# Changelog

All notable changes to pi-qqbot are documented in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and versioning follows [SemVer](https://semver.org/spec/v2.0.0.html).

> Chinese changelog: [CHANGELOG.zh-CN.md](CHANGELOG.zh-CN.md)

## [2.6.2] - 2026-11-01

### Fixed

- **`/qq …` bypassed the command gates**: `/qq` is itself an extension command, so sending `/qq reload`,
  `/qq quit` or `/qq new` landed in the passthrough branch of `routeSlash`, which checks neither
  `commands.allowReload` / `allowQuit` / `allowUpdate` / `allowSession` nor the busy state (`needsIdle`).
  With the defaults (`allowQuit: false`) `/qq quit` from QQ could shut the host pi down. `/qq` is now routed
  *before* passthrough: `bridgeGate()` maps the sub-command back to its built-in name (multi-word sub-commands
  `list tree` / `list fork` / `list resume` are matched as a whole first) and reuses the same
  `allowed()` / `needsIdle` checks.
- **Dispatch receipts swallowed the argument**: `/qq reload` used to be answered with
  `已派发 /qq 给 pi。` — `parseSlash` only takes the first word as the command name, so it looked like `reload`
  had been ignored. Receipts and logs now echo the whole command (truncated at 80 characters with `…`).

### Changed

- Destructive bridge sub-commands (`reload` / `new` / `quit` / `clone`) now answer **before** they are
  dispatched, so the receipt cannot lose the race against `ctx.reload()` / `newSession()`.
- `/qq sendfile …`, `/qq usage …`, `/qq pick …` and unknown sub-commands no longer get an extra generic
  receipt (the bridge answers for itself), which removes one useless message.
- Cleaned up a leftover `+` line in `slash.ts` from an older hand-patched edit
  (`+reply(formatPicker(picker))` — harmless but dirty).

### Compatibility

- `/reload`, `/new`, `/quit`, `/compact` and friends behave exactly as before; only `/qq <sub>` is now
  held to the same gates.
- No config change required: deployments with `allowReload: true` keep working, and `/qq quit` is answered
  with a refusal when `allowQuit` is false (the default).

### Tests

- New `test/qq-bridge-gate.test.mjs` (21 assertions): sub-command mapping, three gate refusals, busy
  refusal, receipt-before-dispatch ordering, multi-word sub-commands, receipt truncation, `/reload` regression.
- Full suite: 274 assertions across 22 test files pass; `tsc --noEmit --strict` is clean for the changed
  `slash.ts`.

## [2.6.1] - 2026-11-01

### Changed

- **Per-language changelogs**: the Chinese changelog is renamed to `CHANGELOG.zh-CN.md` and this English
  `CHANGELOG.en.md` is added. `README.md` links to `CHANGELOG.en.md`, `docs/README.zh-CN.md` links to
  `CHANGELOG.zh-CN.md`.

## [2.6.0] - 2026-11-01

### Added

- **Inline buttons for approvals and single-choice lists**: approval cards carry ✅ 允许一次 / ❌ 拒绝 /
  🚀 以后都同意 buttons (strict tools show only the first two); the `/tree`, `/fork`, `/resume` and
  model-selection lists carry option buttons (2 columns, at most 5 rows, labels truncated at 10 characters
  while the full list stays in the message body). Buttons are attached only to markdown replies
  (`markdownReply=true`).
- **`INTERACTION_CREATE` event pipeline**: the gateway subscribes to intent `1<<26` and dispatches
  interaction events; `QQApi.acknowledgeInteraction` replies with `PUT /interactions/{id}` inside the
  5-second window (matched → ACK 0; expired / unauthorized / out-of-range → ACK 3, duplicate operation).
- **`qq/keyboard.ts`**: keyboard construction plus `button_data` encode/decode, routed by the top-level
  `t` discriminator (`approval` / `pick`).

### Changed

- `QQApi.sendC2C`'s `SendOptions.keyboard` is only sent with markdown messages; when a markdown send
  fails and falls back to plain text, the keyboard is dropped automatically.
- `replyTo` / `bridgeReply` gain an optional `keyboard` passthrough. Picker-button clicks reuse the
  "reply with a number" `/qq pick` dispatch path; approval-button clicks reuse `Approver.confirm` /
  `allowAll`. Text replies (同意/拒绝 N, numbers) all remain as fallbacks.

