JWeBot/CHANGELOG.md

Changelog

beta 1.2.4.1019 - 2026-10-19 18:15:01

• 增强 Taffy 对本地游戏结果的理解：闲聊上下文扩大到 25 轮，并明确标注本地命令结果的发送者和类型。
• Format local command history as tagged context entries so follow-up phrases like "这一把" can link back to recent blackjack and other game results.

beta 1.2.3.1019 - 2026-10-19 18:04:57

• 扩大 Taffy 闲聊可读取的上下文窗口：后续回复现在最多参考最近 15 轮相关对话。
• Increase the default direct-chat context window from 6 to 15 retained turns.

beta 1.2.2.1019 - 2026-10-19 17:31:56

• 修复本地命令后的闲聊断上下文，新增 /知识问答 强制开题，并让多条回复按 0.5～1 秒随机间隔逐条发送。
• Include non-tool local command results in the follow-up chat context so game and account actions like /原石祈愿 can be referenced naturally afterward.
• Exclude utility local commands such as /version, /状态, /debug, and feature-list output from chat context to avoid noisy system details.
• Add randomized spacing between queued multi-part replies and immediate local multi-reply sends.
• Add /知识问答 as a Kernel-owned local command that starts a cold-knowledge quiz immediately while reusing the active five-minute question when one is already running.

beta 1.2.1.1019 - 2026-10-19 17:23:58

• 修复 Taffy 短句拆分只换行不分条的问题：多句闲聊现在会按多条消息逐条发送。
• Encode multi-sentence chat replies with the existing multi-reply marker so direct and cloud chat results enter the multi-message delivery path.
• Split queued delivery helper calls per message part, giving each part a stable per-part event id while preserving structured local command output.

beta 1.2.0.1019 - 2026-10-19 17:05:47

• 优化 Taffy 群聊语气：回复更短、更像群友，减少 AI 式自我解释，并保留主动插话、冷门问答和更新状态提示。
• Add a chat-specific reply style layer that removes common AI-like padding, keeps direct unknown-subject clarification, and splits long casual replies into shorter lines.
• Apply the style rule to direct chat and cloud-agent replies while leaving structured local command output unchanged.
• This 1.2 release grants each existing account both 200 Mora and 1 primogem.

beta 1.1.2.1019 - 2026-10-19 16:38:10

• 新增低频主动插话、随机冷门知识问答和更新生命周期提示：Taffy 会偶尔自然冒泡，抛出限时答题奖励摩拉，并在停机、上线和更新就绪时主动说明状态。
• Use recent safe group context to replace some hourly scan slots with an ambient chat message during active daytime windows.
• Add a 200+ question CS, Apex, Overwatch, and LoL trivia bank with five-minute /回答 A/B/C/D answers, recent-question avoidance, and rarity-based Mora rewards.
• Limit ambient chat with deterministic probability, multi-hour cooldown, and minimum recent-speaker activity so proactive replies feel occasional.
• Send guarded shutdown and startup lifecycle notices during production cutover before the normal ready-stage update announcement and compensation.

beta 1.1.1.1016 - 2026-10-16 17:19:45

• 修复扫码加权重复购买只刷新不叠加的问题。
• Change scan boost semantics to stack each successful purchase as an independent 24-hour +5 weight entry.
• Preserve legacy boost entries by deriving their 24-hour expiry from their creation time.

beta 1.1.0.1016 - 2026-10-16 17:04:25

• 修复 OCR 偶发重复识别消耗型命令导致重复回复的问题，并完善摩拉/扫码榜展示。
• Extend OCR semantic duplicate suppression for resource-mutating local commands so a visible command bubble re-detected after the short 8 second window is still ignored.
• Keep ordinary local commands on the short duplicate window to avoid blocking intentional repeated game/query commands.
• Show scan-boost coupon count in /摩拉, and make /扫码榜 list every configured scan candidate plus next-hour scan weights.
• This major settlement grants each existing account both 200 Mora and 1 primogem.

beta 1.0.5.1016 - 2026-10-16 16:30:44

• 新增原石系统：成就可获得原石，并开放祈愿、扫码加权、Taffy发话和原石榜。
• Add primogem account state, primogem movement history, wish records, scan boost coupons, Taffy speech credits, scheduled speech delivery, and primogem-source ranking without a SQLite schema migration.
• Award primogems from blackjack natural 21, blackjack 20-to-21 hit challenges, Taffy blackjack win streaks, and personal consecutive lottery high-hit pairs.
• Extend post-release settlement so this version grants each existing account both 200 Mora and 1 primogem, and show /version update time down to seconds.

beta 1.0.4.1016 - 2026-10-16

• 新增版本更新补偿流程：每次生产更新后向所有既有账户发放 200 摩拉，并在目标群发布更新公告。
• Add a version-idempotent post-release settlement tool that creates an online SQLite backup, grants Mora through the production account schema, records a version-labelled movement, and tracks announcement delivery independently.
• Run release settlement only after coordinated cutover and rollback gates are disarmed, keeping a healthy runtime active when GUI delivery is uncertain.
• Require the first changelog bullet to be a concise user-facing announcement summary and require visual confirmation before explicitly retrying an uncertain announcement.

