@openclaw/line 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/{accounts-DJVOv1JI.js → accounts-BUBOoW5Q.js}

@@ -1,55 +1,113 @@
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { resolveAccountEntry } from "openclaw/plugin-sdk/account-resolution";
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
 //#region extensions/line/src/accounts.ts
-function readFileIfExists(filePath) {
-	return tryReadSecretFileSync(filePath, "LINE credential file", { rejectSymlink: true });
+function readCredentialFile(filePath, configPath) {
+	return tryReadSecretFileSync(filePath, "LINE credential file", { rejectSymlink: true }, { configPath });
 }
 function resolveToken(params) {
 	const { accountId, baseConfig, accountConfig } = params;
 	if (accountConfig?.channelAccessToken?.trim()) return {
-		token: accountConfig.channelAccessToken.trim(),
-		tokenSource: "config"
-	};
-	const accountFileToken = readFileIfExists(accountConfig?.tokenFile);
-	if (accountFileToken) return {
-		token: accountFileToken,
-		tokenSource: "file"
+		value: accountConfig.channelAccessToken.trim(),
+		source: "config",
+		status: "available"
 	};
+	if (accountConfig?.tokenFile?.trim()) {
+		const result = readCredentialFile(accountConfig.tokenFile, `channels.line.accounts.${accountId}.tokenFile`);
+		return result.status === "available" ? {
+			value: result.value,
+			source: "file",
+			status: "available"
+		} : {
+			value: "",
+			source: "file",
+			status: "configured_unavailable",
+			diagnostic: result.diagnostic
+		};
+	}
 	if (accountId === DEFAULT_ACCOUNT_ID) {
 		if (baseConfig?.channelAccessToken?.trim()) return {
-			token: baseConfig.channelAccessToken.trim(),
-			tokenSource: "config"
-		};
-		const baseFileToken = readFileIfExists(baseConfig?.tokenFile);
-		if (baseFileToken) return {
-			token: baseFileToken,
-			tokenSource: "file"
+			value: baseConfig.channelAccessToken.trim(),
+			source: "config",
+			status: "available"
 		};
+		if (baseConfig?.tokenFile?.trim()) {
+			const result = readCredentialFile(baseConfig.tokenFile, "channels.line.tokenFile");
+			return result.status === "available" ? {
+				value: result.value,
+				source: "file",
+				status: "available"
+			} : {
+				value: "",
+				source: "file",
+				status: "configured_unavailable",
+				diagnostic: result.diagnostic
+			};
+		}
 		const envToken = process.env.LINE_CHANNEL_ACCESS_TOKEN?.trim();
 		if (envToken) return {
-			token: envToken,
-			tokenSource: "env"
+			value: envToken,
+			source: "env",
+			status: "available"
 		};
 	}
 	return {
-		token: "",
-		tokenSource: "none"
+		value: "",
+		source: "none",
+		status: "missing"
 	};
 }
 function resolveSecret(params) {
 	const { accountId, baseConfig, accountConfig } = params;
-	if (accountConfig?.channelSecret?.trim()) return accountConfig.channelSecret.trim();
