Keep first-run access details confined to the active process console and remove development credentials from managed application logs.
Treat notification delivery settings as sensitive during backup and restore, preserve private file access across creation and updates, and align the WebUI guidance with the new boundary.
- Change DEFAULT_BODY_TEMPLATE from plaintext to Server酱-style JSON
- Add JSON-safe escaping in renderTemplate for backslashes and quotes
- Update frontend DEFAULT_TEMPLATE to match backend
- Add tests for JSON escaping behavior
Fixes#106 (targets dev branch)
Global channel store at config/notifications.json, mirroring ui-config's
total-normalize + atomic-write + cached-load conventions: NotificationsConfig
(version, debounceSeconds clamp [0,3600] default 30, channels[]), a total
normalizeNotificationsConfig (drops malformed/non-http channels, dedupes by
id, strips unknown fields), and the pure renderTemplate ({key} substitution;
missing keys left as-is; no re-expansion of substituted values).
Per-UIN opt-in: OneBotConfig.notifications.channelIds (validated slugs,
last-write-wins merge across global+per-uin, deduped) in the onebot package.
Tests: 19 (core notifications-config) + 12 (onebot config), all green.
Adversarial review: 0 blockers / 0 should-fix.
DrSmoothl