@zhin.js/adapter-onebot11 1.1.25 → 1.1.27

package/lib/wss-endpoint.d.ts

@@ -2,7 +2,7 @@
  * OneBot11 reverse WSS endpoint — accepts inbound WebSocket from OneBot implementation.
  */
 import { endpointSpec, type Endpoint, type EndpointSpecification } from 'zhin.js/adapter';
-import type { HttpHost } from '@zhin.js/host-http';
+import { type HttpHost } from '@zhin.js/host-http';
 import type { CapabilityId } from 'zhin.js';
 import { type OneBot11WssConfig } from './protocol.js';
 import { Onebot11Client } from './client.js';

package/lib/wss-endpoint.js

@@ -4,13 +4,14 @@ import { EndpointDeliveryError } from '@zhin.js/im-contract';
  * OneBot11 reverse WSS endpoint — accepts inbound WebSocket from OneBot implementation.
  */
 import { createEndpointSpecification, endpointSpec, createEndpointLifecycle, createRecallEndpointControl, } from 'zhin.js/adapter';
+import { verifyProtocolAccessToken } from '@zhin.js/host-http';
 import { formatCompact, getAdapterLogger } from '@zhin.js/logger';
 import { createOneBot11EndpointManagement } from './endpoint-management.js';
-import { buildSendAction, formatInboundContent, formatInboundMetadata, formatOutboundSegments, isMessageEvent, onebot11InboundConversation, senderDisplayName, senderUserId, } from './protocol.js';
+import { buildSendAction, formatInboundContent, formatInboundMetadata, formatOutboundSegments, isMessageEvent, onebot11InboundConversation, senderDisplayName, onebot11SenderStanding, senderUserId, } from './protocol.js';
 import { receiveOneBot11SideEvent } from './side-event-dispatch.js';
 import { createOneBot11ContentPort } from './content-port.js';
-import { verifyOneBotAccessToken } from './wss-auth.js';
 import { createOneBot11Rpc } from './ws-transport.js';
+import { socketOfConnection } from './ws-types.js';
 import { probeOnebot11SelfId, resolveOnebot11SelfId } from './self-id.js';
 import { callOnebot11Client, readOnebot11Response, onebot11ClientOptions, forwardOnebot11ClientEvents, Onebot11Client } from './client.js';
 export class OneBot11WssEndpoint extends Onebot11Client {
@@ -83,15 +84,16 @@ export class OneBot11WssEndpoint extends Onebot11Client {
             return;
         this.#stopped = false;
         if (!this.#options.config.access_token) {
-            // wss 模式未配 access_token 时任何连接都会被放行（verifyOneBotAccessToken 直接 return true）
+            // 未配 access_token 时只接受本机回环连接（verifyProtocolAccessToken）。
             this.#logger.warn(formatCompact({
                 endpoint: this.#options.config.id,
                 mode: 'wss',
                 ok: false,
-                error: 'missing access_token',
+                error: 'missing access_token: only loopback peers are accepted',
             }));
         }
-        const handle = this.#options.http.ws(this.#options.config.path);
+        // The peer authenticates with this endpoint's own access_token, not a Console credential.
+        const handle = this.#options.http.ws(this.#options.config.path, { auth: 'protocol' });
         this.#wsRelease = handle.onConnection((connection) => {
             this.#connectionTask = this.#connectionTask
                 .then(() => this.#acceptConnection(connection))
@@ -158,6 +160,7 @@ export class OneBot11WssEndpoint extends Onebot11Client {
         }
         const conversation = { ...onebot11InboundConversation(String(this.#options.id), ev), endpoint: this[endpointSpec].identity };
         const inbound = formatInboundMetadata(ev, this.#options.config.id);
+        const platform = onebot11SenderStanding(ev);
         void this[endpointSpec].events.message({
             event: ev,
             ...(typeof ev.time === 'number' ? { platformSentAt: ev.time * 1000 } : {}),
@@ -167,7 +170,7 @@ export class OneBot11WssEndpoint extends Onebot11Client {
             sender: {
                 id: senderUserId(ev),
                 name: senderDisplayName(ev) || undefined,
-                ...(ev.sender?.role ? { roles: [ev.sender.role] } : {}),
+                ...(platform ? { platform } : {}),
             },
             endpointId: inbound.endpointId,
             ...(inbound.mentioned ? { mentioned: true } : {}),
@@ -203,14 +206,14 @@ export class OneBot11WssEndpoint extends Onebot11Client {
     }
     async #acceptConnection(connection) {
         if (!this.#started || this.#stopped) {
-            connection.socket.close();
+            connection.close();
             return;
         }