-	const accountFileSecret = readFileIfExists(accountConfig?.secretFile);
-	if (accountFileSecret) return accountFileSecret;
+	if (accountConfig?.channelSecret?.trim()) return {
+		value: accountConfig.channelSecret.trim(),
+		source: "config",
+		status: "available"
+	};
+	if (accountConfig?.secretFile?.trim()) {
+		const result = readCredentialFile(accountConfig.secretFile, `channels.line.accounts.${accountId}.secretFile`);
+		return result.status === "available" ? {
+			value: result.value,
+			source: "file",
+			status: "available"
+		} : {
+			value: "",
+			source: "file",
+			status: "configured_unavailable",
+			diagnostic: result.diagnostic
+		};
+	}
 	if (accountId === DEFAULT_ACCOUNT_ID) {
-		if (baseConfig?.channelSecret?.trim()) return baseConfig.channelSecret.trim();
-		const baseFileSecret = readFileIfExists(baseConfig?.secretFile);
-		if (baseFileSecret) return baseFileSecret;
+		if (baseConfig?.channelSecret?.trim()) return {
+			value: baseConfig.channelSecret.trim(),
+			source: "config",
+			status: "available"
+		};
+		if (baseConfig?.secretFile?.trim()) {
+			const result = readCredentialFile(baseConfig.secretFile, "channels.line.secretFile");
+			return result.status === "available" ? {
+				value: result.value,
+				source: "file",
+				status: "available"
+			} : {
+				value: "",
+				source: "file",
+				status: "configured_unavailable",
+				diagnostic: result.diagnostic
+			};
+		}
 		const envSecret = process.env.LINE_CHANNEL_SECRET?.trim();
-		if (envSecret) return envSecret;
+		if (envSecret) return {
+			value: envSecret,
+			source: "env",
+			status: "available"
+		};
 	}
-	return "";
+	return {
+		value: "",
+		source: "none",
+		status: "missing"
+	};
 }
 function resolveLineAccount(params) {
 	const cfg = params.cfg;
@@ -57,7 +115,7 @@ function resolveLineAccount(params) {
 	const lineConfig = cfg.channels?.line;
 	const accounts = lineConfig?.accounts;
 	const accountConfig = resolveAccountEntry(accounts, accountId);
-	const { token, tokenSource } = resolveToken({
+	const token = resolveToken({
 		accountId,
 		baseConfig: lineConfig,
 		accountConfig
@@ -79,9 +137,13 @@ function resolveLineAccount(params) {
 		accountId,
 		name: accountConfig?.name ?? (accountId === DEFAULT_ACCOUNT_ID ? lineConfig?.name : void 0),
 		enabled,
-		channelAccessToken: token,
-		channelSecret: secret,
-		tokenSource,
+		channelAccessToken: token.value,
+		channelSecret: secret.value,
+		tokenSource: token.source,
+		signingSecretSource: secret.source,
+		tokenStatus: token.status,
+		signingSecretStatus: secret.status,
+		...[token.diagnostic, secret.diagnostic].some(Boolean) ? { credentialDiagnostics: [token.diagnostic, secret.diagnostic].filter((diagnostic) => Boolean(diagnostic)) } : {},
 		config: mergedConfig
 	};
 }

package/dist/api.js

@@ -1,5 +1,5 @@
-import { n as lineChannelPluginCommon, t as linePlugin } from "./channel-CnPxxRbJ.js";
-import { n as lineSetupAdapter, t as lineSetupWizard } from "./setup-surface-Bc36YSS3.js";
+import { n as lineChannelPluginCommon, t as linePlugin } from "./channel-uT5RTtpi.js";
+import { n as lineSetupAdapter, t as lineSetupWizard } from "./setup-surface-BEt4mazl.js";
 //#region extensions/line/src/channel.setup.ts
 const lineSetupPlugin = {
 	id: "line",

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as linePlugin } from "./channel-CnPxxRbJ.js";
+import { t as linePlugin } from "./channel-uT5RTtpi.js";
 export { linePlugin };

package/dist/{channel-CnPxxRbJ.js → channel-uT5RTtpi.js}

@@ -1,19 +1,21 @@
-import { i as resolveLineAccount, r as resolveDefaultLineAccountId, t as listLineAccountIds } from "./accounts-DJVOv1JI.js";
-import { n as lineSetupAdapter, r as hasLineCredentials, t as lineSetupWizard } from "./setup-surface-Bc36YSS3.js";
-import { a as resolveLineOutboundMedia, d as resolveExactLineGroupConfigKey, i as buildLineQuickReplyFallbackText, l as LineChannelConfigSchema, n as parseLineDirectives, r as createLineSendReceipt, s as getLineRuntime, t as hasLineDirectives } from "./reply-payload-transform-BsbwCJGH.js";
+import { i as resolveLineAccount, r as resolveDefaultLineAccountId, t as listLineAccountIds } from "./accounts-BUBOoW5Q.js";
+import { n as lineSetupAdapter, r as hasLineCredentials, t as lineSetupWizard } from "./setup-surface-BEt4mazl.js";
+import { a as buildLineMediaMessage, d as LineChannelConfigSchema, i as buildLineQuickReplyFallbackText, l as getLineRuntime, n as parseLineDirectives, o as hasLineSpecificMediaOptions, p as resolveExactLineGroupConfigKey, r as createLineSendReceipt, s as resolveLineOutboundMedia, t as hasLineDirectives } from "./reply-payload-transform-r9sa-TYT.js";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
+import { buildDmGroupAccountAllowlistAdapter, createFlatAllowlistOverrideResolver } from "openclaw/plugin-sdk/allowlist-config-edit";
 import { buildChannelOutboundSessionRoute, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { buildChannelGroupsScopeTree, createRestrictSendersChannelSecurity, resolveScopeRequireMention } from "openclaw/plugin-sdk/channel-policy";
 import { createEmptyChannelDirectoryAdapter } from "openclaw/plugin-sdk/directory-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-id";
-import { clearAccountEntryFields } from "openclaw/plugin-sdk/core";
 import { describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
 import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { clearAccountEntryFields } from "openclaw/plugin-sdk/core";
 import { defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-outbound";
 import { createAttachedChannelResultAdapter, createEmptyChannelResult } from "openclaw/plugin-sdk/channel-send-result";
 import { resolveOutboundMediaUrls } from "openclaw/plugin-sdk/reply-payload";
+import { sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { buildTokenChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState, createDependentCredentialStatusIssueCollector } from "openclaw/plugin-sdk/status-helpers";
 //#region extensions/line/src/bindings.ts
@@ -58,6 +60,22 @@ const lineBindingsAdapter = {
 function normalizeLineAllowFrom(entry) {
 	return entry.replace(/^line:(?:user:)?/i, "");
 }
+const lineConfigAdapter = createScopedChannelConfigAdapter({
+	sectionKey: "line",
+	listAccountIds: listLineAccountIds,
+	resolveAccount: (cfg, accountId) => resolveLineAccount({
+		cfg,
+		accountId: accountId ?? void 0
+	}),
+	defaultAccountId: resolveDefaultLineAccountId,
+	clearBaseFields: [
+		"channelSecret",
+		"tokenFile",
+		"secretFile"
+	],
+	resolveAllowFrom: (account) => account.config.allowFrom,
