@kartik.doda/openclaw-plugin-test 1.0.0

package/dist/service/channel.js

@@ -0,0 +1,747 @@
+import { DM_SCOPE } from "../utils.js";
+import { RocketChatClient } from "../client/rest.js";
+import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+import { homedir } from "node:os";
+import { readAllAccounts, readBindingsForAccount, readOwner, readAccount, addAccount, addBinding, ensureAgentForBot, removeBindingsForAccount, removeAccount, removeAgentDir, } from "../cli/config-updater.js";
+import { createBotUser, loginAs, getGroupByName, createDirectMessage, sendMessage, deleteUser, getUserInfo, inviteToGroup, listGroupMembers, } from "../cli/admin-api.js";
+import { checkBotCreationLimit, recordBotCreation } from "../cli/rate-limiter.js";
+import { loadAdmin } from "../cli/credentials.js";
+import { startGateway } from "./gateway.js";
+import { activeClients, connectionStatus } from "./runtime-state.js";
+import { AccessStore } from "../config/access-store.js";
+const BROADCAST_MENTIONS = new Set(["here", "all", "everyone"]);
+export function shouldHandleInboundEvent(event, options) {
+    if (event.senderId === options.botUserId) {
+        return false;
+    }
+    if (options.knownBotUserIds?.has(event.senderId)) {
+        return false;
+    }
+    if (event.roomType === "direct") {
+        return true;
+    }
+    const aliases = new Set(options.mentionNames.map((a) => a.trim().replace(/^@+/, "").toLowerCase()));
+    for (const mention of event.mentions) {
+        const name = mention.toLowerCase();
+        if (BROADCAST_MENTIONS.has(name))
+            continue;
+        if (aliases.has(name))
+            return true;
+    }
+    const normalizedText = event.text.toLowerCase();
+    for (const alias of aliases) {
+        if (normalizedText.includes(`@${alias}`))
+            return true;
+    }
+    return false;
+}
+const COMMAND_RE = /^\s*!(\S+)(?:\s+([\s\S]*))?$/i;
+/**
+ * Commands restricted to the bot owner (`accounts.<id>.owner`). Any other user
+ * with access who tries one of these gets a permission reply and the command is
+ * never executed or forwarded to OpenClaw.
+ */
+const OWNER_ONLY_COMMANDS = new Set([
+    "add-bot",
+    "remove-bot",
+    "add-group",
+    "revoke",
+    "access",
+    "bots",
+]);
+function isOwner(ctx) {
+    const owner = ctx.account.owner?.trim().replace(/^@+/, "").toLowerCase();
+    const actor = ctx.senderName?.trim().replace(/^@+/, "").toLowerCase();
+    return !!owner && !!actor && owner === actor;
+}
+export async function matchCommand(text, ctx) {
+    const normalized = text
+        .replace(/[\u200B\u200C\u200D\uFEFF]/g, "")
+        .replace(/^\s*(@\S+\s+)+/, "")
+        .trim()
+        .replace(/^!\s+/, "!");
+    const match = normalized.match(COMMAND_RE);
+    if (!match)
+        return { action: "passthrough" };
+    const cmd = match[1].toLowerCase();
+    const argStr = match[2] ?? "";
+    if (OWNER_ONLY_COMMANDS.has(cmd) && !isOwner(ctx)) {
+        return {
+            action: "reply",
+            replyText: `\`!${cmd}\` is owner-only. Contact ${ctx.account.owner ? `@${ctx.account.owner}` : "the bot owner"}.`,
+        };
+    }
+    switch (cmd) {
+        case "help":
+            return { action: "reply", replyText: buildHelpText(isOwner(ctx)) };
+        case "access":
+            return { action: "reply", replyText: await runAccess(ctx) };
+        case "bots":
+            return { action: "reply", replyText: runBots() };
+        case "groups":
+            return { action: "reply", replyText: await runGroups(ctx) };
+        case "status":
+            return { action: "reply", replyText: await runStatus(ctx) };
+        case "add-bot":
+            return { action: "reply", replyText: await runAddBot(ctx, argStr) };
+        case "lend":
+            return { action: "reply", replyText: await runLend(ctx, argStr) };
