@gakr-gakr/synology-chat 0.1.0

package/api.ts

@@ -0,0 +1,3 @@
+export { synologyChatPlugin } from "./src/channel.js";
+export { setSynologyRuntime } from "./src/runtime.js";
+export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/autobot.plugin.json

@@ -0,0 +1,22 @@
+{
+  "id": "synology-chat",
+  "activation": {
+    "onStartup": false
+  },
+  "channels": ["synology-chat"],
+  "channelEnvVars": {
+    "synology-chat": [
+      "SYNOLOGY_CHAT_TOKEN",
+      "SYNOLOGY_CHAT_INCOMING_URL",
+      "SYNOLOGY_NAS_HOST",
+      "SYNOLOGY_ALLOWED_USER_IDS",
+      "SYNOLOGY_RATE_LIMIT",
+      "AUTOBOT_BOT_NAME"
+    ]
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {}
+  }
+}

package/channel-plugin-api.ts

@@ -0,0 +1 @@
+export { synologyChatPlugin } from "./src/channel.js";

package/contract-api.ts

@@ -0,0 +1 @@
+export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/index.ts

@@ -0,0 +1,16 @@
+import { defineBundledChannelEntry } from "autobot/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelEntry({
+  id: "synology-chat",
+  name: "Synology Chat",
+  description: "Native Synology Chat channel plugin for AutoBot",
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./channel-plugin-api.js",
+    exportName: "synologyChatPlugin",
+  },
+  runtime: {
+    specifier: "./api.js",
+    exportName: "setSynologyRuntime",
+  },
+});

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@gakr-gakr/synology-chat",
+  "version": "0.1.0",
+  "description": "Synology Chat channel plugin for AutoBot",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/autobot/autobot"
+  },
+  "type": "module",
+  "devDependencies": {
+    "@gakr-gakr/plugin-sdk": "workspace:*"
+  },
+  "autobot": {
+    "extensions": [
+      "./index.ts"
+    ],
+    "setupEntry": "./setup-entry.ts",
+    "channel": {
+      "id": "synology-chat",
+      "label": "Synology Chat",
+      "selectionLabel": "Synology Chat (Webhook)",
+      "docsPath": "/channels/synology-chat",
+      "docsLabel": "synology-chat",
+      "blurb": "Connect your Synology NAS Chat to AutoBot with full agent capabilities.",
+      "order": 90
+    },
+    "install": {
+      "npmSpec": "@gakr-gakr/synology-chat",
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.4.10"
+    },
+    "compat": {
+      "pluginApi": ">=2026.5.19"
+    },
+    "build": {
+      "autobotVersion": "2026.5.19"
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
+    }
+  },
+  "dependencies": {
+    "zod": "4.4.3"
+  }
+}

package/setup-api.ts

@@ -0,0 +1 @@
+export { synologyChatSetupAdapter, synologyChatSetupWizard } from "./src/setup-surface.js";

package/setup-entry.ts

@@ -0,0 +1,9 @@
+import { defineBundledChannelSetupEntry } from "autobot/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelSetupEntry({
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./api.js",
+    exportName: "synologyChatPlugin",
+  },
+});

