Include each account's saved group remark in group list and detail responses.
Keep joined-group, non-member, and fallback results shape-consistent when no remark is available. Document the field in the public response metadata and cover cached and refreshed query paths with regression tests.
Closes#294
Make persisted log filtering predictable across supported startup settings while rejecting configurations that could silently retain more data than intended.
Keep the first WebUI login credential available without weakening normal log thresholds, clarify the operator-facing behavior, and strengthen regression coverage across isolated environments and explicit file-output disablement.
Allow operators to control how much diagnostic information is retained in file logs independently from live console output.
Document the new startup setting and add regression coverage for its default behavior, runtime independence, and unsupported configurations.
Surface account storage preparation and background history progress through the existing live connection status channel. Clearly distinguish unavailable accounts from accounts that remain fully usable during maintenance.
Show processed totals, completion percentage, estimated remaining time, and retry states in both the global notice and account overview. Preserve existing connection update filtering to avoid unnecessary refreshes.
Start each account as soon as its message storage is ready, then continue older history updates without delaying normal account availability. Keep already started accounts online when maintenance needs to be retried.
Handle preparation failures, stale completions, early exits, logout, and shutdown consistently. Add lifecycle coverage for startup ordering, automatic retries, cancellation, and account availability.
Prevent existing message histories from being fully updated on the account startup path. Preserve current message behavior while allowing unfinished maintenance to continue safely after restarts.
Add coverage for older databases, interrupted upgrades, new messages written during maintenance, and newly created account storage.
Derive QQ NT's peerUid_chatType_msg_seq_random identity from its reverse-engineered static routing table before event dispatch. Unknown routes and incomplete identities fail open, while C2C and group peers use their native namespaces.
Refines #266
Identify QQ's service-37 fallback by its byte-exact nested Text reserve so compatibility descriptions are removed without consuming user-authored sibling text or malformed payload fallbacks.
Fixes#289
Match QQ NT's reverse-engineered peer, sequence, and random key so duplicate system events cannot bypass filtering through a different outer package type.
Fixes#266
Return the already-decoded profile remark from fetched and cached get_stranger_info results, document its fallback shape, and regenerate the MCP action catalog.
Fixes#290
Route both private forward actions through the existing self-sent echo callback while preserving the authoritative-receipt and canonical-echo guards.
Fixes#288
Prefer a successfully decoded modern voice record over the empty legacy voice placeholder that can accompany private message pushes.
Preserve legacy-only voice messages and add a protobuf round-trip regression covering the duplicate segment reported in #291.
Fixes#291
Retry narrowly classified startup failures on later watcher ticks with a fixed attempt limit. Preserve permanent failures and record recovery, pending, and exhausted outcomes.
Add regression coverage for recovery, non-retry, and bounded exhaustion.
Route recovered login state through the hook client before dependent services start. Add regression coverage to keep packet actions available after reconciliation.
Fixes#286.
Expose the per-account login history backfill switch in General settings and keep missing or legacy configuration disabled by default.
Document that changes apply on the next login, historical messages are stored locally without event replay or read-state changes, and fixed safety limits govern roster scanning, selected sessions, page size, request spacing, and retries.
Add WebUI normalization coverage so the optional setting survives save and restore without silently inheriting an enabled value. Refs #280.
Add an opt-in per-account login history backfill that waits for roster warmup and a 30-second grace period before silently filling local message history. The setting defaults to disabled and applies on the next account lifecycle.
Run one account at a time, prioritize known local gaps, and process at most three groups plus three friends with one 20-message page per session. Failures are logged and never retried during the same login.
Persist reconstructed history without dispatching OneBot events or changing QQ read state. Keep private metadata and event bodies atomic, honor recall tombstones, suppress live-only history side effects, avoid extra media requests, and stop queued, in-flight, or converting work when the account closes.
Share the persistence path with manual history actions and add lifecycle, cancellation, corruption, partial-failure, peer-identity, and storage-atomicity regression coverage. Refs #280.
Expose a read-only cursor probe plus one-page group and private history methods for login backfill. Validate targets, ranges, response ordering, and page sizes before returning decoded events.
Serialize all history traffic through a process-wide gate. Automatic requests keep a two-second gap, accept at most 100 targets per kind and 20 sequence slots per session, and honor account cancellation before any queued network operation starts.
Keep the probe side-effect free by omitting read markers, and add focused tests for packet budgets, invalid responses, throttling, cancellation, and continued gate usability after failures. Refs #280.
Share packet response validation across group and private history fetches so transport failures and empty responses cannot masquerade as empty pages.
Reject malformed group records and mismatched private-peer responses while preserving explicit QQ control-message filters. Mark fetched contexts as historical so old invite cards cannot overwrite live approval state.
Add wire-level regression coverage for failed responses, malformed entries, peer mismatches, ordering, and live-only identity observations. Refs #280.
Preserve authoritative receipts for private file sends and emit one message_sent event per actual QQ message. Split source uploads from chat publishing so failures surface instead of returning a synthetic zero-sequence receipt.
Fixes#282
Add an opt-in HTTP server setting that accepts OneBot WebSocket connections on the same port and access token while preserving standalone WebSocket server configurations.
Reuse the existing connection lifecycle for authentication, roles, events, heartbeat, streaming actions, token rotation, and shutdown. Expose the switch in WebUI and persist it through strict configuration validation and restore paths.
Refs: #281
Preserve the private conversation peer separately from the poke sender and target. Emit NapCat-compatible user_id and sender_id fields while keeping group notices unchanged.
Add MsgPush and event-converter regression coverage for self-pokes across multiple friend sessions.
Fixes#285.
Require the dress page to identify the requested account and every returned item before exposing the result. Reject malformed nested media metadata instead of silently degrading it.
Bound the HTML request to a 10-second redirect-chain deadline and a 2 MiB response body. Secure redirects by closing previous connections, stripping cross-origin credentials, rejecting cross-origin write forwarding, and surfacing malformed locations.
Replace the captured page with a minimal sanitized fixture and add protocol plus OneBot Action regression coverage for resource limits, redirect safety, response ownership, and structured failures.
Add a read-only action for querying QQ profile decorations from the authenticated web page.
Validate and classify page responses, expose structured errors, and cover parsing with a sanitized fixture.
Correct type 2 link and type 8 rich-media summary field mappings so collection responses no longer fail with unterminated groups.
Add wire-level regression coverage for both layouts.
Route friend remark updates and clears through the commands used by current QQ clients. Emit the required delete flags and surface post-delete cache refresh failures.
Add byte-exact regression coverage for all affected requests.
Fixes#284.
Enforce a global log quota with configurable retention and observable degradation. Add authenticated storage reporting and safe cleanup controls to the settings UI. Protect active stream transfers and isolate parallel test resources.
Follow AlbumService cursors in get_group_album_list so the legacy array response contains every album instead of only the first page.
Reject missing or repeated cursors when the server reports more data, preventing silent truncation and pagination loops. Add regression coverage for multi-page aggregation and malformed cursors.
Fixes#272
Decode the QQ group album video payload, including cover, duration, and multi-resolution URLs. Add a wire-level regression test and update generated action documentation.
Fixes#270
Separate the node editor into fixed header and footer rows with an independently scrollable form body, so short viewports cannot push the save action out of reach.
Normalize the observed AI SILK container marker at the shared audio transcode boundary before invoking the bundled decoder. Preserve caller-owned bytes and leave ordinary SILK, AMR, and unrelated inputs unchanged.
Add unit and packaged-addon regression coverage for MP3 conversion, payload preservation, and input immutability.
Fixes#268
Fetch QQ's versioned robot UIN ranges, classify and persist member status, and surface is_robot from both group member actions.
Preserve unknown legacy cache entries and fail visibly when classification is unavailable.
Closes#265
Encode poke message segments as private window shake messages while keeping the dedicated send_poke action unchanged.
Restrict window shakes to a single ordinary private-chat segment. Reject group, temporary-session, mixed-message, and forwarded usage before identity lookup, media upload, or packet transmission.
Add full outbound request coverage, OneBot action regressions, and live private-chat verification for issue #259.
Closes#259
Replace obsolete AGPL references with the source-available non-commercial terms. Clarify commercial authorization, proprietary addon restrictions, document precedence, and termination handling. Bump the bilingual EULA to version 1.1 effective 2026-07-21.
Decode the verified album cover response field and expose normalized cover details and last-upload timestamps through both album list actions. Preserve the legacy numeric timestamp shape, retain string timestamps for the native response, return null when no cover exists, and avoid additional network requests.
Document the new output contracts in the OneBot and MCP catalogs. Add independent wire fixtures and action-level regression tests for the protocol mapping and public response shapes.
Refs #257
Use the C2C roam cursor and canonical NT sequence for bidirectional history. Persist direction-aware recall tombstones so recalled messages cannot reappear.
Distinguish QQ-authoritative message sequences from local message IDs so group files and reply placeholders cannot become history anchors or be reused by protocol actions.
Filter QQ null roam records and migrate previously stored synthetic rows.
Fixes#254
Recognize both raw UTF-8 UIDs and nested OperatorInfo envelopes in GroupChange pushes while keeping self-kick and voluntary-leave semantics explicit.\n\nFixes #253.
Regenerate the MCP Action catalog so send_group_ai_record advertises the real OneBot message_id returned after a successful AI voice send.
Keep the generic MCP tool surface unchanged while making the corrected result contract visible to agents and clients.
Refs #250
DrSmoothl