+        case "revoke":
+            return { action: "reply", replyText: await runRevoke(ctx, argStr) };
+        case "remove-bot":
+            return { action: "reply", replyText: await runRemoveBot(ctx, argStr) };
+        case "add-group":
+            return { action: "reply", replyText: await runAddGroup(ctx, argStr) };
+        case "compact":
+            return { action: "openclaw-command", command: `/compact${argStr ? " " + argStr : ""}` };
+        case "reset":
+            return { action: "openclaw-command", command: `/reset${argStr ? " " + argStr : ""}` };
+        case "new":
+            return { action: "openclaw-command", command: `/new${argStr ? " " + argStr : ""}` };
+        case "model":
+            return { action: "openclaw-command", command: `/model${argStr ? " " + argStr : ""}` };
+        case "tools":
+            return { action: "openclaw-command", command: `/tools${argStr ? " " + argStr : ""}` };
+        case "skill":
+            return { action: "openclaw-command", command: `/skill${argStr ? " " + argStr : ""}` };
+        case "skills":
+            return { action: "reply", replyText: runSkills() };
+        case "think":
+            return { action: "openclaw-command", command: `/think${argStr ? " " + argStr : ""}` };
+        case "abort":
+            return { action: "openclaw-command", command: `/abort${argStr ? " " + argStr : ""}` };
+        case "reasoning":
+            return { action: "openclaw-command", command: `/reasoning${argStr ? " " + argStr : ""}` };
+        case "verbose":
+            return { action: "openclaw-command", command: `/verbose${argStr ? " " + argStr : ""}` };
+        default:
+            return {
+                action: "reply",
+                replyText: `Unknown command \`!${cmd}\`. Type \`!help\` to see available commands.`,
+            };
+    }
+}
+function buildHelpText(showAll) {
+    const groups = [
+        [
+            "Bot",
+            [
+                ["help", "this menu"],
+                ["status", "Checkout openclaw gateway status"],
+                ["bots", "bots and agents"],
+                ["groups", "groups joined by bots"],
+                ["access", "who can use"],
+                ["add-bot <user>", "create a bot"],
+                ["remove-bot <user...>", "delete bot(s)"],
+                ["add-group <group> [bot]", "invite bot to group"],
+                ["lend <group> <user>", "grant group access"],
+                ["lend dm <user>", "grant DM access"],
+                ["revoke <group> <user>", "revoke group access"],
+                ["revoke dm <user>", "revoke DM access"],
+            ],
+        ],
+        [
+            "Context",
+            [
+                ["compact", "compress history"],
+                ["reset", "wipe all"],
+                ["new [model]", "fresh start"],
+            ],
+        ],
+        ["Model", [["model [name|#]", "list or switch"]]],
+        [
+            "Behavior",
+            [
+                ["think <level>", "off, low, medium, high"],
+                ["abort", "stop reply"],
+                ["reasoning on/off", "show reasoning"],
+                ["verbose on/off", "debug details"],
+            ],
+        ],
+        [
+            "Tools & Skills",
+            [
+                ["tools", "list agent tools"],
+                ["skills", "installed skills"],
+                ["skill <name>", "run a skill"],
+            ],
+        ],
+    ];
+    const lines = ["Commands"];
+    for (const [title, cmds] of groups) {
+        const visible = showAll
+            ? cmds
+            : cmds.filter(([cmd]) => !OWNER_ONLY_COMMANDS.has(cmd.split(/\s/)[0]));
+        if (visible.length === 0)
+            continue;
+        lines.push("", `**${title}**`);
+        for (const [cmd, desc] of visible) {
+            lines.push(`\`!${cmd}\` ${desc}`);