package/src/accounts.ts

@@ -0,0 +1,151 @@
+/**
+ * Account resolution: reads config from channels.synology-chat,
+ * merges per-account overrides, falls back to environment variables.
+ */
+
+import {
+  DEFAULT_ACCOUNT_ID,
+  listCombinedAccountIds,
+  resolveMergedAccountConfig,
+  type AutoBotConfig,
+} from "autobot/plugin-sdk/account-resolution";
+import { resolveDangerousNameMatchingEnabled } from "autobot/plugin-sdk/dangerous-name-runtime";
+import type {
+  SynologyChatChannelConfig,
+  ResolvedSynologyChatAccount,
+  SynologyWebhookPathSource,
+} from "./types.js";
+
+/** Extract the channel config from the full AutoBot config object. */
+function getChannelConfig(cfg: AutoBotConfig): SynologyChatChannelConfig | undefined {
+  return cfg?.channels?.["synology-chat"] as SynologyChatChannelConfig | undefined;
+}
+
+function resolveImplicitAccountId(channelCfg: SynologyChatChannelConfig): string | undefined {
+  return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : undefined;
+}
+
+function getRawAccountConfig(
+  channelCfg: SynologyChatChannelConfig,
+  accountId: string,
+): SynologyChatChannelConfig {
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    return channelCfg;
+  }
+  return channelCfg.accounts?.[accountId] ?? {};
+}
+
+function hasExplicitWebhookPath(rawAccount: SynologyChatChannelConfig | undefined): boolean {
+  return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
+}
+
+function resolveWebhookPathSource(params: {
+  accountId: string;
+  channelCfg: SynologyChatChannelConfig;
+  rawAccount: SynologyChatChannelConfig;
+}): SynologyWebhookPathSource {
+  if (hasExplicitWebhookPath(params.rawAccount)) {
+    return "explicit";
+  }
+  if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) {
+    return "inherited-base";
+  }
+  return "default";
+}
+
+/** Parse allowedUserIds from string or array to string[]. */
+function parseAllowedUserIds(raw: string | string[] | undefined): string[] {
+  if (!raw) {
+    return [];
+  }
+  if (Array.isArray(raw)) {
+    return raw.filter(Boolean);
+  }
+  return raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function parseRateLimitPerMinute(raw: string | undefined): number {
+  if (raw == null) {
+    return 30;
+  }
+  const trimmed = raw.trim();
+  if (!/^-?\d+$/.test(trimmed)) {
+    return 30;
+  }
+  return Number.parseInt(trimmed, 10);
+}
+
+/**
+ * List all configured account IDs for this channel.
+ * Returns ["default"] if there's a base config, plus any named accounts.
+ */
+export function listAccountIds(cfg: AutoBotConfig): string[] {
+  const channelCfg = getChannelConfig(cfg);
+  if (!channelCfg) {
+    return [];
+  }
+
+  return listCombinedAccountIds({
+    configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
+    implicitAccountId: resolveImplicitAccountId(channelCfg),
+  });
+}
+
+/**
+ * Resolve a specific account by ID with full defaults applied.
+ * Falls back to env vars for the "default" account.
+ */
+export function resolveAccount(
+  cfg: AutoBotConfig,
+  accountId?: string | null,
+): ResolvedSynologyChatAccount {
+  const channelCfg = getChannelConfig(cfg) ?? {};
+  const id = accountId || DEFAULT_ACCOUNT_ID;
+  const accountOverrides =
+    id === DEFAULT_ACCOUNT_ID ? undefined : (channelCfg.accounts?.[id] ?? undefined);
+  const rawAccount = getRawAccountConfig(channelCfg, id);
+  const merged = resolveMergedAccountConfig<Record<string, unknown> & SynologyChatChannelConfig>({
+    channelConfig: channelCfg as Record<string, unknown> & SynologyChatChannelConfig,
+    accounts: channelCfg.accounts as
+      | Record<string, Partial<Record<string, unknown> & SynologyChatChannelConfig>>
+      | undefined,
+    accountId: id,
+  });
+
+  // Env var fallbacks (primarily for the "default" account)
+  const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
+  const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
+  const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
+  const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
+  const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
+  const envBotName = process.env.AUTOBOT_BOT_NAME ?? "AutoBot";
+  const webhookPathSource = resolveWebhookPathSource({ accountId: id, channelCfg, rawAccount });
+  const dangerouslyAllowInheritedWebhookPath =
+    rawAccount.dangerouslyAllowInheritedWebhookPath ??
+    channelCfg.dangerouslyAllowInheritedWebhookPath ??
+    false;
+
+  // Merge: account override > base channel config > env var
+  return {
+    accountId: id,
+    enabled: merged.enabled ?? true,
+    token: merged.token ?? envToken,
+    incomingUrl: merged.incomingUrl ?? envIncomingUrl,
+    nasHost: merged.nasHost ?? envNasHost,
+    webhookPath: merged.webhookPath ?? "/webhook/synology",
+    webhookPathSource,
+    dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
+      providerConfig: channelCfg,
+      accountConfig: accountOverrides,
+    }),
+    dangerouslyAllowInheritedWebhookPath,
+    dmPolicy: merged.dmPolicy ?? "allowlist",
+    allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
+    rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+    botName: merged.botName ?? envBotName,
+    allowInsecureSsl: merged.allowInsecureSsl ?? false,
+  };
+}