beta 1.0.3.1016 - 2026-10-16

• Rename the virtual currency user-facing copy to Mora (摩拉) while keeping the existing /金币, /金币排行, and /Taffy金币 commands as aliases.
• Add recent account movement details to /摩拉 and /金币, covering the latest transfer, loan, repayment, lottery, draw, and blackjack net changes.
• Suppress short-window semantic duplicate OCR events so one visible command bubble cannot trigger the same local reply multiple times under new event IDs.

beta 1.0.2.1016 - 2026-10-16

• Cache OCR-negative visible bubbles and reuse stable visual signatures as the OCR cache key so unreadable or lightly re-rendered bubbles do not trigger repeated 10+ second RapidOCR passes during active chat windows.

beta 1.0.1.1016 - 2026-10-16

• Limit RapidOCR ONNXRuntime intra/inter operation threads by default so the adaptive OCR recorder no longer saturates CPU after restart and slow recovery windows do not stretch local command detection into 10+ second scans.

beta 1.0.0.1016 - 2026-10-16

• Promote JWeBot from alpha to beta after the local, staging, privacy, and production deployment gates stabilized.
• Consolidate the current reviewed local command set, including virtual coin transfer, loans, repayment, group leaderboard, multiplayer lottery, blackjack, Steam queries, and CS Major autochess.
• Externalize CS Major autochess game content into package JSON data files for cards, coaches, narratives, draft/shop/economy rules, match formats, and MR15/overtime settings.
• Add a maintained command catalog and keep debug session notes out of the repository by default.
• Keep release validation on tools/sync-local-extensions.py --check, tools/check-local.sh, and tools/check-secrets.py --history.

alpha 0.6.11.1015

• Add /大富翁榜, /金币排行, /金币排行榜, and /richlist for a group-scoped virtual coin leaderboard. Rankings are read-only, sorted by current coin balance, recover display names from configured aliases and observed profiles, and mark active loan principal when present.
• Split leaderboard command ownership into a dedicated reviewed coin-ranking local extension.

alpha 0.6.10.1015

• Add virtual coin loans with /贷款 [金额] and /loan amount, plus repayments through /还款 [金额|全部] and /repay. Loans are stored in the same group-scoped virtual coin account, capped at 500 coins, limited to one active loan per account, and replay-safe through the existing ledger transaction path.
• Split loan command ownership into a dedicated reviewed coin-loan local extension so the single-player game plugin stays under the command-count validation limit.

alpha 0.6.9.1015

• Move CS Major autochess public game data out of cs_autochess.py and into package data files under jwebot_official_extensions/data/cs_autochess/. Player cards, coach cards, narrative fragments, shop/economy odds, draft pacing, synergy thresholds, match formats, MR15/overtime settings, and special event rewards are now data driven.
• Add startup validation for the externalized data so missing fields, duplicate card IDs, invalid schema versions, or an undersized narrative library fail fast before the command engine runs.
• Add regression coverage that verifies the JSON files are packaged, readable, and consistent with the runtime card, coach, match-format, and narrative inventories.
• Add virtual coin transfers with /转账 对方 金额 and /transfer name amount. Transfers are single-transaction ledger updates, require the receiver to initialize /金币 first, reject self-transfers, and replay safely by event ID.

alpha 0.6.8.1015

• Add an atomic compatibility path for old active CS autochess runs. When a group still has a pre-schema-3 active tournament, /自走棋开始 now archives that old run as cancelled and opens a fresh schema-3 season in the same SQLite transaction.
• Preserve old story and battle archive rows while ensuring the new season is the only active autochess run selected by future commands.

alpha 0.6.7.1015

• Expand CS Major autochess content to 100+ player cards and an 18-coach metadata pool while keeping the opening coach draft to 10 visible choices.
• Replace abstract training targets with real round-robin training rounds. Each round resolves participant-vs-participant or participant-vs-AI BO1 scrims, then opens an operation window for D rolling, locking, lineup swaps, tactics, and readiness.
• Replace fixed score bands with deterministic MR15 round simulation. Map scores now come from individual round outcomes, including 15-15 overtime, instead of direct mappings such as 16-6 or 16-9.
• Add a 120+ line local narrative library for openings, streaks, pauses, clutches, economy beats, closes, training hooks, and media/sponsor challenges so match reports vary across maps.
• Hide raw target/performance calculation text from training, match, and challenge reports while preserving structured battle facts in the archive.
• Start drafted players as two-star素材 and rebalance roster completion toward low/mid-cost cards, leaving upgrades and synergies to the shop loop.

alpha 0.6.6.1015

• Rebuild CS Major autochess around multi-message hosting: tournament welcomes, seed order, draft boards, status panels, training results, match reports, standings, brackets, and awards are emitted as separate bounded replies.
• Replace instant full rosters with three draft rounds: round one selects from a fixed 10-coach pool, rounds two and three draft players, then each team is completed to five starters, one coach, and three bench slots.
• Run the full event as training camp, BO3 single-round-robin group stage, one media/sponsor challenge after group round one or two, BO5 semifinals, BO5 final, and final awards.
• Let readiness advance phases automatically. Group matches wait for all real players, while knockout matches only wait for real players still in the current pairing, so eliminated players are not prompted to prepare.
• Add local multi-text reply support across the SDK, official extension adapter, Edge response contract, and recorder GUI sender while preserving single-message compatibility.

alpha 0.6.5.1015

• Extend the AI test path for CS Major autochess to support two-human games: /自走棋加AI战队 now adds AI 战队 A and AI 战队 B when exactly two real players have registered.
• Keep the same command for two- and three-human test modes. The tournament engine selects 2 人+2 AI or 3 人+1 AI from the current registration count.
• Lock the roster after AI teams join, seed the four-team bracket as 1v4 and 2v3, and keep AI teams out of the human preparation order while preserving independent AI operations and story archives.

alpha 0.6.4.1015

• Add a reviewed 2-8 player CS Major autochess extension with a fixed five-player starting lineup, one always-active coach, an eight-slot bench, and a six-candidate shop that shows complete game data.
• Ship a fixed 60-player local pool with rifle, sniper, and in-game-leader roles; team and nation synergies; shared copy counts; and deterministic three-copy/two-star and nine-copy/three-star upgrades.
• Keep all five player slots occupied. Lineup changes are one-for-one swaps, starters cannot be sold directly, and coach upgrades only add a 2%-10% team bonus.
• Add player-selected firepower, stability, and clutch tactics. Resolve stability over firepower, firepower over clutch, clutch over stability, plus sniper/rifle/leader role counters before bounded +/-2% map variance.
• Generate the competition format once at tournament start: two players go directly to the final, three play a round robin for two final places, four use seeded 1v4 and 2v3 semifinals, and five to eight play a complete round robin for four semifinal places.
• Add an explicit three-human-plus-one-AI test mode. The host can add one deterministic local AI as seed four; it buys players, upgrades its coach, swaps its strongest lineup, and selects a counter tactic without an online model.
• Give the bot a persistent host state machine: welcome and format briefing, rotating human preparation order, turn enforcement, explicit handoffs, round introductions, matchup calls, overtime narration, advancement, and championship presentation.
• Run group matches as BO3 and knockout matches as BO5. Simulate every map under MR15, including 15-15 overtime, 19-17/22-20 scores, and separately archived overtime stories.
• Persist run state, idempotent action responses, structured battles, and every generated story in serialized SQLite transactions. Invalid archives roll back the full action.

alpha 0.6.3.1015

• Replace instant personal lottery tickets with one persistent multiplayer lottery round per group: start, register/update, status, draw, and cancel.
• Treat each ticket as three distinct digits from 0-9. Sort digits before storage so 347 and 743 represent the same selection.
• Accept spaced and compact OCR forms. Ticket stakes are 1-500 coins with a default of 10 when omitted.
• Return 0%, 50%, 120%, or 300% of the stake for matching zero, one, two, or three drawn digits. All settlement values remain integer coins.
• Commit entry updates, stake differences, all-player payouts, cancellation refunds, and event replay responses in serialized SQLite transactions.
• Raise the blackjack stake range to 1-500 coins.
• Add per-game personal sequence numbers and /游戏记录 (/gamehistory) for prize draws, lottery rounds, and blackjack hands.
• Prefix game output with the configured player label and game number, such as Player #1：...; aliases share the same counter and account.

alpha 0.6.2.1015

• Bound direct DeepSeek SSE reads to 30 seconds of total wall time in addition to the existing 18-second socket inactivity timeout.
• Stop reading as soon as the SSE [DONE] marker arrives instead of waiting for the upstream connection to close.
• Prevent a trickling or unfinished upstream response from occupying both generation workers for about 15 minutes and delaying later final replies.
• Preserve fast ACK delivery, three-attempt retry behavior, two generation workers, and strict final-reply ordering.
• Treat /21点 开始 100 as a 100-coin stake and accept OCR forms with missing whitespace, such as /21点开始100 and /blackjackstart100.
• Keep blackjack play as explicit steps: start and deal first, then hit or stand in a separate command. Combined forms return this workflow without opening a game or deducting funds.
• Prefix blackjack hands, status and settlement replies with the current group-scoped player's configured display label, such as player：....

alpha 0.6.1.1015

• Add three reviewed plugins: local context summaries for 100/200/300 messages, person and alias lookup, and single-player virtual coin games.
• Provide corresponding Chinese and English commands, including /context, /people, /person, /wallet, /draw, /lottery, and /blackjack.
• Grant each group-scoped person 1000 virtual coins once; persist account state, private blackjack decks, timeout/forfeit rules, and win/loss statistics.
• Commit funds, game state and event replay responses in one SQLite transaction; retries never debit twice, and aliases share the canonical person's account.
• Reconcile the message image after a two-second idle wait so a missed final XDamage notification does not strand an isolated message; drain buffered Xlib events before waiting on the socket. Preserve visual deduplication and guards.
• Keep the generated feature list within the sender's 900-character boundary.
• Document local extractive-summary coverage, OCR identity limitations, game payouts, persistence and rollback behavior.

alpha 0.6.0.1015

• Replace repository-local and hardcoded deployment values with independent, profile-based configuration packages.
• Add atomic config generation, activation, import, redacted/private export, schema validation, and migration of legacy environment/context material.
• Move private person aliases, bot identity, debug sessions, incident reports, telemetry exports, and root-operation archives outside Git with strict permissions.
• Remove fixed Steam rosters, aliases, display names, and SteamIDs from source.
• Make /steam discover the configured account's public friend list at runtime.
• Add /steam时长 游戏名, whitespace-free OCR forms, game-name fuzzy matching, bounded per-account playtime queries, privacy-state accounting, and caching.
• Add /steam时长 游戏名、玩家名 with exact, unique partial, and fuzzy persona matching while limiting game-library requests to the selected account.
• Preserve optional group-person-to-SteamID mappings in private profiles, migrate legacy scoped rosters and aliases, and prefer that roster over public friend discovery.
• Preserve multiline local-command output so /debug remains readable.
• Remove the visible 好友 wording and add a dedicated Steam progress ACK.
• Rename built-in plugin ownership from a personal namespace to jwebot.
• Rename the SDK event field to the generic mention_bot.
• Add a privacy-safe tracked-file/Git-object scanner that never prints matched values.
• Add a six-stage new-host bootstrap, an eight-stage coordinated deployment progress display, runtime requirements, and zero-to-running documentation.
• Add public repository, configuration, SDK, contribution, security, and licensing documentation.
• Start the public history from a sanitized root after a verified private backup; pre-public operational history remains only in protected local archives.

alpha 0.5.11.1015

• Reduce the conservative follow-latest scroll burst from a fixed 25ms to 1ms between each of the existing 30 wheel events.
• Reuse the XDamage producer's verified WeChat window identifier in the adaptive ready-layout gate instead of rediscovering the same window before each screenshot.
• Preserve the shared GUI lock, ready-window geometry gate, second screenshot, and loaded-bottom visual confirmation.
• Add privacy-safe per-step capture telemetry and regression coverage for the optimized slow path.

alpha 0.5.10.1015

• Prioritize queued fast acknowledgements and local-command replies over queued final replies in the guarded GUI sender.
• Keep the active GUI send non-preemptive and preserve strict FIFO ordering within each priority class through a monotonic sequence number.
• Raise the adaptive recorder CPU quota from 150% to 250% to reduce screenshot subprocess stalls under OCR and GUI contention.
• Add deterministic coverage for ACK/local priority, final FIFO ordering, single-sender serialization, and clean worker shutdown.

alpha 0.5.9.1014

• Preserve both capture call contracts in the adaptive ready-window wrapper: zero arguments for startup/polling and one verified window identifier for the optimized XDamage producer.
• Fix the alpha 0.5.8 internal CaptureProducerError restart loop that began on the first relevant XDamage event.
• Add direct regression tests for both ready-gated capture signatures.

alpha 0.5.8.1014

• Recover one unseen bottom-most bot trigger when a viewport resync has no visual overlap, instead of silently dropping the new command.
• Persist a bounded recent-trigger visual history so an old command is not replayed by a later no-overlap resync; ordinary messages remain fail-closed.
• Seed that history from one startup baseline before enabling recovery, so a service restart cannot replay a visible pre-existing command.
• Reuse the XDamage monitor's verified WeChat window identifier and the maximize gate's geometry result, removing one redundant window lookup and one redundant geometry subprocess from each changed-frame capture.
• Add regression coverage for unseen-trigger recovery, seen-trigger replay suppression, signature migration, and the optimized capture path.

alpha 0.5.7.1014

• Replace the single direct-request worker with two parallel generation workers and one strictly ordered GUI delivery worker for ordinary chat and Steam requests.
• Keep final replies in durable created_at, event_id order even when a newer provider call completes first; failed acknowledgements and exhausted requests remain terminal and do not block later replies.
• Separate generation and delivery retry counters so each phase retains its complete retry budget.
• Wake generation and delivery workers immediately on enqueue, generation completion, and acknowledgement instead of adding a one-second idle polling delay to the normal path.
• Split direct-queue telemetry into direct_generation and direct_delivery phases and add concurrency, ordering, ACK-race, retry, Steam, and duplicate regression coverage.

alpha 0.5.6.1014

• Preserve both pre-draft and post-draft group fingerprint gates while capturing only the configured title region instead of decoding the complete WeChat window twice per GUI send.
• Keep the previous full-window fingerprint path as a compatibility fallback for older adaptive upstream modules.
• Add GUI sender coverage for the title-region primary path, full-window fallback, and visual group-mismatch fail-closed handling.

alpha 0.5.5.1014

• Accept incoming WeChat bubbles up to 900px wide so long single-line bot mentions are not discarded before OCR; preserve position, height, area, and outgoing-bubble exclusion gates.
• Wait for adaptive OCR warmup and a first baseline capture from the current service start before reporting adaptive ready or successful deployment.
• Fail and roll back deployment if the adaptive service exits or cannot establish its recorder baseline within 90 seconds.
• Retry the WeChat ready-window gate for up to 30 seconds and discover the exact Weixin window by both class and title before failing closed.
• Pin production privilege switching and X11 inspection to verified absolute executable paths so a restricted root PATH cannot masquerade as a missing WeChat window.

alpha 0.5.4.1014

• Stabilize visible-message sequence alignment with thresholded binary sender/body fingerprints while retaining exact RGB keys for OCR cache invalidation.
• Reset 0.5.3 exact-visual recorder state to a safe no-reply baseline during the signature migration.
• Prefix coordinated deploy phases with [JWeBot], report explicit starting, ready, and active states, and run user installation from the target home to avoid inherited /root working-directory warnings.

alpha 0.5.3.1014

• Align visible message sequences with existing exact bubble visual fingerprints instead of OCR text, preventing scroll/resync OCR drift from dropping a newly mentioned slash command.
• Reset legacy text-signature recorder state to a no-reply visual baseline on startup, avoiding duplicate replay during the signature-scheme migration.
• Preserve repeated identical commands as separate visual occurrences.

alpha 0.5.2.1014

• Print an ASCII pixel-art project signature only after the coordinated production deployer passes every cutover gate and disables rollback.

alpha 0.5.1.1014

• Exclude the static bottom-left input hint from the realtime text ROI so an empty WeChat input box is not misclassified as dirty.
• Label the corrected ROI as input_text_core_v2 in bridge telemetry, keeping pre-fix and post-fix production evidence distinguishable.

alpha 0.5.0.1014

• Move visible WeChat delivery onto a persistent in-process GUI sender queue hosted by the adaptive recorder, avoiding per-message bridge subprocesses for ACK, local-command replies, and final deliveries.
• Add a private AF_UNIX sender socket so Edge delivery helpers submit final replies to the same serialized GUI queue instead of racing the input box.
• Combine clear, paste, ROI draft flag, post-draft group check, Enter send, ROI clear confirmation, and send-button fallback into one bridge call.
• Confirm the input ROI is empty after Ctrl-A/Backspace before using it as the paste baseline, preventing repeated 喵...... ACK drafts from being mistaken for paste failures.

alpha 0.4.15.1014

• Force adaptive recorder logging to INFO so GUI bridge timing telemetry is visible on ACK and final delivery paths.
• Allow ROI, poll, pixel-threshold, flag, and coordinate fields through the packaged runtime telemetry sanitizer.

alpha 0.4.14.1014

• Replace full-input send confirmation with a left-side input-text ROI flag so draft and send confirmation poll only the region that should visibly change.
• Restore the guarded send order to Enter first, then click the scaled send button only as a fallback when ROI clearing is not visually confirmed.
• Emit ROI coordinates, flag state, flag wait time, confirmation source, and bridge stderr tail diagnostics for GUI delivery failures.

alpha 0.4.13.1014

• Emit detailed guarded GUI delivery timings for lock acquisition, pre/post draft screenshots, group fingerprint checks, bridge subprocess duration, draft paste confirmation polling, send-button confirmation polling, Enter fallback, callback hooks, and total send time.
• Return per-step timing metadata from the adaptive GUI bridge so ACK and final delivery reports can attribute fixed waits, screenshot confirmation, VNC input, and fallback paths without logging message text.

alpha 0.4.12.1014

• Optimize guarded WeChat GUI delivery by clicking the scaled send button first and polling for visual confirmation instead of waiting on fixed sleeps.
• Preserve the Enter-key fallback when the button path is not visually confirmed.

alpha 0.4.11.1014

• Add explicit edge.fast_ack.* and recorder.fast_ack.* telemetry names alongside the existing ACK metrics, making fast acknowledgement latency independently filterable without breaking historical dashboards.

alpha 0.4.10.1014

• Cache configured person-alias rows once per group and make configured identity persistence idempotent, eliminating thousands of redundant FULL-synchronous SQLite commits during Edge startup.
• Reduce measured production host systemd socket readiness on the production database snapshot from more than 90 seconds to about one second.

alpha 0.4.9.1014

• Wait up to 45 seconds for the newly started Edge socket and health response before deciding that a production cutover failed, while still failing immediately if systemd marks the service failed.

alpha 0.4.8.1014

• Keep the adaptive OCR process alive while WeChat is absent or awaiting login, then resume capture against the ready main window without a systemd restart storm.
• Install the reviewed wechat_local_ocr.py beside the adaptive runtime instead of importing an independently managed root copy.
• Add a root-coordinated production deploy that records both systemd topologies, backs up root and user files plus SQLite, disables both legacy OCR units, and rolls back all layers when a health gate fails.
• Require empty OCR queues, a ready WeChat window, Edge socket health, stable adaptive restart counts, and SQLite integrity before accepting a production cutover.
• Preserve incoming service state in legacy install and upgrade tools; legacy OCR now remains disabled unless an operator explicitly opts in.
• Prevent Extension Host imports from writing bytecode into verified releases, and exclude only standard interpreter cache files from source packaging.
• Add deployment contract tests and shell-aware syntax validation to the local release gate.

alpha 0.4.7.1014

• Prewarm RapidOCR recognition and detection paths before live capture.
• Cache successful bubble recognition by bounded exact visual fingerprint, recognize only new or changed crops, and periodically revalidate the cache.
• Persist OCR command events through atomic file replacement plus file and directory fsync, then immediately wake the in-process responder while retaining the one-second recovery scan.
• Name the three execution paths explicitly as local-command, deepseek, and openclaw in Edge responses and privacy-safe routing telemetry.
• Add signed plugin description/help metadata, validate it through Host health, generate bundled /功能列表 output automatically, and update plugin creation tooling and author documentation.

alpha 0.4.6.1014

• Add a repeatable local performance baseline for OCR preprocessing, sequence alignment, durable ACK/queue state, and real signed Host process execution.
• Add a structured telemetry-log analyzer with p50, p95, maximum, status, and event-count summaries.
• Measure queue waiting, capture-buffer age, ACK end-to-end latency, and final Edge delivery latency without recording message content.
• Establish the bottleneck order from local measurements and existing runtime evidence: RapidOCR, provider generation, polling wakeups, then one-shot Host startup; SQLite and sequence work remain below 2 ms p95 locally.
• Document the evidence, measurement gaps, and optimization order for later 0.4.x iterations.

alpha 0.4.5.1014

• Close the approved repository-only Extension Host migration scope.
• Treat an invalid installed signed release as a startup failure rather than a preferred-mode fallback; only missing or startup-unhealthy Hosts may fall back.
• Enforce the end-to-end Host deadline after Kernel service execution and expand transport-error telemetry.
• Document completed local work, explicitly deferred external operations, and the next measurement-led OCR/queue/ACK performance-analysis phase.

alpha 0.4.4.1014

• Add privacy-safe structured telemetry for OCR, routing, ACK preparation and confirmation, queues, providers, Host processes, service brokering, and final GUI delivery.
• Hash event and group identifiers, reject message-body fields, and retain only low-cardinality process-local counts and latency summaries.
• Expose telemetry summaries through Edge health without making telemetry part of delivery correctness.
• Instrument OCR capture/recognition/queue stages and distinguish ACK GUI delivery from Edge confirmation.
• Document ACK ordering and the measurement points needed for future OCR, queue, Host-startup, and provider latency optimization.

alpha 0.4.3.1014

• Require a signed release to pass isolated Host health before atomic activation; failed new releases are removed without switching current.
• Add explicit local-only health bypass for packaging environments.
• Complete real-process parity coverage for all 12 reviewed plugins, including memory CRUD, both stateful games, dice challenge, rankings, history, and Steam fast-ACK final generation.
• Fix Host protocol writes so broker messages bypass redirected plugin stdout without exposing plugin output to the parent protocol.

alpha 0.4.2.1014

• Load installed signed plugin manifests into a deterministic startup catalog and freeze command ownership before routing.
• Add in-process, prefer-host, and host-only Edge execution modes with subprocess or AF_UNIX Host transports.
• Route signed healthy plugins through the isolated Host while preserving Kernel-direct commands and Steam fast-ACK queueing.
• Permit startup fallback for missing or unhealthy preferred Hosts, but never replay an active invocation after a possible stateful service call.
• Add real subprocess end-to-end coverage from Edge through the generated adapter, Host protocol, Kernel service broker, and final reply.

alpha 0.4.1.1014

• Add bounded bidirectional JSON-line service brokering between isolated Extension Host processes and Kernel-owned service profiles.
• Enforce declared profile ownership, call IDs, call count, message size, and end-to-end process/socket deadlines.
• Add Host health inventory responses and broker support to both subprocess and AF_UNIX clients.
• Keep service errors generic across the isolation boundary.

alpha 0.4.0.1014

• Start the approved 0.4.x local extension-host migration and performance instrumentation milestone.
• Keep signing-pipeline integration, key rotation, PR rehearsal, target-machine provisioning, deployment, and Linux verification deferred.

alpha 0.3.1.1014

• Add OpenSSH sshsig publisher signatures for canonical extension release records.
• Bind the publisher principal, release filename, artifact metadata, source digest, manifest author, and exact file list through one signed payload.
• Require trusted publisher verification for activation, Host loading, and rollback; unsigned paths now require an explicit local-test override.
• Persist the canonical signature record with each installed release and re-verify it before execution or rollback.
• Add signing support to package, verify, activate, rollback, and standalone release-signing tools.
• Keep production host provisioning, deployment, and systemd validation deferred.

alpha 0.3.0.1014

• Close the 0.2.x complete-function migration after the corrected granular plugin ownership model passed the full local gate.
• Start the approved 0.3.x baseline with Kernel-direct operational commands, official-owned person memory, and 11 project-owned plugins.
• Keep Linux deployment and systemd verification explicitly deferred.

alpha 0.2.6.1014

• Replace grouped plugin domains with one plugin per independently understandable function.
• Keep dice and dice challenge as one complete project-authored collection.
• Make person-memory the only official-authored command plugin.
• Move feature list, status, and balance to unconditional Kernel-direct routing.
• Add required manifest author metadata and release-record schema version 2.
• Generate 11 project plugin packages under the reviewed local-extension namespace and keep only person-memory under extensions/official.
• Rename the canonical rollback switch to JWEBOT_LOCAL_EXTENSIONS_ENABLED, while accepting the old environment key as a compatibility fallback.

alpha 0.2.5.1014

• Move the complete Steam provider into jwebot-official-extensions.
• Migrate fixed roster, group aliases, mode filtering, single-person lookup, cache, API batching, proxy enforcement, and error classification.
• Preserve the existing public SteamClient, SteamUnavailable, API base, and Mihomo default exports through the packaged Edge runtime.
• Keep the no-direct-network-fallback regression tests passing.

alpha 0.2.4.1014

• Add full official-adapter versus compatibility-path parity tests.
• Cover every stateless command family, all memory operations, every dice-challenge phase, guess-number lifecycle, RPS lifecycle, status, balance, Steam generation, and restart persistence.
• Make parity and persistence checks part of the permanent local/CI gate.

alpha 0.2.3.1014

• Route all known local commands through generated official SDK adapters by default.
• Execute stateful behavior through named in-process service brokers without exposing raw Ledger or providers to adapters.
• Preserve the Steam fast-ACK asynchronous path through the official adapter.
• Add JWEBOT_OFFICIAL_EXTENSIONS_ENABLED=0 as a compatibility rollback to direct command-engine dispatch.
• Keep unknown slash-command errors on the compatibility path.
• Install generated adapter modules with the official package.

alpha 0.2.2.1014

• Add reviewed service_profiles as a narrow SDK/manifest capability.
• Generate real Host-loadable packages for all seven official function domains.
• Register every existing alias through SDK command adapters.
• Delegate complex stateful behavior through named Kernel service profiles instead of exposing raw Ledger or provider objects.
• Add synchronization checks so official manifests, adapters, docs, and command ownership cannot drift.
• Validate, source-scan, and package every official extension in CI.

alpha 0.2.1.1014

• Move the complete local command engine out of the Edge runtime into the installable jwebot-official-extensions package.
• Preserve all command replies, persistence, deterministic seeds, game state machines, memory operations, rankings, status, balance, and Steam behavior.
• Inject Ledger, Steam, balance, reply-cleaning, identity, and memory-policy brokers from Kernel instead of importing Edge internals.
• Add a unique ownership map covering every current command kind and alias.
• Add an authoritative migration matrix documenting every command subfunction and non-command Kernel responsibility.

alpha 0.2.0.1014

• Start the approved 0.2 full-function migration milestone.
• Move the complete Edge runtime into jwebot-kernel.
• Keep jwebot_edge.py as a compatibility CLI and module alias so existing imports and runtime monkeypatches continue to affect implementation globals.
• Update tests and the installer for the packaged runtime.
• Preserve all existing command, queue, ledger, model, memory, broadcast, and delivery behavior.
• Do not deploy or validate on Linux in this stage.

alpha 0.1.11.1014

• Add a bounded AF_UNIX client matching the systemd socket-activated Host design.
• Send one canonical JSON request, half-close the write side, and read one bounded response.
• Fail closed on socket timeout, unavailable socket, malformed response, and Host error status.
• Keep the socket client disconnected from the current production Edge path.

alpha 0.1.10.1014

• Add uninstalled systemd socket/service templates for the extension Host.
• Specify a fixed unprivileged identity, AF_UNIX-only private network, read-only system/release paths, empty capabilities, syscall filtering, and CPU/memory/process/runtime limits.
• Add static sandbox-policy checks and unit tests.
• Require explicit target-host provisioning and systemd verification before any future enablement.

alpha 0.1.9.1014

• Add the Kernel-side extension Host client with a minimal inherited environment and isolated process group.
• Enforce parent wall-time deadlines and kill the entire Host process group on timeout.
• Bound request, response, and stderr sizes and reject malformed protocol responses.
• Limit plugin stdout/stderr inside the Host.
• Hash both plugin log messages and field-name sets instead of emitting plugin text.
• Test timeout child-process cleanup and environment-secret exclusion.
• Keep the client disconnected from the production Edge path.

alpha 0.1.8.1014

• Add an installable jwebot-extension-host package.
• Re-verify installed release content, manifest, and source policy before import.
• Enforce exact declared command registration and freeze it before invocation.
• Add a bounded single-request JSON stdin/stdout protocol.
• Scrub inherited environment values and redirect plugin stdout away from IPC.
• Keep storage, HTTP, and scheduling brokers fail-closed.
• Return generic plugin failure classes without exception text.
• Do not connect the Host to Edge or install it on production host.

alpha 0.1.7.1014

• Add verified release installation under full source-digest directories.
• Add locked, atomic current and previous activation pointers.
• Re-verify installed release file lists, records, and source content before reuse.
• Add explicit local activation and rollback tools with no default production path.
• Test rollback, tampered artifacts, tampered installed content, unsafe pointers, and private installed-file permissions.
• Do not execute extension code or modify production host.

alpha 0.1.6.1014

• Add deterministic, content-addressed extension release artifacts.
• Add canonical source and artifact SHA-256 records.
• Verify artifacts without extraction and reject path traversal, non-regular members, expansion limits, file-list drift, and content tampering.
• Refuse replacement of an existing digest-addressed artifact with different bytes.
• Build and verify the example extension artifact in Gitea Actions.
• Explicitly defer publisher signing and production host activation to a later phase.

alpha 0.1.5.1014

• Add a static extension source-policy preflight before packaging.
• Reject unapproved imports, file/process/socket access, dynamic execution builtins, and dunder attribute traversal.
• Enforce source count, size, UTF-8, syntax, and symlink limits.
• Make validate-plugin.py validate both manifest and source policy.
• Document that static policy is a CI prefilter, not a replacement for OS process isolation.

alpha 0.1.4.1014

• Restrict extension command names to Unicode word characters, dots, and hyphens.
• Reject quote/newline template injection before plugin skeleton files are created.
• Add manifest and generator regression tests while preserving Chinese command names.

alpha 0.1.3.1014

• Add a safe command-extension generator that refuses invalid IDs, invalid commands, path traversal, and overwriting existing extensions.
• Add official and friend extension namespaces.
• Add an author guide, SDK API reference, and reusable AI-author prompt.
• Include author tooling and required documentation in the repository gate.

alpha 0.1.2.1014

• Add a deterministic extension catalog that accepts reviewed manifests only during startup.
• Reject duplicate plugin IDs and case-insensitive command ownership conflicts.
• Freeze registration before runtime command resolution.
• Keep catalog views immutable and require explicit command-token boundaries.

alpha 0.1.1.1014

• Make jwebot-kernel the authoritative pure routing implementation used by the existing Edge compatibility entrypoint.
• Preserve the existing jwebot_edge.py public function shapes for current callers and tests.
• Update the production host installer to deploy and roll back the SDK and Kernel package directories together with the compatibility scripts.
• Do not deploy or restart any production service in this repository change.

alpha 0.1.0.1014

• Start the approved 0.1 milestone with installable jwebot-sdk and jwebot-kernel packages.
• Add versioned event, reply, fact, and extension-result contracts.
• Add capability-limited context protocols that expose no GUI, group selector, raw ledger, environment, shell, or unrestricted network access.
• Add strict plugin manifest validation and pure local/chat/cloud routing primitives.
• Add a minimal /hello command extension and package boundary tests.
• Keep all existing root runtime entrypoints unchanged for production host compatibility.

alpha 0.0.7.1014

• Move unit tests into tests/.
• Update tests to load root compatibility entrypoints from the repository root.
• Update local verification commands to discover tests from tests/.

alpha 0.0.6.1014

• Add repository-safe configuration templates under config/examples/.
• Add docs/configuration-guide.md for runtime configuration ownership and deployment destinations.
• Add tools/check-config.sh and include it in the local migration gate.
• Keep real secrets and production host runtime files outside Git.

alpha 0.0.5.1014

• Add a Gitea Actions workflow that runs the standard local migration gate on push and pull request.
• Add requirements-dev.txt for local and CI test dependencies.
• Document dependency installation in README.md.

alpha 0.0.4.1014

• Move home-backup operational material into ops/home-backup/.
• Move the TigerVNC config snippet into deploy/config/.
• Keep backup material in the repository for reference while separating it from the bot runtime path.

alpha 0.0.3.1014

• Add tools/check-local.sh as the standard local migration gate.
• Wire the gate to compile Python entrypoints, validate shell scripts, reject active emergency debug hooks outside their archive docs, and run the full unittest suite.
• Document the local check command in README.md.

alpha 0.0.2.1014

• Remove temporary emergency HTTP debug hooks from production Python entrypoints.
• Preserve removed hook context in docs/debug/emergency-hooks-archive.md.
• Add docs/configuration-inventory.md to document hardcoded addresses, paths, service names, dimensions, models, and their migration policy.
• Keep historical incident markdown unchanged for auditability.

alpha 0.0.1.1014

• Establish the repository version baseline for the private alpha migration.
• Move operational docs into docs/.
• Move deployment scripts, defaults, and systemd units into deploy/.
• Move the cloud responder prompt workspace into agents/wechat-responder/.
• Move the old direct OpenClaw watcher into legacy/.
• Keep current Python runtime entrypoints at repository root to preserve test and deployment compatibility during the first migration step.