@openclaw/mattermost 2026.7.1 → 2026.7.2-beta.2

package/dist/{accounts-ITTlduDO.js → client-BzLj4dyf.js}

@@ -1,17 +1,14 @@
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { resolveChannelPreviewStreamMode, resolveChannelStreamingBlockCoalesce, resolveChannelStreamingBlockEnabled, resolveChannelStreamingChunkMode } from "openclaw/plugin-sdk/channel-outbound";
+import { buildTimeoutAbortSignal } from "openclaw/plugin-sdk/extension-shared";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { fetchWithSsrFGuard, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
-import { createAccountListHelpers, hasConfiguredAccountValue } from "openclaw/plugin-sdk/account-helpers";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
-import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
-import { sleep } from "openclaw/plugin-sdk/runtime-env";
+import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { fetchWithSsrFGuard, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
 import { z } from "zod";
 //#region extensions/mattermost/src/mattermost/client.ts
 const MATTERMOST_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+const MATTERMOST_REQUEST_TIMEOUT_MS = 3e4;
 const MATTERMOST_TEXT_RESPONSE_LIMIT_BYTES = 64 * 1024;
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
 	101,
@@ -103,17 +100,42 @@ function createMattermostClient(params) {
 	if (!baseUrl) throw new Error("Mattermost baseUrl is required");
 	const apiBaseUrl = `${baseUrl}/api/v4`;
 	const token = params.botToken.trim();
+	const requestTimeoutMs = resolveTimerTimeoutMs(params.timeoutMs, MATTERMOST_REQUEST_TIMEOUT_MS);
 	const externalFetchImpl = params.fetchImpl;
 	const guardedFetchImpl = async (input, init) => {
+		const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+		const { timeoutMs: initTimeoutMs, ...requestInit } = init ?? {};
+		const timeoutMs = resolveTimerTimeoutMs(initTimeoutMs, requestTimeoutMs);
 		const { response, release } = await fetchWithSsrFGuard({
-			url: typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url,
-			init,
+			url,
+			init: requestInit,
 			auditContext: "mattermost-api",
-			policy: ssrfPolicyFromPrivateNetworkOptIn(params.allowPrivateNetwork)
+			policy: ssrfPolicyFromPrivateNetworkOptIn(params.allowPrivateNetwork),
+			signal: requestInit.signal ?? void 0,
+			timeoutMs
 		});
 		return responseWithRelease(response, release);
 	};
-	const fetchImpl = externalFetchImpl ?? guardedFetchImpl;
+	const fetchImpl = (externalFetchImpl ? async (input, init) => {
+		const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+		const { timeoutMs: initTimeoutMs, ...requestInit } = init ?? {};
+		const { signal: timeoutSignal, cleanup } = buildTimeoutAbortSignal({
+			timeoutMs: resolveTimerTimeoutMs(initTimeoutMs, requestTimeoutMs),
+			operation: "mattermost-api",
+			url
+		});
+		const callerSignal = requestInit.signal ?? void 0;
+		const signal = callerSignal && timeoutSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : callerSignal ?? timeoutSignal;
+		try {
+			return responseWithRelease(await externalFetchImpl(input, {
+				...requestInit,
+				signal
+			}), async () => cleanup());
+		} catch (error) {
+			cleanup();
+			throw error;
+		}
+	} : void 0) ?? guardedFetchImpl;
 	const request = async (path, init) => {
 		const url = buildMattermostApiUrl(baseUrl, path);
 		const headers = new Headers(init?.headers);
@@ -163,11 +185,12 @@ async function sendMattermostTyping(client, params) {
 		body: JSON.stringify(payload)
 	});
 }
-async function createMattermostDirectChannel(client, userIds, signal) {
