Use the shared model identity rules for capability matching and cache keys.
Preserve Fable overrides and explicit capability opt-outs across 1M aliases.
Add shared project and session selection across IM adapters, preserve bindings on
failed restoration, and synchronize permissions with desktop clients.
Fixes#1286
Adapt structured policy-error handling and Astra model metadata from sub2api's recent compatibility updates. Preserve rejection codes through HTTP and SSE, stop retry and non-streaming replay, and add Astra's effective context to the official runtime.
Reference: https://github.com/Wei-Shaw/sub2api/pull/6636 and https://github.com/Wei-Shaw/sub2api/pull/6572. Implementation uses the existing TypeScript runtime and local regression harnesses.
Treat rejected runtime selections as non-terminal errors and restore the full transcript when only configuration errors are present. Cover errors before, during, and after history loading, plus active streaming and permission states.
- Add 新功能支持 issue template, refine bug/question templates with a
pointer to the user group
- Replace the Feishu user group QR with the WeChat Work group QR in both
READMEs, include contact info for enterprise/Agent customization
- Make the Chinese README the default README.md, keep the English one as
README.en.md, update language badges on both
- Update PR change policy, pr-triage docs set and site docs check for the
renamed README files
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Cover MCP connection-close lifecycle, automatic retry outcomes, headless reconnect and toggle flows, stale OAuth results, and MCP state replacement with deterministic mocks. Configure the headless tests with an isolated placeholder credential so they exercise no live provider.
Stale connections closed by the disabled-state guard now go through
client.cleanup() so their caches are cleared by the close handler at
close time, never by a post-close invalidation that could hit a
connection created by a concurrent re-enable. The post-OAuth reconnect
gets the same disabled check, with the config check and disabled state
write kept synchronous (no await in between) so a later enable cannot
be overwritten by the stale OAuth result.
A reconnect request that completes after the server was disabled no
longer overwrites the disabled state. Connection attempts fold into
disabled when the config no longer allows the server, closing any
fresh connection and clearing its caches; the mcp_toggle enable and
mcp_reconnect handlers apply the same check before writing their
results, and the reconnect failure path keeps disabled when the server
was disabled mid-flight.
A single onclose registered at connection creation now clears caches
and notifies a session-registered handler that updates AppState and
decides whether to reconnect; it is unregistered on unmount so shutdown
closes never reconnect. Disabling a connected server clears its caches
and updates AppState directly, so the disabled state never depends on
the close handler firing (headless sessions and cleanup failures
included). Queued disabled updates are dropped when the server was
re-enabled before the batch flush.
Keep occluded renderers live with display-filtered window streams, refresh
capture regions after geometry changes, and preserve the paste read window.
Allow application shutdown to finish even when resource cleanup throws.
Validated with check:native and an isolated desktop MCP workflow covering
background search, playback, lyrics, and repeated text entry.
Connecting Feishu meant creating a bot by hand on the open platform and
pasting an App ID and App Secret back. Feishu also exposes an RFC 8628
device-authorization flow, so the desktop can now render a QR code, and
confirming it in the app creates the bot and stores its credentials
directly. `adapters/feishu/registration.ts` implements that protocol
rather than importing `registerApp` from `@larksuiteoapi/node-sdk@1.73`:
the repository pins 1.60 for the chat client, and the SDK runs the whole
poll inside one un-cancellable promise where the desktop needs the
stateless begin/poll pair the DingTalk registration already uses. The
scan is create-only, so it can never rewrite the configuration of a bot
the user already runs, and it pre-fills exactly the scopes, events and
callbacks this adapter calls. International tenants finish on Lark's
domain, which is now persisted and honoured by the client.
WeCom, QQ and Slack join the same session model. WeCom and QQ bind by
scanning; Slack has no scan flow, so it uses an app manifest that
pre-fills the scopes and Socket Mode. All three run over long
connections, so no public callback URL is needed, and all three accept
private chats only — pairing authorizes one person, and answering in a
group would extend that authorization to everyone else in the room.
They are built on a new `adapters/common/chat-runtime.ts` instead of a
fourth copy of the loop the five existing adapters each carry. A platform
supplies a `ChatPort` — how to say something, how to open a streaming
reply, optionally how to send an image — and the runtime owns pairing,
command routing, session restore, permission bookkeeping and the
translation of the server's stream. The existing five are deliberately
left on their own copies; migrating them is a separate change with its
own regression surface.
Attachments are downloaded through a deferred loader that runs after the
pairing gate and inside the per-chat queue. Resolving them eagerly would
let an unpaired stranger make the adapter fetch bytes and write them
under ~/.claude/im-downloads — on Slack with the bot token attached —
and would let a slow attachment overtake a text message sent after it.
The sidecar launcher's per-adapter branches become one table. It is
declared above the mode dispatch on purpose: `runAdapters` is hoisted and
runs at module top level, so a table declared below it is still in its
temporal dead zone when the adapters mode reads it — which type checks,
lints and unit tests all miss, and only the compiled binary reveals.
Verified with the checks `check:impact` selects: adapters, server,
desktop, electron, policy, chat-contract, agent-flow, docs, native
(sidecar compile, packaging and an adapters-mode smoke against the real
binary) and coverage. The scan flows themselves are not verified against
live platforms — that needs real WeCom, QQ and Slack accounts and would
create real bots.
Claude-Session: https://claude.ai/code/session_01CCGoP316AK7wdQG3Ms6Uwq
zhb