### Compatibility

- With `markdownReply=false` the behaviour is exactly as before (no keyboard, plain-text replies).
- Custom buttons require the "invited" enablement on the QQ Open Platform; if it is not granted, the
  buttons do not render and numbered/text replies are unaffected.

## [2.5.0] - 2026-11-01

### Added

- **`markdownReply` takes effect**: set `true` and all replies go through QQ markdown messages
  (`msg_type=2`); GFM tables and code blocks are rendered by the QQ client. Previously this config was
  parsed but never consumed. On send failure (e.g. no markdown permission) `qq/api.ts` automatically
  falls back to plain text — safe by design.
- **`util/chunk.ts` splitter keeps tables intact**: `splitText` preserves GFM tables as whole blocks
  (table rows are buffered and flushed as a block when a non-table line appears) and never splits at
  code-fence boundaries; long replies no longer show tables cut in half.

### Changed

- The reply format is driven by `state.cfg.markdownReply`: `replyTo`'s `format` defaults to `auto` and
  applies to final answers, error notices, approval prompts and every receipt; an explicit `"text"`
  still forces plain text.

### Compatibility

- `markdownReply` still defaults to `false`; behaviour is unchanged when it is disabled.

## [2.4.1] - 2026-11-01

### Added

- **`!` / `!!` get an explicit receipt instead of being silently dropped**: these prefixes (full-width
  `！` / `！！` included) are shell shortcuts only in pi's host TUI / RPC front ends (`interactive-mode`'s
  `text.startsWith("!")`, the RPC `bash` control command); the extension API has no equivalent
  (`pi.sendUserMessage()` does not dispatch them, `pi.exec()` bypasses approval and session history).
  `routeSlash()` now intercepts them first and replies explaining why they cannot run and what to do
  instead (describe the task in words; it then goes through the `bash` tool with a QQ approval first).
  Neither executed nor forwarded to the model as chat.
- **`/help` gains a line**: `!` / `!!` are not supported.

### Changed

- **Detection deliberately tightened**: a bang command requires "prefix + non-empty command" (a bare
  `!`, `!!`, `!!!`, `/xxx`, or a sentence-final exclamation such as `你好!` stays ordinary chat), so
  emotional exclamation marks are not swallowed.

### Fixed

- **`/qq reload` no longer errors with `This extension ctx is stale after session replacement or reload`**
  (same for the numbered picks of `/new`, `/clone`, `/resume`, `/fork`, `/tree`): after `runBridge()`
  the handler still called `syncModelFromCtx()` to read `ctx.model`, while `reload()` / `newSession()` /
  `fork()` / `switchSession()` / `navigateTree()` make pi turn every guard getter of the old
  `ExtensionCommandContext` into a throw (`runner.js`'s `createCommandContext` keeps lazy descriptors on
  purpose). Now a `REPLACES_RUNTIME` set (`reload` / `update` / `new` / `quit` / `clone`) skips the ctx
  teardown entirely when the runtime was replaced; `syncModelFromCtx()` itself is fault-tolerant (it
  backs the picks of tree/fork/resume, whose branches only the runtime knows); and after a bridge error
  the code stops touching ctx. Regression test `test/bridge-stale-ctx.test.mjs` reproduces the original
  stack (`syncModelFromCtx` ← `handler`) with a fake ctx whose every getter throws: 3 cases failed
  before the fix, all 5 pass after.

### Compatibility

- Pure additions: slash-command routing, approval, queue, progress and credential intake are unaffected.
- One behaviour change: `!xxx` / `!!xxx` used to be forwarded to the model as ordinary text; they are
  now answered without execution. If you relied on sending `!xxx` to make the model call `bash` itself,
  describe the task normally instead.
- Messages with attachments still bypass all command routing (including bang detection), as before.
- `/reload`, `/update`, `/new`, `/clone` still do what they did (the session is really replaced or
  reloaded); they just no longer report an extra error.
- Tests: new `test/bang-notice.test.mjs` (6 cases) and `test/bridge-stale-ctx.test.mjs` (5 cases); all
  19 test files green under `npm test`.
- Painless upgrade: config format, command names, approval and queue semantics unchanged; `!` / `!!`
  were already "not executed" — only the silence became an explicit receipt.