+async function createMattermostDirectChannel(client, userIds, signal, timeoutMs) {
 	return await client.request("/channels/direct", {
 		method: "POST",
 		body: JSON.stringify(userIds),
-		signal
+		signal,
+		timeoutMs
 	});
 }
 const DM_REPLY_DELIVERY_BARRIER_SLACK_MS = 6e4;
@@ -229,26 +252,24 @@ const RETRYABLE_NETWORK_MESSAGE_SNIPPETS = [
 async function createMattermostDirectChannelWithRetry(client, userIds, options = {}) {
 	const { maxRetries = 3, initialDelayMs = 1e3, maxDelayMs = 1e4, timeoutMs: rawTimeoutMs = 3e4, onRetry } = options;
 	const timeoutMs = resolveTimerTimeoutMs(rawTimeoutMs, 3e4);
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+	return await retryAsync(async () => {
 		const controller = new AbortController();
 		const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
 		try {
-			return await createMattermostDirectChannel(client, userIds, controller.signal);
+			return await createMattermostDirectChannel(client, userIds, controller.signal, timeoutMs);
+		} catch (err) {
+			throw err instanceof Error ? err : new Error(String(err));
 		} finally {
 			clearTimeout(timeoutId);
 		}
-	} catch (err) {
-		lastError = err instanceof Error ? err : new Error(String(err));
-		if (attempt >= maxRetries) break;
-		if (!isRetryableError(lastError)) throw lastError;
-		const exponentialDelay = initialDelayMs * 2 ** attempt;
-		const jitter = Math.random() * exponentialDelay;
-		const delayMs = Math.min(exponentialDelay + jitter, maxDelayMs);
-		if (onRetry) onRetry(attempt + 1, delayMs, lastError);
-		await sleep(delayMs);
-	}
-	throw lastError ?? /* @__PURE__ */ new Error("Failed to create DM channel after retries");
+	}, {
+		attempts: maxRetries + 1,
+		minDelayMs: Math.min(initialDelayMs, maxDelayMs),
+		maxDelayMs,
+		jitter: "full",
+		shouldRetry: (err) => isRetryableError(err),
+		onRetry: (info) => onRetry?.(info.attempt, info.delayMs, info.err)
+	});
 }
 function isRetryableError(error) {
 	const candidates = collectErrorCandidates(error);
@@ -258,7 +279,9 @@ function isRetryableError(error) {
 	for (const message of messages) {
 		const clientErrorMatch = message.match(/mattermost api (4\d{2})\b/);
 		if (!clientErrorMatch) continue;
-		const statusCode = Number.parseInt(clientErrorMatch[1], 10);
+		const statusCodeText = clientErrorMatch[1];
+		if (!statusCodeText) continue;
+		const statusCode = Number.parseInt(statusCodeText, 10);
 		if (statusCode >= 400 && statusCode < 500) return false;
 	}
 	if (messages.some((message) => /mattermost api \d{3}\b/.test(message))) return false;
@@ -360,77 +383,4 @@ async function uploadMattermostFile(client, params) {
 	return info;
 }
 //#endregion
-//#region extensions/mattermost/src/mattermost/accounts.ts
-const mattermostAccountHelpers = createAccountListHelpers("mattermost", { hasImplicitDefaultAccount: (cfg) => {
-	const mattermost = cfg.channels?.mattermost;
-	return Boolean(mattermost?.baseUrl?.trim() && (hasConfiguredAccountValue(mattermost.botToken) || process.env.MATTERMOST_BOT_TOKEN?.trim()));
-} });
-function listMattermostAccountIds(cfg) {
-	return mattermostAccountHelpers.listAccountIds(cfg);
-}
-function resolveDefaultMattermostAccountId(cfg) {
-	return mattermostAccountHelpers.resolveDefaultAccountId(cfg);
-}
-function mergeMattermostAccountConfig(cfg, accountId) {
-	return resolveMergedAccountConfig({
-		channelConfig: cfg.channels?.mattermost,
-		accounts: cfg.channels?.mattermost?.accounts,
-		accountId,
-		omitKeys: ["defaultAccount"],
-		nestedObjectKeys: ["commands"]
-	});
-}
-function resolveMattermostRequireMention(config) {
