@archipelagolab/lobi 1.0.0

package/src/approval-reactions.test.ts

@@ -0,0 +1,107 @@
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  buildMatrixApprovalReactionHint,
+  clearMatrixApprovalReactionTargetsForTest,
+  listMatrixApprovalReactionBindings,
+  registerMatrixApprovalReactionTarget,
+  resolveMatrixApprovalReactionTarget,
+  unregisterMatrixApprovalReactionTarget,
+} from "./approval-reactions.js";
+
+afterEach(() => {
+  clearMatrixApprovalReactionTargetsForTest();
+});
+
+describe("matrix approval reactions", () => {
+  it("lists reactions in stable decision order", () => {
+    expect(listMatrixApprovalReactionBindings(["allow-once", "deny", "allow-always"])).toEqual([
+      { decision: "allow-once", emoji: "✅", label: "Allow once" },
+      { decision: "allow-always", emoji: "♾️", label: "Allow always" },
+      { decision: "deny", emoji: "❌", label: "Deny" },
+    ]);
+  });
+
+  it("builds a compact reaction hint", () => {
+    expect(buildMatrixApprovalReactionHint(["allow-once", "deny"])).toBe(
+      "React here: ✅ Allow once, ❌ Deny",
+    );
+  });
+
+  it("resolves a registered approval anchor event back to an approval decision", () => {
+    registerMatrixApprovalReactionTarget({
+      roomId: "!ops:example.org",
+      eventId: "$approval-msg",
+      approvalId: "req-123",
+      allowedDecisions: ["allow-once", "allow-always", "deny"],
+    });
+
+    expect(
+      resolveMatrixApprovalReactionTarget({
+        roomId: "!ops:example.org",
+        eventId: "$approval-msg",
+        reactionKey: "✅",
+      }),
+    ).toEqual({
+      approvalId: "req-123",
+      decision: "allow-once",
+    });
+    expect(
+      resolveMatrixApprovalReactionTarget({
+        roomId: "!ops:example.org",
+        eventId: "$approval-msg",
+        reactionKey: "♾️",
+      }),
+    ).toEqual({
+      approvalId: "req-123",
+      decision: "allow-always",
+    });
+    expect(
+      resolveMatrixApprovalReactionTarget({
+        roomId: "!ops:example.org",
+        eventId: "$approval-msg",
+        reactionKey: "❌",
+      }),
+    ).toEqual({
+      approvalId: "req-123",
+      decision: "deny",
+    });
+  });
+
+  it("ignores reactions that are not allowed on the registered approval anchor event", () => {
+    registerMatrixApprovalReactionTarget({
+      roomId: "!ops:example.org",
+      eventId: "$approval-msg",
+      approvalId: "req-123",
+      allowedDecisions: ["allow-once", "deny"],
+    });
+
+    expect(
+      resolveMatrixApprovalReactionTarget({
+        roomId: "!ops:example.org",
+        eventId: "$approval-msg",
+        reactionKey: "♾️",
+      }),
+    ).toBeNull();
+  });
+
+  it("stops resolving reactions after the approval anchor event is unregistered", () => {
+    registerMatrixApprovalReactionTarget({
+      roomId: "!ops:example.org",
+      eventId: "$approval-msg",
+      approvalId: "req-123",
+      allowedDecisions: ["allow-once", "allow-always", "deny"],
+    });
+    unregisterMatrixApprovalReactionTarget({
+      roomId: "!ops:example.org",
+      eventId: "$approval-msg",
+    });
+
+    expect(
+      resolveMatrixApprovalReactionTarget({
+        roomId: "!ops:example.org",
+        eventId: "$approval-msg",
+        reactionKey: "✅",
+      }),
+    ).toBeNull();
+  });
+});