+	formatAllowFrom: (allowFrom) => normalizeStringEntries(allowFrom).map(normalizeLineAllowFrom)
+});
 const lineChannelPluginCommon = {
 	meta: {
 		id: "line",
@@ -81,34 +99,24 @@ const lineChannelPluginCommon = {
 	reload: { configPrefixes: ["channels.line"] },
 	configSchema: LineChannelConfigSchema,
 	config: {
-		...createScopedChannelConfigAdapter({
-			sectionKey: "line",
-			listAccountIds: listLineAccountIds,
-			resolveAccount: (cfg, accountId) => resolveLineAccount({
-				cfg,
-				accountId: accountId ?? void 0
-			}),
-			defaultAccountId: resolveDefaultLineAccountId,
-			clearBaseFields: [
-				"channelSecret",
-				"tokenFile",
-				"secretFile"
-			],
-			resolveAllowFrom: (account) => account.config.allowFrom,
-			formatAllowFrom: (allowFrom) => normalizeStringEntries(allowFrom).map(normalizeLineAllowFrom)
-		}),
+		...lineConfigAdapter,
 		isConfigured: (account) => hasLineCredentials(account),
 		describeAccount: (account) => describeWebhookAccountSnapshot({
 			account,
 			configured: hasLineCredentials(account),
-			extra: { tokenSource: account.tokenSource ?? void 0 }
+			extra: {
+				tokenSource: account.tokenSource ?? void 0,
+				signingSecretSource: account.signingSecretSource ?? void 0,
+				tokenStatus: account.tokenStatus,
+				signingSecretStatus: account.signingSecretStatus
+			}
 		})
 	}
 };
 //#endregion
 //#region extensions/line/src/gateway.ts
 const loadLineProbeRuntime$1 = createLazyRuntimeModule(() => import("./probe.runtime-CRhVGqwl.js"));
-const loadLineMonitorRuntime = createLazyRuntimeModule(() => import("./monitor.runtime-BiNrVz5G.js"));
+const loadLineMonitorRuntime = createLazyRuntimeModule(() => import("./monitor.runtime-CHlqxGVL.js"));
 const lineGatewayAdapter = {
 	startAccount: async (ctx) => {
 		const account = ctx.account;
@@ -223,42 +231,12 @@ function inferLineTargetChatType(target) {
 }
 //#endregion
 //#region extensions/line/src/outbound.ts
-const loadLineOutboundRuntime = createLazyRuntimeModule(() => import("./outbound.runtime-CI-t7Z8P.js"));
-function isLineUserTarget(target) {
-	const normalized = target.trim().replace(/^line:(group|room|user):/i, "").replace(/^line:/i, "");
-	return /^U/i.test(normalized);
-}
-function hasLineSpecificMediaOptions(lineData) {
-	return Boolean(lineData.mediaKind ?? lineData.previewImageUrl?.trim() ?? (typeof lineData.durationMs === "number" ? lineData.durationMs : void 0) ?? lineData.trackingId?.trim());
-}
-function buildLineMediaMessageObject(resolved, opts) {
-	switch (resolved.mediaKind) {
-		case "video": {
-			const previewImageUrl = resolved.previewImageUrl?.trim();
-			if (!previewImageUrl) throw new Error("LINE video messages require previewImageUrl to reference an image URL");
-			return {
-				type: "video",
-				originalContentUrl: resolved.mediaUrl,
-				previewImageUrl,
-				...opts?.allowTrackingId && resolved.trackingId ? { trackingId: resolved.trackingId } : {}
-			};
-		}
-		case "audio": return {
-			type: "audio",
-			originalContentUrl: resolved.mediaUrl,
-			duration: resolved.durationMs ?? 6e4
-		};
-		default: return {
-			type: "image",
-			originalContentUrl: resolved.mediaUrl,
-			previewImageUrl: resolved.previewImageUrl ?? resolved.mediaUrl
-		};
-	}
-}
+const loadLineOutboundRuntime = createLazyRuntimeModule(() => import("./outbound.runtime-ByZ0Dsvu.js"));
 const lineOutboundAdapter = {
 	deliveryMode: "direct",
 	chunker: (text, limit) => getLineRuntime().channel.text.chunkMarkdownText(text, limit),
 	textChunkLimit: 5e3,
+	sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text),
 	sendPayload: async ({ to, payload, accountId, cfg, onDeliveryResult }) => {
 		const runtime = getLineRuntime();
 		const outboundRuntime = await loadLineOutboundRuntime();
@@ -300,6 +278,12 @@ const lineOutboundAdapter = {
 		const chunks = processed.text ? runtime.channel.text.chunkMarkdownText(processed.text, chunkLimit) : [];
 		const mediaUrls = resolveOutboundMediaUrls(payload);
 		const useLineSpecificMedia = hasLineSpecificMediaOptions(lineData);
+		const mediaOptions = {
+			mediaKind: useLineSpecificMedia ? lineData.mediaKind : "image",
+			previewImageUrl: lineData.previewImageUrl,
+			durationMs: lineData.durationMs,
+			trackingId: lineData.trackingId
+		};
 		const shouldSendQuickRepliesInline = chunks.length === 0 && hasQuickReplies;
 		const sendMediaMessages = async () => {
 			for (const url of mediaUrls) {
@@ -314,12 +298,7 @@ const lineOutboundAdapter = {
 					}));
 					continue;
 				}
-				const resolved = await resolveLineOutboundMedia(trimmed, {
-					mediaKind: lineData.mediaKind,
-					previewImageUrl: lineData.previewImageUrl,
-					durationMs: lineData.durationMs,
-					trackingId: lineData.trackingId
-				});
+				const resolved = await resolveLineOutboundMedia(trimmed, mediaOptions);
 				await recordResult((lineRuntime?.sendMessageLine ?? outboundRuntime.sendMessageLine)(to, "", {
 					verbose: false,
 					mediaUrl: resolved.mediaUrl,
@@ -401,21 +380,7 @@ const lineOutboundAdapter = {
 			for (const url of mediaUrls) {
 				const trimmed = url?.trim();
 				if (!trimmed) continue;
-				if (!useLineSpecificMedia) {
-					quickReplyMessages.push({
-						type: "image",
-						originalContentUrl: trimmed,
-						previewImageUrl: trimmed
-					});
-					continue;
-				}
-				const resolved = await resolveLineOutboundMedia(trimmed, {
-					mediaKind: lineData.mediaKind,
-					previewImageUrl: lineData.previewImageUrl,
-					durationMs: lineData.durationMs,
-					trackingId: lineData.trackingId
-				});
-				quickReplyMessages.push(buildLineMediaMessageObject(resolved, { allowTrackingId: isLineUserTarget(to) }));
+				quickReplyMessages.push(await buildLineMediaMessage(trimmed, mediaOptions, to));
 			}
 			if (quickReplyMessages.length > 0 && quickReply) {
 				const lastIndex = quickReplyMessages.length - 1;
@@ -554,13 +519,16 @@ const lineStatusAdapter = createComputedAccountStatusAdapter({
 		configured: hasLineCredentials(account),
 		extra: {
 			tokenSource: account.tokenSource,
+			signingSecretSource: account.signingSecretSource,
+			tokenStatus: account.tokenStatus,
+			signingSecretStatus: account.signingSecretStatus,
 			mode: "webhook"
 		}
 	})
 });
 //#endregion
 //#region extensions/line/src/channel.ts
-const loadLineChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-FPcRtjcT.js"));
+const loadLineChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-BqNglqnr.js"));
 const lineSecurityAdapter = createRestrictSendersChannelSecurity({
 	channelKey: "line",
 	resolveDmPolicy: (account) => account.config.dmPolicy,
@@ -581,6 +549,27 @@ const linePlugin = createChatChannelPlugin({
 		...lineChannelPluginCommon,
 		setupWizard: lineSetupWizard,
 		groups: { resolveRequireMention: resolveLineGroupRequireMention },
+		allowlist: buildDmGroupAccountAllowlistAdapter({
+			channelId: "line",
+			resolveAccount: ({ cfg, accountId }) => resolveLineAccount({
+				cfg,
+				accountId: accountId ?? void 0
+			}),
+			normalize: ({ cfg, accountId, values }) => lineConfigAdapter.formatAllowFrom({
+				cfg,
+				accountId,
+				allowFrom: values
+			}),
+			resolveDmAllowFrom: (account) => account.config.allowFrom,
+			resolveGroupAllowFrom: (account) => account.config.groupAllowFrom,
+			resolveDmPolicy: (account) => account.config.dmPolicy,
+			resolveGroupPolicy: (account) => account.config.groupPolicy,
+			resolveGroupOverrides: createFlatAllowlistOverrideResolver({
+				resolveRecord: (account) => account.config.groups,
+				label: (groupId) => groupId,
+				resolveEntries: (groupCfg) => groupCfg?.allowFrom
+			})
+		}),
 		messaging: {
 			targetPrefixes: ["line"],
 			normalizeTarget: normalizeLineMessagingTarget,

package/dist/channel.runtime-BqNglqnr.js

@@ -0,0 +1,4 @@
+import { t as monitorLineProvider } from "./monitor-Bk-lpoOZ.js";
+import { t as probeLineBot } from "./probe-BslD77tJ.js";
+import { S as pushMessageLine } from "./markdown-to-line-D1vapcdP.js";
+export { monitorLineProvider, probeLineBot, pushMessageLine };

package/dist/contract-api.js

@@ -1,2 +1,2 @@
-import { i as resolveLineAccount, r as resolveDefaultLineAccountId, t as listLineAccountIds } from "./accounts-DJVOv1JI.js";
+import { i as resolveLineAccount, r as resolveDefaultLineAccountId, t as listLineAccountIds } from "./accounts-BUBOoW5Q.js";
 export { listLineAccountIds, resolveDefaultLineAccountId, resolveLineAccount };

package/dist/{markdown-to-line-CixmAKiG.js → markdown-to-line-D1vapcdP.js}

@@ -1,13 +1,14 @@
-import { i as resolveLineAccount } from "./accounts-DJVOv1JI.js";
-import { o as validateLineMediaUrl, r as createLineSendReceipt } from "./reply-payload-transform-BsbwCJGH.js";
+import { i as resolveLineAccount } from "./accounts-BUBOoW5Q.js";
+import { c as validateLineMediaUrl, r as createLineSendReceipt } from "./reply-payload-transform-r9sa-TYT.js";
 import { c as uriAction, d as createReceiptCard, o as messageAction, s as postbackAction, t as toFlexMessage } from "./flex-templates-K1lS9i8L.js";
+import { stripMarkdown, stripMarkdown as stripMarkdown$1 } from "openclaw/plugin-sdk/text-chunking";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
-import { messagingApi } from "@line/bot-sdk";
 import { logVerbose } from "openclaw/plugin-sdk/runtime-env";
+import { messagingApi } from "@line/bot-sdk";
 import { recordChannelActivity } from "openclaw/plugin-sdk/channel-activity-runtime";
+import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
-import { stripMarkdown, stripMarkdown as stripMarkdown$1 } from "openclaw/plugin-sdk/text-chunking";
 //#region extensions/line/src/template-messages.ts
 const COMPACT_TEMPLATE_TEXT_LIMIT = 60;
 const graphemeSegmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
@@ -221,6 +222,14 @@ function resolveLineChannelAccessToken(explicit, params) {
 //#region extensions/line/src/send.ts
 const userProfileCache = /* @__PURE__ */ new Map();
 const PROFILE_CACHE_TTL_MS = 300 * 1e3;
+const PROFILE_CACHE_MAX_ENTRIES = 1e3;
+function cacheUserProfile(userId, profile) {
+	userProfileCache.delete(userId);
+	userProfileCache.set(userId, profile);
+	if (userProfileCache.size <= PROFILE_CACHE_MAX_ENTRIES) return;
+	for (const [key, cached] of userProfileCache) if (profile.fetchedAt - cached.fetchedAt >= PROFILE_CACHE_TTL_MS) userProfileCache.delete(key);
+	pruneMapToMaxSize(userProfileCache, PROFILE_CACHE_MAX_ENTRIES);
+}
 function normalizeTarget(to) {
 	const trimmed = to.trim();
 	if (!trimmed) throw new Error("Recipient is required for LINE sends");
@@ -469,7 +478,7 @@ async function getUserProfile(userId, opts) {
 			displayName: profile.displayName,
 			pictureUrl: profile.pictureUrl
 		};
-		userProfileCache.set(userId, {
+		cacheUserProfile(userId, {
 			...result,
 			fetchedAt: Date.now()
 		});