- Add deleteQzoneMsg API method to NTQQWebApi for deleting Qzone posts by tid
- Implement buildQzoneDeleteBody to construct form-encoded request payload
- Implement parseQzoneDeleteResponse to validate deletion API response
- Add QzoneDeleteResponse and QzoneDeleteParams type definitions
- Create DeleteQzoneMsg OneBot action handler with payload validation
- Register delete_qzone_msg action in router and action handlers
- Add example payload and response for DeleteQzoneMsg action
- Add comprehensive unit tests for delete body construction and response parsing
- Fix indentation inconsistency in createAlbumCommentRequest call
- Add QzonePublishResponse interface and parsing logic for publish API responses
- Add buildQzonePublishBody function to construct publish request parameters
- Add buildQzoneUploadImageBody function to construct image upload request parameters
- Add parseQzoneUploadImageResponseText function to parse upload API responses
- Add toQzoneRichval function to format image data for publish requests
- Add publishQzoneMsg method to NTQQWebApi for publishing space messages with optional images
- Add uploadImageToQzone method to NTQQWebApi for uploading images to QQ space
- Add getQzoneAuth private method to retrieve authentication tokens (skey, pskey, g_tk)
- Add SendQzoneMsg action handler to expose QQ space publishing via OneBot API
- Add comprehensive unit tests for all Qzone data construction and parsing functions
- Update action router to register SendQzoneMsg action
- Update action examples to demonstrate Qzone publishing usage
Refresh the downstream release workflow to use the newer QQNT 3.2.30-50969 AppImage URLs for both x86_64 and arm64 builds.
Update release note prompt and AI model
Clarifies the release note prompt to require strict output format without wrapping the result in a code block. Also updates the release publish workflow to use `google/gemma-4-26b-a4b-it:free` instead of the previous OpenAI model endpoint setting.
Update QQNT installer URL in release workflow
Switches the release publish workflow to download a newer QQNT x64 installer (9.9.32.50969) from the updated qqdl.gtimg.cn source instead of the previous dldir1v6.qq.com link.
Add mappings for QQ 50969 builds
Add appid/QUA entries and native/packet send-recv offsets for the new 9.9.32-50969 Windows build and 3.2.30-50969 Linux x64/arm64 builds. Also normalize the existing 3.2.30-50828 x64 native recv offset format by removing the leading zero.
* fix(onebot): destructure quick_reply in replyElement converter
parseMessageSegments passes the whole RecvMessageContext object as the
4th argument to element converters, but replyElement declared the
parameter as `quick_reply` without destructuring. The object is always
truthy, so every reply element took the quick-reply branch and skipped
lookup methods 2/3 whenever method 1 found no match, dropping the reply
segment from the reported OneBot message (it degrades to at + text).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(onebot): fall back to msgSeq match when msgRandom mismatches in reply lookup
All three reply lookup methods matched candidates only by msgRandom
whenever records.msgRandom was present. When the recorded msgRandom is
stale or inconsistent with the message database, the quoted message
returned by a seq-based query was discarded even though its msgSeq
matched exactly. Match by msgRandom first and fall back to an exact
msgSeq match.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: xulang <xuxiaolang2003@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The action hardcoded used_space=0 and total_space=10GiB. The kernel's
getGroupFileList call already returns the group's space usage in its
groupSpaceResult, so read it (a single-item fetch) instead of the
placeholders. Falls back to the previous constants when the field is
absent, so there is no regression.
Also relax the empty-count guard from `!groupFileCount` to `=== undefined`
so a group with zero files is not mistaken for "Group not found".
Update external version metadata to support new QQ releases. Added appid/qua entries for 9.9.32-50828 and 3.2.30-50828, plus corresponding send/recv native and packet offsets across x64 and arm64 targets.
When QQ kicks the bot offline, the WebUI incorrectly shows the account as still
logged in, blocking users from re-login via QR code or password until NapCat is
restarted.
Root cause: The KickedOffLine event handlers in both the shell (base.ts) and
framework (napcat.ts) only set the error message without resetting
QQLoginStatus. The QQGetQRcodeHandler and other login endpoints check
getQQLoginStatus() and reject all re-login attempts when it remains true.
Fix: Set QQLoginStatus to false in both event handlers, ensuring the WebUI
state syncs with the actual account status when kicked offline.
Two changes:
- napcat-shell/base.ts: add setQQLoginStatus(false) before setQQLoginError()
- napcat-framework/napcat.ts: register a KickedOffLine listener that resets
the login status (the framework previously had no KickedOffLine listener)
Fixes: #508, #1818
Register new builds and architecture-specific offsets/IDs for 9.9.31-49738 and 3.2.29-49738. Updated packages/napcat-core/external/appid.json to add appid/qua entries, and napi2native.json and packet.json to add send/recv offsets for x64 (and arm64 where applicable). These additions track the new builds and their native mappings.
Express req.method returns uppercase strings ('GET', 'POST', etc.),
so `req.method === 'get'` never matches. This caused GET requests
to fall through to the else-if branch instead of directly using
req.query as the payload.