-        if (!verifyOneBotAccessToken(this.#options.config.access_token, connection.request)) {
-            connection.socket.close(4003, 'Unauthorized');
+        if (!verifyProtocolAccessToken(this.#options.config.access_token, connection)) {
+            connection.close(4003, 'Unauthorized');
             return;
         }
-        const socket = connection.socket;
+        const socket = socketOfConnection(connection);
         await this.#connectionLifecycle.stop();
         this.#rpc.disconnect('连接已替换');
         await this.#connectionLifecycle.start(async (lifecycleHandle) => {
@@ -229,18 +232,7 @@ export class OneBot11WssEndpoint extends Onebot11Client {
                 if (this.#ws === socket)
                     this.#ws = undefined;
             });
-            this.#connectionLifecycle.startHeartbeat(() => {
-                try {
-                    socket.ping?.();
-                }
-                catch {
-                    /* ignore */
-                }
-            }, this.#options.config.heartbeat_interval);
-            socket.on('pong', () => {
-                if (this.#ws === socket)
-                    this.#connectionLifecycle.notifyHeartbeatAck();
-            });
+            // Dead-peer detection is the Host transport's keepalive (protocol ping / pong).
             socket.on('message', (data) => {
                 if (this.#ws !== socket || this.#connectionLifecycle.state === 'closed')
                     return;
@@ -267,7 +259,7 @@ export class OneBot11WssEndpoint extends Onebot11Client {
         this.#logger.debug(formatCompact({
             endpoint: this.#options.config.id,
             mode: 'wss',
-            peer: connection.request.socket.remoteAddress,
+            peer: connection.remoteAddress,
         }));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-onebot11",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "description": "Zhin.js OneBot 11 adapter for Plugin Runtime (WebSocket client)",
   "type": "module",
   "main": "./lib/index.js",
@@ -19,7 +19,6 @@
     "schema.json",
     "src",
     "lib",
-    "tools",
     "agents",
     "README.md",
     "CHANGELOG.md",
@@ -38,42 +37,41 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/zhinjs/zhin",
+    "url": "git+https://github.com/zhinjs/zhin.git",
     "directory": "plugins/adapters/onebot11"
   },
   "dependencies": {
     "@imhelper/onebot-v11": "1.0.7",
     "imhelper": "1.0.7",
     "ws": "^8.21.1",
-    "@zhin.js/adapter-onebot-events": "0.0.4",
-    "@zhin.js/adapter": "1.1.31",
-    "@zhin.js/agent-feature": "1.1.16",
-    "@zhin.js/console-contract": "1.1.5",
-    "@zhin.js/core": "1.1.59",
-    "@zhin.js/feature-kit": "1.1.15",
-    "@zhin.js/host-http": "1.1.17",
-    "@zhin.js/im-contract": "1.1.13",
-    "@zhin.js/logger": "1.1.2",
-    "@zhin.js/page": "1.1.17",
-    "@zhin.js/permission": "1.1.15",
-    "@zhin.js/skill": "1.1.16",
-    "@zhin.js/tool": "1.1.18"
+    "zod": "^4.6.7",
+    "@zhin.js/adapter": "1.1.33",
+    "@zhin.js/adapter-onebot-events": "0.0.6",
+    "@zhin.js/agent-feature": "1.1.17",
+    "@zhin.js/console-contract": "1.1.6",
+    "@zhin.js/core": "1.2.0",
+    "@zhin.js/feature-kit": "1.1.16",
+    "@zhin.js/host-http": "1.2.0",
+    "@zhin.js/im-contract": "1.1.14",
+    "@zhin.js/logger": "1.1.3",
+    "@zhin.js/page": "1.1.18",
+    "@zhin.js/permission": "1.2.0",
+    "@zhin.js/skill": "1.1.17",
+    "@zhin.js/tool": "1.1.19"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
     "@types/ws": "^8.18.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "@zhin.js/host-http": "1.1.17",
-    "zhin.js": "1.1.24"
+    "@zhin.js/host-http": "1.2.0",
+    "zhin.js": "1.1.26"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
-    "@zhin.js/adapter": "^1.1.31",
-    "@zhin.js/command": "^1.1.17",
-    "@zhin.js/core": "^1.1.59",
-    "zhin.js": "^1.1.24"
+    "@zhin.js/adapter": "^1.1.33",
+    "@zhin.js/command": "^1.2.0",
+    "@zhin.js/core": "^1.2.0",
+    "zhin.js": "^1.1.26"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
@@ -81,9 +79,6 @@
     },
     "zhin.js": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "author": {
@@ -135,6 +130,7 @@
   "scripts": {
     "build": "tsc",
     "clean": "rimraf lib",
-    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/adapters/onebot11/tests"
+    "test": "pnpm run test:types && vitest run --root ../../.. plugins/adapters/onebot11/tests",
+    "test:types": "tsc -p tsconfig.type-tests.json"
   }
 }