+        }
+    }
+    return lines.join("\n");
+}
+function runBots() {
+    const accounts = readAllAccounts();
+    if (accounts.length === 0) {
+        return "No Rocket.Chat bot accounts configured.";
+    }
+    const lines = [];
+    for (const account of accounts) {
+        const mention = account.mentionNames[0] ?? account.accountId;
+        const bindings = readBindingsForAccount(account.accountId);
+        if (bindings.length === 0) {
+            lines.push(`- ${mention} - (no agent bound)`);
+            continue;
+        }
+        for (const binding of bindings) {
+            const scope = binding.peer ? `${binding.peer.kind} ${binding.peer.id}` : "global";
+            lines.push(`- ${mention} → ${binding.agentId} (${scope})`);
+        }
+    }
+    return ["**Bot accounts**", ...lines].join("\n");
+}
+function parseSkillFrontmatter(content) {
+    const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---/);
+    if (!fmMatch)
+        return {};
+    const fm = fmMatch[1];
+    const result = {};
+    const nameLine = fm.match(/^name:\s*(.+)$/m);
+    if (nameLine)
+        result.name = nameLine[1].trim().replace(/^["']|["']$/g, "");
+    const descLine = fm.match(/^description:\s*(.+)$/m);
+    if (descLine)
+        result.description = descLine[1].trim().replace(/^["']|["']$/g, "");
+    return result;
+}
+function runSkills() {
+    const skillsDir = resolve(homedir(), ".openclaw", "skills");
+    if (!existsSync(skillsDir)) {
+        return "No skills installed (expected at ~/.openclaw/skills).";
+    }
+    const entries = readdirSync(skillsDir).filter((name) => {
+        const full = resolve(skillsDir, name);
+        try {
+            return statSync(full).isDirectory() || statSync(full).isSymbolicLink();
+        }
+        catch {
+            return false;
+        }
+    });
+    const skills = [];
+    for (const name of entries) {
+        const skillMd = resolve(skillsDir, name, "SKILL.md");
+        if (!existsSync(skillMd))
+            continue;
+        let content = "";
+        try {
+            content = readFileSync(skillMd, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const fm = parseSkillFrontmatter(content);
+        if (!fm.name)
+            continue;
+        skills.push({ name: fm.name, description: fm.description ?? "" });
+    }
+    if (skills.length === 0) {
+        return "No skills installed (expected at ~/.openclaw/skills).";
+    }
+    const lines = ["**Skills**"];
+    for (const s of skills) {
+        lines.push(`- \`!skill ${s.name}\`${s.description ? ` - ${s.description}` : ""}`);
+    }
+    lines.push("", "Run a skill: `!skill <name>`");
+    return lines.join("\n");
+}
+async function runGroups(ctx) {
+    try {
+        const subs = await ctx.client.listSubscriptions(null);
+        const rooms = subs
+            .filter((s) => s.t === "c" || s.t === "p")
+            .map((s) => (s.fname ? `#${s.fname}` : s.name ? `#${s.name}` : ""))
+            .filter(Boolean);
+        if (rooms.length === 0) {
+            return "This bot is not in any groups or channels yet.";
+        }
+        return ["**Groups this bot is in**", ...rooms.map((r) => `- ${r}`)].join("\n");
+    }
+    catch {
+        return "Could not load group memberships.";
+    }
+}
+async function runAccess(ctx) {
+    const account = ctx.account;
+    const mention = account.mentionNames[0] ?? account.accountId;
+    const owner = readOwner(account.accountId);
+    const store = new AccessStore();
+    const grants = store.loadGrants(account.accountId);
+    store.close();
+    const lines = [];
+    lines.push(`owner - ${owner ? `${owner}` : "(unset)"}`);
+    if (grants.length === 0) {
+        lines.push("No grants. Only the owner can use the bot.");
+    }
+    else {
+        // Group grants per user so a user with both group + DM access shows on one line.
