@zhin.js/adapter-onebot11 1.1.0 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # @zhin.js/adapter-onebot11
 
+## 1.1.2
+
+### Patch Changes
+
+- a9e4a40: Derive Command user routes only from explicit `commands/**/*/index.ts(x)` entry paths instead of prepending the plugin owner. Child plugins can now publish top-level static or dynamic commands, while duplicate routes across owners fail during generation construction. Adapter endpoint commands move to explicit paths such as `commands/qq/endpoint/list/index.ts` and are invoked as `qq endpoint list`.
+- 8740059: Standardize TypeScript capabilities on named module directories such as `commands/foo/index.ts`, `middlewares/audit/index.ts`, `handlers/message-receive/index.ts`, `pages/workroom/index.tsx`, and `mcps/filesystem/index.ts`. Only the fixed `index` entry is discovered; sibling files remain private helpers.
+
+  Command route segments come from directories, while `[name]`, `[[name]]`, `[...name]`, and `[[...name]]` directories declare dynamic parameters. Plugin owners do not enter the route unless their config explicitly sets `commandNamespace`; Endpoint `commandPrefix` remains platform-owned and defaults to an empty string.
+
+  Migrate the built-in adapters, plugins, examples, generators, migration tooling, hot reload classification, Agent authoring surfaces, documentation, and release artifacts to the explicit entry convention.
+
+  Make Tool ownership and progressive disclosure explicit across all four supported locations: plugin-public `tools/`, Agent-private `agents/<name>/tools/`, Skill-private `skills/<name>/tools/`, and Agent-Skill-private `agents/<name>/skills/<name>/tools/`. Move adapter and group-suite operations that require domain instructions into their owning Skills so `load_skill` is the only path that unlocks their schemas.
+
+  Remove the package-root `agent/` convention. Public capabilities now use named package-root directories, schedules use `schedules/<name>/index.ts` or `plugin.ts` injection, MCP connections use `mcps/<name>/index.ts`, Prompt Sections use `prompt-sections/<name>/index.ts`, Agent definitions use `agents/<name>/`, and permission vocabulary is published as `PERMITS.md`.
+
+- 25a845a: Unify Skills on `skills/<name>/SKILL.md`, support Agent-private Skills and nested Skill-private Tools, publish and mount existing plugin Skills, add governed Skill metadata and Turn access filtering, unlock only already-admitted same-owner Tools, and make `on-risk` and `once` approval behavior precise.
+- ddbb92e: Isolate adapter Skills under platform-specific Agents and automatically select the matching platform Agent for IM ingress, preventing unrelated adapter Skills from entering another platform's prompt surface.
+- 4380cf9: Colocate adapter command definitions and Agent Skill handlers with their owning capabilities, and provide a shared validated platform permission constructor.
+- d08d3d3: Require one canonical expanded OneBot 11 endpoint configuration. Remove nested endpoint, environment, `type: ws_reverse`, and standalone heartbeat compatibility surfaces; reverse WebSocket connection replacement, heartbeat, pending actions, and stale-event admission now share the endpoint lifecycle.
+- 5c3858e: Make `@zhin.js/im-contract` the explicit zero-dependency owner of transport identities, canonical segments, media guards, conversation facts, stores, and delivery contracts. Platform adapters now read media contracts from that foundation instead of reaching through Core.
+- 33ea736: Use `tools/<name>/index.ts` and `defineAgentTool` from `@zhin.js/tool` as the sole Agent Tool authoring model. Remove the duplicate `@zhin.js/tools` definition, context, bridge, export, and discovery path; migrate plugin manifests, examples, scaffolding, HMR, and prepack compilation to the generation-owned Tool Feature.
