Keep the full control-character range limited to decoded styled-card text. Preserve member-level error isolation and cover whitespace, Unicode text, cached output, and restart behavior.
Refs #680
Retry eligible storage failures as temporary files and preserve their storage type for later use. Reject incompatible mixed content before chat publication.
Refs #644
- expose DEFAULT_MAX_PAYLOAD_BYTES; an inbound frame over the cap now reports its
declared byte size, message type and the effective limit, recovered by walking
the buffered frame stream so the number is right when a chunk carries several
frames, the oversized header spans chunks, or control frames are interleaved;
when the walk cannot reach a verdict the error names the cap without a size
- truncate close reasons to the RFC 6455 control-frame room on a UTF-8 boundary
(an over-long reason previously produced an invalid control frame)
- add optional maxPayloadBytes (default 100 MiB unchanged) to the three adapters
that read WebSocket frames: wsServers, wsClients and httpServers with
enableWebSocket. httpClients rejects the field because it has no WebSocket
transport, and the value is part of the binding signature so a change rebinds
the transport instead of being saved without taking effect
- keep the existing 1009 log lines and append the actionable hint instead of
replacing the template
- WebUI field (including httpServers once the embedded listener is on) and README
docs for the 100 MiB => ~445 s (7:26) inline PCM consequence
Report distinct invitations separately and approve only the request that belongs to the account and inviter. Reject ambiguous approvals and resolve the sender of invitations from outside the contact list.
Refs #612
Read accessible Qzone homepage posts and generate their original share cards. Return sharing notices so callers can confirm visibility before sending through the existing message actions.
Include SDK contracts, action discovery, documentation, and regression coverage.
Fixes#609
Include verification message reception in administrator permission results. Preserve unavailable states and surface failed reads.
Update SDK contracts, action metadata, documentation and isolated behavior coverage.
Expose administrator permission controls through OneBot, the SDK, and MCP.
Document limits and unknown states, and validate public request and result contracts.
Add actions to read a space name and description and update the current account profile. Preserve omitted fields and support explicit empty values, with matching SDK types, MCP discovery, documentation, and tests.
Allow up to four video upload connections while keeping one connection as the default. Preserve existing messaging interfaces and add configuration controls, reliable failure handling, and upload diagnostics.
Closes#569
Expose readable feed content, media and available statistics while preserving existing result fields and callers. Carry continuation state across pages and report invalid or stalled pagination explicitly.
Add threaded text replies while preserving existing comments and image
uploads. Include parent references and update SDK and MCP contracts.
Reject incomplete targets and unsupported reply images before sending.
Fixes#573
Add local media upload-and-send helpers with an optional Node file source
and stage-aware errors. Add explicit quoted replies and cancellable event
waits while preserving existing methods and handler contracts.
Propagate group-file publication failures instead of reporting success.
Cover cancellation, cleanup, signed message IDs, package exports, consumer
types, and real HTTP/WebSocket upload-to-send integration.
Validation: pnpm run ci (6231 tests passed, 9 skipped); SDK package contents
verified with npm pack --dry-run --ignore-scripts.
Document result shapes and practical calls for all built-in actions,
including prerequisites, streaming workflows and compatibility limits.
Preserve existing interfaces and execution behavior, and verify the
catalog against action validation and representative responses.
Require patched Node.js releases and refresh affected application and build dependencies.
Align installation requirements, startup checks, and release workflows with the security baseline.
Keep repeated confirmations of the same private message from producing duplicate events while preserving distinct messages and stored content.
Refs #528.
DrSmoothl