ClosesNapNeko/NapCatQQ#1864
Replace the previous "New Feature" section with a short suggestion to try SnowLuma as a NapCat GUI alternative. Removes the v4.8.115+ notes about Stream API and recommending string IDs, simplifying the README and pointing users to the SnowLuma GitHub repository.
Add compilerOptions.rootDir = ".." to tsconfig.json for napcat-onebot, napcat-shell, and napcat-webui-backend to ensure the TypeScript compiler uses the monorepo package root for source resolution. Also remove an extraneous blank line in theme.tsx near FileManager.uploadWebUIFont (minor formatting cleanup).
CI: use `pnpm i --ignore-scripts` in release-publish workflow to avoid running package install scripts during CI.
Shell: defer showing the QR code until after attempting WebUi quick-login/password fallback. Adds checks for NAPCAT_QUICK_ACCOUNT and quick-password env vars (and WebUi quick-login list), runs WebUi quick config, and only calls getQRCodePicture() if no fallback was attempted and the user is not logged in. Includes error handling for the quick-login attempt.
Add external mappings for Windows x64 versions 9.9.30-48762 and 9.9.31-49599 across appid, napi2native, and packet files. appid.json: add appid 537352525 (9.9.30-48762) and 537355779 (9.9.31-49599) with QUA strings. napi2native.json: add send/recv hashes for 9.9.30-48762-x64 (0A9B1BC / 1F0324D) and 9.9.31-49599-x64 (0AF885C / 20058E1). packet.json: add send/recv offsets for 9.9.30-48762-x64 (2F3B960 / 2F3EEE0) and 9.9.31-49599-x64 (3082C40 / 30861C8).
Switch moduleResolution to "bundler" in base and package tsconfigs and consolidate path aliases for monorepo packages. Remove several package-level baseUrl entries and update package paths to reference ../../packages/* (add explicit napcat-common/src and napcat-image-size/src mappings). Also add a rootDir override for napcat-core. These changes unify module resolution and path aliases so TypeScript and bundlers resolve workspace packages consistently.
Introduce a safe PR build dispatch flow and related helpers.
- Add GitHubAPI.createWorkflowDispatch to .github/scripts/lib/github.ts and tighten getRepository nullability.
- Add .github/scripts/pr-build-dispatch.ts to dispatch an untrusted workflow_run (workflow_dispatch) for PR builds.
- Rewrite .github/workflows/build-pr.yml to split privileged checks (pull_request_target / issue_comment) from untrusted execution (workflow_dispatch):
- Add workflow_dispatch inputs for PR metadata.
- Ensure privileged jobs only check conditions, post comments and dispatch the untrusted build.
- Untrusted build jobs (framework/shell/publish) run under workflow_dispatch, checkout PR code into a separate workspace, clear GITHUB_TOKEN in build steps, and set stricter permissions and persist-credentials:false where appropriate.
- Adjust concurrency, outputs, and inter-job dependencies to work with inputs rather than passing sensitive data between privileged and untrusted contexts.
- Update trigger-docker and result-comment flows to rely on workflow_dispatch inputs and only run in the untrusted run where appropriate.
- Change packages/napcat-vite/vite-plugin-version.js to read NAPCAT_GITHUB_TOKEN (instead of GITHUB_TOKEN) to avoid exposing Actions write tokens in untrusted builds.
These changes aim to improve security by preventing execution of PR-controlled code with elevated repo permissions and by isolating token usage.
pnpm 10 exits non-zero on [ERR_PNPM_IGNORED_BUILDS] by default, which
broke CI after the global pnpm version on GitHub runners bumped.
Replace ad-hoc `npm i -g pnpm` calls with pnpm/action-setup@v4 pinned to
version 9 across build-ci.yml, build-pr.yml, and drop the redundant
Install pnpm step from pr-build-run.ts.
* fix: enable wss connections and add certificate verification toggle in WebSocket Client
Previous behavior: the WebSocket Client only supported unencrypted ws:// connections; wss:// URLs were not handled and would fail to connect, providing no option to disable TLS certificate validation for development or self-signed certificates.
Fixed behavior: secure WebSocket connections (wss://) are now fully supported. A verifyCertificate configuration option has been introduced, defaulting to true. When set to false, certificate errors (e.g., self-signed certificates) are ignored, enabling safe local testing while maintaining strict validation by default for production.
* fix: improve wss certificate verification and add tests
Previous behavior: wsOptions used 'any' type without type safety, verifyCertificate was added to napcat-protocol without implementation, and no tests existed for the new config option.
Fixed behavior: wsOptions now uses proper WebSocket.ClientOptions type for compile-time safety, verifyCertificate removed from napcat-protocol (no WebSocket client implementation exists there), and comprehensive tests added to validate config loading and default values.
Add mappings for version 9.9.30-48517: update packages/napcat-core/external/appid.json with appid 537352474 and qua "V1_WIN_NQ_9.9.30_48517_GW_B", and update packages/napcat-core/external/napi2native.json with the x64 mapping (send: "0A9B1BC", recv: "1F0324D"). These entries add support for the new 9.9.30-48517 release.
手瓜一十雪