+- Updated dependencies [c861789]
+- Updated dependencies [1414ccb]
+- Updated dependencies [743d470]
+- Updated dependencies [62dee52]
+- Updated dependencies [cd54131]
+- Updated dependencies [244e475]
+- Updated dependencies [a9e4a40]
+- Updated dependencies [5855db7]
+- Updated dependencies [ec921d2]
+- Updated dependencies [8740059]
+- Updated dependencies [63d1f7a]
+- Updated dependencies [25a845a]
+- Updated dependencies [103f2c3]
+- Updated dependencies [9110ab8]
+- Updated dependencies [cd2a888]
+- Updated dependencies [eb3227a]
+- Updated dependencies [b853dba]
+- Updated dependencies [e561309]
+- Updated dependencies [d4c6175]
+- Updated dependencies [7a0e1ca]
+- Updated dependencies [103b5d3]
+- Updated dependencies [5a7a7f7]
+- Updated dependencies [b076eae]
+- Updated dependencies [535fed1]
+- Updated dependencies [73a24b7]
+- Updated dependencies [4380cf9]
+- Updated dependencies [2dbbc15]
+- Updated dependencies [1cb1163]
+- Updated dependencies [be3061e]
+- Updated dependencies [75f8332]
+- Updated dependencies [81935e2]
+- Updated dependencies [f9ed01b]
+- Updated dependencies [ac0ab50]
+- Updated dependencies [5140ce1]
+- Updated dependencies [522d75f]
+- Updated dependencies [a7611b3]
+- Updated dependencies [8823044]
+- Updated dependencies [379439b]
+- Updated dependencies [11c9352]
+- Updated dependencies [6b70e46]
+- Updated dependencies [135ac91]
+- Updated dependencies [140cf0f]
+- Updated dependencies [251e4d2]
+- Updated dependencies [203ad34]
+- Updated dependencies [e6c5113]
+- Updated dependencies [e0f6478]
+- Updated dependencies [baef56b]
+- Updated dependencies [698f16f]
+- Updated dependencies [da0a8e3]
+- Updated dependencies [2fd8017]
+- Updated dependencies [5c3858e]
+- Updated dependencies [33ea736]
+- Updated dependencies [507d602]
+- Updated dependencies [df9f76b]
+  - @zhin.js/core@1.1.37
+  - @zhin.js/tool@1.1.1
+  - @zhin.js/host-http@1.1.1
+  - @zhin.js/adapter@1.1.14
+  - @zhin.js/feature-kit@1.1.1
+  - @zhin.js/agent-feature@1.1.1
+  - @zhin.js/skill@1.1.1
+  - @zhin.js/logger@1.1.1
+  - @zhin.js/im-contract@1.1.1
+  - @zhin.js/permission@1.1.1
+
+## 1.1.1
+
+### Patch Changes
+
+- 33b1582: Update vulnerable dependencies and replace unsafe HTML and protocol-text regular expressions with bounded scanners.
+- Updated dependencies [769e67f]
+  - @zhin.js/adapter@1.1.13
+  - @zhin.js/core@1.1.36
+
 ## 1.1.0
 
 ### Minor Changes

package/README.md

@@ -18,11 +18,13 @@ pnpm add @zhin.js/adapter-onebot11
 
 ## Plugin Runtime
 
-- `@zhin.js/adapter` — 约定式 `adapters/onebot11.ts`（`defineAdapter`）
+- `@zhin.js/adapter` — 约定式 `adapters/onebot11/index.ts`（`defineAdapter`）
 - `@zhin.js/core` — `Endpoint.emit(...)` 入站、`outboundMessageToken` 出站
 - `zhin.js` — `plugin.ts`（`definePlugin`）
 - 配置经插件 `schema.json` 落到 `plugins.<instanceKey>`
 
+`AdapterIndex` 会把实例默认值与 `endpoints[]` 的逐项覆盖合并；协议层只接收一个已经展开的 endpoint 配置，不再读取嵌套 endpoint、旧 `type: ws_reverse` 别名或进程环境。
+
 每个 Endpoint 的 `$client` 是 `@imhelper/onebot-v11` 的 `OneBotV11Client`。业务代码直接调用
 `$client.call(action, params)` 和 Client 的公开平台能力；双工 WS 的 `echo` 响应由 Endpoint
 先行分流，只有事件帧进入 Client 的 `ingest()` 和公开事件流。
@@ -46,7 +48,7 @@ plugins:
     reconnect_interval: 5000
