@openclaw/irc 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/api.js

@@ -1,3 +1,3 @@
-import { _ as resolveDefaultIrcAccountId, g as listIrcAccountIds, h as listEnabledIrcAccounts, n as ircSetupWizard, r as ircSetupAdapter, t as ircPlugin, v as resolveIrcAccount } from "./channel-Bfg9kJRw.js";
+import { _ as resolveDefaultIrcAccountId, g as listIrcAccountIds, h as listEnabledIrcAccounts, n as ircSetupWizard, r as ircSetupAdapter, t as ircPlugin, v as resolveIrcAccount } from "./channel-BO1GdA4V.js";
 import { n as setIrcRuntime } from "./runtime-xy-FcjJC.js";
 export { ircPlugin, ircSetupAdapter, ircSetupWizard, listEnabledIrcAccounts, listIrcAccountIds, resolveDefaultIrcAccountId, resolveIrcAccount, setIrcRuntime };

package/dist/{channel-Bfg9kJRw.js → channel-BO1GdA4V.js}

@@ -5,7 +5,7 @@ import { createAccountListHelpers, describeAccountSnapshot } from "openclaw/plug
 import { formatNormalizedAllowFromEntries } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildChannelOutboundSessionRoute, createChatChannelPlugin, parseOptionalDelimitedEntries } from "openclaw/plugin-sdk/channel-core";
-import { buildMutableAllowEntryDetector, collectStandardAllowlistLists, composeAccountWarningCollectors, createAllowlistProviderOpenWarningCollector, createDangerousNameMatchingMutableAllowlistWarningCollector, resolveScopeKeyCaseInsensitive, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
+import { buildMutableAllowEntryDetector, collectStandardAllowlistLists, createAllowlistProviderOpenWarningCollector, createConditionalWarningCollector, createDangerousNameMatchingMutableAllowlistWarningCollector, resolveScopeKeyCaseInsensitive, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { createChannelDirectoryAdapter, createResolvedDirectoryEntriesLister } from "openclaw/plugin-sdk/directory-runtime";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { buildBaseChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
@@ -14,7 +14,7 @@ import { DEFAULT_ACCOUNT_ID, DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, normali
 import { parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
-import { normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries, normalizeStringifiedOptionalString, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createAccountStatusSink, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, runPassiveAccountLifecycle, sanitizeForPlainText } from "openclaw/plugin-sdk/channel-outbound";
 import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
@@ -25,6 +25,7 @@ import net from "node:net";
 import tls from "node:tls";
 import { withTimeout } from "openclaw/plugin-sdk/security-runtime";
 import { randomUUID } from "node:crypto";
+import { assertSecretOwnerAvailable } from "openclaw/plugin-sdk/channel-secret-owner-runtime";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
 import { applyAccountNameToChannelSection, createAllowFromSection, createPromptParsedAllowFromForAccount, createSetupInputPresenceValidator, createSetupTranslator, createStandardChannelSetupStatus, createTopLevelChannelAllowFromSetter, createTopLevelChannelDmPolicySetter, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
@@ -42,6 +43,16 @@ const { listAccountIds: listIrcAccountIds, resolveDefaultAccountId: resolveDefau
 	hasImplicitDefaultAccount: (cfg) => Boolean((cfg.channels?.irc?.host?.trim() || process.env.IRC_HOST?.trim()) && (cfg.channels?.irc?.nick?.trim() || process.env.IRC_NICK?.trim()))
 });
 function resolvePassword(accountId, merged) {
+	const configPassword = resolveSecretInputString({
+		value: merged.password,
+		path: `channels.irc.accounts.${accountId}.password`,
+		mode: "inspect"
+	});
+	if (configPassword.status === "configured_unavailable") return {
+		password: "",
+		source: "config",
+		unavailable: true
+	};
 	if (accountId === DEFAULT_ACCOUNT_ID) {
 		const envPassword = process.env.IRC_PASSWORD?.trim();
 		if (envPassword) return {
@@ -51,7 +62,7 @@ function resolvePassword(accountId, merged) {
 	}
 	if (merged.passwordFile?.trim()) {
 		let diagnostic;
-		const filePassword = tryReadSecretFileSync(merged.passwordFile, "IRC password file", {
+		const password = tryReadSecretFileSync(merged.passwordFile, "IRC password file", {
