@eclaw/openclaw-channel 1.2.0 → 1.2.1

package/dist/webhook-handler.d.ts

@@ -15,4 +15,5 @@
  *   - Mission context via eclaw_context.missionHints
  *   - Silent suppression via silentToken (default "[SILENT]")
  */
-export declare function createWebhookHandler(expectedToken: string, accountId: string, cfg: any): (req: any, res: any) => Promise<void>;
+export declare function createWebhookHandler(_expectedToken: string, // kept for API compat; auth is handled by webhook-registry
+accountId: string, cfg: any): (req: any, res: any) => Promise<void>;

package/dist/webhook-handler.js

@@ -17,19 +17,15 @@ import { getClient, setActiveEvent, clearActiveEvent } from './outbound.js';
  *   - Mission context via eclaw_context.missionHints
  *   - Silent suppression via silentToken (default "[SILENT]")
  */
-export function createWebhookHandler(expectedToken, accountId, 
+export function createWebhookHandler(_expectedToken, // kept for API compat; auth is handled by webhook-registry
+accountId, 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 cfg // full openclaw config (ctx.cfg from startAccount)
 ) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     return async (req, res) => {
-        // Verify callback token
-        const authHeader = req.headers?.authorization;
-        if (expectedToken && (!authHeader || authHeader !== `Bearer ${expectedToken}`)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-            return;
-        }
+        // Token verification is handled by webhook-registry dispatch.
+        // No additional auth check needed here.
         const msg = req.body;
         // ACK immediately so E-Claw doesn't time out
         res.writeHead(200, { 'Content-Type': 'application/json' });

package/dist/webhook-registry.js

@@ -22,18 +22,30 @@ export function unregisterWebhookToken(callbackToken) {
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export async function dispatchWebhook(req, res) {
     const authHeader = req.headers?.authorization;
-    if (!authHeader?.startsWith('Bearer ')) {
-        res.writeHead(401, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Unauthorized' }));
-        return;
+    // Try Bearer-token routing first (preferred)
+    if (authHeader?.startsWith('Bearer ')) {
+        const token = authHeader.slice(7);
+        const entry = registry.get(token);
+        if (entry) {
+            await entry.handler(req, res);
+            return;
+        }
+        // Token present but unknown — fall through to single-handler fallback
     }
-    const token = authHeader.slice(7);
-    const entry = registry.get(token);
-    if (!entry) {
-        // Unknown token — likely a stale push after a server restart
-        res.writeHead(404, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Unknown token' }));
+    // Fallback: if exactly one handler is registered, route to it.
+    // This handles E-Claw backends that don't echo callback_token.
+    if (registry.size === 1) {
+        const [, entry] = [...registry.entries()][0];
+        await entry.handler(req, res);
         return;
     }
-    await entry.handler(req, res);
+    // No valid routing possible
+    if (registry.size === 0) {
+        res.writeHead(503, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'No handlers registered' }));
+    }
+    else {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unauthorized' }));
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eclaw/openclaw-channel",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "E-Claw channel plugin for OpenClaw — AI chat platform for live wallpaper entities",
   "type": "module",
   "main": "./dist/index.js",