     heartbeat_interval: 30000
     endpoints:
-      - name: ob11-bot
+      - id: ob11-bot
         url: "ws://127.0.0.1:6700"
         access_token: "${ONEBOT11_ACCESS_TOKEN}"
 ```
@@ -74,15 +76,15 @@ plugins:
 
 | 类别 | 路径 |
 |------|------|
-| Permit 词汇 | `agent/PERMITS.md` |
-| 平台工具 | `agent/tools/set_title.ts` → `onebot11_set_title` |
-| 技能说明 | `agent/skills/onebot11.md` |
+| Permit 词汇 | `PERMITS.md` |
+| 平台工具 | `tools/set_title/index.ts` → `onebot11_set_title` |
+| 技能说明 | `agents/onebot11/skills/onebot11/SKILL.md` |
 
 ## 迁移说明（Plugin Runtime）
 
 - **notice / request / meta 侧事件**：经 the unified `Endpoint.emit(...)` ingress 归一后分发到 `handlers`；消息仍走 `outboundMessageToken`。
 - **群管工具暂未迁移**：旧 Adapter 经 `createSceneManagementTools` 注册踢人 / 禁言 / 群名片等成套 agent 工具；迁移后仅保留 `onebot11_set_title`，其余群管能力可通过 `$client.call()`（如 `set_group_kick`、`set_group_ban`）作为逃生舱调用。
-- **平台权限门禁**：`plugin.ts` setup 已注册 `registerDefaultScenePlatformPermitChecker('onebot11')`，`scene_admin` / `scene_owner` 依据入站 metadata 中的 sender `role`（owner / admin）判定。
+- **平台权限门禁**：`plugin.ts` setup 通过 generation-owned `permissionHostToken` 调用 `host.registerPlatform('onebot11', createSceneRolePlatformChecker())`，`scene_admin` / `scene_owner` 依据入站 metadata 中的 sender `role`（owner / admin）判定。
 
 ## 文档链接
 

package/adapters/{onebot11.js → onebot11/index.js}

@@ -1,15 +1,15 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 /**
- * Convention entry: discover `adapters/onebot11.ts` → defineAdapter.
+ * Convention entry: discover `adapters/onebot11/index.ts` → defineAdapter.
  */
 import { defineAdapter } from 'zhin.js/adapter';
 import { httpHostToken } from '@zhin.js/host-http';
-import { OneBot11WsEndpoint } from "../lib/ws-endpoint.js";
-import { OneBot11WssEndpoint } from "../lib/wss-endpoint.js";
-import { resolveOneBot11Config, } from "../lib/protocol.js";
-import { onebot11RuntimeStateToken } from "../lib/onebot11-runtime-state.js";
-export { OneBot11WsEndpoint } from "../lib/ws-endpoint.js";
-export { OneBot11WssEndpoint } from "../lib/wss-endpoint.js";
+import { OneBot11WsEndpoint } from "../../lib/ws-endpoint.js";
+import { OneBot11WssEndpoint } from "../../lib/wss-endpoint.js";
+import { resolveOneBot11Config, } from "../../lib/protocol.js";
+import { onebot11RuntimeStateToken } from "../../lib/onebot11-runtime-state.js";
+export { OneBot11WsEndpoint } from "../../lib/ws-endpoint.js";
+export { OneBot11WssEndpoint } from "../../lib/wss-endpoint.js";
 export default defineAdapter({
     capabilities: ['inbound', 'outbound'],
     operations: ['recall'],
@@ -20,7 +20,7 @@ export default defineAdapter({
     },
     create(context) {
         const config = resolveOneBot11Config(context.config);
-        // 注册到插件运行时状态（onebot11.endpoint list 的"运行中"数据源）
+        // 注册到插件运行时状态（onebot11 endpoint list 的"运行中"数据源）
         context.use(onebot11RuntimeStateToken).endpoints.set(config.id, {
             id: config.id,
             mode: config.connection,

package/adapters/{onebot11.ts → onebot11/index.ts}

@@ -1,29 +1,29 @@
 /**
- * Convention entry: discover `adapters/onebot11.ts` → defineAdapter.
+ * Convention entry: discover `adapters/onebot11/index.ts` → defineAdapter.
  */
 import { defineAdapter } from 'zhin.js/adapter';
 import { httpHostToken } from '@zhin.js/host-http';
-import { OneBot11WsEndpoint } from '../src/ws-endpoint.js';
-import { OneBot11WssEndpoint } from '../src/wss-endpoint.js';
+import { OneBot11WsEndpoint } from '../../src/ws-endpoint.js';
+import { OneBot11WssEndpoint } from '../../src/wss-endpoint.js';
 import {
   resolveOneBot11Config,
-  type OneBot11AdapterConfig,
-} from '../src/protocol.js';
-import { onebot11RuntimeStateToken } from '../src/onebot11-runtime-state.js';
+  type OneBot11EndpointConfig,
+} from '../../src/protocol.js';
+import { onebot11RuntimeStateToken } from '../../src/onebot11-runtime-state.js';
 
-export { OneBot11WsEndpoint } from '../src/ws-endpoint.js';
-export type { OneBot11WsEndpointOptions } from '../src/ws-endpoint.js';
-export { OneBot11WssEndpoint } from '../src/wss-endpoint.js';
-export type { OneBot11WssEndpointOptions } from '../src/wss-endpoint.js';
-export type { OneBot11WsSocket, OneBot11WsCreateOptions } from '../src/ws-types.js';
+export { OneBot11WsEndpoint } from '../../src/ws-endpoint.js';
+export type { OneBot11WsEndpointOptions } from '../../src/ws-endpoint.js';
+export { OneBot11WssEndpoint } from '../../src/wss-endpoint.js';
+export type { OneBot11WssEndpointOptions } from '../../src/wss-endpoint.js';
+export type { OneBot11WsSocket, OneBot11WsCreateOptions } from '../../src/ws-types.js';
 
 declare module '@zhin.js/core' {
   interface AdapterEndpoints {
-    onebot11: import('../src/ws-endpoint.js').OneBot11WsEndpoint;
+    onebot11: import('../../src/ws-endpoint.js').OneBot11WsEndpoint;
   }
 }
 
-export default defineAdapter<OneBot11AdapterConfig>({
+export default defineAdapter<OneBot11EndpointConfig>({
   capabilities: ['inbound', 'outbound'],
   operations: ['recall'],
   // OneBot file 参数原生消费 url / base64:// 媒体；无卡片交互面，交互段降级纯文本。
@@ -33,7 +33,7 @@ export default defineAdapter<OneBot11AdapterConfig>({
   },
   create(context) {
     const config = resolveOneBot11Config(context.config);
-    // 注册到插件运行时状态（onebot11.endpoint list 的"运行中"数据源）
+    // 注册到插件运行时状态（onebot11 endpoint list 的"运行中"数据源）
     context.use(onebot11RuntimeStateToken).endpoints.set(config.id, {
       id: config.id,
       mode: config.connection,

package/agents/onebot11/agent.json

@@ -0,0 +1,20 @@
+{
+  "name": "ONEBOT11 Platform Agent",
+  "version": "1.0.0",
+  "description": "Handles onebot11 platform-specific operations and progressively loads only the required platform Skill.",
+  "trigger_rules": {
+    "file_patterns": [],
+    "keywords": [
+      "onebot11",
+      "adapter:onebot11"
+    ]
+  },
+  "entry_points": [
+    "system.md",
+    "boundaries.md",
+    "conventions.md"
+  ],
+  "platforms": [
+    "onebot11"
+  ]
+}

package/agents/onebot11/boundaries.md

@@ -0,0 +1,3 @@
+# Boundaries
+
+Operate only on the active onebot11 endpoint and authenticated conversation context. Respect every Tool permission and approval policy. Do not infer identifiers, roles, or authorization from display names.

package/agents/onebot11/conventions.md

@@ -0,0 +1,3 @@
+# Conventions
+
+Use stable platform identifiers from the current turn or directory queries. Load one task-specific Skill at a time, and use the unified reply and outbound message path.

package/agents/onebot11/skills/onebot11/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: onebot11
+platforms: [onebot11]
+description: OneBot 11 消息通道与群专属头衔设置能力。
+keywords: [onebot11, qq, title, 头衔]
+tags: [adapter, messaging]
+tools:
+  - set_title
+---
+
+# OneBot 11
+
+`set_title` 用于设置群成员专属头衔。执行前确认群、目标用户和头衔文本，并遵守 Tool 自身审批与平台权限。
+
+当前 Agent Tool 不提供踢人、禁言、管理员、群名片、成员列表或群信息操作。

package/agents/onebot11/skills/onebot11/tools/set_title/index.js

@@ -0,0 +1,25 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
+import { defineAgentTool } from '@zhin.js/tool';
+import { z } from 'zod';
+export default defineAgentTool({
+    description: '设置 QQ 群成员的专属头衔。只有群主才能设置。',
+    inputSchema: z.object({
+        group_id: z.number().describe('目标群号'),
+        user_id: z.number().describe('目标成员 QQ号'),
+        title: z.string().describe('头衔文字'),
+    }),
+    adapter: 'onebot11',
+    tags: ['onebot11'],
+    permissions: ['platform(onebot11,scene_owner)'],
+    async execute({ group_id, user_id, title }, context) {
+        const client = context.$client;
+        const response = await client.call('set_group_special_title', {
+            group_id,
+            user_id,
+            special_title: title,
+            duration: -1,
+        });
+        const success = response.status === 'ok';
+        return { success, message: success ? `已将 ${user_id} 的头衔设为 "${title}"` : '设置失败' };
+    },
+});

package/{agent/tools/set_title.ts → agents/onebot11/skills/onebot11/tools/set_title/index.ts}

@@ -1,4 +1,4 @@
-import { defineAgentTool } from '@zhin.js/agent/tools';
+import { defineAgentTool } from '@zhin.js/tool';
 import { z } from 'zod';
 export default defineAgentTool<{ group_id: number; user_id: number; title: string }>({
   description: '设置 QQ 群成员的专属头衔。只有群主才能设置。',

package/agents/onebot11/system.md

@@ -0,0 +1,3 @@
+# ONEBOT11 Platform Agent
+
+You are the onebot11 platform specialist. Interpret requests in the current onebot11 conversation and load only the narrowest private Skill needed for the task.

package/commands/{endpoint/add/[id].js → onebot11/endpoint/add/[id]/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { onebot11EndpointCommands } from "../../../lib/onebot11-endpoint-commands.js";
+import { onebot11EndpointCommands } from '../../definition.js';
 export default onebot11EndpointCommands.add;

package/commands/onebot11/endpoint/add/[id]/index.ts

@@ -0,0 +1,3 @@
+import { onebot11EndpointCommands } from '../../definition.js';
+
+export default onebot11EndpointCommands.add;

package/{lib/onebot11-endpoint-commands.js → commands/onebot11/endpoint/definition.js}

@@ -1,10 +1,11 @@
+// Generated by build-plugin-runtime-entries.mjs. Do not edit.
 /**
- * `onebot11.endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
- * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ * `onebot11 endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/onebot11/endpoint/ 下的 list / add / remove 直接默认导出这三项。
  */
 import { createEndpointCommands } from 'zhin.js/adapter';
 import { defineCommand } from 'zhin.js/command';
-import { onebot11RuntimeStateToken } from './onebot11-runtime-state.js';
+import { onebot11RuntimeStateToken } from "../../../lib/onebot11-runtime-state.js";
 export const onebot11EndpointCommands = createEndpointCommands({
     adapterKey: 'onebot11',
     adapterDisplayName: 'OneBot 11',

package/{src/onebot11-endpoint-commands.ts → commands/onebot11/endpoint/definition.ts}

@@ -1,10 +1,10 @@
 /**
- * `onebot11.endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
- * commands/endpoint/ 下的 list / add / remove 直接默认导出这三项。
+ * `onebot11 endpoint` 命令族：由 @zhin.js/adapter 的 createEndpointCommands 套件生成。
+ * commands/onebot11/endpoint/ 下的 list / add / remove 直接默认导出这三项。
  */
 import { createEndpointCommands } from 'zhin.js/adapter';
 import { defineCommand } from 'zhin.js/command';
-import { onebot11RuntimeStateToken } from './onebot11-runtime-state.js';
+import { onebot11RuntimeStateToken } from '../../../src/onebot11-runtime-state.js';
 
 export const onebot11EndpointCommands = createEndpointCommands({
   adapterKey: 'onebot11',

package/commands/{endpoint/list.js → onebot11/endpoint/list/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { onebot11EndpointCommands } from "../../lib/onebot11-endpoint-commands.js";
+import { onebot11EndpointCommands } from '../definition.js';
 export default onebot11EndpointCommands.list;

package/commands/onebot11/endpoint/list/index.ts

@@ -0,0 +1,3 @@
+import { onebot11EndpointCommands } from '../definition.js';
+
+export default onebot11EndpointCommands.list;

package/commands/{endpoint/remove/[id].js → onebot11/endpoint/remove/[id]/index.js}

@@ -1,3 +1,3 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
-import { onebot11EndpointCommands } from "../../../lib/onebot11-endpoint-commands.js";
+import { onebot11EndpointCommands } from '../../definition.js';
 export default onebot11EndpointCommands.remove;

package/commands/onebot11/endpoint/remove/[id]/index.ts

@@ -0,0 +1,3 @@
+import { onebot11EndpointCommands } from '../../definition.js';
+
+export default onebot11EndpointCommands.remove;

package/lib/index.d.ts

@@ -1,8 +1,8 @@
-export { buildSendAction, buildWsConnectOptions, extractQuoteId, formatInboundContent, formatInboundMetadata, formatOutboundSegments, getChannelId, isMessageEvent, isOneBot11BotMentioned, mediaRefToOneBotFile, onebot11InboundConversation, resolveOneBot11Config, senderDisplayName, senderNickname, senderUserId, type OneBot11ActionRequest, type OneBot11ActionResponse, type OneBot11AdapterConfig, type OneBot11ConfigBase, type OneBot11EndpointConfig, type OneBot11Event, type OneBot11Segment, type OneBot11Sender, type OneBot11WireSegment, type OneBot11WsConfig, type OneBot11WssConfig, type ResolvedOneBot11Config, } from './protocol.js';
+export { buildSendAction, buildWsConnectOptions, extractQuoteId, formatInboundContent, formatInboundMetadata, formatOutboundSegments, getChannelId, isMessageEvent, isOneBot11BotMentioned, mediaRefToOneBotFile, onebot11InboundConversation, resolveOneBot11Config, senderDisplayName, senderNickname, senderUserId, type OneBot11ActionRequest, type OneBot11ActionResponse, type OneBot11ConfigBase, type OneBot11EndpointConfig, type OneBot11Event, type OneBot11Segment, type OneBot11Sender, type OneBot11WireSegment, type OneBot11WsConfig, type OneBot11WssConfig, type ResolvedOneBot11Config, } from './protocol.js';
 export { OneBot11WsEndpoint, type OneBot11WsEndpointOptions, } from './ws-endpoint.js';
 export { OneBot11WssEndpoint, type OneBot11WssEndpointOptions, } from './wss-endpoint.js';
 export type { OneBot11WsSocket, OneBot11WsCreateOptions } from './ws-types.js';
-export { callOneBot11WsAction, decodeWsPayload, handleOneBot11WsMessage, rejectAllPending, startOneBot11Heartbeat, } from './ws-transport.js';
+export { callOneBot11WsAction, decodeWsPayload, handleOneBot11WsMessage, rejectAllPending, } from './ws-transport.js';
 export { verifyOneBotAccessToken } from './wss-auth.js';
 export { Onebot11Client, onebot11Client, type Onebot11ClientEventMap, } from './client.js';
 export type { OneBotV11ActionUrlResolver, OneBotV11AdapterConfig as ImHelperOneBotV11AdapterConfig, OneBotV11Call, OneBotV11ClientConfig, OneBotV11Event as ImHelperOneBotV11Event, OneBotV11Response, } from '@imhelper/onebot-v11';

package/lib/index.js

@@ -1,7 +1,7 @@
 export { buildSendAction, buildWsConnectOptions, extractQuoteId, formatInboundContent, formatInboundMetadata, formatOutboundSegments, getChannelId, isMessageEvent, isOneBot11BotMentioned, mediaRefToOneBotFile, onebot11InboundConversation, resolveOneBot11Config, senderDisplayName, senderNickname, senderUserId, } from './protocol.js';
 export { OneBot11WsEndpoint, } from './ws-endpoint.js';
 export { OneBot11WssEndpoint, } from './wss-endpoint.js';
-export { callOneBot11WsAction, decodeWsPayload, handleOneBot11WsMessage, rejectAllPending, startOneBot11Heartbeat, } from './ws-transport.js';
+export { callOneBot11WsAction, decodeWsPayload, handleOneBot11WsMessage, rejectAllPending, } from './ws-transport.js';
 export { verifyOneBotAccessToken } from './wss-auth.js';
 export { Onebot11Client, onebot11Client, } from './client.js';
 export { ProtocolError } from '@imhelper/onebot-v11';

package/lib/onebot11-runtime-state.js

@@ -1,6 +1,6 @@
 /**
  * OneBot11 插件实例的运行时状态：adapter create() 注册的 endpoint 列表。
- * 由 plugin.ts setup() provide，adapter create 与 `onebot11.endpoint` 命令共享（同一 owner generation）。
+ * 由 plugin.ts setup() provide，adapter create 与 `onebot11 endpoint` 命令共享（同一 owner generation）。
  */
 import { defineEndpointRuntimeStateToken } from 'zhin.js/adapter';
 export const onebot11RuntimeStateToken = defineEndpointRuntimeStateToken('onebot11');

package/lib/protocol.d.ts

@@ -3,32 +3,16 @@
  * Canonicalization is owned by gateway/core before endpoint.send.
  * Spec: https://github.com/botuniverse/onebot-11
  */
-import { type MediaRef } from '@zhin.js/core';
-import type { ConversationRef } from '@zhin.js/im-contract';
-/** Transitional legacy endpoint row (`endpoints[]` with `context: onebot11`). */
-export interface OneBot11LegacyEndpointRow {
-    readonly context?: string;
+import { type MediaRef, type ConversationRef } from '@zhin.js/im-contract';
+/** One endpoint config after AdapterIndex expands `plugins.<instanceKey>.endpoints`. */
+export interface OneBot11EndpointConfig {
     readonly connection?: 'ws' | 'wss';
-    /** Legacy alias: `type: 'ws' | 'ws_reverse'` */
-    readonly type?: string;
-    readonly id?: string;
-    readonly access_token?: string;
-    readonly url?: string;
-    readonly path?: string;
-    readonly reconnect_interval?: number;
-    readonly heartbeat_interval?: number;
-}
-/** Plugin Runtime owner config (`plugins.<instanceKey>` / schema.json). */
-export interface OneBot11AdapterConfig {
-    readonly connection?: 'ws' | 'wss';
-    readonly id?: string;
+    readonly id: string;
     readonly access_token?: string;
     readonly url?: string;
     readonly path?: string;
     readonly reconnect_interval?: number;
     readonly heartbeat_interval?: number;
-    /** Transitional: legacy root `endpoints[]` with `context: onebot11`. */
-    readonly endpoints?: ReadonlyArray<OneBot11LegacyEndpointRow>;
 }
 export interface OneBot11ConfigBase {
     readonly context: 'onebot11';
@@ -49,7 +33,6 @@ export interface OneBot11WssConfig extends OneBot11ConfigBase {
     readonly heartbeat_interval: number;
 }
 export type ResolvedOneBot11Config = OneBot11WsConfig | OneBot11WssConfig;
-export type OneBot11EndpointConfig = ResolvedOneBot11Config;
 export interface OneBot11Sender {
     readonly role?: string;
     readonly nickname?: string;
@@ -92,7 +75,7 @@ export interface OneBot11WireSegment {
     readonly type: string;
     readonly data?: Record<string, unknown>;
 }
-export declare function resolveOneBot11Config(config?: OneBot11AdapterConfig): ResolvedOneBot11Config;
+export declare function resolveOneBot11Config(config: OneBot11EndpointConfig): ResolvedOneBot11Config;
 /** 判断是否为消息事件（post_type=message） */
 export declare function isMessageEvent(ev: OneBot11Event): ev is OneBot11Event & {
     message_id: number | string;

package/lib/protocol.js

@@ -3,57 +3,53 @@
  * Canonicalization is owned by gateway/core before endpoint.send.
  * Spec: https://github.com/botuniverse/onebot-11
  */
-import { isMediaRef } from '@zhin.js/core';
+import { isMediaRef } from '@zhin.js/im-contract';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 const logger = getLogger('onebot11');
-function normalizeConnection(connection, legacyType) {
+function normalizeConnection(connection) {
     if (connection === 'ws' || connection === 'wss')
         return connection;
-    if (legacyType === 'ws_reverse' || legacyType === 'wss')
-        return 'wss';
-    if (legacyType === 'ws')
-        return 'ws';
     return 'ws';
 }
-export function resolveOneBot11Config(config = {}) {
-    const entry = config.endpoints?.find((item) => item.context === 'onebot11');
-    const connection = normalizeConnection(config.connection ?? entry?.connection, entry?.type);
-    const id = (typeof config.id === 'string' && config.id)
-        || (typeof entry?.id === 'string' && entry.id)
-        || process.env.ONEBOT11_BOT_NAME
-        || 'onebot11-bot';
-    const access_token = config.access_token ?? entry?.access_token;
+export function resolveOneBot11Config(config) {
+    const connection = normalizeConnection(config.connection);
+    const id = requiredEndpointField(config.id, 'id');
+    const access_token = optionalEndpointField(config.access_token);
     if (connection === 'ws') {
-        const url = config.url ?? entry?.url;
-        if (!url) {
-            throw new TypeError('OneBot11 connection:ws requires url (plugins.<key>.url or endpoints with context: onebot11)');
-        }
+        const url = requiredEndpointField(config.url, 'url');
         return {
             context: 'onebot11',
             connection: 'ws',
             id,
             access_token,
             url,
-            reconnect_interval: config.reconnect_interval ?? entry?.reconnect_interval ?? 5000,
-            heartbeat_interval: config.heartbeat_interval ?? entry?.heartbeat_interval ?? 30_000,
+            reconnect_interval: config.reconnect_interval ?? 5000,
+            heartbeat_interval: config.heartbeat_interval ?? 30_000,
         };
     }
     if (connection === 'wss') {
-        const path = config.path ?? entry?.path;
-        if (!path) {
-            throw new TypeError('OneBot11 connection:wss requires path');
-        }
+        const path = requiredEndpointField(config.path, 'path');
         return {
             context: 'onebot11',
             connection: 'wss',
             id,
             access_token,
             path,
-            heartbeat_interval: config.heartbeat_interval ?? entry?.heartbeat_interval ?? 30_000,
+            heartbeat_interval: config.heartbeat_interval ?? 30_000,
         };
     }
     throw new TypeError(`Unknown OneBot11 connection: ${String(connection)}`);
 }
+function requiredEndpointField(value, field) {
+    const resolved = optionalEndpointField(value);
+    if (!resolved) {
+        throw new TypeError(`OneBot11 endpoint requires a non-empty ${field}`);
+    }
+    return resolved;
+}
+function optionalEndpointField(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
 /** 判断是否为消息事件（post_type=message） */
 export function isMessageEvent(ev) {
     return ev.post_type === 'message' && ev.message_id != null;
@@ -91,9 +87,24 @@ export function formatInboundContent(ev) {
             .join('');
     }
     return typeof ev.raw_message === 'string'
-        ? ev.raw_message.replace(/\[CQ:[^\]]+\]/g, '').trim()
+        ? stripCqCodes(ev.raw_message).trim()
         : '';
 }
+function stripCqCodes(input) {
+    let result = '';
+    let cursor = 0;
+    while (cursor < input.length) {
+        const start = input.indexOf('[CQ:', cursor);
+        if (start < 0)
+            return result + input.slice(cursor);
+        result += input.slice(cursor, start);
+        const end = input.indexOf(']', start + 4);
+        if (end < 0)
+            return result + input.slice(start);
+        cursor = end + 1;
+    }
+    return result;
+}
 export function senderDisplayName(ev) {
     const name = ev.sender?.card || ev.sender?.nickname;
     if (typeof name === 'string' && name)

package/lib/ws-transport.d.ts

@@ -9,5 +9,4 @@ export declare function handleOneBot11WsMessage(data: unknown, options: {
 export declare function callOneBot11WsAction(ws: OneBot11WsSocket | undefined, pending: Map<string, OneBot11PendingAction>, requestId: {
     value: number;
 }, action: string, params: Record<string, unknown>): Promise<OneBot11ActionResponse>;
-export declare function startOneBot11Heartbeat(ws: OneBot11WsSocket | undefined, intervalMs: number, existingTimer?: NodeJS.Timeout): NodeJS.Timeout;
 export declare function rejectAllPending(pending: Map<string, OneBot11PendingAction>, message?: string): void;

package/lib/ws-transport.js

@@ -1,4 +1,4 @@
-import { clearInterval, clearTimeout, setInterval, setTimeout } from 'node:timers';
+import { clearTimeout, setTimeout } from 'node:timers';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 import { WS_OPEN, } from './ws-types.js';
 const logger = getLogger('onebot11');
@@ -50,18 +50,6 @@ export function callOneBot11WsAction(ws, pending, requestId, action, params) {
         ws.send(JSON.stringify(req));
     });
 }
-export function startOneBot11Heartbeat(ws, intervalMs, existingTimer) {
-    if (existingTimer)
-        clearInterval(existingTimer);
-    return setInterval(() => {
-        try {
-            ws?.ping?.();
-        }
-        catch {
-            /* ignore */
-        }
-    }, intervalMs);
-}
 export function rejectAllPending(pending, message = '连接已关闭') {
     for (const [, entry] of pending) {
         clearTimeout(entry.timeout);