@clawling/clawchat-plugin-openclaw 2026.6.16-1 → 2026.6.16-3

package/dist/src/config.js

@@ -185,6 +185,27 @@ function readOptionalString(value) {
 function readEnvString(env, key) {
     return readOptionalString(env[key]);
 }
+/**
+ * Decode a string claim from a JWT access token's payload (no signature
+ * verification — this is for self-identifying claims the backend already signed,
+ * e.g. `oid` owner id). Returns "" on any malformed input.
+ */
+function decodeJwtStringClaim(token, claim) {
+    if (typeof token !== "string")
+        return "";
+    const segments = token.split(".");
+    if (segments.length < 2 || !segments[1])
+        return "";
+    try {
+        const json = Buffer.from(segments[1], "base64url").toString("utf8");
+        const parsed = JSON.parse(json);
+        const value = parsed?.[claim];
+        return typeof value === "string" ? value.trim() : "";
+    }
+    catch {
+        return "";
+    }
+}
 function readGroupMode(value) {
     return value === "mention" ? "mention" : "all";
 }
@@ -291,7 +312,13 @@ export function resolveOpenclawClawlingAccount(cfg, env = process.env) {
     const token = readOptionalString(channel.token) || readEnvString(env, CLAWCHAT_TOKEN_ENV);
     const agentId = readOptionalString(channel.agentId) || readEnvString(env, CLAWCHAT_AGENT_ID_ENV);
     const userId = readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV);
-    const ownerUserId = readOptionalString(channel.ownerUserId) || readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV);
+    const ownerUserId = readOptionalString(channel.ownerUserId) ||
+        readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV) ||
+        // Fall back to the access token's `oid` (owner) claim. A provisioner may
+        // inject token + userId but omit ownerUserId; without it the connect gate
+        // (hasOpenclawClawlingConnectCredentials) never passes and the plugin sits
+        // in the wait-for-activation loop. The owner is always carried in the token.
+        decodeJwtStringClaim(token, "oid");
     const enabled = typeof channel.enabled === "boolean" ? channel.enabled : true;
     const outputVisibility = readOutputVisibility(channel.outputVisibility);
     const chats = readChats(channel.chats);

package/dist/src/plugin-report.js

@@ -1,11 +1,38 @@
 import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
-/** Best-effort read of this plugin's package version; "unknown" on failure. */
+const PACKAGE_NAME = "@clawling/clawchat-plugin-openclaw";
+/**
+ * Best-effort read of this plugin's package version; "unknown" on failure.
+ *
+ * Walks up from this module's directory to the nearest package.json whose
+ * name matches this plugin, instead of assuming a fixed relative depth. The
+ * compiled module lives at dist/src/plugin-report.js (rootDir "." + outDir
+ * "dist"), so a hard-coded "../package.json" resolves to the non-existent
+ * dist/package.json at runtime and always falls back to "unknown" — even
+ * though it happens to work when tests run straight from src/.
+ */
 export function resolvePluginVersion() {
     try {
         const require = createRequire(import.meta.url);
-        const pkg = require("../package.json");
-        return pkg.version ?? "unknown";
+        let dir = dirname(fileURLToPath(import.meta.url));
+        // Bounded climb (handles dist/src, src, and any reasonable nesting).
+        for (let i = 0; i < 8; i += 1) {
+            try {
+                const pkg = require(join(dir, "package.json"));
+                if (pkg.name === PACKAGE_NAME && pkg.version)
+                    return pkg.version;
+            }
+            catch {
+                // no package.json at this level — keep climbing
+            }
+            const parent = dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+        return "unknown";
     }
     catch {
         return "unknown";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.6.16-1",
+  "version": "2026.6.16-3",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "files": [

package/src/config.ts

@@ -309,6 +309,25 @@ function readEnvString(env: Record<string, string | undefined>, key: string): st
   return readOptionalString(env[key]);
 }
 
+/**
+ * Decode a string claim from a JWT access token's payload (no signature
+ * verification — this is for self-identifying claims the backend already signed,
+ * e.g. `oid` owner id). Returns "" on any malformed input.
+ */
+function decodeJwtStringClaim(token: string, claim: string): string {
+  if (typeof token !== "string") return "";
+  const segments = token.split(".");
+  if (segments.length < 2 || !segments[1]) return "";
+  try {
+    const json = Buffer.from(segments[1], "base64url").toString("utf8");
+    const parsed = JSON.parse(json) as Record<string, unknown>;
+    const value = parsed?.[claim];
+    return typeof value === "string" ? value.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
 function readGroupMode(value: unknown): GroupMode {
   return value === "mention" ? "mention" : "all";
 }
@@ -444,7 +463,13 @@ export function resolveOpenclawClawlingAccount(
   const agentId = readOptionalString(channel.agentId) || readEnvString(env, CLAWCHAT_AGENT_ID_ENV);
   const userId = readOptionalString(channel.userId) || readEnvString(env, CLAWCHAT_USER_ID_ENV);
   const ownerUserId =
-    readOptionalString(channel.ownerUserId) || readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV);
+    readOptionalString(channel.ownerUserId) ||
+    readEnvString(env, CLAWCHAT_OWNER_USER_ID_ENV) ||
+    // Fall back to the access token's `oid` (owner) claim. A provisioner may
+    // inject token + userId but omit ownerUserId; without it the connect gate
+    // (hasOpenclawClawlingConnectCredentials) never passes and the plugin sits
+    // in the wait-for-activation loop. The owner is always carried in the token.
+    decodeJwtStringClaim(token, "oid");
   const enabled = typeof channel.enabled === "boolean" ? channel.enabled : true;
   const outputVisibility = readOutputVisibility(channel.outputVisibility);
   const chats = readChats(channel.chats);

package/src/plugin-report.ts

@@ -1,12 +1,40 @@
 import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { createOpenclawClawlingApiClient } from "./api-client.ts";
 
-/** Best-effort read of this plugin's package version; "unknown" on failure. */
+const PACKAGE_NAME = "@clawling/clawchat-plugin-openclaw";
+
+/**
+ * Best-effort read of this plugin's package version; "unknown" on failure.
+ *
+ * Walks up from this module's directory to the nearest package.json whose
+ * name matches this plugin, instead of assuming a fixed relative depth. The
+ * compiled module lives at dist/src/plugin-report.js (rootDir "." + outDir
+ * "dist"), so a hard-coded "../package.json" resolves to the non-existent
+ * dist/package.json at runtime and always falls back to "unknown" — even
+ * though it happens to work when tests run straight from src/.
+ */
 export function resolvePluginVersion(): string {
   try {
     const require = createRequire(import.meta.url);
-    const pkg = require("../package.json") as { version?: string };
-    return pkg.version ?? "unknown";
+    let dir = dirname(fileURLToPath(import.meta.url));
+    // Bounded climb (handles dist/src, src, and any reasonable nesting).
+    for (let i = 0; i < 8; i += 1) {
+      try {
+        const pkg = require(join(dir, "package.json")) as {
+          name?: string;
+          version?: string;
+        };
+        if (pkg.name === PACKAGE_NAME && pkg.version) return pkg.version;
+      } catch {
+        // no package.json at this level — keep climbing
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    return "unknown";
   } catch {
     return "unknown";
   }