SNOWLUMA_ variables can set the factory OneBot listen ports, WebUI TLS,
packet and hook timeouts, the stream directory, file download timeout,
and notification HTTP timeout. The values apply in memory and are not
written back to saved config.
get_group_tags lists the tags under one group category. add_group_tag
and delete_group_tag add or remove a tag by name. Callers pass the
category number as group_class. An empty name is rejected.
Refs #506
Keep forwarded cards readable when previews contain unsupported characters
without changing the forwarded messages.
Reject invalid resource references and record affected preview fields for
troubleshooting.
Refs #467
Keep custom titles and previews available when reading uploaded forwards,
including nested messages and refreshed sender names.
Reject malformed preview metadata before processing the request.
Refs #493
Require a server message receipt before returning success. Log unconfirmed responses and leave retries to the caller to avoid duplicate sends.
Fixes#492
Private-chat voice bubbles arrived without a waveform: the NapCat-derived
14-byte c2c bytesGeneralFlags blob suppresses it. A/B testing that single
field (everything else byte-identical) shows the receiver drops the shipped
waveform while it is present and draws the bars as soon as it is gone, so c2c
now sends no flags at all. Group voice keeps its 10-byte blob unchanged.
Correct approval handling for filtered friend requests and preserve clear failures when an account cannot be resolved or the request is rejected.
Add regression coverage for separate account identities, approval errors, and existing list and rejection behavior.
Fixes#460
Allow image replies in existing group temporary conversations while preserving passive-only restrictions. Missing, expired, or mismatched sessions remain rejected before media processing, and sending never creates or refreshes a session.
Fixes#471
Resolve saved stickers by resource ID or MD5, support group and private destinations with optional replies, and preserve presentation in upload and message metadata.
Fixes#468
Linux doubt-request lists were returning the request time as the applicant account, so later uid lookup queried the wrong value.
Decode the account, request time, and source group from the live list layout.
Refs #460
DoQunComment still came back 10016 after the owner-uin fix because the
write header only sent time + short feed id. Official cell_common also
carries the 421 locator; copy that cell, and synthesize it if omitted.
Fixes#436
DoQunComment still returned 10016 after the feed lookup because we
stamped the bot onto StFeed.cellUserInfo. Official FeedWorker copies
the feed owner's uin there and only puts the bot on StComment.
Fixes#436
Pad and phone device conversations were missing from the friend list
and arrived as empty private messages. They now show up as stable
contacts and support text send/receive.
Fixes#452
Group albums already list videos, but upload only accepted images.
Add a dedicated video action that extracts a cover and returns the new video id.
Fixed#331
Treat envelope field 1 as seq, not success, and attach the media cell plus batch id.
Empty id or a non-zero result fails the action instead of returning a blank comment.
Fixed#436
Roster warmup now talks on the first live sender, so ownership tests
only count Test.* packets. Image upload still reports a missing body
as an image failure.
Moving a friend who is already in the target category still succeeds.
Media upload preflight now uses the same envelope success and error
rules as other OIDB calls.
Friend, group, and member lists load as soon as a Bridge can send
packets, instead of waiting for OneBot database preparation. Login
history sync still waits until the instance is usable and both lists
have loaded.
Invalid bind hosts and TLS without a certificate pair can no longer be
saved. Deleting certificates while TLS is on is rejected. A bad listener
does not start HTTP instead, and shutdown unbinds before tearing down
the hook.
Inbox groups and operator sightings are no longer treated as current
membership after a restart. Members who actually joined stay on the
roster until they leave.
Bot-built merged forwards left hollow NT images after long-msg fetch,
so get_forward_msg returned empty file/url. Decode now rebuilds identity
from md5, ignores stubs, and forward uploads keep a legacy image sibling.
C2C offline-file download receipts were reported as the peer sending a
file. Treat downloadFlag=2 as a receipt and drop it from the chat stream.
Raise patched floors for qs, fast-uri, hono, @hono/node-server,
postcss, ip-address, body-parser, and brace-expansion so the
lockfile no longer resolves vulnerable transitive versions.
Keep hono on the 4.12 line used by WebUI. Direct core ranges now
start at the patched releases; pnpm.overrides prevent lockfile
regeneration from rolling back.
Workspace typecheck is clean. Core 1085 tests and MCP 64 tests pass.
DrSmoothl