@occum-net/occumclaw 0.2.2 → 0.4.1

package/index.ts

@@ -74,8 +74,10 @@ interface MsgContext {
   AccountId?: string;
   Provider?: string;
   ChatType?: string;
+  GroupId?: string;
   SenderId?: string;
   SenderName?: string;
+  SenderUsername?: string;
   Timestamp?: number;
   CommandAuthorized?: boolean;
   MessageSid?: string;
@@ -142,6 +144,164 @@ interface OpenClawPluginApi {
   registerChannel(registration: { plugin: any }): void;
 }
 
+// ─── Group Tool Policy (channel-level + per-sender overrides) ───────────────
+//
+// Follows the same resolution hierarchy as OpenClaw's built-in Telegram channel:
+//
+//   1. Group-specific sender override  (groups.<channelId>.toolsBySender)
+//   2. Group-specific tool policy       (groups.<channelId>.tools)
+//   3. Wildcard sender override         (groups.*.toolsBySender)
+//   4. Wildcard tool policy             (groups.*.tools)
+//   5. undefined → fall back to global  (tools.allow / tools.profile)
+//
+// Config path (either works; plugin-style avoids config validation issues):
+//   channels.occum.accounts.<accountId>.groups.<channelId>.tools
+//   plugins.entries.occumclaw.config.groups.<channelId>.tools
+//
+// Per-sender key format:
+//   "id:<senderId>"       — match by user/agent ID
+//   "username:<handle>"   — match by username
+//   "name:<displayName>"  — match by display name
+//   "*"                   — wildcard (any sender)
+
+/** Tool policy: allow/alsoAllow/deny lists for a group or sender. */
+interface GroupToolPolicyConfig {
+  allow?: string[];
+  alsoAllow?: string[];
+  deny?: string[];
+}
+
+/** Per-sender overrides keyed by "id:<val>", "username:<val>", "name:<val>", or "*". */
+type GroupToolPolicyBySenderConfig = Record<string, GroupToolPolicyConfig>;
+
+/** Config for a single occum.net channel (group) or the wildcard "*" default. */
+interface OccumGroupConfig {
+  tools?: GroupToolPolicyConfig;
+  toolsBySender?: GroupToolPolicyBySenderConfig;
+}
+
+/** ChannelGroupContext passed by OpenClaw to resolveToolPolicy. */
+interface ChannelGroupContext {
+  cfg: any;
+  groupId?: string | null;
+  groupChannel?: string | null;
+  groupSpace?: string | null;
+  accountId?: string | null;
+  senderId?: string | null;
+  senderName?: string | null;
+  senderUsername?: string | null;
+  senderE164?: string | null;
+}
+
+const SENDER_KEY_TYPES = ["id", "e164", "username", "name"] as const;
+
+/**
+ * Match a sender against toolsBySender entries.
+ *
+ * Resolution order: id → e164 → username → name → wildcard "*".
+ * First match wins. All comparisons are case-insensitive.
+ */
+function resolveToolsBySender(
+  toolsBySender: GroupToolPolicyBySenderConfig | undefined,
+  sender: { senderId?: string | null; senderName?: string | null; senderUsername?: string | null; senderE164?: string | null },
+): GroupToolPolicyConfig | undefined {
+  if (!toolsBySender) return undefined;
+
+  // Build lookup buckets and extract wildcard
+  const buckets: Record<string, Map<string, GroupToolPolicyConfig>> = {
+    id: new Map(),
+    e164: new Map(),
+    username: new Map(),
+    name: new Map(),
+  };
+  let wildcard: GroupToolPolicyConfig | undefined;
+
+  for (const [rawKey, policy] of Object.entries(toolsBySender)) {
+    if (!policy) continue;
+    const trimmed = rawKey.trim();
+    if (!trimmed) continue;
+
+    if (trimmed === "*") {
+      wildcard = policy;
+      continue;
+    }
+
+    const lower = trimmed.toLowerCase();
+    for (const type of SENDER_KEY_TYPES) {
+      const prefix = `${type}:`;
+      if (lower.startsWith(prefix)) {
+        const value = trimmed.slice(prefix.length).trim().toLowerCase();
+        if (value && !buckets[type].has(value)) {
+          buckets[type].set(value, policy);
+        }
+        break;
+      }
+    }
+  }
+
+  // Match in priority order: id → e164 → username → name → wildcard
+  if (sender.senderId) {
+    const match = buckets.id.get(sender.senderId.trim().toLowerCase());
+    if (match) return match;
+  }
+  if (sender.senderE164) {
+    const match = buckets.e164.get(sender.senderE164.trim().toLowerCase());
+    if (match) return match;
+  }
+  if (sender.senderUsername) {
+    const match = buckets.username.get(sender.senderUsername.trim().toLowerCase());
+    if (match) return match;
+  }
+  if (sender.senderName) {
+    const match = buckets.name.get(sender.senderName.trim().toLowerCase());
+    if (match) return match;
+  }
+
+  return wildcard;
+}
+
+/**
+ * Resolve the effective tool policy for an inbound occum.net message.
+ *
+ * Looks up groups config from (in order):
+ *   1. channels.occum.accounts.<accountId>.groups   (channel-style, if OpenClaw validates it)
+ *   2. plugins.entries.occumclaw.config.groups       (plugin-style, always safe)
+ *
+ * Then resolves per-channel and per-sender overrides with wildcard fallback.
+ */
+function resolveOccumToolPolicy(params: ChannelGroupContext): GroupToolPolicyConfig | undefined {
+  const { cfg, groupId, accountId, senderId, senderName, senderUsername, senderE164 } = params;
+
+  // Try channel-style config first, then fall back to plugin config
+  const acctId = accountId ?? "default";
+  const groups: Record<string, OccumGroupConfig> | undefined =
+    cfg?.channels?.occum?.accounts?.[acctId]?.groups
+    ?? cfg?.plugins?.entries?.occumclaw?.config?.groups;
+
+  if (!groups || typeof groups !== "object") return undefined;
+
+  const groupConfig = groupId ? groups[groupId] ?? undefined : undefined;
+  const defaultConfig = groups["*"] ?? undefined;
+
+  const senderInfo = { senderId, senderName, senderUsername, senderE164 };
+
+  // Priority 1: Group-specific sender override
+  const groupSender = resolveToolsBySender(groupConfig?.toolsBySender, senderInfo);
+  if (groupSender) return groupSender;
+
+  // Priority 2: Group-specific tool policy
+  if (groupConfig?.tools) return groupConfig.tools;
+
+  // Priority 3: Wildcard sender override
+  const defaultSender = resolveToolsBySender(defaultConfig?.toolsBySender, senderInfo);
+  if (defaultSender) return defaultSender;
+
+  // Priority 4: Wildcard tool policy
+  if (defaultConfig?.tools) return defaultConfig.tools;
+
+  return undefined;
+}
+
 // ─── Account Config ─────────────────────────────────────────────────────────
 
 interface OccumAccount {
@@ -212,6 +372,10 @@ function createOccumChannelPlugin(logger: PluginLogger) {
       chatTypes: ["direct" as const],
     },
 
+    groups: {
+      resolveToolPolicy: resolveOccumToolPolicy,
+    },
+
     config: {
       listAccountIds: (cfg: any) => listAccountIds(cfg),
       resolveAccount: (cfg: any, accountId?: string | null) => resolveAccount(cfg, accountId),
@@ -369,6 +533,11 @@ function createOccumChannelPlugin(logger: PluginLogger) {
             const replyChannelId = event.channelId;
             const sessionId = crypto.randomUUID();
 
+            // Extract sender username from event body if available
+            const senderUsername = (event.body as any)?.senderUsername
+              ?? (event.body as any)?.username
+              ?? undefined;
+
             const msgCtx: MsgContext = {
               Body: text,
               BodyForAgent: text,
@@ -381,10 +550,12 @@ function createOccumChannelPlugin(logger: PluginLogger) {
               AccountId: ctx.accountId,
               Provider: "occum",
               ChatType: "direct",
+              GroupId: event.channelId,
               SenderId: event.senderType === "user"
                 ? String(event.senderUserId)
                 : String(event.senderAgentId),
               SenderName: senderLabel,
+              SenderUsername: senderUsername,
               Timestamp: new Date(event.createdAt).getTime(),
               CommandAuthorized: true,
               MessageSid: event.id,

package/openclaw.plugin.json

@@ -9,7 +9,39 @@
     "additionalProperties": false,
     "properties": {
       "agentToken": { "type": "string" },
-      "apiUrl": { "type": "string", "default": "https://api.occum.net" }
+      "apiUrl": { "type": "string", "default": "https://api.occum.net" },
+      "groups": {
+        "type": "object",
+        "description": "Per-channel and per-sender tool policy overrides. Keys are channel IDs or \"*\" for wildcard.",
+        "additionalProperties": {
+          "type": "object",
+          "properties": {
+            "tools": {
+              "type": "object",
+              "properties": {
+                "allow": { "type": "array", "items": { "type": "string" } },
+                "alsoAllow": { "type": "array", "items": { "type": "string" } },
+                "deny": { "type": "array", "items": { "type": "string" } }
+              },
+              "additionalProperties": false
+            },
+            "toolsBySender": {
+              "type": "object",
+              "description": "Per-sender overrides keyed by id:<val>, username:<val>, name:<val>, or *",
+              "additionalProperties": {
+                "type": "object",
+                "properties": {
+                  "allow": { "type": "array", "items": { "type": "string" } },
+                  "alsoAllow": { "type": "array", "items": { "type": "string" } },
+                  "deny": { "type": "array", "items": { "type": "string" } }
+                },
+                "additionalProperties": false
+              }
+            }
+          },
+          "additionalProperties": false
+        }
+      }
     },
     "required": []
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@occum-net/occumclaw",
-  "version": "0.2.2",
+  "version": "0.4.1",
   "publishConfig": {
     "access": "public"
   },