 			rejectSymlink: true,
 			credentialDiagnostic: {
 				configPath: `channels.irc.accounts.${accountId}.passwordFile`,
@@ -60,8 +71,8 @@ function resolvePassword(accountId, merged) {
 				}
 			}
 		});
-		if (filePassword) return {
-			password: filePassword,
+		if (password) return {
+			password,
 			source: "passwordFile"
 		};
 		return {
@@ -70,12 +81,8 @@ function resolvePassword(accountId, merged) {
 			diagnostic
 		};
 	}
-	const configPassword = normalizeResolvedSecretInputString({
-		value: merged.password,
-		path: `channels.irc.accounts.${accountId}.password`
-	});
-	if (configPassword) return {
-		password: configPassword,
+	if (configPassword.status === "available") return {
+		password: configPassword.value,
 		source: "config"
 	};
 	return {
@@ -85,23 +92,29 @@ function resolvePassword(accountId, merged) {
 }
 function resolveNickServConfig(accountId, nickserv) {
 	const base = nickserv ?? {};
+	const configPassword = resolveSecretInputString({
+		value: base.password,
+		path: `channels.irc.accounts.${accountId}.nickserv.password`,
+		mode: "inspect"
+	});
+	const unavailable = Boolean(configPassword.ref);
 	const envPassword = accountId === DEFAULT_ACCOUNT_ID ? process.env.IRC_NICKSERV_PASSWORD?.trim() : void 0;
 	const envRegisterEmail = accountId === DEFAULT_ACCOUNT_ID ? process.env.IRC_NICKSERV_REGISTER_EMAIL?.trim() : void 0;
 	const passwordFile = base.passwordFile?.trim();
-	let resolvedPassword = normalizeResolvedSecretInputString({
-		value: base.password,
-		path: `channels.irc.accounts.${accountId}.nickserv.password`
-	}) || envPassword || "";
+	let resolvedPassword;
 	let diagnostic;
-	if (!resolvedPassword && passwordFile) resolvedPassword = tryReadSecretFileSync(passwordFile, "IRC NickServ password file", {
-		rejectSymlink: true,
-		credentialDiagnostic: {
-			configPath: `channels.irc.accounts.${accountId}.nickserv.passwordFile`,
-			report: (value) => {
-				diagnostic = value;
+	if (!unavailable) {
+		resolvedPassword = configPassword.value || envPassword;
+		if (!resolvedPassword && passwordFile) resolvedPassword = tryReadSecretFileSync(passwordFile, "IRC NickServ password file", {
+			rejectSymlink: true,
+			credentialDiagnostic: {
+				configPath: `channels.irc.accounts.${accountId}.nickserv.passwordFile`,
+				report: (value) => {
+					diagnostic = value;
+				}
 			}
-		}
-	}) ?? "";
+		});
+	}
 	return {
 		config: {
 			...base,
@@ -110,7 +123,8 @@ function resolveNickServConfig(accountId, nickserv) {
 			password: resolvedPassword || void 0,
 			registerEmail: base.registerEmail?.trim() || envRegisterEmail || void 0
 		},
-		diagnostic
+		diagnostic,
+		unavailable: base.enabled !== false && unavailable
 	};
 }
 function resolveIrcAccount(params) {
@@ -154,7 +168,7 @@ function resolveIrcAccount(params) {
 			realname,
 			password: passwordResolution.password,
 			passwordSource: passwordResolution.source,
-			tokenStatus: diagnostics.length > 0 ? "configured_unavailable" : passwordResolution.password || nickservResolution.config.password ? "available" : "missing",
+			tokenStatus: diagnostics.length > 0 || passwordResolution.unavailable || nickservResolution.unavailable ? "configured_unavailable" : passwordResolution.password || nickservResolution.config.password ? "available" : "missing",
 			...diagnostics.length > 0 ? { credentialDiagnostics: diagnostics } : {},
 			config
 		};
@@ -183,7 +197,7 @@ const collectIrcMutableAllowlistWarnings = createDangerousNameMatchingMutableAll
 });
 //#endregion
 //#region extensions/irc/src/gateway.ts
-const loadIrcChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel-runtime-kWMtRD4g.js"));
+const loadIrcChannelRuntime$1 = createLazyRuntimeModule(() => import("./channel-runtime-CSpBc1ef.js"));
 async function startIrcGatewayAccount(ctx) {
 	const account = ctx.account;
 	const statusSink = createAccountStatusSink({
@@ -613,6 +627,8 @@ async function connectIrcClient(options) {
 //#endregion
 //#region extensions/irc/src/connect-options.ts
 function buildIrcConnectOptions(account, overrides = {}) {
+	assertSecretOwnerAvailable("account", `irc:${account.accountId}`);