## [2.4.0] - 2026-11-01

### Added

- **No more silence when the model runs out of credit or its key is invalid**: on a provider error pi
  only leaves `stopReason: "error"` + `errorMessage` on the assistant message and produces **no body
  text**, so QQ used to see just "no reaction". Now `message_end` classifies the error (`billing` /
  `auth` / `permission` / `rate` / `other`) and `agent_settled` replies with the **current model**
  (`provider/model`), the server's original message and three recovery paths. 401 / 402 / `1311 plan
  not open` all take the "recoverable" branch; errors with body text, user-cancelled runs and 500-class
  errors behave as before.
- **Remote key replacement**: after running out of credit, sending a bare key (`sk-…` / `ark-…` / `AIza…`
  / hex / base64 / local-service placeholders like `ollama`, quoted or backticked also accepted) writes
  it into the failing provider in `~/.pi/agent/auth.json` and really probes it once with
  `GET <baseUrl>/models`, replying with a masked fragment and the probe result. **No `sk-` prefix is
  assumed**: the only criteria are "non-empty + printable ASCII + no whitespace"; a bare string (the
  whole message is the key) additionally requires length ≥ 12 with digits / uppercase / separators, so
  ordinary text like `configuration.ts` is not swallowed.
- **Onboarding a new endpoint from QQ**: send `https://host/v1 <key>` or `endpoint <url> <key> models a,b`
  → probes `/models` (falls back to `/v1` without a version suffix; 401/403 immediately marks the key
  invalid) → filters out non-chat ids (`embedding` / `rerank` / speech / image generation) → writes
  `models.json` + `pi.registerProvider()` (usable in the running process immediately) → sends a
  **numbered list with context sizes**; replying with a number calls `pi.setModel()` (reuses the
  existing picker, valid 10 minutes). The provider id is auto-derived as `qq-<host>`, numbered on
  collision.
- **Model parameters align with the built-in catalog**: `/models` usually returns only ids, so
  `borrowModelMeta()` borrows `contextWindow` / `maxTokens` / `reasoning` / `input` / `thinkingLevelMap` /
  `cost` / `compat` / `inputLimits` from `modelRegistry.getAll()` (built-in catalog + configured
  providers) by model id, ordered "same host > same-vendor domain family > `openai-completions`".
  Conservative defaults (128k / 16k) apply only when nothing can be borrowed, and the receipt says how
  many were filled in and how many are defaults.
- **Self-update from QQ**: `/update` (or 「更新自己」「升级一下插件」「自更新」) → `npm view` for the
  latest version → **`pi update npm:@zxh126/pi-qqbot`** → **version-verification gate** (the on-disk
  `package.json` must equal the registry version, otherwise it only reports and does not reload) →
  `/qq reload` (`ctx.reload()`). Natural-language triggers are deliberately narrow — a bare 「更新」
  is not recognised.

### Changed

- **Config `commands.allowUpdate`** (default `false`, in the style of `allowReload` / `allowQuit`):
  gates `/update` and 「更新自己」; a top-level default plus per-bot override.
- **`PickerKind` gains `model`**: numbered selection supports "models of a newly onboarded service";
  picking one calls `pi.setModel()` directly; when the model is no longer in the catalog it says so
  instead of silently proceeding, prompting a fresh `/model`.
- **Error notices and logs**: `errorMessage` is uniformly run through `redactSecrets()` + whitespace
  collapse + 600-char clip; the error class and current model are written to `pi-qqbot.log`
  (`[reply] 本轮模型接口报错: <class> <provider/model> <original>`), inspectable afterwards.

### Compatibility

- Pure additions: without `commands.allowUpdate` nothing changes; outside the billing/auth-failure state
  a bare key is not treated as a credential (the explicit `key …` form excepted).
- Requires pi to provide `message_end`'s `stopReason` / `errorMessage`, `pi.registerProvider()` and
  `pi.setModel()` (all present in pi 1.4.x).
- Disk writes touch only pi's own `auth.json` / `models.json`, using pi's own `proper-lockfile` +
  atomic rename; `models.json` only adds or edits its own provider, never touching others.
- The install directory is shared: `/update` only updates the disk; other pi processes still running
  old code must reload or restart on their own.