+        const byUser = new Map();
+        for (const grant of grants) {
+            const scope = grant.roomId === "*"
+                ? "everywhere (group + dm)"
+                : grant.roomId === DM_SCOPE
+                    ? "dm"
+                    : `group: #${grant.roomName ?? grant.roomId}`;
+            const list = byUser.get(grant.username) ?? [];
+            list.push(scope);
+            byUser.set(grant.username, list);
+        }
+        for (const [username, scopes] of byUser) {
+            lines.push(`- ${username} - ${scopes.join(", ")}`);
+        }
+    }
+    return [`**Access for ${mention}**`, ...lines].join("\n");
+}
+function adminAuth(ctx) {
+    const { userId, accessToken } = ctx.account.auth;
+    return { userId, authToken: accessToken };
+}
+/**
+ * Resolve an admin credential to call privileged APIs (e.g. users.create).
+ * Prefers the dedicated admin credential saved during setup; falls back to the
+ * bot account's own token if no admin was configured.
+ */
+async function adminAuthForServer(serverUrl, ctx) {
+    const admin = await loadAdmin(serverUrl);
+    if (admin)
+        return { userId: admin.userId, authToken: admin.authToken };
+    return adminAuth(ctx);
+}
+/** Parse `key value --flag value` style args into a positional list + flags map. */
+function parseArgs(argStr) {
+    const tokens = argStr.trim().length ? argStr.trim().split(/\s+/) : [];
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < tokens.length; i++) {
+        const tok = tokens[i];
+        if (tok.startsWith("--")) {
+            const key = tok.slice(2);
+            const next = tokens[i + 1];
+            if (next && !next.startsWith("--")) {
+                flags[key] = next;
+                i++;
+            }
+            else {
+                flags[key] = "true";
+            }
+        }
+        else {
+            positional.push(tok);
+        }
+    }
+    return { positional, flags };
+}
+async function runStatus(ctx) {
+    const mention = ctx.account.mentionNames[0] ?? ctx.account.accountId;
+    const gateway = connectionStatus.get(ctx.account.accountId) ??
+        (activeClients.has(ctx.account.accountId) ? "online" : "stopped");
+    const bindings = readBindingsForAccount(ctx.account.accountId);
+    const agent = bindings[0]?.agentId ?? "(unbound)";
+    const runtime = ctx.channelRuntime ? "ready" : "unavailable";
+    return [
+        "**Status**",
+        `- gateway - ${gateway}`,
+        `- bot - ${mention}`,
+        `- agent - ${agent}`,
+        `- runtime - ${runtime}`,
+    ].join("\n");
+}
+async function runAddBot(ctx, argStr) {
+    const { positional, flags } = parseArgs(argStr);
+    const username = positional[0];
+    if (!username) {
+        return [
+            "**Create a new bot user**",
+            'Usage: `!add-bot <username> [--name "..."] [--email ...] [--agent <id>]`',
+            "",
+            "Examples:",
+            "  `!add-bot alice` - quick create; auto-creates a dedicated agent `rc-alice`",
+            '  `!add-bot alice --name "Alice Smith" --email alice@example.com --agent support`',
+            "",
+            "By default each bot gets its own dedicated agent (`rc-<username>`), so memory is isolated. " +
+                "Pass `--agent <id>` to bind the bot to an existing shared agent instead (e.g. `main`, `work`).",
+            "",
+            "A random password is generated and shown once. The bot comes online automatically.",
+        ].join("\n");
+    }
+    const name = flags.name ?? username;
+    const email = flags.email ?? `${username.toLowerCase()}@openclaw.local`;
+    const password = randomToken(16);
+    let agent;
+    let agentNote = "";
+    if (flags.agent) {
+        agent = flags.agent;
+    }
+    else {
+        const result = ensureAgentForBot(username);
+        agent = result.agentId;
+        if (result.fallback) {
+            return [
+                `Created bot ${username}, but could not auto-create a dedicated agent.`,
+                `Falling back to 'main' - memory is isolated per-bot via session keys, but the bot shares the main agent workspace.`,
+            ].join("\n");
+        }
+        if (result.created) {
