Roster warmup now talks on the first live sender, so ownership tests
only count Test.* packets. Image upload still reports a missing body
as an image failure.
Moving a friend who is already in the target category still succeeds.
Media upload preflight now uses the same envelope success and error
rules as other OIDB calls.
Friend, group, and member lists load as soon as a Bridge can send
packets, instead of waiting for OneBot database preparation. Login
history sync still waits until the instance is usable and both lists
have loaded.
Invalid bind hosts and TLS without a certificate pair can no longer be
saved. Deleting certificates while TLS is on is rejected. A bad listener
does not start HTTP instead, and shutdown unbinds before tearing down
the hook.
Inbox groups and operator sightings are no longer treated as current
membership after a restart. Members who actually joined stay on the
roster until they leave.
Bot-built merged forwards left hollow NT images after long-msg fetch,
so get_forward_msg returned empty file/url. Decode now rebuilds identity
from md5, ignores stubs, and forward uploads keep a legacy image sibling.
C2C offline-file download receipts were reported as the peer sending a
file. Treat downloadFlag=2 as a receipt and drop it from the chat stream.
Running the suite left an untracked `packages/onebot/config/onebot_<uin>.json`
in the worktree. The manager's real session-start path materializes a default
per-UIN config, and that path is resolved against cwd — which vitest sets to the
package root. Tests that inject a fake instance still went through it, so the
file (holding a generated access token) reappeared on every run and a
`git add -A` would have committed it.
Run each forked test process from its own temp dir, and fail the file if the
package root gains an entry anyway.
Quotes of bot-sent private messages used a different sequence than
the send receipt, so reply.id and send_private_msg disagreed. Resolve
those quotes to the stored send id by send time when the quoted
sequence does not match.
Fixes#433
NoneBot 1 request handlers call `.handle_quick_operation_async`.
Treat that name as the existing quick-operation action so group
invites are approved instead of ignored.
Fixes#434
Raise patched floors for qs, fast-uri, hono, @hono/node-server,
postcss, ip-address, body-parser, and brace-expansion so the
lockfile no longer resolves vulnerable transitive versions.
Keep hono on the 4.12 line used by WebUI. Direct core ranges now
start at the patched releases; pnpm.overrides prevent lockfile
regeneration from rolling back.
Workspace typecheck is clean. Core 1085 tests and MCP 64 tests pass.
The requirement list still opens only while the new-password field
is focused. After blur, unmet rules stay visible as field text, and
Save can be pressed to return focus to that field.
Private delete_msg could return success while the message stayed
visible. The 64-bit id sent with a private recall is now built with
integer bits so it matches the original message.
Fixes#431
A handler shared by several event kinds now types as one kind at a
time. The converter table still records which kinds are not converted,
so the compile-time check for dropped converted kinds works.
Conversion still decides whether an event becomes OneBot JSON. The
pipeline now lists every kind as handle or drop, so a new converted
kind cannot be forgotten.
Live push and history now share one keep-or-drop decision. Control
signals and empty bodies stay hidden; undecodable content is kept and
logged on both paths.
Action handlers now only see fields from the param table. Extra client
keys are still ignored. Garbage values on declared numbers fail instead
of becoming zero.
A join now counts the member as in the group right away. A leave drops
them from the live roster without forgetting who they are. Other
sightings still do not mean the person is in the group.
Some clients fill unused group_id with an empty string when sending a
private message through send_msg. Treat that empty string as absent so
the send is a normal private chat.
Fixes#426
A failed git push after the version commit used to abort the pipeline.
Re-running the same release command now retries the push instead of
stopping as out of sync.
After identity persistence is suspended, later observations were still
logged one-by-one. That filled Docker logs and made the WebUI log
stream unusable while the bot kept receiving messages. Report the skip
once, then at most once a minute with a count. Console write failures
must not throw into message handling.
Fill in the stranger-info action docs, catalog, and remaining profile
fixtures after the qidian flags landed. Ordinary accounts still
default to zero.
Refs #404
Return qidian master and crew flags from get_stranger_info so callers can tell a qidian account from a normal one. Ordinary accounts keep the flags at zero. Existing stranger fields are unchanged.
Refs #404
QQ reports a per-member kick outcome in the command body. A zero
outcome means the member was removed; treat that as success instead
of a false failure. Still reject a non-zero outcome so callers do
not see success when the kick did not take effect.
Fixes#413
get_forward_msg returned image segments with empty url and file when
the long-msg payload omitted a download path. Rebuild the URL from
the file fingerprint the payload still carries.
Fixes#412
get_doubt_friends_add_request was rereading the uid as a number, so
uid came back empty and user_id was wrong. Keep the uid string and
the account number as separate fields.
Fixes#410
get_msg_emoji_likes was asking the recent-used emoji catalog, so a
reacted message came back empty. Use the native reactor list and the
local reaction cache instead.
Fixes#409
set_group_member_permissions was still rejected after the previous
command switch. Linux QQ writes these capabilities with the same
group-detail command as the other admin settings.
Closes#392
The debug console search sat under the response pane and treated a
finger swipe as a selection. The list now stays above the response
and can be scrolled.
Closes#396
Add get_msg_emoji_likes so a bot can see all reactions on one message
and the users behind each emoji, instead of querying one emoji at a
time.
Closes#399
set_qq_profile accepts sex. get_stranger_info now returns the online
status, extended status, and custom status that QQ already provides
on the user profile.
Closes#397Closes#398
DrSmoothl