-	if (config.chatmode === "oncall") return true;
-	if (config.chatmode === "onmessage") return false;
-	if (config.chatmode === "onchar") return true;
-	return config.requireMention;
-}
-function resolveMattermostAccount(params) {
-	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultMattermostAccountId(params.cfg));
-	const baseEnabled = params.cfg.channels?.mattermost?.enabled !== false;
-	const merged = mergeMattermostAccountConfig(params.cfg, accountId);
-	const accountEnabled = merged.enabled !== false;
-	const enabled = baseEnabled && accountEnabled;
-	const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
-	const envToken = allowEnv ? process.env.MATTERMOST_BOT_TOKEN?.trim() : void 0;
-	const envUrl = allowEnv ? process.env.MATTERMOST_URL?.trim() : void 0;
-	const configToken = params.allowUnresolvedSecretRef ? normalizeSecretInputString(merged.botToken) : normalizeResolvedSecretInputString({
-		value: merged.botToken,
-		path: `channels.mattermost.accounts.${accountId}.botToken`
-	});
-	const configUrl = merged.baseUrl?.trim();
-	const botToken = configToken || envToken;
-	const baseUrl = normalizeMattermostBaseUrl(configUrl || envUrl);
-	const requireMention = resolveMattermostRequireMention(merged);
-	const botTokenSource = configToken ? "config" : envToken ? "env" : "none";
-	const baseUrlSource = configUrl ? "config" : envUrl ? "env" : "none";
-	return {
-		accountId,
-		enabled,
-		name: normalizeOptionalString(merged.name),
-		botToken,
-		baseUrl,
-		botTokenSource,
-		baseUrlSource,
-		config: merged,
-		chatmode: merged.chatmode,
-		oncharPrefixes: merged.oncharPrefixes,
-		requireMention,
-		textChunkLimit: merged.textChunkLimit,
-		chunkMode: resolveChannelStreamingChunkMode(merged) ?? merged.chunkMode,
-		streamingMode: resolveChannelPreviewStreamMode(merged, "partial"),
-		blockStreaming: resolveChannelStreamingBlockEnabled(merged) ?? merged.blockStreaming,
-		blockStreamingCoalesce: resolveChannelStreamingBlockCoalesce(merged) ?? merged.blockStreamingCoalesce
-	};
-}
-/**
-* Resolve the effective replyToMode for a given chat type.
-* Mattermost auto-threading only applies to channel and group messages.
-*/
-function resolveMattermostReplyToMode(account, kind) {
-	if (kind === "direct") return "off";
-	return account.config.replyToMode ?? "off";
-}
-//#endregion
-export { hasConfiguredSecretInput as C, buildSecretInputSchema as S, readMattermostError as _, MattermostPostSchema as a, updateMattermostPost as b, createMattermostPost as c, fetchMattermostChannelByName as d, fetchMattermostMe as f, normalizeMattermostBaseUrl as g, fetchMattermostUserTeams as h, resolveMattermostReplyToMode as i, deleteMattermostPost as l, fetchMattermostUserByUsername as m, resolveDefaultMattermostAccountId as n, createMattermostClient as o, fetchMattermostUser as p, resolveMattermostAccount as r, createMattermostDirectChannelWithRetry as s, listMattermostAccountIds as t, fetchMattermostChannel as u, resolveMattermostReplyDeliveryBarrierTimeoutMs as v, uploadMattermostFile as x, sendMattermostTyping as y };
+export { uploadMattermostFile as _, deleteMattermostPost as a, fetchMattermostMe as c, fetchMattermostUserTeams as d, normalizeMattermostBaseUrl as f, updateMattermostPost as g, sendMattermostTyping as h, createMattermostPost as i, fetchMattermostUser as l, resolveMattermostReplyDeliveryBarrierTimeoutMs as m, createMattermostClient as n, fetchMattermostChannel as o, readMattermostError as p, createMattermostDirectChannelWithRetry as r, fetchMattermostChannelByName as s, MattermostPostSchema as t, fetchMattermostUserByUsername as u };

