAL_PEER_UINS='<原两个号码>' 即可。
回归注意: 默认关闭特殊通道后, 对这两类会话的合并转发视频URL获取与回复
  缓存直返行为会走通用分支, 建议内部测试确认无回归后按需配置环境变量。

packages/snowcat-core/helper/log.ts

@@ -336,9 +336,16 @@ function textElementToText (textElement: any): string {
   return '';
 }
 
+// 历史: 同 onebot/api/msg.ts 的特定会话特殊处理, 改为可配置数组, 默认空=不跳过。
+// 如需旧行为: NAPCAT_SPECIAL_PEER_UINS='284840486,1094950020'
+const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '')
+  .split(',')
+  .map(s => s.trim())
+  .filter(s => /^\d+$/.test(s));
+
 function replyElementToText (replyElement: any, msg: RawMessage, recursiveLevel: number): string {
   const recordMsgOrNull = msg.records.find((record) => replyElement.sourceMsgIdInRecords === record.msgId);
-  return `[回复消息 ${recordMsgOrNull && recordMsgOrNull.peerUin !== '284840486' && recordMsgOrNull.peerUin !== '1094950020'
+  return `[回复消息 ${recordMsgOrNull && !SPECIAL_PEER_UINS.includes(recordMsgOrNull.peerUin)
     ? rawMessageToText(recordMsgOrNull, recursiveLevel + 1)
     : `未找到消息记录 (MsgId = ${replyElement.sourceMsgIdInRecords})`
     }]`;

packages/snowcat-onebot/api/msg.ts

@@ -1,4 +1,12 @@
 import { FileNapCatOneBotUUID } from 'snowcat-common/src/file-uuid';
+
+// 历史: 特定会话(如文件传输助手/官方助手类号)走特殊回包与视频URL通道。
+// 改造: 从硬编码字面量改为可配置数组(环境变量优先, 默认空=不做特殊处理), 保留原分支结构。
+// 如需恢复旧行为, 配置 NAPCAT_SPECIAL_PEER_UINS='284840486,1094950020' 即可。
+const SPECIAL_PEER_UINS: string[] = (process.env['NAPCAT_SPECIAL_PEER_UINS'] ?? '')
+  .split(',')
+  .map(s => s.trim())
+  .filter(s => /^\d+$/.test(s));
 import { MessageUnique } from 'snowcat-common/src/message-unique';
 import {
   ChatType,
@@ -298,7 +306,7 @@ export class OneBotMsgApi {
       const records = msg.records.find(msgRecord => msgRecord.msgId === element?.sourceMsgIdInRecords);
 
       // 特定账号的特殊处理
-      if (records && (records.peerUin === '284840486' || records.peerUin === '1094950020')) {
+      if (records && (SPECIAL_PEER_UINS.includes(records.peerUin))) {
         return createReplyData(records.msgId);
       }
 
@@ -416,7 +424,7 @@ export class OneBotMsgApi {
       // 读取视频链接并兜底
       let videoUrlWrappers: Awaited<ReturnType<typeof this.core.apis.FileApi.getVideoUrl>> | undefined;
 
-      if (msg.peerUin === '284840486' || msg.peerUin === '1094950020') {
+      if (SPECIAL_PEER_UINS.includes(msg.peerUin)) {
         try {
           videoUrlWrappers = await this.core.apis.FileApi.getVideoUrl({
             chatType: msg.chatType,
@@ -1171,7 +1179,7 @@ export class OneBotMsgApi {
       resMsg.sender.nickname = member?.nick ?? member?.cardName ?? '临时会话';
       resMsg.temp_source = 0;
     } else {
-      resMsg.group_id = 284840486;
+      resMsg.group_id = SPECIAL_PEER_UINS[0] ? parseInt(SPECIAL_PEER_UINS[0]) : 0;
       resMsg.temp_source = 0;
       resMsg.sender.nickname = '临时会话';
     }