+	if (account.tokenStatus === "configured_unavailable") throw new Error(`IRC credentials for account "${account.accountId}" are configured but unavailable.`);
 	return {
 		host: account.host,
 		port: account.port,
@@ -755,6 +771,16 @@ async function sendMessageIrc(to, text, opts) {
 }
 //#endregion
 //#region extensions/irc/src/message-adapter.ts
+async function sendIrcMessage(...args) {
+	const { target, ...result } = await sendMessageIrc(...args);
+	return {
+		...result,
+		target: {
+			kind: "conversation",
+			id: target
+		}
+	};
+}
 const ircMessageAdapter = defineChannelMessageAdapter({
 	id: "irc",
 	durableFinal: { capabilities: {
@@ -763,12 +789,12 @@ const ircMessageAdapter = defineChannelMessageAdapter({
 		replyTo: true
 	} },
 	send: {
-		text: async ({ cfg, to, text, accountId, replyToId }) => await sendMessageIrc(to, text, {
+		text: async ({ cfg, to, text, accountId, replyToId }) => await sendIrcMessage(to, text, {
 			cfg,
 			accountId: accountId ?? void 0,
 			replyTo: replyToId ?? void 0
 		}),
-		media: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => await sendMessageIrc(to, mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text, {
+		media: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => await sendIrcMessage(to, mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text, {
 			cfg,
 			accountId: accountId ?? void 0,
 			replyTo: replyToId ?? void 0
@@ -1399,7 +1425,7 @@ const meta = {
 	systemImage: "number",
 	markdownCapable: true
 };
-const loadIrcChannelRuntime = createLazyRuntimeModule(() => import("./channel-runtime-kWMtRD4g.js"));
+const loadIrcChannelRuntime = createLazyRuntimeModule(() => import("./channel-runtime-CSpBc1ef.js"));
 function normalizePairingTarget(raw) {
 	const normalized = normalizeIrcAllowEntry(raw);
 	if (!normalized) return "";
@@ -1455,7 +1481,7 @@ const resolveIrcDmPolicy = createScopedDmSecurityResolver({
 	policyPathSuffix: "dmPolicy",
 	normalizeEntry: (raw) => normalizeIrcAllowEntry(raw)
 });
-const collectIrcSecurityWarnings = composeAccountWarningCollectors(createAllowlistProviderOpenWarningCollector({
+const collectIrcGroupPolicyWarnings = createAllowlistProviderOpenWarningCollector({
 	providerConfigPresent: (cfg) => cfg.channels?.irc !== void 0,
 	resolveGroupPolicy: (account) => account.config.groupPolicy,
 	buildOpenWarning: {
@@ -1463,7 +1489,19 @@ const collectIrcSecurityWarnings = composeAccountWarningCollectors(createAllowli
 		openBehavior: "allows all channels and senders (mention-gated)",
 		remediation: "Prefer channels.irc.groupPolicy=\"allowlist\" with channels.irc.groups"
 	}
-}), (account) => !account.config.tls && "- IRC TLS is disabled (channels.irc.tls=false); traffic and credentials are plaintext.", (account) => account.config.nickserv?.register && "- IRC NickServ registration is enabled (channels.irc.nickserv.register=true); this sends \"REGISTER\" on every connect. Disable after first successful registration.", (account) => account.config.nickserv?.register && !account.config.nickserv.password?.trim() && "- IRC NickServ registration is enabled but no NickServ password is resolved; set channels.irc.nickserv.password, channels.irc.nickserv.passwordFile, or IRC_NICKSERV_PASSWORD.");
+});
+const collectIrcOpenGroupFindings = createConditionalWarningCollector.findings({
+	collectWarnings: collectIrcGroupPolicyWarnings,
+	checkId: "channels.irc.groups.open",
+	severity: "critical",
+	title: "IRC security warning"
+});
+const collectIrcSecurityWarnings = (params) => [
+	...collectIrcOpenGroupFindings(params),
+	...!params.account.config.tls ? ["- IRC TLS is disabled (channels.irc.tls=false); traffic and credentials are plaintext."] : [],
+	...params.account.config.nickserv?.register ? ["- IRC NickServ registration is enabled (channels.irc.nickserv.register=true); this sends \"REGISTER\" on every connect. Disable after first successful registration."] : [],
+	...params.account.config.nickserv?.register && !params.account.config.nickserv.password?.trim() ? ["- IRC NickServ registration is enabled but no NickServ password is resolved; set channels.irc.nickserv.password, channels.irc.nickserv.passwordFile, or IRC_NICKSERV_PASSWORD."] : []
+];
 const ircPlugin = createChatChannelPlugin({