package/dist/doctor-contract-BaUvVh8e.js

@@ -0,0 +1,19 @@
+import { createLegacyPrivateNetworkDoctorContract } from "openclaw/plugin-sdk/ssrf-runtime";
+import { defineChannelAliasMigration } from "openclaw/plugin-sdk/runtime-doctor";
+//#region extensions/mattermost/src/doctor-contract.ts
+const networkContract = createLegacyPrivateNetworkDoctorContract({ channelKey: "mattermost" });
+const streamingAliasMigration = defineChannelAliasMigration({
+	channelId: "mattermost",
+	streaming: { defaultMode: "partial" },
+	accountStreamingReplacesRoot: true
+});
+const legacyConfigRules = [...networkContract.legacyConfigRules, ...streamingAliasMigration.legacyConfigRules];
+function normalizeCompatibilityConfig({ cfg }) {
+	const network = networkContract.normalizeCompatibilityConfig({ cfg });
+	return streamingAliasMigration.normalizeChannelConfig({
+		cfg: network.config,
+		changes: network.changes
+	});
+}
+//#endregion
+export { normalizeCompatibilityConfig as n, legacyConfigRules as t };

package/dist/doctor-contract-api.js

@@ -1,2 +1,2 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-ttH0DCuq.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BaUvVh8e.js";
 export { legacyConfigRules, normalizeCompatibilityConfig };

package/dist/gateway-auth-api.js

@@ -1,2 +1,2 @@
-import { t as resolveMattermostGatewayAuthBypassPaths } from "./gateway-auth-bypass-BIXLORHU.js";
+import { t as resolveMattermostGatewayAuthBypassPaths } from "./gateway-auth-bypass-CL1PxV3z.js";
 export { resolveMattermostGatewayAuthBypassPaths as resolveGatewayAuthBypassPaths };

package/dist/{gateway-auth-bypass-BIXLORHU.js → gateway-auth-bypass-CL1PxV3z.js}

@@ -23,8 +23,9 @@ function collectMattermostSlashCallbackPaths(raw) {
 	} catch {}
 	return [...paths];
 }
-function resolveMattermostGatewayAuthBypassPaths(cfg) {
-	const base = cfg.channels?.mattermost && typeof cfg.channels.mattermost === "object" ? cfg.channels.mattermost : void 0;
+function resolveMattermostGatewayAuthBypassPaths(params) {
+	const channels = params.cfg.channels;
+	const base = channels?.mattermost && typeof channels.mattermost === "object" ? channels.mattermost : void 0;
 	const callbackPaths = new Set(collectMattermostSlashCallbackPaths(readMattermostCommands(base?.commands)).filter(isMattermostBypassPath));
 	const accounts = base?.accounts ?? {};
 	for (const account of Object.values(accounts)) {

package/dist/interactions-DO7J-ND1.js

@@ -0,0 +1,375 @@
+import { t as getMattermostRuntime } from "./runtime-CNB4YGqJ.js";
+import { g as updateMattermostPost } from "./client-BzLj4dyf.js";
+import { b as readRequestBodyWithLimit, m as isTrustedProxyAddress, w as resolveClientIp } from "./monitor-auth-dEHa1_On.js";
+import { createHmac } from "node:crypto";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/mattermost/src/mattermost/interactions.ts
+const INTERACTION_MAX_BODY_BYTES = 64 * 1024;
+const INTERACTION_BODY_TIMEOUT_MS = 1e4;
+const SIGNED_CHANNEL_ID_CONTEXT_KEY = "__openclaw_channel_id";
+const callbackUrls = /* @__PURE__ */ new Map();
+function setInteractionCallbackUrl(accountId, url) {
+	callbackUrls.set(accountId, url);
+}
+function resolveInteractionCallbackPath(accountId) {
+	return `/mattermost/interactions/${accountId}`;
+}
+function isWildcardBindHost(rawHost) {
+	const trimmed = rawHost.trim();
+	if (!trimmed) return false;
+	const host = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+	return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::0";
+}
+function normalizeCallbackBaseUrl(baseUrl) {
+	return baseUrl.trim().replace(/\/+$/, "");
+}
+function headerValue(value) {
+	if (Array.isArray(value)) return normalizeOptionalString(value[0]);
+	return normalizeOptionalString(value);
+}
+function isAllowedInteractionSource(params) {
+	const { allowedSourceIps } = params;
+	if (!allowedSourceIps?.length) return true;
+	return isTrustedProxyAddress(resolveClientIp({
+		remoteAddr: params.req.socket?.remoteAddress,
+		forwardedFor: headerValue(params.req.headers["x-forwarded-for"]),
+		realIp: headerValue(params.req.headers["x-real-ip"]),
+		trustedProxies: params.trustedProxies,
+		allowRealIpFallback: params.allowRealIpFallback
+	}), allowedSourceIps);
+}
+/**
+* Resolve the interaction callback URL for an account.
+* Falls back to computing it from interactions.callbackBaseUrl or gateway host config.
+*/
+function computeInteractionCallbackUrl(accountId, cfg) {
+	const path = resolveInteractionCallbackPath(accountId);
+	const callbackBaseUrl = normalizeOptionalString(cfg?.interactions?.callbackBaseUrl) ?? normalizeOptionalString(cfg?.channels?.mattermost?.interactions?.callbackBaseUrl);
+	if (callbackBaseUrl) return `${normalizeCallbackBaseUrl(callbackBaseUrl)}${path}`;
+	const port = typeof cfg?.gateway?.port === "number" ? cfg.gateway.port : 18789;
+	let host = cfg?.gateway?.customBindHost && !isWildcardBindHost(cfg.gateway.customBindHost) ? cfg.gateway.customBindHost.trim() : "localhost";
+	if (host.includes(":") && !(host.startsWith("[") && host.endsWith("]"))) host = `[${host}]`;
+	return `http://${host}:${port}${path}`;
+}
+/**
+* Resolve the interaction callback URL for an account.
+* Prefers the in-memory registered URL (set by the gateway monitor) so callers outside the
+* monitor lifecycle can reuse the runtime-validated callback destination.
+*/
+function resolveInteractionCallbackUrl(accountId, cfg) {
+	const cached = callbackUrls.get(accountId);
+	if (cached) return cached;
+	return computeInteractionCallbackUrl(accountId, cfg);
+}
+const interactionSecrets = /* @__PURE__ */ new Map();
+let defaultInteractionSecret;
+function deriveInteractionSecret(botToken) {
+	return createHmac("sha256", "openclaw-mattermost-interactions").update(botToken).digest("hex");
+}
+function setInteractionSecret(accountIdOrBotToken, botToken) {
+	if (typeof botToken === "string") {
+		interactionSecrets.set(accountIdOrBotToken, deriveInteractionSecret(botToken));
+		return;
+	}
+	defaultInteractionSecret = deriveInteractionSecret(accountIdOrBotToken);
+}
+function getInteractionSecret(accountId) {
+	const scoped = accountId ? interactionSecrets.get(accountId) : void 0;
+	if (scoped) return scoped;
+	if (defaultInteractionSecret) return defaultInteractionSecret;
+	if (interactionSecrets.size === 1) {
+		const first = interactionSecrets.values().next().value;
+		if (typeof first === "string") return first;
+	}
+	throw new Error("Interaction secret not initialized — call setInteractionSecret(accountId, botToken) first");
+}
+function canonicalizeInteractionContext(value) {
+	if (Array.isArray(value)) return value.map((item) => canonicalizeInteractionContext(item));
+	if (value && typeof value === "object") {
+		const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, canonicalizeInteractionContext(entryValue)]);
+		return Object.fromEntries(entries);
+	}
+	return value;
+}
+function generateInteractionToken(context, accountId) {
+	const secret = getInteractionSecret(accountId);
+	const payload = JSON.stringify(canonicalizeInteractionContext(context));
+	return createHmac("sha256", secret).update(payload).digest("hex");
+}
+function verifyInteractionToken(context, token, accountId) {
+	return safeEqualSecret(generateInteractionToken(context, accountId), token);
+}
+/**
+* Build Mattermost `props.attachments` with interactive buttons.
+*
+* Each button includes an HMAC token in its integration context so the
+* callback handler can verify the request originated from a legitimate
+* button click (Mattermost's recommended security pattern).
+*/
+/**
+* Sanitize a button ID so Mattermost's action router can match it.
+* Mattermost uses the action ID in the URL path `/api/v4/posts/{id}/actions/{actionId}`
+* and IDs containing hyphens or underscores break the server-side routing.
+* See: https://github.com/mattermost/mattermost/issues/25747
+*/
+function sanitizeActionId(id) {
+	return id.replace(/[-_]/g, "");
+}
+function buildButtonAttachments(params) {
+	const actions = params.buttons.map((btn) => {
+		const safeId = sanitizeActionId(btn.id);
+		const context = {
+			action_id: safeId,
+			...btn.context
+		};
+		const token = generateInteractionToken(context, params.accountId);
+		return {
+			id: safeId,
+			type: "button",
+			name: btn.name,
+			style: btn.style,
+			integration: {
+				url: params.callbackUrl,
+				context: {
+					...context,
+					_token: token
+				}
+			}
+		};
+	});
+	return [{
+		text: params.text ?? "",
+		actions
+	}];
+}
+function buildButtonProps(params) {
+	const buttons = params.buttons.flatMap((item) => Array.isArray(item) ? item : [item]).map((btn) => ({
+		id: normalizeStringifiedOptionalString(btn.id ?? btn.callback_data) ?? "",
+		name: normalizeStringifiedOptionalString(btn.text ?? btn.name ?? btn.label) ?? "",
+		style: btn.style ?? "default",
+		context: typeof btn.context === "object" && btn.context !== null ? {
+			...btn.context,
+			[SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId
+		} : { [SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId }
+	})).filter((btn) => btn.id && btn.name);
+	if (buttons.length === 0) return;
+	return { attachments: buildButtonAttachments({
+		callbackUrl: params.callbackUrl,
+		accountId: params.accountId,
+		buttons,
+		text: params.text
+	}) };
+}
+function readInteractionBody(req) {
+	return readRequestBodyWithLimit(req, {
+		maxBytes: INTERACTION_MAX_BODY_BYTES,
+		timeoutMs: INTERACTION_BODY_TIMEOUT_MS
+	});
+}
+function createMattermostInteractionHandler(params) {
+	const { client, accountId, log } = params;
+	const core = getMattermostRuntime();
+	function parseInteractionPayload(raw) {
+		try {
+			return JSON.parse(raw);
+		} catch {
+			throw new Error("Mattermost interaction body was malformed JSON");
+		}
+	}
+	return async (req, res) => {
+		if (req.method !== "POST") {
+			res.statusCode = 405;
+			res.setHeader("Allow", "POST");
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Method Not Allowed" }));
+			return;
+		}
+		if (!isAllowedInteractionSource({
+			req,
+			allowedSourceIps: params.allowedSourceIps,
+			trustedProxies: params.trustedProxies,
+			allowRealIpFallback: params.allowRealIpFallback
+		})) {
+			log?.(`mattermost interaction: rejected callback source remote=${req.socket?.remoteAddress ?? "?"}`);
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Forbidden origin" }));
+			return;
+		}
+		let payload;
+		try {
+			payload = parseInteractionPayload(await readInteractionBody(req));
+		} catch (err) {
+			log?.(`mattermost interaction: failed to parse body: ${String(err)}`);
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Invalid request body" }));
+			return;
+		}
+		const context = payload.context;
+		if (!context) {
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing context" }));
+			return;
+		}
+		const token = context["_token"];
+		if (typeof token !== "string") {
+			log?.("mattermost interaction: missing _token in context");
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing token" }));
+			return;
+		}
+		const { _token, ...contextWithoutToken } = context;
+		if (!verifyInteractionToken(contextWithoutToken, token, accountId)) {
+			log?.("mattermost interaction: invalid _token");
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Invalid token" }));
+			return;
+		}
+		const actionId = context.action_id;
+		if (typeof actionId !== "string") {
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing action_id in context" }));
+			return;
+		}
+		const signedChannelId = typeof contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY] === "string" ? contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY].trim() : "";
+		if (signedChannelId && signedChannelId !== payload.channel_id) {
+			log?.(`mattermost interaction: signed channel mismatch payload=${payload.channel_id} signed=${signedChannelId}`);
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Channel mismatch" }));
+			return;
+		}
+		const userName = payload.user_name ?? payload.user_id;
+		let originalMessage;
+		let originalPost;
+		let clickedButtonName = null;
+		try {
+			originalPost = await client.request(`/posts/${payload.post_id}`);
+			const postChannelId = originalPost.channel_id?.trim();
+			if (!postChannelId || postChannelId !== payload.channel_id) {
+				log?.(`mattermost interaction: post channel mismatch payload=${payload.channel_id} post=${postChannelId ?? "<missing>"}`);
+				res.statusCode = 403;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Post/channel mismatch" }));
+				return;
+			}
+			originalMessage = originalPost.message ?? "";
+			const postAttachments = Array.isArray(originalPost?.props?.attachments) ? originalPost.props.attachments : [];
+			for (const att of postAttachments) {
