@zhin.js/adapter-github 0.1.35 → 0.1.37

package/lib/adapter.d.ts

@@ -1,19 +1,63 @@
+/**
+ * GitHub 适配器（基于 gh CLI + App 认证 + Webhook/轮询混合）
+ */
 import { Adapter, Plugin } from 'zhin.js';
 import { GitHubBot } from './bot.js';
+import type { Router } from '@zhin.js/http';
 import type { GitHubBotConfig, GenericWebhookPayload } from './types.js';
-import { GitHubAPI, GitHubOAuthClient } from './api.js';
+import type { GhClient } from './gh-client.js';
 export declare class GitHubAdapter extends Adapter<GitHubBot> {
-    get publicUrl(): string | undefined;
+    /** 轮询定时器 */
+    private _pollTimer;
+    /** 每个 repo 的 ETag 缓存 */
+    private _etags;
+    /** 每个 repo 最后处理的事件 ID（防重复） */
+    private _lastEventIds;
+    /** Webhook 是否已激活 */
+    private _webhookActive;
     constructor(plugin: Plugin);
     createBot(config: GitHubBotConfig): GitHubBot;
     start(): Promise<void>;
-    /** 获取第一个可用 bot 的 API (工具用) */
-    getAPI(): GitHubAPI | null;
-    /** 创建 OAuth 状态并返回授权 URL（供 github_bind 工具使用） */
-    createOAuthState(platform: string, platformUid: string): string | null;
-    getOAuthClient(platform: string, platformUid: string): Promise<GitHubOAuthClient | null>;
-    setupOAuth(router: import('@zhin.js/http').Router): void;
-    setupWebhook(router: import('@zhin.js/http').Router): void;
+    stop(): Promise<void>;
+    /** 获取第一个可用 bot 的 GhClient (工具用) */
+    getAPI(): GhClient | null;
+    /** 获取指定用户绑定的 GhClient；未绑定则返回 null */
+    getUserAPI(platform: string, platformUid: string): Promise<GhClient | null>;
+    /** 获取用户 API，若未绑定则降级为 bot 默认的 API */
+    getUserOrDefaultAPI(platform?: string, platformUid?: string): Promise<GhClient | null>;
+    /** 获取第一个 bot 的 client_id（App 认证时从 /app 自动获取） */
+    getClientId(): string | null;
+    /** 获取第一个 bot 的 host 配置 */
+    getHost(): string | undefined;
+    /** 获取 App slug（用于生成安装链接） */
+    getAppSlug(): string | null;
+    /** 获取所有已发现的安装信息 */
+    getInstallations(): {
+        id: number;
+        account: {
+            login: string;
+            type: string;
+        };
+        target_type: string;
+    }[];
+    /** 第一个 bot 是否配置了 Webhook */
+    get hasWebhookConfig(): boolean;
+    /** Webhook 是否已激活 */
+    get webhookActive(): boolean;
+    /** 在 router 上挂载 Webhook 路由（生产环境推荐） */
+    setupWebhook(router: Router): void;
+    /** 处理 Webhook 推送的事件 */
+    handleWebhookPayload(event: string, payload: any): Promise<void>;
+    /** 启动事件轮询 */
+    startPolling(): void;
+    /** 停止事件轮询 */
+    stopPolling(): void;
+    /** 轮询所有已订阅仓库的事件 */
+    private pollAllRepos;
+    /** 轮询单个仓库的事件 */
+    private pollRepoEvents;
+    /** Events API type → webhook event name */
+    private mapEventType;
     dispatchNotification(eventName: string, payload: GenericWebhookPayload): Promise<void>;
 }
 //# sourceMappingURL=adapter.d.ts.map

package/lib/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,OAAO,EACP,MAAM,EAEP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAa,qBAAqB,EAAgB,MAAM,YAAY,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAqB,MAAM,UAAU,CAAC;AAkE3E,qBAAa,aAAc,SAAQ,OAAO,CAAC,SAAS,CAAC;IACnD,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAGlC;gBAEW,MAAM,EAAE,MAAM;IAI1B,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS;IAIvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,8BAA8B;IAC9B,MAAM,IAAI,SAAS,GAAG,IAAI;IAK1B,+CAA+C;IAC/C,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAchE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAW9F,UAAU,CAAC,MAAM,EAAE,OAAO,eAAe,EAAE,MAAM,GAAG,IAAI;IA6GxD,YAAY,CAAC,MAAM,EAAE,OAAO,eAAe,EAAE,MAAM,GAAG,IAAI;IAwFpD,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CA+C7F"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,OAAO,EACP,MAAM,EAEP,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAa,qBAAqB,EAAgB,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AA+D/C,qBAAa,aAAc,SAAQ,OAAO,CAAC,SAAS,CAAC;IACnD,YAAY;IACZ,OAAO,CAAC,UAAU,CAA+C;IACjE,wBAAwB;IACxB,OAAO,CAAC,MAAM,CAA6B;IAC3C,8BAA8B;IAC9B,OAAO,CAAC,aAAa,CAA6B;IAClD,oBAAoB;IACpB,OAAO,CAAC,cAAc,CAAS;gBAEnB,MAAM,EAAE,MAAM;IAI1B,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS;IAIvC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAK3B,mCAAmC;IACnC,MAAM,IAAI,QAAQ,GAAG,IAAI;IAKzB,qCAAqC;IAC/B,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAWjF,oCAAoC;IAC9B,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAQ5F,gDAAgD;IAChD,WAAW,IAAI,MAAM,GAAG,IAAI;IAK5B,0BAA0B;IAC1B,OAAO,IAAI,MAAM,GAAG,SAAS;IAK7B,4BAA4B;IAC5B,UAAU,IAAI,MAAM,GAAG,IAAI;IAK3B,mBAAmB;IACnB,gBAAgB;;;;;;;;IAKhB,4BAA4B;IAC5B,IAAI,gBAAgB,IAAI,OAAO,CAG9B;IAED,oBAAoB;IACpB,IAAI,aAAa,IAAI,OAAO,CAE3B;IAID,sCAAsC;IACtC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IA4ClC,uBAAuB;IACjB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA4DtE,aAAa;IACb,YAAY,IAAI,IAAI;IAcpB,aAAa;IACb,WAAW,IAAI,IAAI;IAQnB,mBAAmB;YACL,YAAY;IAsB1B,gBAAgB;YACF,cAAc;IAiE5B,2CAA2C;IAC3C,OAAO,CAAC,YAAY;IAgBd,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;CA+C7F"}

package/lib/adapter.js

@@ -1,10 +1,9 @@
 /**
- * GitHub 适配器
+ * GitHub 适配器（基于 gh CLI + App 认证 + Webhook/轮询混合）
  */
-import crypto from 'node:crypto';
 import { Adapter, } from 'zhin.js';
+import crypto from 'node:crypto';
 import { GitHubBot } from './bot.js';
-import { GitHubOAuthClient, exchangeOAuthCode } from './api.js';
 const VALID_EVENTS = ['push', 'issue', 'star', 'fork', 'unstar', 'pull_request'];
 function safeParseEvents(raw) {
     if (Array.isArray(raw))
@@ -19,8 +18,6 @@ function safeParseEvents(raw) {
     }
     return [];
 }
-const oauthStates = new Map();
-const OAUTH_STATE_TTL = 5 * 60 * 1000;
 function formatNotification(event, p) {
     const repo = p.repository.full_name;
     const sender = p.sender.login;
@@ -71,10 +68,14 @@ function formatNotification(event, p) {
     }
 }
 export class GitHubAdapter extends Adapter {
-    get publicUrl() {
-        const bot = this.bots.values().next().value;
-        return bot?.$config.public_url?.replace(/\/+$/, '');
-    }
+    /** 轮询定时器 */
+    _pollTimer = null;
+    /** 每个 repo 的 ETag 缓存 */
+    _etags = new Map();
+    /** 每个 repo 最后处理的事件 ID（防重复） */
+    _lastEventIds = new Map();
+    /** Webhook 是否已激活 */
+    _webhookActive = false;
     constructor(plugin) {
         super(plugin, 'github', []);
     }
@@ -84,210 +85,274 @@ export class GitHubAdapter extends Adapter {
     async start() {
         await super.start();
     }
-    /** 获取第一个可用 bot 的 API (工具用) */
-    getAPI() {
-        const bot = this.bots.values().next().value;
-        return bot?.api || null;
+    async stop() {
+        this.stopPolling();
+        await super.stop();
     }
-    /** 创建 OAuth 状态并返回授权 URL（供 github_bind 工具使用） */
-    createOAuthState(platform, platformUid) {
+    /** 获取第一个可用 bot 的 GhClient (工具用) */
+    getAPI() {
         const bot = this.bots.values().next().value;
-        const clientId = bot?.$config.client_id;
-        if (!clientId)
-            return null;
-        const state = crypto.randomUUID();
-        oauthStates.set(state, { platform, platformUid, expires: Date.now() + OAUTH_STATE_TTL });
-        const base = this.publicUrl || '';
-        return `${base}/pub/github/oauth?state=${state}`;
+        return bot?.gh || null;
     }
-    // ── OAuth 用户查询 ─────────────────────────────────────────────────
-    async getOAuthClient(platform, platformUid) {
+    /** 获取指定用户绑定的 GhClient；未绑定则返回 null */
+    async getUserAPI(platform, platformUid) {
         const db = this.plugin.root?.inject('database');
         const model = db?.models?.get('github_oauth_users');
         if (!model)
             return null;
-        const [row] = await model.select().where({ platform, platform_uid: platformUid });
-        if (!row)
+        const [record] = await model.select().where({ platform, platform_uid: platformUid });