package/src/approval-auth.ts

@@ -0,0 +1,22 @@
+import {
+  createResolvedApproverActionAuthAdapter,
+  resolveApprovalApprovers,
+} from "autobot/plugin-sdk/approval-auth-runtime";
+import { resolveAccount } from "./accounts.js";
+
+function normalizeSynologyChatApproverId(value: string | number): string | undefined {
+  const trimmed = String(value).trim();
+  return /^\d+$/.test(trimmed) ? trimmed : undefined;
+}
+
+export const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
+  channelLabel: "Synology Chat",
+  resolveApprovers: ({ cfg, accountId }) => {
+    const account = resolveAccount(cfg ?? {}, accountId);
+    return resolveApprovalApprovers({
+      allowFrom: account.allowedUserIds,
+      normalizeApprover: normalizeSynologyChatApproverId,
+    });
+  },
+  normalizeSenderId: (value) => normalizeSynologyChatApproverId(value),
+});

package/src/channel.test-mocks.ts

@@ -0,0 +1,176 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Mock } from "vitest";
+import { vi } from "vitest";
+
+type RegisteredRoute = {
+  path: string;
+  accountId: string;
+  handler: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+};
+
+export const registerPluginHttpRouteMock: Mock<(params: RegisteredRoute) => () => void> = vi.fn(
+  () => vi.fn(),
+);
+
+export const dispatchReplyWithBufferedBlockDispatcher: Mock<
+  () => Promise<{ counts: Record<string, number> }>
+> = vi.fn().mockResolvedValue({ counts: {} });
+export const finalizeInboundContextMock: Mock<
+  (ctx: Record<string, unknown>) => Record<string, unknown>
+> = vi.fn((ctx) => ctx);
+export const buildChannelInboundEventContextMock: Mock<
+  (params: {
+    channel: string;
+    accountId?: string;
+    timestamp?: number;
+    from: string;
+    sender: { id: string; name?: string };
+    conversation: { kind: string; label?: string };
+    route: {
+      accountId?: string;
+      routeSessionKey: string;
+      dispatchSessionKey?: string;
+    };
+    reply: { to: string; originatingTo: string };
+    message: {
+      rawBody: string;
+      bodyForAgent?: string;
+      commandBody?: string;
+    };
+    extra?: Record<string, unknown>;
+  }) => Record<string, unknown>
+> = vi.fn((params) =>
+  finalizeInboundContextMock({
+    Body: params.message.rawBody,
+    BodyForAgent: params.message.bodyForAgent ?? params.message.rawBody,
+    RawBody: params.message.rawBody,
+    CommandBody: params.message.commandBody ?? params.message.rawBody,
+    From: params.from,
+    To: params.reply.to,
+    SessionKey: params.route.dispatchSessionKey ?? params.route.routeSessionKey,
+    AccountId: params.route.accountId ?? params.accountId,
+    OriginatingChannel: params.channel,
+    OriginatingTo: params.reply.originatingTo,
+    ChatType: params.conversation.kind,
+    SenderName: params.sender.name,
+    SenderId: params.sender.id,
+    Provider: params.channel,
+    Surface: params.channel,
+    ConversationLabel: params.conversation.label,
+    Timestamp: params.timestamp,
+    ...params.extra,
+  }),
+);
+export const resolveAgentRouteMock: Mock<
+  (params: { accountId?: string }) => { agentId: string; sessionKey: string; accountId: string }
+> = vi.fn((params) => {
+  const accountId = params.accountId?.trim() || "default";
+  return {
+    agentId: `agent-${accountId}`,
+    sessionKey: `agent:agent-${accountId}:main`,
+    accountId,
+  };
+});
+let mockRuntimeConfig: unknown = {};
+