package/src/approval-reactions.ts

@@ -0,0 +1,158 @@
+import type { ExecApprovalReplyDecision } from "openclaw/plugin-sdk/approval-runtime";
+
+const MATRIX_APPROVAL_REACTION_META = {
+  "allow-once": {
+    emoji: "✅",
+    label: "Allow once",
+  },
+  "allow-always": {
+    emoji: "♾️",
+    label: "Allow always",
+  },
+  deny: {
+    emoji: "❌",
+    label: "Deny",
+  },
+} satisfies Record<ExecApprovalReplyDecision, { emoji: string; label: string }>;
+
+const MATRIX_APPROVAL_REACTION_ORDER = [
+  "allow-once",
+  "allow-always",
+  "deny",
+] as const satisfies readonly ExecApprovalReplyDecision[];
+
+export type MatrixApprovalReactionBinding = {
+  decision: ExecApprovalReplyDecision;
+  emoji: string;
+  label: string;
+};
+
+export type MatrixApprovalReactionResolution = {
+  approvalId: string;
+  decision: ExecApprovalReplyDecision;
+};
+
+type MatrixApprovalReactionTarget = {
+  approvalId: string;
+  allowedDecisions: readonly ExecApprovalReplyDecision[];
+};
+
+const matrixApprovalReactionTargets = new Map<string, MatrixApprovalReactionTarget>();
+
+function buildReactionTargetKey(roomId: string, eventId: string): string | null {
+  const normalizedRoomId = roomId.trim();
+  const normalizedEventId = eventId.trim();
+  if (!normalizedRoomId || !normalizedEventId) {
+    return null;
+  }
+  return `${normalizedRoomId}:${normalizedEventId}`;
+}
+
+export function listMatrixApprovalReactionBindings(
+  allowedDecisions: readonly ExecApprovalReplyDecision[],
+): MatrixApprovalReactionBinding[] {
+  const allowed = new Set(allowedDecisions);
+  return MATRIX_APPROVAL_REACTION_ORDER.filter((decision) => allowed.has(decision)).map(
+    (decision) => ({
+      decision,
+      emoji: MATRIX_APPROVAL_REACTION_META[decision].emoji,
+      label: MATRIX_APPROVAL_REACTION_META[decision].label,
+    }),
+  );
+}
+
+export function buildMatrixApprovalReactionHint(
+  allowedDecisions: readonly ExecApprovalReplyDecision[],
+): string | null {
+  const bindings = listMatrixApprovalReactionBindings(allowedDecisions);
+  if (bindings.length === 0) {
+    return null;
+  }
+  return `React here: ${bindings.map((binding) => `${binding.emoji} ${binding.label}`).join(", ")}`;
+}
+
+export function resolveMatrixApprovalReactionDecision(
+  reactionKey: string,
+  allowedDecisions: readonly ExecApprovalReplyDecision[],
+): ExecApprovalReplyDecision | null {
+  const normalizedReaction = reactionKey.trim();
+  if (!normalizedReaction) {
+    return null;
+  }
+  const allowed = new Set(allowedDecisions);
+  for (const decision of MATRIX_APPROVAL_REACTION_ORDER) {
+    if (!allowed.has(decision)) {
+      continue;
+    }
+    if (MATRIX_APPROVAL_REACTION_META[decision].emoji === normalizedReaction) {
+      return decision;
+    }
+  }
+  return null;
+}
+
+export function registerMatrixApprovalReactionTarget(params: {
+  roomId: string;
+  eventId: string;
+  approvalId: string;
+  allowedDecisions: readonly ExecApprovalReplyDecision[];
+}): void {
+  const key = buildReactionTargetKey(params.roomId, params.eventId);
+  const approvalId = params.approvalId.trim();
+  const allowedDecisions = Array.from(
+    new Set(
+      params.allowedDecisions.filter(
+        (decision): decision is ExecApprovalReplyDecision =>
+          decision === "allow-once" || decision === "allow-always" || decision === "deny",
+      ),
+    ),
+  );
+  if (!key || !approvalId || allowedDecisions.length === 0) {
+    return;
+  }
+  matrixApprovalReactionTargets.set(key, {
+    approvalId,
+    allowedDecisions,
+  });
+}
+
+export function unregisterMatrixApprovalReactionTarget(params: {
+  roomId: string;
+  eventId: string;
+}): void {
+  const key = buildReactionTargetKey(params.roomId, params.eventId);
+  if (!key) {
+    return;
+  }
+  matrixApprovalReactionTargets.delete(key);
+}
+
+export function resolveMatrixApprovalReactionTarget(params: {
+  roomId: string;
+  eventId: string;
+  reactionKey: string;
+}): MatrixApprovalReactionResolution | null {
+  const key = buildReactionTargetKey(params.roomId, params.eventId);
+  if (!key) {
+    return null;
+  }
+  const target = matrixApprovalReactionTargets.get(key);
+  if (!target) {
+    return null;
+  }
+  const decision = resolveMatrixApprovalReactionDecision(
+    params.reactionKey,
+    target.allowedDecisions,
+  );
+  if (!decision) {
+    return null;
+  }
+  return {
+    approvalId: target.approvalId,
+    decision,
+  };
+}
+
+export function clearMatrixApprovalReactionTargetsForTest(): void {
+  matrixApprovalReactionTargets.clear();
+}

package/src/auth-precedence.ts

@@ -0,0 +1,61 @@
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+
+export type MatrixResolvedStringField =
+  | "homeserver"
+  | "userId"
+  | "accessToken"
+  | "password"
+  | "deviceId"
+  | "deviceName";
+
+export type MatrixResolvedStringValues = Record<MatrixResolvedStringField, string>;
+
+type MatrixStringSourceMap = Partial<Record<MatrixResolvedStringField, string>>;
+
+const MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS = new Set<MatrixResolvedStringField>([
+  "userId",
+  "accessToken",
+  "password",
+  "deviceId",
+]);
+
+function resolveMatrixStringSourceValue(value: string | undefined): string {
+  return typeof value === "string" ? value : "";
+}
+
+function shouldAllowBaseAuthFallback(accountId: string, field: MatrixResolvedStringField): boolean {
+  return (
+    normalizeAccountId(accountId) === DEFAULT_ACCOUNT_ID ||
+    !MATRIX_DEFAULT_ACCOUNT_AUTH_ONLY_FIELDS.has(field)
+  );
+}
+
+export function resolveMatrixAccountStringValues(params: {
+  accountId: string;
+  account?: MatrixStringSourceMap;
+  scopedEnv?: MatrixStringSourceMap;
+  channel?: MatrixStringSourceMap;
+  globalEnv?: MatrixStringSourceMap;
+}): MatrixResolvedStringValues {
+  const fields: MatrixResolvedStringField[] = [
+    "homeserver",
+    "userId",
+    "accessToken",
+    "password",
+    "deviceId",
+    "deviceName",
+  ];
+  const resolved = {} as MatrixResolvedStringValues;
+
+  for (const field of fields) {
+    resolved[field] =
+      resolveMatrixStringSourceValue(params.account?.[field]) ||
+      resolveMatrixStringSourceValue(params.scopedEnv?.[field]) ||
+      (shouldAllowBaseAuthFallback(params.accountId, field)
+        ? resolveMatrixStringSourceValue(params.channel?.[field]) ||
+          resolveMatrixStringSourceValue(params.globalEnv?.[field])
+        : "");
+  }
+
+  return resolved;
+}

package/src/channel-account-paths.ts

@@ -0,0 +1,92 @@
+import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
+import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
+import type { PinnedDispatcherPolicy, SsrFPolicy } from "openclaw/plugin-sdk/infra-runtime";
+import { formatMatrixErrorMessage } from "./matrix/errors.js";
+import type { MatrixProbe } from "./matrix/probe.js";
+import type { CoreConfig } from "./types.js";
+
+type ResolveMatrixAuth = (params: { cfg: CoreConfig; accountId?: string }) => Promise<{
+  homeserver: string;
+  accessToken: string;
+  userId: string;
+  deviceId?: string;
+  allowPrivateNetwork?: boolean;
+  ssrfPolicy?: SsrFPolicy;
+  dispatcherPolicy?: PinnedDispatcherPolicy;
+}>;
+
+type ProbeMatrix = (params: {
+  homeserver: string;
+  accessToken: string;
+  userId: string;
+  deviceId?: string;
+  timeoutMs: number;
+  accountId?: string;
+  allowPrivateNetwork?: boolean;
+  ssrfPolicy?: SsrFPolicy;
+  dispatcherPolicy?: PinnedDispatcherPolicy;
+}) => Promise<MatrixProbe>;
+
+type SendMessageMatrix = (
+  to: string,
+  message: string,
+  options?: { accountId?: string },
+) => Promise<unknown>;
+
+export function createMatrixProbeAccount(params: {
+  resolveMatrixAuth: ResolveMatrixAuth;
+  probeMatrix: ProbeMatrix;
+}) {
+  return async ({
+    account,
+    timeoutMs,
+    cfg,
+  }: {
+    account: { accountId?: string };
+    timeoutMs?: number;
+    cfg: unknown;
+  }): Promise<MatrixProbe> => {
+    try {
+      const auth = await params.resolveMatrixAuth({
+        cfg: cfg as CoreConfig,
+        accountId: account.accountId,
+      });
+      return await params.probeMatrix({
+        homeserver: auth.homeserver,
+        accessToken: auth.accessToken,
+        userId: auth.userId,
+        deviceId: auth.deviceId,
+        timeoutMs: timeoutMs ?? 5_000,
+        accountId: account.accountId,
+        allowPrivateNetwork: auth.allowPrivateNetwork,
+        ssrfPolicy: auth.ssrfPolicy,
+        dispatcherPolicy: auth.dispatcherPolicy,
+      });
+    } catch (err) {
+      return {
+        ok: false,
+        error: formatMatrixErrorMessage(err),
+        elapsedMs: 0,
+      };
+    }
+  };
+}
+
+export function createMatrixPairingText(sendMessageMatrix: SendMessageMatrix) {
+  return {
+    idLabel: "matrixUserId",
+    message: PAIRING_APPROVED_MESSAGE,
+    normalizeAllowEntry: createPairingPrefixStripper(/^matrix:/i),
+    notify: async ({
+      id,
+      message,
+      accountId,
+    }: {
+      id: string;
+      message: string;
+      accountId?: string;
+    }) => {
+      await sendMessageMatrix(`user:${id}`, message, accountId ? { accountId } : {});
+    },
+  };
+}

package/src/channel.account-paths.test.ts

@@ -0,0 +1,102 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createMatrixPairingText, createMatrixProbeAccount } from "./channel-account-paths.js";
+
+const sendMessageMatrixMock = vi.hoisted(() => vi.fn());
+const probeMatrixMock = vi.hoisted(() => vi.fn());
+const resolveMatrixAuthMock = vi.hoisted(() => vi.fn());
+
+vi.mock("./matrix/send.js", async () => {
+  const actual = await vi.importActual<typeof import("./matrix/send.js")>("./matrix/send.js");
+  return {
+    ...actual,
+    sendMessageMatrix: (...args: unknown[]) => sendMessageMatrixMock(...args),
+  };
+});
+
+vi.mock("./matrix/probe.js", async () => {
+  const actual = await vi.importActual<typeof import("./matrix/probe.js")>("./matrix/probe.js");
+  return {
+    ...actual,
+    probeMatrix: (...args: unknown[]) => probeMatrixMock(...args),
+  };
+});
+
+vi.mock("./matrix/client.js", async () => {
+  const actual = await vi.importActual<typeof import("./matrix/client.js")>("./matrix/client.js");
+  return {
+    ...actual,
+    resolveMatrixAuth: (...args: unknown[]) => resolveMatrixAuthMock(...args),
+  };
+});
+
+describe("matrix account path propagation", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    sendMessageMatrixMock.mockResolvedValue({
+      messageId: "$sent",
+      roomId: "!room:example.org",
+    });
+    probeMatrixMock.mockResolvedValue({
+      ok: true,
+      error: null,
+      status: null,
+      elapsedMs: 5,
+      userId: "@poe:example.org",
+    });
+    resolveMatrixAuthMock.mockResolvedValue({
+      accountId: "poe",
+      homeserver: "https://matrix.example.org",
+      userId: "@poe:example.org",
+      accessToken: "poe-token",
+      deviceId: "POEDEVICE",
+    });
+  });
+
+  it("forwards accountId when notifying pairing approval", async () => {
+    const pairingText = createMatrixPairingText(sendMessageMatrixMock);
+
+    expect(pairingText.normalizeAllowEntry("  matrix:@user:example.org  ")).toBe(
+      "@user:example.org",
+    );
+
+    await pairingText.notify({
+      id: "@user:example.org",
+      message: pairingText.message,
+      accountId: "poe",
+    });
+
+    expect(sendMessageMatrixMock).toHaveBeenCalledWith(
+      "user:@user:example.org",
+      expect.any(String),
+      { accountId: "poe" },
+    );
+  });
+
+  it("forwards accountId and deviceId to matrix probes", async () => {
+    const probeAccount = createMatrixProbeAccount({
+      resolveMatrixAuth: resolveMatrixAuthMock,
+      probeMatrix: probeMatrixMock,
+    });
+
+    await probeAccount({
+      cfg: {} as never,
+      timeoutMs: 500,
+      account: {
+        accountId: "poe",
+      } as never,
+    });
+
+    expect(resolveMatrixAuthMock).toHaveBeenCalledWith({
+      cfg: {},
+      accountId: "poe",
+    });
+    expect(probeMatrixMock).toHaveBeenCalledWith({
+      homeserver: "https://matrix.example.org",
+      accessToken: "poe-token",
+      userId: "@poe:example.org",
+      deviceId: "POEDEVICE",
+      timeoutMs: 500,
+      accountId: "poe",
+    });
+  });
+});