+        if (!record?.access_token)
             return null;
-        return new GitHubOAuthClient(row.access_token);
+        const base = this.getAPI();
+        if (!base)
+            return null;
+        return base.withToken(record.access_token);
+    }
+    /** 获取用户 API，若未绑定则降级为 bot 默认的 API */
+    async getUserOrDefaultAPI(platform, platformUid) {
+        if (platform && platformUid) {
+            const userApi = await this.getUserAPI(platform, platformUid);
+            if (userApi)
+                return userApi;
+        }
+        return this.getAPI();
+    }
+    /** 获取第一个 bot 的 client_id（App 认证时从 /app 自动获取） */
+    getClientId() {
+        const bot = this.bots.values().next().value;
+        return bot?.gh.clientId || null;
+    }
+    /** 获取第一个 bot 的 host 配置 */
+    getHost() {
+        const bot = this.bots.values().next().value;
+        return bot?.$config.host;
     }
-    // ── OAuth 路由 (由 useContext('router') 注入) ─────────────────────
-    setupOAuth(router) {
-        const OAUTH_SCOPES = 'repo,user';
-        router.get('/pub/github/oauth', async (ctx) => {
-            const state = ctx.query.state;
-            if (!state || !oauthStates.has(state)) {
+    /** 获取 App slug（用于生成安装链接） */
+    getAppSlug() {
+        const bot = this.bots.values().next().value;
+        return bot?.gh.appSlug || null;
+    }
+    /** 获取所有已发现的安装信息 */
+    getInstallations() {
+        const bot = this.bots.values().next().value;
+        return bot?.gh.installations || [];
+    }
+    /** 第一个 bot 是否配置了 Webhook */
+    get hasWebhookConfig() {
+        const bot = this.bots.values().next().value;
+        return !!bot?.$config.webhook_secret;
+    }
+    /** Webhook 是否已激活 */
+    get webhookActive() {
+        return this._webhookActive;
+    }
+    // ── Webhook ──────────────────────────────────────────────────────
+    /** 在 router 上挂载 Webhook 路由（生产环境推荐） */
+    setupWebhook(router) {
+        const bot = this.bots.values().next().value;
+        if (!bot?.$config.webhook_secret) {
+            this.plugin.logger.warn('Webhook 配置缺失 webhook_secret，跳过注册');
+            return;
+        }
+        const secret = bot.$config.webhook_secret;
+        const path = bot.$config.webhook_path || '/github/webhook';
+        router.post(path, async (ctx) => {
+            const signature = ctx.get('x-hub-signature-256');
+            const event = ctx.get('x-github-event');
+            const deliveryId = ctx.get('x-github-delivery');
+            if (!signature || !event) {
                 ctx.status = 400;
-                ctx.body = 'Invalid or expired state. Please use /github bind to generate a new link.';
+                ctx.body = { error: 'Missing signature or event header' };
                 return;
             }
-            const bot = this.bots.values().next().value;
-            const clientId = bot?.$config.client_id;
-            if (!clientId) {
-                ctx.status = 500;
-                ctx.body = 'GitHub App OAuth not configured (missing client_id).';
+            // HMAC-SHA256 签名验证
+            const body = ctx.request.rawBody || JSON.stringify(ctx.request.body);
+            const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(body).digest('hex');
+            if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
+                this.plugin.logger.warn(`Webhook 签名验证失败 (delivery: ${deliveryId})`);
+                ctx.status = 401;
+                ctx.body = { error: 'Invalid signature' };
                 return;
             }
-            const base = this.publicUrl || ctx.origin;
-            const redirectUri = `${base}/pub/github/oauth/callback`;
-            const url = `https://github.com/login/oauth/authorize?client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=${OAUTH_SCOPES}&state=${state}`;
-            ctx.redirect(url);