+export function setSynologyRuntimeConfigForTest(cfg: unknown): void {
+  mockRuntimeConfig = cfg;
+}
+
+async function readRequestBodyWithLimitForTest(req: IncomingMessage): Promise<string> {
+  return await new Promise<string>((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (chunk) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    });
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    req.on("error", reject);
+  });
+}
+
+vi.mock("autobot/plugin-sdk/setup", async () => {
+  const actual = await vi.importActual<object>("autobot/plugin-sdk/setup");
+  return {
+    ...actual,
+    DEFAULT_ACCOUNT_ID: "default",
+  };
+});
+
+vi.mock("autobot/plugin-sdk/channel-config-schema", async () => {
+  const actual = await vi.importActual<object>("autobot/plugin-sdk/channel-config-schema");
+  return {
+    ...actual,
+    buildChannelConfigSchema: vi.fn((schema: unknown) => ({ schema })),
+  };
+});
+
+vi.mock("autobot/plugin-sdk/webhook-ingress", async () => {
+  const actual = await vi.importActual<object>("autobot/plugin-sdk/webhook-ingress");
+  return {
+    ...actual,
+    registerPluginHttpRoute: registerPluginHttpRouteMock,
+    readRequestBodyWithLimit: vi.fn(readRequestBodyWithLimitForTest),
+    isRequestBodyLimitError: vi.fn(() => false),
+    requestBodyErrorToText: vi.fn(() => "Request body too large"),
+    createFixedWindowRateLimiter: vi.fn(() => ({
+      isRateLimited: vi.fn(() => false),
+      size: vi.fn(() => 0),
+      clear: vi.fn(),
+    })),
+  };
+});
+
+vi.mock("./client.js", () => ({
+  sendMessage: vi.fn().mockResolvedValue(true),
+  sendFileUrl: vi.fn().mockResolvedValue(true),
+  resolveLegacyWebhookNameToChatUserId: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("./runtime.js", () => ({
+  getSynologyRuntime: vi.fn(() => ({
+    config: { current: vi.fn(() => mockRuntimeConfig) },
+    channel: {
+      routing: {
+        resolveAgentRoute: resolveAgentRouteMock,
+      },
+      reply: {
+        finalizeInboundContext: finalizeInboundContextMock,
+        dispatchReplyWithBufferedBlockDispatcher,
+      },
+      session: {
+        resolveStorePath: vi.fn(() => "/tmp/autobot/synology-chat-sessions.json"),
+        recordInboundSession: vi.fn(async () => undefined),
+      },
+      turn: {
+        run: vi.fn(async (params) => {
+          const input = await params.adapter.ingest(params.raw);
+          if (!input) {
+            return { admission: { kind: "drop", reason: "ingest-null" }, dispatched: false };
+          }
+          const resolved = await params.adapter.resolveTurn(input, {
+            kind: "message",
+            canStartAgentTurn: true,
+          });
+          const dispatchResult = await resolved.dispatchReplyWithBufferedBlockDispatcher({
+            ctx: resolved.ctxPayload,
+            cfg: mockRuntimeConfig,
+            dispatcherOptions: {
+              ...resolved.dispatcherOptions,
+              deliver: resolved.delivery.deliver,
+              onError: resolved.delivery.onError,
+            },
+          });
+          return {
+            admission: { kind: "dispatch" },
+            dispatched: true,
+            dispatchResult,
+            ctxPayload: resolved.ctxPayload,
+            routeSessionKey: resolved.routeSessionKey,
+          };
+        }),
+        buildContext: buildChannelInboundEventContextMock,
+      },
+    },
+  })),
+  setSynologyRuntime: vi.fn(),
+}));