+            agentNote = ` (auto-created dedicated agent '${agent}')`;
+        }
+    }
+    try {
+        const limitCheck = checkBotCreationLimit("inline", { serverUrl: ctx.account.serverUrl });
+        if (!limitCheck.allowed) {
+            return limitCheck.reason ?? "Bot creation limit reached.";
+        }
+        const auth = await adminAuthForServer(ctx.account.serverUrl, ctx);
+        const existingServer = await getUserInfo(ctx.account.serverUrl, auth, { username });
+        const existingConfig = readAccount(username.toLowerCase());
+        if (existingServer) {
+            return `Bot ${username} already exists on the Rocket.Chat server. Use \`!remove-bot ${username}\` first if you want to recreate it.`;
+        }
+        if (existingConfig) {
+            return `Bot ${username} already exists in OpenClaw config. Use \`!remove-bot ${username}\` first if you want to recreate it.`;
+        }
+        await createBotUser(ctx.account.serverUrl, auth, { username, name, password, email });
+        const botAuth = await loginAs(ctx.account.serverUrl, username, password);
+        recordBotCreation(username, "inline");
+        const accountId = username;
+        addAccount({
+            accountId,
+            serverUrl: ctx.account.serverUrl,
+            auth: { mode: "token", userId: botAuth.userId, accessToken: botAuth.authToken },
+            mentionNames: [username],
+            ...(ctx.account.owner ? { owner: ctx.account.owner } : {}),
+        });
+        addBinding({ channel: "rocketchat", accountId, agentId: agent });
+        const owner = ctx.account.owner?.trim().replace(/^@+/, "") || undefined;
+        let dmNote = "";
+        if (owner) {
+            try {
+                const dmRoom = await createDirectMessage(ctx.account.serverUrl, botAuth, owner);
+                await sendMessage(ctx.account.serverUrl, botAuth, dmRoom, `Hi! I'm ${username}, your new Rocket.Chat bot connected to OpenClaw (agent \`${agent}\`). ` +
+                    `Once you see status online, confirm with \`!status\` or \`!help\` to know more.`);
+                dmNote = `Welcome DM sent to ${owner}.`;
+            }
+            catch (e) {
+                dmNote = `Could not DM ${owner}: ${e instanceof Error ? e.message : String(e)}`;
+            }
+        }
+        void startBotAccount(ctx, {
+            accountId,
+            serverUrl: ctx.account.serverUrl,
+            auth: { mode: "token", userId: botAuth.userId, accessToken: botAuth.authToken },
+            ...(owner ? { owner } : {}),
+            agent,
+        });
+        return [
+            `**Created bot ${username}**`,
+            `agent - ${agent}${agentNote}`,
+            `password (shown once) - \`${password}\``,
+            ...(dmNote ? [dmNote] : []),
+        ].join("\n");
+    }
+    catch (e) {
+        return `Failed to create bot: ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+/** Bring a freshly created bot account online immediately (hot-start), without a full OpenClaw restart. */
+function startBotAccount(ctx, account) {
+    const controller = new AbortController();
+    const botCtx = {
+        accountId: account.accountId,
+        account: {
+            accountId: account.accountId,
+            enabled: true,
+            serverUrl: account.serverUrl,
+            auth: account.auth,
+            transport: { mode: "websocket" },
+            mentionNames: [account.accountId],
+            ...(account.owner ? { owner: account.owner } : {}),
+        },
+        channelRuntime: ctx.channelRuntime,
+        abortSignal: controller.signal,
+        setStatus: (status) => console.log(`[RC] [rocketchat:${account.accountId}] hot-start: ${status}`),
+    };
+    startGateway(botCtx).catch((err) => console.error(`[RC] [rocketchat:${account.accountId}] hot-start failed: ${err instanceof Error ? err.message : String(err)}`));
+}
+/**
+ * Notify the affected user about a lend/revoke. The notice is always sent
+ * via DM to the user so that group chats only show the command reply, not a
+ * second personal notification. Returns an error note to append to the
+ * command reply if the notice could not be delivered.