+            const payload = ctx.request.body;
+            ctx.status = 200;
+            ctx.body = { ok: true };
+            // 异步处理事件，不阻塞响应
+            this.handleWebhookPayload(event, payload).catch(e => this.plugin.logger.error(`Webhook 事件处理失败 (${event}):`, e));
         });
-        router.get('/pub/github/oauth/callback', async (ctx) => {
-            const { code, state } = ctx.query;
-            if (!code || !state) {
-                ctx.status = 400;
-                ctx.body = 'Missing code or state parameter.';
-                return;
+        this._webhookActive = true;
+        this.plugin.logger.info(`GitHub Webhook 已注册: POST ${path}`);
+    }
+    /** 处理 Webhook 推送的事件 */
+    async handleWebhookPayload(event, payload) {
+        const bot = this.bots.values().next().value;
+        const repo = payload.repository?.full_name;
+        this.plugin.logger.debug(`Webhook: ${event}${payload.action ? `.${payload.action}` : ''} ${repo || ''}`);
+        // 记录事件到数据库
+        if (repo) {
+            const db = this.plugin.root?.inject('database');
+            const eventsModel = db?.models?.get('github_events');
+            if (eventsModel) {
+                await eventsModel.insert({ id: Date.now(), repo, event_type: event, payload }).catch(() => { });
             }
-            const pending = oauthStates.get(state);
-            if (!pending || Date.now() > pending.expires) {
-                oauthStates.delete(state);
-                ctx.status = 400;
-                ctx.body = 'State expired. Please use /github bind to try again.';
-                return;
+        }
+        // 处理消息类事件（Issue/PR 评论）
+        if (bot && event === 'issue_comment' && payload.action === 'created' && payload.comment) {
+            const message = bot.$formatMessage(payload);
+            const botUser = bot.gh.authenticatedUser;
+            if (!(botUser && message.$sender.id === botUser)) {
+                this.emit('message.receive', message);
             }
-            oauthStates.delete(state);
-            const bot = this.bots.values().next().value;
-            const clientId = bot?.$config.client_id;
-            const clientSecret = bot?.$config.client_secret;
-            if (!clientId || !clientSecret) {
-                ctx.status = 500;
-                ctx.body = 'OAuth not configured.';
-                return;
+        }
+        if (bot && event === 'pull_request_review_comment' && payload.action === 'created' && payload.comment) {
+            const message = bot.formatPRReviewComment(payload);
+            const botUser = bot.gh.authenticatedUser;
+            if (!(botUser && message.$sender.id === botUser)) {
+                this.emit('message.receive', message);
             }
-            try {
-                const tokenData = await exchangeOAuthCode(clientId, clientSecret, code);
-                const oauthClient = new GitHubOAuthClient(tokenData.access_token);
-                const userRes = await oauthClient.getUser();
-                if (!userRes.ok) {
-                    ctx.status = 500;
-                    ctx.body = 'Failed to fetch GitHub user info.';
-                    return;
-                }
-                const ghUser = userRes.data;
-                const db = this.plugin.root?.inject('database');
-                const model = db?.models?.get('github_oauth_users');
-                if (!model) {
-                    ctx.status = 500;
-                    ctx.body = 'Database not ready.';
-                    return;
-                }
-                const [existing] = await model.select().where({ platform: pending.platform, platform_uid: pending.platformUid });
-                if (existing) {
-                    await model.update({
-                        github_login: ghUser.login,
-                        github_id: ghUser.id,
-                        access_token: tokenData.access_token,