+				const match = att.actions?.find((a) => a.id === actionId);
+				if (match?.name) {
+					clickedButtonName = match.name;
+					break;
+				}
+			}
+			if (clickedButtonName === null) {
+				log?.(`mattermost interaction: action ${actionId} not found in post ${payload.post_id}`);
+				res.statusCode = 403;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Unknown action" }));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: failed to validate post ${payload.post_id}: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Failed to validate interaction" }));
+			return;
+		}
+		if (!originalPost) {
+			log?.(`mattermost interaction: missing fetched post ${payload.post_id}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Failed to load interaction post" }));
+			return;
+		}
+		log?.(`mattermost interaction: action=${actionId} user=${payload.user_name ?? payload.user_id} post=${payload.post_id} channel=${payload.channel_id}`);
+		if (params.authorizeButtonClick) try {
+			const authorization = await params.authorizeButtonClick({
+				payload,
+				post: originalPost
+			});
+			if (!authorization.ok) {
+				res.statusCode = authorization.statusCode ?? 200;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify(authorization.response ?? { ephemeral_text: "You are not allowed to use this action here." }));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: authorization failed: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Interaction authorization failed" }));
+			return;
+		}
+		if (params.handleInteraction) try {
+			const response = await params.handleInteraction({
+				payload,
+				userName,
+				actionId,
+				actionName: clickedButtonName,
+				originalMessage,
+				context: contextWithoutToken,
+				post: originalPost
+			});
+			if (response !== null) {
+				res.statusCode = 200;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify(response));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: custom handler failed: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Interaction handler failed" }));
+			return;
+		}
+		try {
+			const eventLabel = `Mattermost button click: action="${actionId}" by ${payload.user_name ?? payload.user_id} in channel ${payload.channel_id}`;
+			const sessionKey = params.resolveSessionKey ? await params.resolveSessionKey({
+				channelId: payload.channel_id,
+				userId: payload.user_id,
+				post: originalPost
+			}) : `agent:main:mattermost:${accountId}:${payload.channel_id}`;
+			core.system.enqueueSystemEvent(eventLabel, {
+				sessionKey,
+				contextKey: `mattermost:interaction:${payload.post_id}:${actionId}`
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: system event dispatch failed: ${String(err)}`);
+		}
+		try {
+			await updateMattermostPost(client, payload.post_id, {
+				message: originalMessage,
+				props: { attachments: [{ text: `✓ **${clickedButtonName}** selected by @${userName}` }] }
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: failed to update post ${payload.post_id}: ${String(err)}`);
+		}
+		res.statusCode = 200;
+		res.setHeader("Content-Type", "application/json");
+		res.end("{}");
+		if (params.dispatchButtonClick) try {
+			await params.dispatchButtonClick({
+				channelId: payload.channel_id,
+				userId: payload.user_id,
+				userName,
+				actionId,
+				actionName: clickedButtonName,
+				postId: payload.post_id,
+				post: originalPost
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: dispatchButtonClick failed: ${String(err)}`);
+		}
+	};
+}
+//#endregion
+export { resolveInteractionCallbackPath as a, setInteractionSecret as c, createMattermostInteractionHandler as i, buildButtonProps as n, resolveInteractionCallbackUrl as o, computeInteractionCallbackUrl as r, setInteractionCallbackUrl as s, buildButtonAttachments as t };

package/dist/policy-api.js

@@ -1,2 +1,2 @@
-import { r as isMattermostSenderAllowed } from "./monitor-auth-BiDuyvOc.js";
+import { r as isMattermostSenderAllowed } from "./monitor-auth-dEHa1_On.js";
 export { isMattermostSenderAllowed };

package/dist/secret-contract-B4R5Bmhv.js

@@ -0,0 +1,28 @@
+import { collectSimpleChannelFieldAssignments, createChannelSecretTargetRegistryEntries, getChannelSurface } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/mattermost/src/secret-contract.ts
+const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
+	channelKey: "mattermost",
+	account: ["botToken"],
+	channel: ["botToken"]
+});
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "mattermost");
+	if (!resolved) return;
+	const { channel: mattermost, surface } = resolved;
+	collectSimpleChannelFieldAssignments({
+		channelKey: "mattermost",
+		field: "botToken",
+		channel: mattermost,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topInactiveReason: "no enabled account inherits this top-level Mattermost botToken.",
+		accountInactiveReason: "Mattermost account is disabled."
+	});
+}
+const channelSecrets = {
+	secretTargetRegistryEntries,
+	collectRuntimeConfigAssignments
+};
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Cx0LUNXy.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-B4R5Bmhv.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };