diff --git a/src/channel.ts b/src/channel.ts
index 80fe138..f824c1d 100644
--- a/src/channel.ts
+++ b/src/channel.ts
@@ -172,18 +172,6 @@ export const qqbotPlugin: ChannelPlugin<ResolvedQQBotAccount> = {
       });
     },
   },
-  // 新增：消息目标解析
-  messaging: {
-    normalizeTarget: (target) => {
-      // 支持格式: qqbot:openid, qqbot:group:xxx, openid, group:xxx
-      const normalized = target.replace(/^qqbot:/i, "");
-      return { ok: true, to: normalized };
-    },
-    targetResolver: {
-      looksLikeId: (id) => /^[A-F0-9]{32}$/i.test(id) || id.startsWith("group:") || id.startsWith("channel:"),
-      hint: "<openid> or group:<groupOpenid>",
-    },
-  },
   outbound: {
     deliveryMode: "direct",
     chunker: chunkText,
diff --git a/src/config.ts b/src/config.ts
index 99678d2..0b92dc1 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -128,11 +128,16 @@ export function applyQQBotAccountConfig(
   const next = { ...cfg };
 
   if (accountId === DEFAULT_ACCOUNT_ID) {
+    // 如果没有设置过 allowFrom，默认设置为 ["*"]
+    const existingConfig = (next.channels?.qqbot as QQBotChannelConfig) || {};
+    const allowFrom = existingConfig.allowFrom ?? ["*"];
+    
     next.channels = {
       ...next.channels,
       qqbot: {
         ...(next.channels?.qqbot as Record<string, unknown> || {}),
         enabled: true,
+        allowFrom,
         ...(input.appId ? { appId: input.appId } : {}),
         ...(input.clientSecret
           ? { clientSecret: input.clientSecret }
@@ -144,6 +149,10 @@ export function applyQQBotAccountConfig(
       },
     };
   } else {
+    // 如果没有设置过 allowFrom，默认设置为 ["*"]
+    const existingAccountConfig = (next.channels?.qqbot as QQBotChannelConfig)?.accounts?.[accountId] || {};
+    const allowFrom = existingAccountConfig.allowFrom ?? ["*"];
+    
     next.channels = {
       ...next.channels,
       qqbot: {
@@ -154,6 +163,7 @@ export function applyQQBotAccountConfig(
           [accountId]: {
             ...((next.channels?.qqbot as QQBotChannelConfig)?.accounts?.[accountId] || {}),
             enabled: true,
+            allowFrom,
             ...(input.appId ? { appId: input.appId } : {}),
             ...(input.clientSecret
               ? { clientSecret: input.clientSecret }