-                        scope: tokenData.scope || '',
-                        updated_at: new Date(),
-                    }).where({ id: existing.id });
-                }
-                else {
-                    await model.insert({
-                        id: Date.now(),
-                        platform: pending.platform,
-                        platform_uid: pending.platformUid,
-                        github_login: ghUser.login,
-                        github_id: ghUser.id,
-                        access_token: tokenData.access_token,
-                        scope: tokenData.scope || '',
-                        created_at: new Date(),
-                        updated_at: new Date(),
-                    });
+        }
+        if (bot && event === 'pull_request_review' && payload.action === 'submitted') {
+            const message = bot.formatPRReview(payload);
+            if (message) {
+                const botUser = bot.gh.authenticatedUser;
+                if (!(botUser && message.$sender.id === botUser)) {
+                    this.emit('message.receive', message);
                 }
-                this.plugin.logger.info(`OAuth 绑定成功: ${pending.platform}:${pending.platformUid} → ${ghUser.login}`);
-                ctx.type = 'text/html';
-                ctx.body = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>绑定成功</title><style>body{font-family:system-ui;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}div{text-align:center;background:#fff;padding:3rem;border-radius:12px;box-shadow:0 2px 12px rgba(0,0,0,.1)}h1{color:#28a745;margin-bottom:.5rem}p{color:#666}</style></head><body><div><h1>GitHub 账号绑定成功</h1><p>已绑定 GitHub 用户: <strong>${ghUser.login}</strong></p><p>你现在可以关闭这个页面，回到聊天中使用 GitHub 功能了。</p></div></body></html>`;
-            }
-            catch (err) {
-                this.plugin.logger.error('OAuth callback 失败:', err);
-                ctx.status = 500;
-                ctx.body = `OAuth failed: ${err.message}`;
             }
-        });
-        this.plugin.logger.debug('GitHub OAuth: GET /pub/github/oauth, GET /pub/github/oauth/callback');
+        }
+        // 通知订阅者
+        if (repo) {
+            const genericPayload = {
+                action: payload.action,
+                repository: payload.repository,
+                sender: payload.sender,
+                ref: payload.ref,
+                commits: payload.commits,
+                issue: payload.issue,
+                pull_request: payload.pull_request,
+                forkee: payload.forkee,
+            };
+            await this.dispatchNotification(event, genericPayload);
+        }
     }
-    // ── Webhook 路由 (由 useContext('router') 注入) ────────────────────
-    setupWebhook(router) {
-        router.post('/pub/github/webhook', async (ctx) => {
+    // ── 事件轮询 ────────────────────────────────────────────────────
+    /** 启动事件轮询 */
+    startPolling() {
+        if (this._pollTimer)
+            return;
+        const bot = this.bots.values().next().value;
+        const interval = (bot?.$config.poll_interval || 60) * 1000;
+        this.plugin.logger.info(`GitHub 事件轮询已启动 (间隔 ${interval / 1000}s)`);
+        // 立即执行一次
+        this.pollAllRepos().catch(e => this.plugin.logger.error('轮询失败:', e));
+        this._pollTimer = setInterval(() => {
+            this.pollAllRepos().catch(e => this.plugin.logger.error('轮询失败:', e));
+        }, interval);
+    }
+    /** 停止事件轮询 */
+    stopPolling() {
+        if (this._pollTimer) {
+            clearInterval(this._pollTimer);
+            this._pollTimer = null;
+            this.plugin.logger.debug('GitHub 事件轮询已停止');
+        }
+    }
+    /** 轮询所有已订阅仓库的事件 */
+    async pollAllRepos() {
+        const db = this.plugin.root?.inject('database');
+        const model = db?.models?.get('github_subscriptions');
+        if (!model)
+            return;
+        // 获取所有不重复的订阅仓库
+        const allSubs = await model.select();
+        const repos = [...new Set((allSubs || []).map((s) => s.repo))];
+        if (!repos.length)
+            return;
+        const gh = this.getAPI();
+        if (!gh)
+            return;
+        for (const repo of repos) {
             try {
-                const eventName = ctx.request.headers['x-github-event'];
-                const signature = ctx.request.headers['x-hub-signature-256'];
-                const payload = ctx.request.body;
-                this.plugin.logger.info(`GitHub Webhook: ${eventName} - ${payload?.repository?.full_name || '(no repo)'}`);
-                if (eventName === 'ping') {
-                    this.plugin.logger.info(`GitHub Webhook ping OK — hook_id: ${payload?.hook_id}, zen: ${payload?.zen}`);
-                    ctx.status = 200;
-                    ctx.body = { message: 'pong' };
-                    return;
-                }
-                if (signature) {
-                    let verified = false;
-                    const rawBody = JSON.stringify(payload);
-                    for (const bot of this.bots.values()) {
-                        const secret = bot.$config.webhook_secret;
-                        if (!secret)
-                            continue;
-                        const expected = `sha256=${crypto.createHmac('sha256', secret).update(rawBody).digest('hex')}`;
-                        if (signature === expected) {
-                            verified = true;
-                            break;
-                        }
-                    }
-                    if (!verified) {
-                        const hasSecret = Array.from(this.bots.values()).some(b => b.$config.webhook_secret);
-                        if (hasSecret) {
-                            this.plugin.logger.warn('GitHub Webhook 签名验证失败');
-                            ctx.status = 401;
-                            ctx.body = { error: 'Invalid signature' };
-                            return;
-                        }
-                    }
-                }
-                if (!payload?.repository) {
-                    ctx.status = 400;
-                    ctx.body = { error: 'Invalid payload' };
-                    return;
-                }
-                const db = this.plugin.root?.inject('database');
-                const eventsModel = db?.models?.get('github_events');
-                if (eventsModel) {
-                    await eventsModel.insert({ id: Date.now(), repo: payload.repository.full_name, event_type: eventName, payload });
-                }
-                const bot = this.bots.values().next().value;
-                if (bot) {
-                    let message = null;
-                    if (eventName === 'issue_comment' && payload.action === 'created') {
-                        message = bot.$formatMessage(payload);
-                    }
-                    else if (eventName === 'pull_request_review_comment' && payload.action === 'created') {
-                        message = bot.formatPRReviewComment(payload);
-                    }
-                    else if (eventName === 'pull_request_review' && payload.action === 'submitted') {
-                        message = bot.formatPRReview(payload);
-                    }
-                    if (message) {
-                        const botUser = bot.api.authenticatedUser;
-                        if (botUser && message.$sender.id === botUser) {
-                            this.plugin.logger.debug(`忽略 bot 自身评论: ${message.$sender.id}`);
-                        }
-                        else {
-                            this.emit('message.receive', message);
-                        }
-                    }
-                }
-                await this.dispatchNotification(eventName, payload);
-                ctx.status = 200;
-                ctx.body = { message: 'OK' };
+                await this.pollRepoEvents(repo, gh);
             }
-            catch (error) {
-                this.plugin.logger.error('Webhook 处理失败:', error);
-                ctx.status = 500;
-                ctx.body = { error: 'Internal server error' };
+            catch (e) {
+                this.plugin.logger.warn(`轮询 ${repo} 事件失败:`, e);
             }
-        });
-        this.plugin.logger.debug('GitHub Webhook: POST /pub/github/webhook');
+        }
+    }
+    /** 轮询单个仓库的事件 */
+    async pollRepoEvents(repo, gh) {
+        const etag = this._etags.get(repo);
+        const { events, etag: newEtag } = await gh.listRepoEvents(repo, etag);
+        if (newEtag)
+            this._etags.set(repo, newEtag);
+        if (!events.length)
+            return;
+        const lastId = this._lastEventIds.get(repo);
+        const newEvents = [];
+        for (const ev of events) {
+            if (ev.id === lastId)
+                break;
+            newEvents.push(ev);
+        }
+        if (!newEvents.length)
+            return;
+        // 记录最新事件 ID
+        this._lastEventIds.set(repo, events[0].id);
+        // 首次轮询只记录位置，不触发通知（避免启动时大量回溯）
+        if (!lastId) {
+            this.plugin.logger.debug(`${repo}: 首次轮询，记录位置 (${events[0].id})，跳过 ${events.length} 条历史事件`);
+            return;
+        }
+        this.plugin.logger.debug(`${repo}: ${newEvents.length} 条新事件`);
+        const bot = this.bots.values().next().value;
+        // 按时间正序处理（API 返回倒序）
+        for (const ev of newEvents.reverse()) {
+            const eventName = this.mapEventType(ev.type);
+            if (!eventName)
+                continue;
+            // 构造与 webhook payload 兼容的结构
+            const payload = {
+                action: ev.payload?.action,
+                repository: ev.repo ? { full_name: ev.repo.name, html_url: `https://github.com/${ev.repo.name}`, description: '' } : ev.payload?.repository,
+                sender: { login: ev.actor?.login || '?', id: ev.actor?.id || 0, html_url: `https://github.com/${ev.actor?.login}` },
+                ref: ev.payload?.ref,
+                commits: ev.payload?.commits,
+                issue: ev.payload?.issue,
+                pull_request: ev.payload?.pull_request,
+                forkee: ev.payload?.forkee,
+            };
+            // 记录事件到数据库
+            const db = this.plugin.root?.inject('database');
+            const eventsModel = db?.models?.get('github_events');
+            if (eventsModel) {
+                await eventsModel.insert({ id: Date.now(), repo, event_type: eventName, payload: ev.payload }).catch(() => { });
+            }
+            // 处理消息类事件（Issue/PR 评论）
+            if (bot && eventName === 'issue_comment' && ev.payload?.action === 'created' && ev.payload?.comment) {
+                const message = bot.$formatMessage(ev.payload);
+                const botUser = bot.gh.authenticatedUser;
+                if (!(botUser && message.$sender.id === botUser)) {
+                    this.emit('message.receive', message);
+                }
+            }
+            // 通知订阅者
+            await this.dispatchNotification(eventName, payload);
+        }
+    }
+    /** Events API type → webhook event name */
+    mapEventType(type) {
+        const map = {
+            PushEvent: 'push',
+            IssuesEvent: 'issues',
+            WatchEvent: 'star',
+            ForkEvent: 'fork',
+            PullRequestEvent: 'pull_request',
+            IssueCommentEvent: 'issue_comment',
+            PullRequestReviewEvent: 'pull_request_review',
+            PullRequestReviewCommentEvent: 'pull_request_review_comment',
+        };
+        return map[type] || null;
     }
     // ── 通知推送 ───────────────────────────────────────────────────────
     async dispatchNotification(eventName, payload) {