 	base: {
 		id: "irc",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as ircPlugin } from "./channel-Bfg9kJRw.js";
+import { t as ircPlugin } from "./channel-BO1GdA4V.js";
 export { ircPlugin };

package/dist/{channel-runtime-kWMtRD4g.js → channel-runtime-CSpBc1ef.js}

@@ -1,4 +1,4 @@
-import { a as resolveIrcGroupRequireMention, c as buildIrcAllowlistCandidates, d as buildIrcConnectOptions, f as connectIrcClient, i as resolveIrcGroupMatch, l as isChannelTarget, m as parseIrcPrefix, o as sanitizeIrcAssistantText, p as parseIrcLine, s as sendMessageIrc, u as normalizeIrcAllowEntry, v as resolveIrcAccount } from "./channel-Bfg9kJRw.js";
+import { a as resolveIrcGroupRequireMention, c as buildIrcAllowlistCandidates, d as buildIrcConnectOptions, f as connectIrcClient, i as resolveIrcGroupMatch, l as isChannelTarget, m as parseIrcPrefix, o as sanitizeIrcAssistantText, p as parseIrcLine, s as sendMessageIrc, u as normalizeIrcAllowEntry, v as resolveIrcAccount } from "./channel-BO1GdA4V.js";
 import { t as getIrcRuntime } from "./runtime-xy-FcjJC.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { bindIngressLifecycleToReplyOptions, createChannelIngressError, createChannelIngressMonitor, resolveChannelStreamingBlockEnabled } from "openclaw/plugin-sdk/channel-outbound";
@@ -455,14 +455,16 @@ function decodeIrcIngressPayload(payload, claimedId) {
 }
 function inspectIrcIngress(raw, phase) {
 	try {
+		const projection = inspectRawPrivmsg(raw.body.rawLine);
+		if (phase === "claim") raw.claimedProjection = projection;
 		return {
-			eventId: raw.eventId,
-			laneKey: inspectRawPrivmsg(raw.rawLine).laneKey
+			eventId: raw.body.eventId,
+			laneKey: projection.laneKey
 		};
 	} catch (error) {
 		if (phase === "admission" && error instanceof IrcIngressPayloadError) return {
-			eventId: raw.eventId,
-			laneKey: `invalid:${raw.eventId}`
+			eventId: raw.body.eventId,
+			laneKey: `invalid:${raw.body.eventId}`
 		};
 		throw error;
 	}
@@ -479,8 +481,8 @@ function createIrcIngressMonitor(options) {
 		inspect: (raw, context) => inspectIrcIngress(raw, context.phase),
 		payload: {
 			version: IRC_INGRESS_PAYLOAD_VERSION,
-			serialize: (raw) => raw,
-			deserialize: (body) => body,
+			serialize: (raw) => raw.body,
+			deserialize: (body) => ({ body }),
 			encode: ({ body }) => ({
 				version: IRC_INGRESS_PAYLOAD_VERSION,
 				...body
@@ -490,13 +492,13 @@ function createIrcIngressMonitor(options) {
 		},
 		deliver: (raw, lifecycle, claim) => {
 			const message = {
-				...inspectRawPrivmsg(raw.rawLine).message,
+				...raw.claimedProjection.message,
 				messageId: claim.id,
-				timestamp: raw.receivedAt
+				timestamp: raw.body.receivedAt
 			};
 			return options.dispatch(message, lifecycle, {
-				connectedNick: raw.connectedNick.trim(),
-				connectionEpoch: raw.connectionEpoch.trim()
+				connectedNick: raw.body.connectedNick.trim(),
+				connectionEpoch: raw.body.connectionEpoch.trim()
 			});
 		},
 		pollIntervalMs: options.pollIntervalMs ?? IRC_INGRESS_POLL_INTERVAL_MS,
@@ -526,13 +528,13 @@ function createIrcIngressMonitor(options) {
 					const receivedAt = Date.now();
 					const normalizedNick = connectedNick.trim();
 					if (!normalizedNick) return Promise.reject(/* @__PURE__ */ new Error("IRC ingress connected nickname is required."));
-					return monitor.admit({
+					return monitor.admit({ body: {
 						eventId,
 						rawLine,
 						receivedAt,
 						connectionEpoch: epoch,
 						connectedNick: normalizedNick
-					}, { receivedAt }).then(() => void 0);
+					} }, { receivedAt }).then(() => void 0);
 				}
 			};
 		},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/irc",
-  "version": "2026.8.1-beta.2",
+  "version": "2026.8.1-beta.3",
   "description": "OpenClaw IRC channel plugin",
   "type": "module",
   "openclaw": {
@@ -121,10 +121,10 @@
       }
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.2"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.2",
+      "openclawVersion": "2026.8.1-beta.3",
       "bundledDist": false
     },
     "release": {
@@ -149,7 +149,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.2"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {