@openclaw/mattermost 2026.2.21 → 2026.6.11

package/dist/doctor-contract-api.js

@@ -0,0 +1,2 @@
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-ttH0DCuq.js";
+export { legacyConfigRules, normalizeCompatibilityConfig };

package/dist/doctor-contract-ttH0DCuq.js

@@ -0,0 +1,7 @@
+import { createLegacyPrivateNetworkDoctorContract } from "openclaw/plugin-sdk/ssrf-runtime";
+//#region extensions/mattermost/src/doctor-contract.ts
+const contract = createLegacyPrivateNetworkDoctorContract({ channelKey: "mattermost" });
+const legacyConfigRules = contract.legacyConfigRules;
+const normalizeCompatibilityConfig = contract.normalizeCompatibilityConfig;
+//#endregion
+export { normalizeCompatibilityConfig as n, legacyConfigRules as t };

package/dist/gateway-auth-api.js

@@ -0,0 +1,2 @@
+import { t as resolveMattermostGatewayAuthBypassPaths } from "./gateway-auth-bypass-BHgOAkk8.js";
+export { resolveMattermostGatewayAuthBypassPaths as resolveGatewayAuthBypassPaths };

package/dist/gateway-auth-bypass-BHgOAkk8.js

@@ -0,0 +1,37 @@
+//#region extensions/mattermost/src/gateway-auth-bypass.ts
+const DEFAULT_SLASH_CALLBACK_PATH = "/api/channels/mattermost/command";
+function readTrimmedString(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeCallbackPath(value) {
+	const trimmed = readTrimmedString(value);
+	if (!trimmed) return DEFAULT_SLASH_CALLBACK_PATH;
+	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+}
+function readMattermostCommands(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function isMattermostBypassPath(path) {
+	return path === DEFAULT_SLASH_CALLBACK_PATH || path.startsWith("/api/channels/mattermost/");
+}
+function collectMattermostSlashCallbackPaths(raw) {
+	const paths = new Set([normalizeCallbackPath(raw?.callbackPath)]);
+	const callbackUrl = readTrimmedString(raw?.callbackUrl);
+	if (callbackUrl) try {
+		const pathname = new URL(callbackUrl).pathname;
+		if (pathname) paths.add(pathname);
+	} catch {}
+	return [...paths];
+}
+function resolveMattermostGatewayAuthBypassPaths(cfg) {
+	const base = cfg.channels?.mattermost && typeof cfg.channels.mattermost === "object" ? cfg.channels.mattermost : void 0;
+	const callbackPaths = new Set(collectMattermostSlashCallbackPaths(readMattermostCommands(base?.commands)).filter(isMattermostBypassPath));
+	const accounts = base?.accounts ?? {};
+	for (const account of Object.values(accounts)) {
+		const accountConfig = account && typeof account === "object" && !Array.isArray(account) ? account : void 0;
+		for (const path of collectMattermostSlashCallbackPaths(readMattermostCommands(accountConfig?.commands))) if (isMattermostBypassPath(path)) callbackPaths.add(path);
+	}
+	return [...callbackPaths];
+}
+//#endregion
+export { resolveMattermostGatewayAuthBypassPaths as t };

package/dist/index.js

@@ -0,0 +1,31 @@
+import { defineBundledChannelEntry, loadBundledEntryExportSync } from "openclaw/plugin-sdk/channel-entry-contract";
+//#region extensions/mattermost/index.ts
+function registerSlashCommandRoute(api) {
+	loadBundledEntryExportSync(import.meta.url, {
+		specifier: "./slash-route-api.js",
+		exportName: "registerSlashCommandRoute"
+	})(api);
+}
+var mattermost_default = defineBundledChannelEntry({
+	id: "mattermost",
+	name: "Mattermost",
+	description: "Mattermost channel plugin",
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./channel-plugin-api.js",
+		exportName: "mattermostPlugin"
+	},
+	secrets: {
+		specifier: "./secret-contract-api.js",
+		exportName: "channelSecrets"
+	},
+	runtime: {
+		specifier: "./runtime-api.js",
+		exportName: "setMattermostRuntime"
+	},
+	registerFull(api) {
+		registerSlashCommandRoute(api);
+	}
+});
+//#endregion
+export { mattermost_default as default };

package/dist/monitor-auth-BiDuyvOc.js

@@ -0,0 +1,183 @@
+import { parseAccessGroupAllowFromEntry } from "openclaw/plugin-sdk/access-groups";
+import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { normalizeLowercaseStringOrEmpty, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildAgentMediaPayload } from "openclaw/plugin-sdk/agent-media-payload";
+import { resolveAllowlistMatchSimple } from "openclaw/plugin-sdk/allow-from";
+import { logInboundDrop } from "openclaw/plugin-sdk/channel-inbound";
+import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-outbound";
+import { logTypingFailure } from "openclaw/plugin-sdk/channel-feedback";
+import { listSkillCommandsForAgents } from "openclaw/plugin-sdk/command-auth-native";
+import { buildModelsProviderData } from "openclaw/plugin-sdk/models-provider-runtime";
+import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
+import { resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
+import { resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/media-runtime";
+import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
+import { DEFAULT_GROUP_HISTORY_LIMIT, createChannelHistoryWindow } from "openclaw/plugin-sdk/reply-history";
+import { registerPluginHttpRoute } from "openclaw/plugin-sdk/webhook-targets";
+import { isRequestBodyLimitError, readRequestBodyWithLimit } from "openclaw/plugin-sdk/webhook-ingress";
+import { isTrustedProxyAddress, resolveClientIp } from "openclaw/plugin-sdk/core";
+import { parseTcpPort } from "openclaw/plugin-sdk/number-runtime";
+//#region extensions/mattermost/src/mattermost/monitor-auth.ts
+const mattermostIngressIdentity = {
+	key: "sender-id",
+	normalize: normalizeMattermostAllowEntry,
+	aliases: [{
+		key: "sender-name",
+		kind: "plugin:mattermost-user-name",
+		normalizeEntry: normalizeMattermostAllowEntry,
+		normalizeSubject: normalizeMattermostAllowEntry,
+		dangerous: true
+	}],
+	isWildcardEntry: (entry) => normalizeMattermostAllowEntry(entry) === "*",
+	resolveEntryId: ({ entryIndex, fieldKey }) => `mattermost-entry-${entryIndex + 1}:${fieldKey === "sender-name" ? "name" : "user"}`
+};
+function normalizeMattermostAllowEntry(entry) {
+	const trimmed = entry.trim();
+	if (!trimmed) return "";
+	if (trimmed === "*") return "*";
+	const accessGroupName = parseAccessGroupAllowFromEntry(trimmed);
+	if (accessGroupName) return `accessGroup:${accessGroupName}`;
+	const normalized = trimmed.replace(/^(mattermost|user):/i, "").replace(/^@/, "").trim();
+	return normalized ? normalizeLowercaseStringOrEmpty(normalized) : "";
+}
+function normalizeMattermostAllowList(entries) {
+	return uniqueStrings(entries.map((entry) => normalizeMattermostAllowEntry(String(entry))).filter(Boolean));
+}
+function formatMattermostDirectMessageDropLog(params) {
+	const reason = params.reasonCode ? ` reason=${params.reasonCode}` : "";
+	const hint = params.dmPolicy === "open" && params.reasonCode === "dm_policy_not_allowlisted" ? " hint=add-allowFrom-wildcard" : "";
+	return `mattermost: drop dm sender=${params.senderId} (dmPolicy=${params.dmPolicy}${reason}${hint})`;
+}
+function isMattermostSenderAllowed(params) {
+	const allowFrom = normalizeMattermostAllowList(params.allowFrom);
+	if (allowFrom.length === 0) return false;
+	return resolveAllowlistMatchSimple({
+		allowFrom,
+		senderId: normalizeMattermostAllowEntry(params.senderId),
+		senderName: params.senderName ? normalizeMattermostAllowEntry(params.senderName) : void 0,
+		allowNameMatching: params.allowNameMatching
+	}).allowed;
+}
+function mapMattermostChannelKind(channelType) {
+	const normalized = channelType?.trim().toUpperCase();
+	if (normalized === "D") return "direct";
+	if (normalized === "G" || normalized === "P") return "group";
+	return "channel";
+}
+async function resolveMattermostMonitorInboundAccess(params) {
+	const { account, cfg, senderId, senderName, channelId, kind, groupPolicy, storeAllowFrom, allowTextCommands, hasControlCommand } = params;
+	const dmPolicy = account.config.dmPolicy ?? "pairing";
+	const allowNameMatching = isDangerousNameMatchingEnabled(account.config);
+	const configAllowFrom = account.config.allowFrom ?? [];
+	const configGroupAllowFrom = account.config.groupAllowFrom ?? [];
+	const readStoreAllowFrom = params.readStoreAllowFrom ?? (storeAllowFrom != null ? async () => [...storeAllowFrom] : void 0);
+	return await resolveStableChannelMessageIngress({
+		channelId: "mattermost",
+		accountId: account.accountId,
+		identity: mattermostIngressIdentity,
+		cfg,
+		...readStoreAllowFrom ? { readStoreAllowFrom } : {},
+		useDefaultPairingStore: params.readStoreAllowFrom === void 0 && storeAllowFrom == null,
+		subject: {
+			stableId: senderId,
+			aliases: { "sender-name": senderName }
+		},
+		conversation: {
+			kind,
+			id: channelId
+		},
+		event: {
+			kind: params.eventKind ?? "message",
+			authMode: "inbound",
+			mayPair: params.mayPair ?? true
+		},
+		dmPolicy,
+		groupPolicy,
+		policy: {
+			groupAllowFromFallbackToAllowFrom: true,
+			mutableIdentifierMatching: allowNameMatching ? "enabled" : "disabled"
+		},
+		allowFrom: configAllowFrom,
+		groupAllowFrom: configGroupAllowFrom,
+		command: {
+			allowTextCommands,
+			hasControlCommand: allowTextCommands && hasControlCommand,
+			directGroupAllowFrom: kind === "direct" ? "effective" : "none"
+		}
+	});
+}
+function resolveMattermostCommandDenyReason(params) {
+	if (params.decision.decision === "allow") return null;
+	if (params.kind === "direct") {
+		if (params.decision.reasonCode === "dm_policy_disabled") return "dm-disabled";
+		if (params.dmPolicy === "pairing" && (params.decision.admission === "pairing-required" || params.decision.reasonCode === "dm_policy_pairing_required")) return "dm-pairing";
+		return "unauthorized";
+	}
+	if (params.decision.reasonCode === "group_policy_disabled") return "channels-disabled";
+	if (params.decision.reasonCode === "group_policy_empty_allowlist") return "channel-no-allowlist";
+	return "unauthorized";
+}
+async function authorizeMattermostCommandInvocation(params) {
+	const { account, cfg, senderId, senderName, channelId, channelInfo, storeAllowFrom, readStoreAllowFrom, allowTextCommands, hasControlCommand } = params;
+	if (!channelInfo?.type) return {
+		ok: false,
+		denyReason: "unknown-channel",
+		commandAuthorized: false,
+		channelInfo,
+		kind: "channel",
+		chatType: "channel",
+		channelName: "",
+		channelDisplay: "",
+		roomLabel: `#${channelId}`
+	};
+	const kind = mapMattermostChannelKind(channelInfo.type);
+	const chatType = kind;
+	const channelName = channelInfo.name ?? "";
+	const channelDisplay = channelInfo.display_name ?? channelName;
+	const roomLabel = channelName ? `#${channelName}` : channelDisplay || `#${channelId}`;
+	const defaultGroupPolicy = cfg.channels?.defaults?.groupPolicy;
+	const ingress = await resolveMattermostMonitorInboundAccess({
+		account,
+		cfg,
+		senderId,
+		senderName,
+		channelId,
+		kind,
+		groupPolicy: account.config.groupPolicy ?? defaultGroupPolicy ?? "allowlist",
+		storeAllowFrom,
+		readStoreAllowFrom,
+		allowTextCommands,
+		hasControlCommand,
+		eventKind: "native-command",
+		mayPair: true
+	});
+	const denyReason = resolveMattermostCommandDenyReason({
+		decision: ingress.ingress,
+		kind,
+		dmPolicy: account.config.dmPolicy ?? "pairing"
+	});
+	if (denyReason) return {
+		ok: false,
+		denyReason,
+		commandAuthorized: false,
+		channelInfo,
+		kind,
+		chatType,
+		channelName,
+		channelDisplay,
+		roomLabel
+	};
+	return {
+		ok: true,
+		commandAuthorized: ingress.commandAccess.authorized,
+		channelInfo,
+		kind,
+		chatType,
+		channelName,
+		channelDisplay,
+		roomLabel
+	};
+}
+//#endregion
+export { resolveChannelMediaMaxBytes as C, warnMissingProviderGroupPolicyFallbackOnce as E, resolveAllowlistProviderRuntimeGroupPolicy as S, resolveDefaultGroupPolicy as T, logInboundDrop as _, normalizeMattermostAllowList as a, readRequestBodyWithLimit as b, buildAgentMediaPayload as c, createChannelMessageReplyPipeline as d, createChannelPairingController as f, loadOutboundMediaFromUrl as g, listSkillCommandsForAgents as h, normalizeMattermostAllowEntry as i, buildModelsProviderData as l, isTrustedProxyAddress as m, formatMattermostDirectMessageDropLog as n, resolveMattermostMonitorInboundAccess as o, isRequestBodyLimitError as p, isMattermostSenderAllowed as r, DEFAULT_GROUP_HISTORY_LIMIT as s, authorizeMattermostCommandInvocation as t, createChannelHistoryWindow as u, logTypingFailure as v, resolveClientIp as w, registerPluginHttpRoute as x, parseTcpPort as y };

package/dist/policy-api.js

@@ -0,0 +1,2 @@
+import { r as isMattermostSenderAllowed } from "./monitor-auth-BiDuyvOc.js";
+export { isMattermostSenderAllowed };

package/dist/runtime-CNB4YGqJ.js

@@ -0,0 +1,8 @@
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+//#region extensions/mattermost/src/runtime.ts
+const { setRuntime: setMattermostRuntime, getRuntime: getMattermostRuntime, tryGetRuntime: getOptionalMattermostRuntime } = createPluginRuntimeStore({
+	pluginId: "mattermost",
+	errorMessage: "Mattermost runtime not initialized"
+});
+//#endregion
+export { getOptionalMattermostRuntime as n, setMattermostRuntime as r, getMattermostRuntime as t };

package/dist/runtime-api.js

@@ -0,0 +1,24 @@
+import { r as setMattermostRuntime } from "./runtime-CNB4YGqJ.js";
+import { buildAgentMediaPayload } from "openclaw/plugin-sdk/agent-media-payload";
+import { resolveAllowlistMatchSimple } from "openclaw/plugin-sdk/allow-from";
+import { formatInboundFromLabel, logInboundDrop } from "openclaw/plugin-sdk/channel-inbound";
+import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+import { createAccountStatusSink, createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-outbound";
+import { logTypingFailure } from "openclaw/plugin-sdk/channel-feedback";
+import { listSkillCommandsForAgents, resolveControlCommandGate, resolveStoredModelOverride } from "openclaw/plugin-sdk/command-auth-native";
+import { buildModelsProviderData } from "openclaw/plugin-sdk/models-provider-runtime";
+import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
+import { GROUP_POLICY_BLOCKED_LABEL, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
+import { getAgentScopedMediaLocalRoots, resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/media-runtime";
+import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";
+import { DEFAULT_GROUP_HISTORY_LIMIT, buildPendingHistoryContextFromMap, clearHistoryEntriesIfEnabled, createChannelHistoryWindow, recordPendingHistoryEntryIfEnabled } from "openclaw/plugin-sdk/reply-history";
+import { registerPluginHttpRoute } from "openclaw/plugin-sdk/webhook-targets";
+import { isRequestBodyLimitError, rawDataToString, readRequestBodyWithLimit } from "openclaw/plugin-sdk/webhook-ingress";
+import { DEFAULT_ACCOUNT_ID, buildChannelConfigSchema, createDedupeCache, isTrustedProxyAddress, parseStrictPositiveInteger, resolveClientIp } from "openclaw/plugin-sdk/core";
+import { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
+import { applyAccountNameToChannelSection, applySetupAccountConfigPatch, migrateBaseNameToDefaultAccount } from "openclaw/plugin-sdk/setup";
+import { buildComputedAccountStatusSnapshot } from "openclaw/plugin-sdk/channel-status";
+import { loadSessionStore, resolveStorePath } from "openclaw/plugin-sdk/session-store-runtime";
+import { normalizeAccountId, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
+import { normalizeProviderId } from "openclaw/plugin-sdk/provider-model-shared";
+export { DEFAULT_ACCOUNT_ID, DEFAULT_GROUP_HISTORY_LIMIT, GROUP_POLICY_BLOCKED_LABEL, applyAccountNameToChannelSection, applySetupAccountConfigPatch, buildAgentMediaPayload, buildChannelConfigSchema, buildComputedAccountStatusSnapshot, buildModelsProviderData, buildPendingHistoryContextFromMap, chunkTextForOutbound, clearHistoryEntriesIfEnabled, createAccountStatusSink, createChannelHistoryWindow, createChannelMessageReplyPipeline, createChannelPairingController, createDedupeCache, formatInboundFromLabel, getAgentScopedMediaLocalRoots, isDangerousNameMatchingEnabled, isRequestBodyLimitError, isTrustedProxyAddress, listSkillCommandsForAgents, loadOutboundMediaFromUrl, loadSessionStore, logInboundDrop, logTypingFailure, migrateBaseNameToDefaultAccount, normalizeAccountId, normalizeProviderId, parseStrictPositiveInteger, rawDataToString, readRequestBodyWithLimit, recordPendingHistoryEntryIfEnabled, registerPluginHttpRoute, resolveAllowlistMatchSimple, resolveAllowlistProviderRuntimeGroupPolicy, resolveChannelMediaMaxBytes, resolveClientIp, resolveControlCommandGate, resolveDefaultGroupPolicy, resolveStorePath, resolveStoredModelOverride, resolveThreadSessionKeys, setMattermostRuntime, warnMissingProviderGroupPolicyFallbackOnce };

package/dist/secret-contract-Cx0LUNXy.js

@@ -0,0 +1,44 @@
+import { collectSimpleChannelFieldAssignments, getChannelSurface } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/mattermost/src/secret-contract.ts
+const secretTargetRegistryEntries = [{
+	id: "channels.mattermost.accounts.*.botToken",
+	targetType: "channels.mattermost.accounts.*.botToken",
+	configFile: "openclaw.json",
+	pathPattern: "channels.mattermost.accounts.*.botToken",
+	secretShape: "secret_input",
+	expectedResolvedValue: "string",
+	includeInPlan: true,
+	includeInConfigure: true,
+	includeInAudit: true
+}, {
+	id: "channels.mattermost.botToken",
+	targetType: "channels.mattermost.botToken",
+	configFile: "openclaw.json",
+	pathPattern: "channels.mattermost.botToken",
+	secretShape: "secret_input",
+	expectedResolvedValue: "string",
+	includeInPlan: true,
+	includeInConfigure: true,
+	includeInAudit: true
+}];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "mattermost");
+	if (!resolved) return;
+	const { channel: mattermost, surface } = resolved;
+	collectSimpleChannelFieldAssignments({
+		channelKey: "mattermost",
+		field: "botToken",
+		channel: mattermost,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topInactiveReason: "no enabled account inherits this top-level Mattermost botToken.",
+		accountInactiveReason: "Mattermost account is disabled."
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Cx0LUNXy.js";
+export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/setup-entry.js

@@ -0,0 +1,15 @@
+import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+//#region extensions/mattermost/setup-entry.ts
+var setup_entry_default = defineBundledChannelSetupEntry({
+	importMetaUrl: import.meta.url,
+	plugin: {
+		specifier: "./channel-plugin-api.js",
+		exportName: "mattermostSetupPlugin"
+	},
+	secrets: {
+		specifier: "./secret-contract-api.js",
+		exportName: "channelSecrets"
+	}
+});
+//#endregion
+export { setup_entry_default as default };

package/dist/slash-route-api.js

@@ -0,0 +1,2 @@
+import { i as registerSlashCommandRoute } from "./slash-state-I1qleAHM.js";
+export { registerSlashCommandRoute };