package/plugin.js

@@ -1,6 +1,5 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { definePlugin } from 'zhin.js';
-import { permissionHostToken, createSceneRolePlatformChecker } from '@zhin.js/permission';
 import { createOnebot11ConsoleRpc } from "./lib/console.js";
 export default definePlugin({
     name: 'onebot11',
@@ -9,12 +8,8 @@ export default definePlugin({
         displayName: 'OneBot 11 Adapter',
     },
     setup(context) {
-        const dispose = context.resources.has(permissionHostToken)
-            ? context.resources.use(permissionHostToken).registerPlatform('onebot11', createSceneRolePlatformChecker())
-            : undefined;
         return {
             consoleRpc: createOnebot11ConsoleRpc(context.resources, () => context.config.get()),
-            ...(dispose ? { dispose } : {}),
         };
     },
 });

package/schema.json

@@ -20,34 +20,6 @@
       "type": "number",
       "default": 30000
     },
-    "master": {
-      "type": [
-        "string",
-        "number"
-      ],
-      "description": "框架 master（platform user id；AI/工具权限、endpoint 管理）。endpoints[i].master 可逐项覆盖",
-      "x-i18n": {
-        "en": {
-          "description": "Framework masters (platform user id; AI/tool permissions and endpoint management). endpoints[i].master can override this value."
-        }
-      }
-    },
-    "trusted": {
-      "type": "array",
-      "items": {
-        "type": [
-          "string",
-          "number"
-        ],
-        "description": "Trusted platform user id"
-      },
-      "description": "框架 trusted 用户列表（弱于 master）。endpoints[i].trusted 可逐项追加",
-      "x-i18n": {
-        "en": {
-          "description": "Framework trusted users, below master authority. endpoints[i].trusted can add users."
-        }
-      }
-    },
     "endpoints": {
       "type": "array",
       "minItems": 1,
@@ -56,34 +28,6 @@
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "master": {
-            "type": [
-              "string",
-              "number"
-            ],
-            "description": "本 endpoint 的框架 master（platform user id）；覆盖顶层 master",
-            "x-i18n": {
-              "en": {
-                "description": "Framework masters for this endpoint (platform user id), overriding the top-level master list."
-              }
-            }
-          },
-          "trusted": {
-            "type": "array",
-            "items": {
-              "type": [
-                "string",
-                "number"
-              ],
-              "description": "Trusted platform user id"
-            },
-            "description": "本 endpoint 的 trusted 列表",
-            "x-i18n": {
-              "en": {
-                "description": "Trusted users for this endpoint."
-              }
-            }
-          },
           "connection": {
             "type": "string",
             "enum": [