+ */
+async function notifyAccessChange(ctx, cleanUser, roomId, scopeLabel, action, targetIsBot) {
+    const botMention = ctx.account.mentionNames[0] ?? ctx.accountId;
+    const how = roomId === DM_SCOPE ? "You can now DM the bot." : "You can now mention the bot there.";
+    const text = action === "granted"
+        ? `You've been granted access to ${botMention} in ${scopeLabel}. ${how}`
+        : `Your access to ${botMention} in ${scopeLabel} has been revoked.`;
+    try {
+        const botAuth = adminAuth(ctx);
+        const dmRoomId = await createDirectMessage(ctx.account.serverUrl, botAuth, cleanUser);
+        await ctx.client.postMessage(dmRoomId, text);
+        return undefined;
+    }
+    catch (e) {
+        return ` (notice to ${cleanUser} failed: ${e instanceof Error ? e.message : String(e)})`;
+    }
+}
+async function runLend(ctx, argStr) {
+    const { positional, flags } = parseArgs(argStr);
+    const wantDm = flags.dm === "true";
+    let groupName;
+    let username;
+    if (positional[0]?.toLowerCase() === "dm") {
+        username = positional[1];
+        groupName = undefined;
+    }
+    else if (wantDm) {
+        username = positional[0];
+        groupName = undefined;
+    }
+    else {
+        groupName = positional[0];
+        username = positional[1];
+    }
+    if (!username)
+        return [
+            "Usage:",
+            "  `!lend <group> <user>` - grant group/channel access",
+            "  `!lend dm <user>` (or `!lend <user> --dm`) - grant DM access only",
+        ].join("\n");
+    const cleanUser = username.replace(/^@+/, "");
+    try {
+        const auth = await adminAuthForServer(ctx.account.serverUrl, ctx);
+        const targetUser = await getUserInfo(ctx.account.serverUrl, auth, { username: cleanUser });
+        if (!targetUser)
+            return `User ${cleanUser} not found on the Rocket.Chat server.`;
+        let roomId;
+        let roomName;
+        if (groupName) {
+            const group = await getGroupByName(ctx.account.serverUrl, auth, groupName);
+            if (!group)
+                return `Group "${groupName}" not found.`;
+            roomId = group._id;
+            roomName = group.name;
+        }
+        else {
+            roomId = DM_SCOPE;
+            roomName = "direct";
+        }
+        const denial = assertCanDelegate(ctx, roomId);
+        if (denial)
+            return denial;
+        const store = new AccessStore();
+        const ok = store.addGrant({
+            accountId: ctx.accountId,
+            roomId,
+            roomName,
+            username: cleanUser,
+            ...(ctx.account.owner ? { grantedBy: ctx.account.owner } : {}),
+        });
+        store.close();
+        const scope = roomId === DM_SCOPE ? "direct messages" : `#${roomName}`;
+        if (ok) {
+            const notice = await notifyAccessChange(ctx, cleanUser, roomId, scope, "granted", !!targetUser.roles?.includes("bot"));
+            return `Granted ${cleanUser} access to ${ctx.account.mentionNames[0] ?? ctx.accountId} in ${scope}.${notice ?? ""}`;
+        }
+        return `That grant already exists.`;
+    }
+    catch (e) {
+        return `Failed to lend: ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+async function runRevoke(ctx, argStr) {
+    const { positional, flags } = parseArgs(argStr);
+    const wantDm = flags.dm === "true";
+    let groupName;
+    let username;
+    if (positional[0]?.toLowerCase() === "dm") {
+        username = positional[1];
+        groupName = undefined;
+    }
+    else if (wantDm) {
+        username = positional[0];
+        groupName = undefined;
+    }
+    else {
+        groupName = positional[0];
+        username = positional[1];
+    }
+    if (!username)
+        return [
+            "Usage:",
+            "  `!revoke <group> <user>` - remove a user's group/channel access",
+            "  `!revoke dm <user>` (or `!revoke <user> --dm`) - remove a user's DM access",
+        ].join("\n");
+    const cleanUser = username.replace(/^@+/, "");
+    try {
+        const auth = await adminAuthForServer(ctx.account.serverUrl, ctx);
+        const targetUser = await getUserInfo(ctx.account.serverUrl, auth, { username: cleanUser });
+        if (!targetUser)
+            return `User ${cleanUser} not found on the Rocket.Chat server.`;
+        let roomId;
+        let roomName;
+        if (groupName) {
+            const group = await getGroupByName(ctx.account.serverUrl, auth, groupName);
+            if (!group)
+                return `Group "${groupName}" not found.`;
+            roomId = group._id;
+            roomName = group.name;
+        }
+        else {
+            roomId = DM_SCOPE;
+            roomName = "direct";
+        }
+        const store = new AccessStore();
+        const ok = store.removeGrant({
+            accountId: ctx.accountId,
+            roomId,
+            username: cleanUser,
+            ...(ctx.account.owner ? { revokedBy: ctx.account.owner } : {}),
+        });
+        store.close();
+        const scope = roomId === DM_SCOPE ? "direct messages" : `#${roomName}`;
+        if (ok) {
+            const notice = await notifyAccessChange(ctx, cleanUser, roomId, scope, "revoked", !!targetUser.roles?.includes("bot"));
+            return `Revoked ${cleanUser}'s access to ${ctx.account.mentionNames[0] ?? ctx.accountId} in ${scope}.${notice ?? ""}`;
+        }
+        return `No such grant found. ${cleanUser} did not have access in ${scope}.`;
+    }
+    catch (e) {
+        return `Failed to revoke: ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+/**
+ * Non-owners may only delegate access within scopes where they themselves hold a grant.
+ * Returns an error string when delegation is not allowed, otherwise undefined.
+ */
+function assertCanDelegate(ctx, roomId) {
+    const owner = ctx.account.owner?.trim().replace(/^@+/, "").toLowerCase();
+    const actor = ctx.senderName?.trim().replace(/^@+/, "").toLowerCase();
+    if (!actor || actor === owner)
+        return undefined;
+    const store = new AccessStore();
+    const actorGrants = store.loadGrants(ctx.accountId);
+    store.close();
+    const allowed = actorGrants.some((g) => {
+        const gu = g.username.trim().replace(/^@+/, "").toLowerCase();
+        if (gu !== actor)
+            return false;
+        if (roomId === DM_SCOPE)
+            return g.roomId === DM_SCOPE;
+        return g.roomId === "*" || g.roomId === roomId;
+    });
+    return allowed ? undefined : "You can only grant access in spaces where you already have access.";
+}
+async function runRemoveBot(ctx, argStr) {
+    const { positional } = parseArgs(argStr);
+    const usernames = positional.map((p) => p.trim().replace(/^@+/, "")).filter(Boolean);
+    if (usernames.length === 0)
+        return "Usage: `!remove-bot <username...>` - delete one or more bot accounts (server user + OpenClaw config)";
+    try {
+        const auth = await adminAuthForServer(ctx.account.serverUrl, ctx);
+        const blocks = [];
+        let removedCount = 0;
+        for (const username of usernames) {
+            const result = await removeSingleBot(ctx, auth, username);
+            if (result.removed)
+                removedCount++;
+            blocks.push(result.text);
+        }
+        return [`**Removed ${removedCount}/${usernames.length} bot(s)**`, ...blocks].join("\n");
+    }
+    catch (e) {
+        return `Failed to remove bot(s): ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+async function removeSingleBot(ctx, auth, username) {