### Tests

- **14 suites / 191 cases** all green (`npm test`).
- New `test/billing.test.mjs` (26): error classification, Chinese copy, `parseCredentialMessage` forms,
  `looksLikeSecret` (including non-`sk-` prefixes, explicit/bare tightness), `stripWrapping`,
  `normalizeBaseUrl` / `extractModelIds`, `probeEndpoint` (success / `/v1` fallback / immediate 401 /
  network error), `providerIdForEndpoint`, `borrowModelMeta`, `filterChatModelIds`, `modelLabel`,
  `updateProviderKey` / `upsertEndpointProvider` persistence.
- New `test/credential-intake.test.mjs` (11): drives the real `handleMessage` — bare key while broke,
  no swallow when not broke, explicit prefix, endpoint registration + numbered list, metadata
  borrowing, probe 401, resend with `models`, numbered pick `setModel`, non-`sk` key, quoted key.
- New `test/selfupdate.test.mjs` (13): version comparison (incl. prerelease), npm output parsing, five
  flow outcomes (latest / updated / check failure / update failure / version mismatch),
  `isUpdateSelfIntent`, `/update` gating.
- New `test/error-notice.test.mjs` (8): 402 / 401 / 500 / with body / cancelled / cleared after a good
  run / credential gate / redaction.

## [2.3.0] - 2026-10-31

### Added

- **Remote-context notice**: in `before_agent_start` it first checks "was this turn dispatched by this
  extension as a QQ message", and only then writes a notice into the system prompt's
  `qq-remote-context` section (before the user message, invisible on both QQ and the TUI): the
  conversation comes from a remote QQ user who cannot see the local screen or dialogs; desktop
  screenshots / screen OCR / UI automation / keyboard-mouse simulation / headed browsers are **off by
  default** (`mcp__screenshot`, `mcp__winui` named explicitly) — render images off-screen to PNG and
  send them back with `qq_send_file`; capturing the desktop once is allowed only to check whether the
  machine is locked. Merely loading the extension or chatting in the local TUI injects nothing — it
  must wait for the first QQ message to actually start a run.
- **System-prompt rules**: every run **from QQ** appends three short rules (remote user / locked screen
  → off-screen rendering / say so plainly when human help is needed) so they survive compaction of a
  long session; no stacking within one turn, and local TUI runs get nothing.
- **Re-injection after compaction**: `session_compact` clears the "noticed" flag so the next message
  injects the notice again.
- **Config `remote`**: `notice` (default `true`, once per session), `guidelines` (default `true`),
  `extra` (appended to the notice, empty by default); a top-level default plus per-bot override.
- **Local hand-off correction**: when, within one session, the previous turn came from QQ and the next
  is typed directly in the local TUI, that local turn injects a one-time `qq-local-handoff` section
  ("remote QQ user" premise void: screenshots are fine, no `qq_send_file` needed); consecutive local
  turns do not repeat it. Detected via the `input` event's `source=interactive` (this extension's
  `sendUserMessage` is `extension`, so it never misfires); interjecting mid-run of a QQ turn does not
  count as a hand-off (no new run). `/status` gains `来源: QQ（远程）/ 本机（TUI）`.

### Fixed

- **No automatic progress while an approval is pending**: when a tool approval waits for the user,
  automatic progress pushes are held back (otherwise one line every 15 s would push the approval
  prompt off-screen); they resume on the next interval after the approval is handled (or times out).
  Asking `/progress` yourself still works; `/status` shows 「等审批期间暂缓」. The in-session manual
  pause (`/progress off`) and quota-silence semantics are unchanged.

### Tests

- New `test/remote-notice.test.mjs` (defaults / copy elements / `extra` append / system-rule length).
- `test/config.test.mjs` gains `remote` global-default + per-account override cases.
- `test/accounts.test.mjs` gains 3 cases: **local TUI chat injects nothing**, only the first QQ
  message's run injects and once per session, re-injection after compaction; `remote.notice=false`
  disables only the notice and `remote.extra` appends; `remote.guidelines=false` disables only the
  rules, and repeated triggers within one turn do not stack.
- `test/progress.test.mjs` gains cases: no push while an approval is pending, `/status` shows the hold,
  asking for progress still answers once, pushes resume after the approval is handled.
- `test/accounts.test.mjs` gains 2 more cases: the local hand-off corrects exactly once (`/status`
  shows the origin); the pending hand-off is overwritten by a new QQ turn, and an `extension`-source
  input is not a hand-off.
- `test/remote-notice.test.mjs` gains `qq-local-handoff` tag and copy assertions.

## [2.2.1] - 2026-02-11

### Fixed

- **Copy text was treated as a command**: when a user quoted the whole approval prompt back (or
  discussed it in a sentence like 「你这句话里说『取消自动同意』」), the old **unanchored** regex
  matched 「取消自动同意」 / 「以后都同意」 inside the sentence and acted on it (the log even showed
  a reply of 「当前没有开启自动同意」). `parseReply` now strips whitespace and punctuation and does
  **whole-sentence matching** with a length cap (≤ 12 chars); quoted prompts, long sentences and
  exclamations are never parsed — they go to pi as ordinary chat.
- **The approval prompt was too wordy**: compressed from 3 lines (with 「停止」/「以后都同意」/
  「取消自动同意」) to 2 lines: `[审批 #N] <summary>` + `回「同意 N」或「拒绝 N」；想全部放行回
  「以后都同意」。`; tools that must be confirmed every time (file sending) use the strict copy
  (no 「以后都同意」).

### Tests

- New `test/approver.test.mjs` (6 cases: approve/reject variants, stop / always-allow / revoke-always,
  quoted prompt not parsed, mid-sentence keywords not parsed, 「停止汇报」 not a command, overlong
  sentence not parsed, prompt ≤ 2 lines).
- `test/queue.test.mjs` syncs the strict-copy assertions (19 cases).

## [2.2.0] - 2026-02-11

### Added

- **Sending local files to QQ**: new tool `qq_send_file(path, name?)` and command `/sendfile <path>`.
  Uploads through the official rich-media API in chunks (`upload_prepare` → chunked `PUT` →
  `upload_part_finish` → merge for `file_info`), then sends with `msg_type=7` + `media.file_info` as a
  **passive reply** (`srv_send_msg:false`, no active-quota burn). Local files have no public URL and
  the one-shot binary upload caps at 5 MB, so everything goes through chunking, no relay dependency.
- **`file_type` mapping**: png/jpg/jpeg → image (1), mp4 → video (2), silk → voice (3), everything
  else → file (4); otherwise QQ answers `850019`. Images/videos/voice display inline; other formats
  arrive as a downloadable file card.
- **Outbound files are force-gated (asked every time)**: `qq_send_file` is added to
  `FORCE_APPROVAL_TOOLS` — a QQ approval is mandatory no matter what `approve.tools` says, and it
  **skips the session-wide 「以后都同意」 and remembered decisions**; each file is confirmed on its
  own and is never written into remember. The prompt shows the file path and display name, with
  「需单独确认」.
- **Config `files`**: `enabled` (default true), `maxBytes` (default 30 MB; QQ hard cap 200 MB),
  overridable per bot.
- **Error-code translation**: `850031` too large, `850019` format unsupported, `40093002` daily
  capacity reached, `850027` timeout, `850018` muted/rate-limited, `40093001` transfer failed — all
  turned into Chinese receipts.

### Changed

- `qq/api.ts`: new `sendC2CMedia(openid, fileInfo, { msgId })`, reusing the existing send queue and
  `msg_seq` counting.
- `slash.ts`: new takable command `sendfile` (not gated by `commands.allowSession`; guarded by
  `files.enabled` + approval).
- `index.ts`: `State` records `restBase`; `/help` gains the `/sendfile` entry.
- `package.json`: new peer dependency `typebox` (tool-parameter schema; aliased by the pi runtime).

### Tests

- New `test/upload.test.mjs` (9 cases: `file_type` mapping, md5/sha1/md5_10m, the full chunked
  pipeline with byte reassembly, image type, chunk retry, local validation (missing / directory /
  empty / over limit), merge without `file_info`, error-code translation, `sendC2CMedia`'s
  `msg_type=7` body).
- Added to `npm test`; the whole suite went 130 → 140 cases green (queue 18 → 19, with the new
  "file sends are always approved" case).

## [2.1.0] - 2026-02-11

### Added

- **Receiving QQ attachments (images / voice / video / documents / archives / plain files)**: incoming
  attachments are downloaded to temp files immediately and their paths are handed to pi as marker
  lines — images as `图片路径 <path>`, the rest by type as `语音路径` / `视频路径` / `文档路径` /
  `压缩包路径` / `文件路径`. The original text stays on the first line, in the same turn as the
  paths; pi's `read` tool can open the image directly and `bash` can process the files. (Before
  2.1.0 only images were kept and never saved to disk; a pure-image message delivered an empty
  string to pi.)
- **QQ receipt**: after saving, the bot replies 「已收到 N 个附件（图片 ×1、文档 ×1），已存为临时文件
  并交给 pi：」 followed by each path; failed downloads are listed with the reason, and the text part
  still runs.
- **Automatic temp-file cleanup**: the save directory is split by date
  (`<system temp>/pi-qqbot/<bot>/<YYYY-MM-DD>/`) and swept at session start according to
  `attachments.retentionHours` (default 24 h) and `attachments.maxFiles` (default 200); `<date>`
  subdirectories not created by this extension are never touched.
- **Config `attachments`**: `enabled` / `dir` / `maxBytes` / `maxPerMessage` / `retentionHours` /
  `maxFiles`, overridable per bot in `qqbots[]` like `queue` / `progress`. With `enabled: false` it
  replies with an ignore notice and processes text only.
- **New `attachment.ts`**: six-type detection, filename sanitising (only `[0-9a-zA-Z._-]` kept),
  concurrent downloads (default 3), 25 MB per-attachment cap, 30 s download timeout, one retry with
  credentials on 401/403, a failed attachment never blocks the others.

### Changed

- `qq/gateway.ts`: `QQMessage.attachments` becomes `{ url, contentType, filename?, size? }[]` and
  **no longer drops non-image attachments**; when a voice message body only has `voice_wav_url`, that
  is used as the download URL.
- The gateway log no longer prints the whole JSON packet (it carries the short-lived `rkey`
  credential); it logs openid / content summary / attachment count / source host instead.
- `handleMessage()`: messages with attachments **bypass** slash commands, approval parsing, numbered
  selection and built-in commands — always ordinary content (still queued when busy).

### Tests

- New `test/attachment.test.mjs` (12 cases: six-type detection, extension rules, saved content, over
  limit, 401 retry, partial failure, per-message cap, receipt copy, directory cleanup).
- `test/queue.test.mjs` 12 → 18 cases (pure-image dispatch, text+document line joining, busy queueing,
  `enabled=false` ignore notice, `/status` bypass, failed download still delivers the text).

## [2.0.1] - 2026-10-25

### Fixed

- **Word order: 「暂停汇报进度」 was not recognised** and leaked to the model as ordinary chat. Both
  orders — 「暂停**进度汇报**」 and 「暂停**汇报进度**」 — are now recognised; trailing particles
  like 「别汇报了**吧**」 are also caught.

### Changed

- **Colloquial mute words expanded**: 「别汇报了」「别说了」「别讲了」「别推了」「别发了」「别报了」
  「闭嘴」「安静」「打住」「甭」 etc. are equivalent to `/progress off` (resume with 「恢复汇报」 /
  「接着说」).
- **「停」 now interrupts the task** (per user feedback): `停`/`停下`/`停一下`/`停停`/`停掉`/`别跑了`
  join `RE_CANCEL` and are fully equivalent to `/cancel`; only noun-carrying phrases like 「停止汇报」
  or pure shut-up words mute the reports.
- **Asking for progress is a command**: 「汇报一下当前进度」「看一下进度」「说说进度」「进度如何」
  「进度怎么样」 are no longer forwarded to pi as chat; while busy they answer once with a summary
  without queueing, while idle they answer 「当前没有正在运行的任务」.
- `/help` distinguishes the two meanings: to stop only the pushes use `/progress off` / 「别汇报了」 /
  「闭嘴」; 「停」 interrupts the task.
- Both READMEs gain the colloquial-shortcut table (intent → things to say).

### Tests

- `test/progress.test.mjs` 16 → 22 cases (new/rewritten: both word orders, colloquial mute words,
  「停/停下/停一下/停止/取消」 all interrupt, 「停止汇报」 still mutes, three poses of asking for
  progress, no false positives).

## [2.0.0] - 2026-10-25

### Added

- **Multiple QQ bots (one config, one machine, several pi processes)**: the config takes
  `qqbots: [...]` with multiple `appId` / `appSecret` pairs, supporting `name` and per-account
  overrides of `sandbox` / `allowlist` / `queue` / `progress` / `approve` / `commands` (unwritten keys
  inherit the global defaults, merged per key).
- **Automatic claiming**: every pi process, on start (`session_start`), claims the first **offline**
  bot in config order; processes that cannot claim stay off QQ but rescan every 5 seconds and take
  over when someone exits. One lock per process — never concurrent double-connection.
- **"Never steal a bot temporarily released by a reload"**: on session rebuild (`/reload`, `/new`,
  `/fork`, `/resume`) a 20-second reservation is written **before** releasing the lock, so other
  processes skip that bot; after claiming, the reservation record is re-read and yielded on collision
  (closing the race window). The new runtime reclaims its own bot with the same pid, silently.
- **Visible identity**: the claim log carries bot name / appId / cwd / pid; the first QQ receipt is
  prefixed with 「（已接入 qqbot「work」）」; `/status`'s first line shows `bot: work (…0143) · cwd: …`.
- **Takeover notices**: `~/.pi/agent/pi-qqbot-<appId>.owner.json` records the previous holder's pid and
  working directory; on takeover the log writes the old and new pid/cwd and the first QQ receipt
  carries 「（qqbot「work」已由新实例接管 · 当前工作目录 …）」.
- `PI_QQBOT_ACCOUNT=<name|appId>` pins an account (for debugging or a fixed directory); an unknown
  name means no connection, with a log line.
- **Credentials are verified right after claiming**: the claim immediately exchanges an
  `access_token`; on failure it **releases the lock** and skips that bot (trying the next one), so a
  bot with a wrong secret can no longer hold the slot while never connecting; when nothing works it
  stops rescanning pointlessly.
- **Fix** `AuthManager`: the QQ platform answers invalid credentials with HTTP 200 + `code 100016`;
  the old code went on to connect the gateway with an empty token. It now throws immediately (with
  code/message) and is caught during claiming.
- New doc [docs/accounts.md](docs/accounts.md); new tests `test/config.test.mjs` (9),
  `test/lock.test.mjs` (8, real subprocesses + real lockfile, including "two processes in the same
  working directory each get one bot"), `test/accounts.test.mjs` (9, end-to-end claiming / notices /
  invalid-credential degradation), `test/auth.test.mjs` (3).

### Changed

- Logs are per account: `~/.pi/agent/pi-qqbot-<name>.log` (several processes on one machine no longer
  interleave); the single-bot v1 format still writes `pi-qqbot.log`.
- `/status` gains the bot identity and working-directory lines; `/help` gains the multi-bot note.
- Config loading becomes `loadAccounts()` (returns the account list in order); `loadConfig()` stays as
  a compatibility wrapper.

### Compatibility

- **Old single-bot configs work unchanged** (equivalent to an account named `default`, behaving like
  1.5.0); `QQ_BOT_APPID` / `QQ_BOT_APPSECRET` still apply to the single-bot scenario only.
- Writing both the top-level `appId` and `qqbots` → error, no connection (ambiguity is not guessed);
  an account with missing credentials / duplicate `appId` / duplicate `name` is skipped with a log
  line, the rest work normally.
- **A bot is not bound to a working directory**: allocation depends only on config order and online
  state, not on cwd — several pi processes in the same directory each get their own bot. cwd is only
  used for logs, takeover notices and `/status`.
- Recommended: restart (or `/reload`) once after the upgrade — per-account log files only appear on a
  fresh start.

## [1.5.0] - 2026-10-25

### Added

- **Pause / resume automatic progress reports (per session)**: `/progress off` (aliases `/p pause`,
  `暂停`, `stop`, 「暂停汇报」「关闭自动汇报」) stops the timer; `/progress on` (aliases `resume`,
  `start`, `恢复`, 「恢复汇报」「继续汇报」) turns it back on.
  - The manual pause survives runs (`agent_start` no longer resets it) and only resets to enabled on
    `session_start` (`/new`, `/reload`, restart).
  - While manually paused, `/progress`, 「进度」, 「当前进度」, 「现在进度」, 「进展」 **answer once
    with the current summary** without secretly re-opening the 15 s timer, and the reply ends with
    「（自动汇报已暂停，发 /progress on 恢复）」.
  - Strictly separate from the existing "quota silence": quota silence is the automatic pause after a
    failed send, cleared by asking once; the manual pause is cleared only by `on` / 「恢复汇报」.
  - `/progress <gibberish>` answers with usage instead of being silently ignored.
- `/status` gains an `自动汇报:` line distinguishing four modes: `开启（每 Ns）` / `已暂停（本会话…）`
  / `推送失败已静默` / `未启用（配置 progress.enabled=false）`.
- Bare-text queries 「当前进度」「现在进度」「目前进展」 (sub-commands allowed, e.g. 「进度 暂停」)
  also route to the progress query.
- Tests: `test/progress.test.mjs` gains 7 cases (pause/resume immediate effect, survives runs, asking
  while paused does not unpause, Chinese commands without false positives, idle 「当前进度」,
  `/status` copy, unknown subcommand).

### Changed

- `/progress` (no argument) no longer clears the pause while manually paused (previously any query
  wiped the pause flag).
- "Failed-send silence" and "user pause" are two separate states (`progressPaused` / `progressMuted`)
  that no longer overwrite each other.
- README (English) and `docs/README.zh-CN.md` command table, progress section and `progress.enabled`
  notes updated in sync.

## [1.4.0] - 2026-10-24

### Added

- While a task runs, a progress summary is pushed every `progress.intervalMs` (default 15 s): turns,
  tool-call count with the top three tools, failure count, the most recently finished tool (with
  duration), the tool currently running, and token usage. Built purely from local events — no model
  call, no tokens spent.
- End-to-end secret redaction (`redact.ts`): progress summaries, approval prompts, queue previews and
  log writes all pass through one scrubber covering `Authorization` / QQ bot tokens / `sk-…` /
  `ghp_…` / `npm_…` / `AKIA…` / JWT / PEM / `token=` / `password=` / `--api-key` / URL `user:pass@` /
  high-entropy strings.
- `/progress` (aliases `/p`, 「进度」) and the busy-time queries 「到哪了」 / 「怎么样了」.
- A final answer that cannot be delivered (quota) is cached and re-sent with
  「（上一条回复发送失败，补发如下）」 on the next message.
- Config `progress.enabled` / `progress.intervalMs` (env override `PI_QQBOT_PROGRESS_MS`).

## [1.3.3] - 2026-10-24

### Fixed

- The `/usage` report read-back now polls: `appendEntry` lands after the command's `await` returns,
  which occasionally missed the freshly written report.

## [1.3.2] - 2026-10-24

### Fixed

- `/usage` read-back fallback: when `getEntries` has not refreshed yet, read the tail of the session
  file directly; `generatedAt` tolerates millisecond timestamps.

## [1.3.1] - 2026-10-24

### Fixed

- `/usage rate` now really executes and reads the config file back to confirm, instead of claiming
  success in words only.

## [1.3.0] - 2026-10-24

### Added

- `/usage`, `/cost` (extension commands that only print to `ctx.ui.*`) are bridged back to QQ instead
  of being silent.
- `/mcp`, `/llama` — commands that need host-TUI selection dialogs or login — answer with an explicit
  explanation instead.

## [1.2.1] - 2026-10-24

### Changed

- Log timestamps use local time with a UTC offset (e.g. `[2026-10-24T07:39:09.762+08:00]`), aligning
  directly with file mtimes and process start times — no timezone arithmetic needed.

## [1.2.0] - 2026-10-24

### Added

- Messages arriving while busy go into a queue and resume automatically after the current task
  settles; `/cancel` is never queued and takes effect immediately.
- `/queue` (alias `/q`) to view the queue; `/queue clear`, `/queue drop <编号>` to manage it.
- Config `queue.max` (0 = queueing off) and `queue.ack`.

## [1.1.0] - 2026-10-24

### Added

- Numbered-selection takeover for `/tree`, `/fork`, `/resume`: replies with a list of at most 10
  entries, valid only for the asking user, expiring in 10 minutes.
- `/clone` support.

## [1.0.0] - 2026-10-24

### Added

- Takes over pi's slash commands (allowlist `commands.passthrough` / `allowReload` / `allowQuit` /
  `allowSession`): `/reload`, `/new`, `/compact`, `/session`, `/name`, `/model`, `/thinking`,
  `/quit`, plus passthrough of extension commands, prompt templates and `/skill:name`.
- While a task is running, `/reload`, `/new`, `/compact`, `/quit`, `/tree`, `/fork`, `/clone`,
  `/resume` refuse to execute.

## [0.3.0] - 2026-10-24

### Added

- `/cancel` (aliases `/stop`, `/abort`, 「取消」「停止」「中止」「终止」「算了」) interrupts the
  running task: first terminates pending approvals and empties the queue, then `ctx.abort()` and
  drops the half-written reply; an 8-second watchdog releases the busy flag as a fallback.

## [0.2.1] - 2026-10-24

### Changed

- The Chinese README moves into `docs/README.zh-CN.md`, fixing the npm page defaulting to the Chinese
  readme.

## [0.2.0] - 2026-10-24

### Added

- Session-level "always allow" (`approve.remember`), including the request already waiting;
  phrases that only look like cancelling — 「取消自动同意」「恢复审批」 — still go through the
  approval branch.
- Bilingual README (Chinese and English).

## [0.1.0] - 2026-10-16

### Added

- Initial release: bridges the Pi coding agent into QQ private chats (C2C), single session +
  `proper-lockfile` single-instance lock (host takeover), remote approval before dangerous tools
  (`bash` / `powershell` / `write` / `edit` and `destructiveHint` tools) run, automatic segmentation
  of long replies.