package/src/console-spec.ts

@@ -7,9 +7,38 @@ export const onebot11ConsoleSpec = {
   adapterKey: 'onebot11',
   adapterDisplayName: 'OneBot 11',
   fields: [
-    { key: 'url', description: 'OneBot 实现 WebSocket URL（connection: ws 必填）', descriptionI18n: { en: 'OneBot WebSocket URL (required for connection: ws)' } },
-    { key: 'path', description: 'reverse-wss 路径（connection: wss）', descriptionI18n: { en: 'Reverse WebSocket path (connection: wss)' } },
-    { key: 'access_token', env: true, description: 'OneBot access token' },
+    {
+      key: 'url',
+      label: '正向 WebSocket 地址',
+      labelI18n: { en: 'Forward WebSocket URL' },
+      group: '连接模式',
+      groupI18n: { en: 'Connection Mode' },
+      placeholder: 'ws://127.0.0.1:3001',
+      description: 'OneBot 实现 WebSocket URL（connection: ws 必填）',
+      descriptionI18n: { en: 'OneBot WebSocket URL (required for connection: ws)' },
+    },
+    {
+      key: 'path',
+      label: '反向 WebSocket 路径',
+      labelI18n: { en: 'Reverse WebSocket Path' },
+      group: '连接模式',
+      groupI18n: { en: 'Connection Mode' },
+      placeholder: '/onebot/v11/ws',
+      description: 'reverse-wss 路径（connection: wss）',
+      descriptionI18n: { en: 'Reverse WebSocket path (connection: wss)' },
+    },
+    {
+      key: 'access_token',
+      env: true,
+      label: 'Access Token (访问令牌)',
+      labelI18n: { en: 'Access Token' },
+      group: '安全认证',
+      groupI18n: { en: 'Authentication' },
+      placeholder: '与 OneBot 协议端一致的 Token',
+      placeholderI18n: { en: 'Token matching OneBot server config' },
+      description: 'OneBot 11 接口鉴权令牌（Access Token）',
+      descriptionI18n: { en: 'OneBot access token' },
+    },
   ] as readonly AdapterConsoleField[],
   docsUrl: 'https://zhin.js.org/adapters/onebot11',
   readPermission: 'onebot11:read',

package/src/endpoint-management.ts

@@ -15,16 +15,49 @@ import {
   type EndpointGroupRequest,
   type PendingRpcRequest,
 } from 'zhin.js/adapter';
+import { standingFromMemberRole, type PlatformStanding, type SelfStandingRequest } from '@zhin.js/im-contract';
 
 /** 管理面只依赖 endpoint 的 callApi（ws/wss 两种传输各自实现）。 */
 export interface OneBot11ManagementCaller {
   callApi(request: PendingRpcRequest): Promise<unknown>;
 }
 
+/** How long one `get_login_info` answer is reused (bursts only; see inspectSelfStanding). */
+const SELF_ID_TTL_MS = 5_000;
+
 export function createOneBot11EndpointManagement(
   endpoint: OneBot11ManagementCaller,
 ): EndpointManagement {
+  // The login account can change across reconnects (or a different account on the same
+  // connection), so `get_login_info` is not remembered for the endpoint's lifetime: only briefly,
+  // to coalesce bursts, and never across a failed lookup.
+  let login: { readonly id: string; readonly at: number } | undefined;
+  const loginId = async (signal: AbortSignal | undefined): Promise<string | undefined> => {
+    if (login && Date.now() - login.at < SELF_ID_TTL_MS) return login.id;
+    login = undefined;
+    const info = asRecord(await endpoint.callApi({ action: 'get_login_info', signal }));
+    const id = info.user_id;
+    const value = (typeof id === 'number' && id > 0) || (typeof id === 'string' && id.trim() !== '' && id !== '0') ? String(id) : undefined;
+    if (value) login = { id: value, at: Date.now() };
+    return value;
+  };
   return Object.freeze<EndpointManagement>({
+    /** ADR 0056 §1: the Bot's own group role (`get_login_info`, then `get_group_member_info` self). */
+    async inspectSelfStanding({ conversation, signal }: SelfStandingRequest): Promise<PlatformStanding | undefined> {
+      if (conversation.kind !== 'group') return undefined;
+      const selfId = await loginId(signal);
+      if (!selfId) return undefined;
+      let member: Record<string, unknown>;
+      try {
+        member = asRecord(await endpoint.callApi({ action: 'get_group_member_info', signal, params: {
+          group_id: toNumberId(conversation.id, 'group_id'), user_id: toNumberId(selfId, 'user_id'), no_cache: true,
+        } }));
+      } catch (error) {
+        login = undefined;
+        throw error;
+      }
+      return standingFromMemberRole(member.role);
+    },
     async listFriends(request: EndpointManagementRequest = {}): Promise<readonly EndpointFriend[]> {
       const data = await endpoint.callApi({ action: 'get_friend_list', signal: request.signal });
       return toArray(data).map((value) => {

package/src/protocol.ts

@@ -4,7 +4,7 @@ import type { EndpointProfileConfiguration } from 'zhin.js/adapter';
  * Canonicalization is owned by gateway/core before endpoint.send.
  * Spec: https://github.com/botuniverse/onebot-11
  */
-import { EndpointDeliveryError, isMediaRef, type MediaRef, type ConversationRef } from '@zhin.js/im-contract';
+import { EndpointDeliveryError, isMediaRef, type MediaRef, type ConversationRef, type PlatformStanding } from '@zhin.js/im-contract';
 import { toCanonicalSegments, type Segment } from '@zhin.js/core';
 import { formatCompact, getLogger } from '@zhin.js/logger';
 
@@ -218,6 +218,16 @@ export function senderUserId(ev: OneBot11Event): string {
   return ev.user_id != null ? String(ev.user_id) : '';
 }
 
+/**
+ * ADR 0056 §1：群消息 `sender.role`（owner / admin / member）→ `sender.platform.standing`。
+ * 私聊不上报；未知角色词不上报。OneBot v11 没有平台原生角色与权限位。
+ */
+export function onebot11SenderStanding(ev: OneBot11Event): PlatformStanding | undefined {
+  if (ev.message_type !== 'group') return undefined;
+  const role = ev.sender?.role;
+  return role === 'owner' || role === 'admin' || role === 'member' ? { standing: role } : undefined;
+}
+
 /** 显示名（群名片优先）放 metadata.nickname；没有则返回 undefined，不写该字段。 */
 export function senderNickname(ev: OneBot11Event): string | undefined {
   const name = ev.sender?.card || ev.sender?.nickname;

package/src/ws-endpoint.ts

@@ -29,6 +29,7 @@ import {
   isMessageEvent,
   onebot11InboundConversation,
   senderDisplayName,
+  onebot11SenderStanding,
   senderUserId,
   type OneBot11Event,
   type OneBot11WsConfig,
@@ -192,6 +193,7 @@ export class OneBot11WsEndpoint extends Onebot11Client implements Endpoint {
     const conversation = { ...onebot11InboundConversation(String(this.#options.id), ev), endpoint: this[endpointSpec].identity };
     const content = formatInboundContent(ev);
     const inbound = formatInboundMetadata(ev, this.#options.config.id);
+    const platform = onebot11SenderStanding(ev);
     void this[endpointSpec].events.message({
       event: ev,
       ...(typeof ev.time === 'number' ? { platformSentAt: ev.time * 1000 } : {}),
@@ -201,7 +203,7 @@ export class OneBot11WsEndpoint extends Onebot11Client implements Endpoint {
       sender: {
         id: senderUserId(ev),
         name: senderDisplayName(ev) || undefined,
-        ...(ev.sender?.role ? { roles: [ev.sender.role] } : {}),
+        ...(platform ? { platform } : {}),
       },
       endpointId: inbound.endpointId,
       ...(inbound.mentioned ? { mentioned: true } : {}),

package/src/ws-types.ts

@@ -1,3 +1,5 @@
+import type { WsConnection } from '@zhin.js/host-http';
+
 /** Minimal WS surface used by the endpoint (real `ws` or test mock). */
 export interface OneBot11WsSocket {
   readonly readyState: number;
@@ -13,3 +15,34 @@ export interface OneBot11WsCreateOptions {
 }
 
 export const WS_OPEN = 1;
+
+/**
+ * A Host reverse-WebSocket connection seen through the OneBot11WsSocket surface. Protocol
+ * keepalive (ping / pong) belongs to the Host transport, so `ping` is absent.
+ */
+export function socketOfConnection(connection: WsConnection): OneBot11WsSocket {
+  let readyState = 1;
+  connection.onClose(() => { readyState = 3; });
+  const subscriptions = new Map<(...args: unknown[]) => void, () => void>();
+  const off = (_event: string, listener: (...args: unknown[]) => void): void => {
+    subscriptions.get(listener)?.();
+    subscriptions.delete(listener);
+  };
+  return {
+    get readyState() { return readyState; },
+    send: (data: string) => connection.send(data),
+    close: (code?: number, reason?: string) => connection.close(code, reason),
+    on(event: string, listener: (...args: unknown[]) => void) {
+      if (event === 'message') {
+        subscriptions.set(listener, connection.onMessage((data) => {
+          listener(typeof data === 'string' ? data : Buffer.from(data));
+        }));
+      } else if (event === 'close') {
+        subscriptions.set(listener, connection.onClose((code, reason) => listener(code, reason)));
+      }
+      // 'error' surfaces as a close on a WsConnection; 'open' already happened.
+    },
+    off,
+    removeListener: off,
+  } as OneBot11WsSocket;
+}

package/src/wss-auth.ts

@@ -1,17 +1,10 @@
-import type { IncomingMessage } from 'node:http';
+import { verifyProtocolAccessToken, type ProtocolAuthRequest } from '@zhin.js/host-http';
 
 export function verifyOneBotAccessToken(
   accessToken: string | undefined,
-  request: IncomingMessage,
+  request: ProtocolAuthRequest,
 ): boolean {
+  // Webhook semantics: no configured token admits any caller (reverse sockets use verifyProtocolAccessToken).
   if (!accessToken) return true;
-  const auth = request.headers.authorization ?? '';
-  if (auth === `Bearer ${accessToken}`) return true;
-  try {
-    const url = new URL(request.url ?? '/', 'http://localhost');
-    if (url.searchParams.get('access_token') === accessToken) return true;
-  } catch {
-    /* ignore */
-  }
-  return false;
+  return verifyProtocolAccessToken(accessToken, request);
 }

package/src/wss-endpoint.ts

@@ -15,7 +15,7 @@ import {
   type PendingRpcRequest,
   type EndpointTransportState,
 } from 'zhin.js/adapter';
-import type { HttpHost, WsConnection } from '@zhin.js/host-http';
+import { verifyProtocolAccessToken, type HttpHost, type WsConnection } from '@zhin.js/host-http';
 import { formatCompact, getAdapterLogger } from '@zhin.js/logger';
 import type { CapabilityId } from 'zhin.js';
 import { createOneBot11EndpointManagement } from './endpoint-management.js';
@@ -27,17 +27,15 @@ import {
   isMessageEvent,
   onebot11InboundConversation,
   senderDisplayName,
+  onebot11SenderStanding,
   senderUserId,
   type OneBot11Event,
   type OneBot11WssConfig,
 } from './protocol.js';
 import { receiveOneBot11SideEvent } from './side-event-dispatch.js';
 import { createOneBot11ContentPort } from './content-port.js';
-import { verifyOneBotAccessToken } from './wss-auth.js';
 import { createOneBot11Rpc, type OneBot11Rpc } from './ws-transport.js';
-import {
-  type OneBot11WsSocket,
-} from './ws-types.js';
+import { socketOfConnection, type OneBot11WsSocket } from './ws-types.js';
 import { probeOnebot11SelfId, resolveOnebot11SelfId } from './self-id.js';
 import { callOnebot11Client, readOnebot11Response, onebot11ClientOptions, forwardOnebot11ClientEvents, Onebot11Client } from './client.js';
 
@@ -117,15 +115,16 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
     if (this.#started) return;
     this.#stopped = false;
     if (!this.#options.config.access_token) {
-      // wss 模式未配 access_token 时任何连接都会被放行（verifyOneBotAccessToken 直接 return true）
+      // 未配 access_token 时只接受本机回环连接（verifyProtocolAccessToken）。
       this.#logger.warn(formatCompact({
         endpoint: this.#options.config.id,
         mode: 'wss',
         ok: false,
-        error: 'missing access_token',
+        error: 'missing access_token: only loopback peers are accepted',
       }));
     }
-    const handle = this.#options.http.ws(this.#options.config.path);
+    // The peer authenticates with this endpoint's own access_token, not a Console credential.
+    const handle = this.#options.http.ws(this.#options.config.path, { auth: 'protocol' });
     this.#wsRelease = handle.onConnection((connection) => {
       this.#connectionTask = this.#connectionTask
         .then(() => this.#acceptConnection(connection))
@@ -194,6 +193,7 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
     }
     const conversation = { ...onebot11InboundConversation(String(this.#options.id), ev), endpoint: this[endpointSpec].identity };
     const inbound = formatInboundMetadata(ev, this.#options.config.id);
+    const platform = onebot11SenderStanding(ev);
     void this[endpointSpec].events.message({
       event: ev,
       ...(typeof ev.time === 'number' ? { platformSentAt: ev.time * 1000 } : {}),
@@ -203,7 +203,7 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
       sender: {
         id: senderUserId(ev),
         name: senderDisplayName(ev) || undefined,
-        ...(ev.sender?.role ? { roles: [ev.sender.role] } : {}),
+        ...(platform ? { platform } : {}),
       },
       endpointId: inbound.endpointId,
       ...(inbound.mentioned ? { mentioned: true } : {}),
@@ -240,14 +240,14 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
 
   async #acceptConnection(connection: WsConnection): Promise<void> {
     if (!this.#started || this.#stopped) {
-      connection.socket.close();
+      connection.close();
       return;
     }
-    if (!verifyOneBotAccessToken(this.#options.config.access_token, connection.request)) {
-      connection.socket.close(4003, 'Unauthorized');
+    if (!verifyProtocolAccessToken(this.#options.config.access_token, connection)) {
+      connection.close(4003, 'Unauthorized');
       return;
     }
-    const socket = connection.socket as unknown as OneBot11WsSocket;
+    const socket = socketOfConnection(connection);
     await this.#connectionLifecycle.stop();
     this.#rpc.disconnect('连接已替换');
     await this.#connectionLifecycle.start(async (lifecycleHandle) => {
@@ -264,16 +264,7 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
         }
         if (this.#ws === socket) this.#ws = undefined;
       });
-      this.#connectionLifecycle.startHeartbeat(() => {
-        try {
-          socket.ping?.();
-        } catch {
-          /* ignore */
-        }
-      }, this.#options.config.heartbeat_interval);
-      socket.on('pong', () => {
-        if (this.#ws === socket) this.#connectionLifecycle.notifyHeartbeatAck();
-      });
+      // Dead-peer detection is the Host transport's keepalive (protocol ping / pong).
       socket.on('message', (data) => {
         if (this.#ws !== socket || this.#connectionLifecycle.state === 'closed') return;
         this.#connectionLifecycle.notifyHeartbeatAck();
@@ -296,7 +287,7 @@ export class OneBot11WssEndpoint extends Onebot11Client implements Endpoint {
     this.#logger.debug(formatCompact({
       endpoint: this.#options.config.id,
       mode: 'wss',
-      peer: connection.request.socket.remoteAddress,
+      peer: connection.remoteAddress,
     }));
   }
 }