+    const configured = readAccount(username);
+    const onServer = await getUserInfo(ctx.account.serverUrl, auth, { username });
+    if (!configured && !onServer) {
+        return {
+            removed: false,
+            text: `- ${username}: not found on server or in OpenClaw config. Skipped.`,
+        };
+    }
+    activeClients.delete(username);
+    let serverNote = "";
+    try {
+        await deleteUser(ctx.account.serverUrl, auth, username);
+        serverNote = "Rocket.Chat user deleted.";
+    }
+    catch (e) {
+        serverNote = `Could not delete Rocket.Chat user: ${e instanceof Error ? e.message : String(e)}`;
+    }
+    const existingBindings = readBindingsForAccount(username);
+    const boundAgent = existingBindings[0]?.agentId;
+    const ownsDedicatedAgent = boundAgent === `rc-${username}`;
+    removeBindingsForAccount(username);
+    removeAccount(username);
+    if (ownsDedicatedAgent) {
+        removeAgentDir(username);
+    }
+    const lines = [
+        `- ${username}: ${serverNote}`,
+        `  OpenClaw config account + agent binding removed.`,
+        ownsDedicatedAgent
+            ? `  Agent workspace \`rc-${username}\` removed.`
+            : `  Kept shared agent \`${boundAgent}\` (bot was not its owner).`,
+    ];
+    return { removed: true, text: lines.join("\n") };
+}
+async function runAddGroup(ctx, argStr) {
+    const { positional } = parseArgs(argStr);
+    const groupName = positional[0]?.trim().replace(/^#+/, "");
+    const botName = positional[1]?.trim().replace(/^@+/, "") || ctx.account.mentionNames[0] || ctx.accountId;
+    if (!groupName)
+        return "Usage: `!add-group <group> [<bot>]` - invite a bot into a group/channel (defaults to this bot)";
+    try {
+        const auth = await adminAuthForServer(ctx.account.serverUrl, ctx);
+        const botExists = await getUserInfo(ctx.account.serverUrl, auth, { username: botName });
+        if (!botExists) {
+            return `Bot ${botName} not found on the Rocket.Chat server. Use \`!add-bot ${botName}\` to create it first.`;
+        }
+        const botConfigured = readAccount(botName.toLowerCase());
+        if (!botConfigured) {
+            return `${botName} exists on the server but is not configured in OpenClaw. Use \`!add-bot ${botName}\` to set it up.`;
+        }
+        const group = await getGroupByName(ctx.account.serverUrl, auth, groupName);
+        if (!group)
+            return `Group/channel "#${groupName}" not found.`;
+        const isPrivate = group.isPrivate;
+        const members = await listGroupMembers(ctx.account.serverUrl, auth, group._id);
+        const alreadyIn = members.some((m) => m.username.toLowerCase() === botName.toLowerCase());
+        if (alreadyIn) {
+            return `${botName} is already a member of #${group.name}. No action needed.`;
+        }
+        try {
+            await inviteToGroup(ctx.account.serverUrl, auth, group._id, botName, isPrivate);
+        }
+        catch (e) {
+            return `Failed to add ${botName} to #${group.name}: ${e instanceof Error ? e.message : String(e)}`;
+        }
+        return `Invited ${botName} to #${group.name}${isPrivate ? " (private group)" : " (channel)"}. The bot will start receiving messages there.`;
+    }
+    catch (e) {
+        return `Failed to add bot to group: ${e instanceof Error ? e.message : String(e)}`;
+    }
+}
+function randomToken(length) {
+    const chars = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789";
+    let out = "";
+    for (let i = 0; i < length; i++)
+        out += chars[Math.floor(Math.random() * chars.length)];
+    return out;
+}
+//# sourceMappingURL=channel.js.map