@openclaw/mattermost 2026.7.2-beta.1 → 2026.7.2-beta.2

package/dist/accounts-C4Azn6rA.js

@@ -0,0 +1,83 @@
+import { f as normalizeMattermostBaseUrl } from "./client-BzLj4dyf.js";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveChannelPreviewStreamMode, resolveChannelStreamingBlockCoalesce, resolveChannelStreamingBlockEnabled, resolveChannelStreamingChunkMode } from "openclaw/plugin-sdk/channel-outbound";
+import { createAccountListHelpers, hasConfiguredAccountValue } from "openclaw/plugin-sdk/account-helpers";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
+import { resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
+import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+//#region extensions/mattermost/src/mattermost/accounts.ts
+const mattermostAccountHelpers = createAccountListHelpers("mattermost", { hasImplicitDefaultAccount: (cfg) => {
+	const mattermost = cfg.channels?.mattermost;
+	return Boolean(mattermost?.baseUrl?.trim() && (hasConfiguredAccountValue(mattermost.botToken) || process.env.MATTERMOST_BOT_TOKEN?.trim()));
+} });
+function listMattermostAccountIds(cfg) {
+	return mattermostAccountHelpers.listAccountIds(cfg);
+}
+function resolveDefaultMattermostAccountId(cfg) {
+	return mattermostAccountHelpers.resolveDefaultAccountId(cfg);
+}
+function mergeMattermostAccountConfig(cfg, accountId) {
+	return resolveMergedAccountConfig({
+		channelConfig: cfg.channels?.mattermost,
+		accounts: cfg.channels?.mattermost?.accounts,
+		accountId,
+		omitKeys: ["defaultAccount"],
+		nestedObjectKeys: ["commands"]
+	});
+}
+function resolveMattermostRequireMention(config) {
+	if (config.chatmode === "oncall") return true;
+	if (config.chatmode === "onmessage") return false;
+	if (config.chatmode === "onchar") return true;
+	return config.requireMention;
+}
+function resolveMattermostAccount(params) {
+	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultMattermostAccountId(params.cfg));
+	const baseEnabled = params.cfg.channels?.mattermost?.enabled !== false;
+	const merged = mergeMattermostAccountConfig(params.cfg, accountId);
+	const accountEnabled = merged.enabled !== false;
+	const enabled = baseEnabled && accountEnabled;
+	const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
+	const envToken = allowEnv ? process.env.MATTERMOST_BOT_TOKEN?.trim() : void 0;
+	const envUrl = allowEnv ? process.env.MATTERMOST_URL?.trim() : void 0;
+	const configToken = params.allowUnresolvedSecretRef ? normalizeSecretInputString(merged.botToken) : normalizeResolvedSecretInputString({
+		value: merged.botToken,
+		path: `channels.mattermost.accounts.${accountId}.botToken`
+	});
+	const configUrl = merged.baseUrl?.trim();
+	const botToken = configToken || envToken;
+	const baseUrl = normalizeMattermostBaseUrl(configUrl || envUrl);
+	const requireMention = resolveMattermostRequireMention(merged);
+	const botTokenSource = configToken ? "config" : envToken ? "env" : "none";
+	const baseUrlSource = configUrl ? "config" : envUrl ? "env" : "none";
+	return {
+		accountId,
+		enabled,
+		name: normalizeOptionalString(merged.name),
+		botToken,
+		baseUrl,
+		botTokenSource,
+		baseUrlSource,
+		config: merged,
+		chatmode: merged.chatmode,
+		oncharPrefixes: merged.oncharPrefixes,
+		requireMention,
+		textChunkLimit: merged.textChunkLimit,
+		chunkMode: resolveChannelStreamingChunkMode(merged),
+		streamingMode: resolveChannelPreviewStreamMode(merged, "partial"),
+		blockStreaming: resolveChannelStreamingBlockEnabled(merged),
+		blockStreamingCoalesce: resolveChannelStreamingBlockCoalesce(merged)
+	};
+}
+/**
+* Resolve the effective replyToMode for a given chat type.
+* Direct messages stay flat unless explicitly opted into a per-chat-type mode.
+*/
+function resolveMattermostReplyToMode(account, kind) {
+	const scopedMode = account.config.replyToModeByChatType?.[kind];
+	if (scopedMode !== void 0) return scopedMode;
+	if (kind === "direct") return "off";
+	return account.config.replyToMode ?? "off";
+}
+//#endregion
+export { buildSecretInputSchema as a, resolveMattermostReplyToMode as i, resolveDefaultMattermostAccountId as n, hasConfiguredSecretInput as o, resolveMattermostAccount as r, listMattermostAccountIds as t };

package/dist/api.js

@@ -1,2 +1,3 @@
-import { r as isMattermostSenderAllowed } from "./monitor-auth-BiDuyvOc.js";
-export { isMattermostSenderAllowed };
+import { r as isMattermostSenderAllowed } from "./monitor-auth-dEHa1_On.js";
+import { t as buildButtonAttachments } from "./interactions-DO7J-ND1.js";
+export { buildButtonAttachments, isMattermostSenderAllowed };

package/dist/channel-plugin-api.js

@@ -1,4 +1,4 @@
-import { a as describeMattermostAccount, c as mattermostMeta, i as MattermostChannelConfigSchema, n as mattermostSetupWizard, o as isMattermostConfigured, r as mattermostSetupAdapter, s as mattermostConfigAdapter, t as mattermostPlugin } from "./channel-plugin-runtime-BkzZgYxP.js";
+import { a as MattermostChannelConfigSchema, c as mattermostConfigAdapter, l as mattermostMeta, n as mattermostSetupWizard, o as describeMattermostAccount, r as mattermostSetupAdapter, s as isMattermostConfigured, t as mattermostPlugin } from "./channel-plugin-runtime-BXmjNn6B.js";
 import { t as resolveMattermostGatewayAuthBypassPaths } from "./gateway-auth-bypass-CL1PxV3z.js";
 //#region extensions/mattermost/src/channel.setup.ts
 const mattermostSetupPlugin = {

package/dist/{channel-plugin-runtime-BkzZgYxP.js → channel-plugin-runtime-BXmjNn6B.js}

@@ -1,30 +1,31 @@
-import { C as hasConfiguredSecretInput, S as buildSecretInputSchema, g as normalizeMattermostBaseUrl, i as resolveMattermostReplyToMode, n as resolveDefaultMattermostAccountId, r as resolveMattermostAccount, t as listMattermostAccountIds } from "./accounts-B2NRPlqr.js";
+import { f as normalizeMattermostBaseUrl } from "./client-BzLj4dyf.js";
+import { a as buildSecretInputSchema, i as resolveMattermostReplyToMode, n as resolveDefaultMattermostAccountId, o as hasConfiguredSecretInput, r as resolveMattermostAccount, t as listMattermostAccountIds } from "./accounts-C4Azn6rA.js";
 import { t as resolveMattermostGatewayAuthBypassPaths } from "./gateway-auth-bypass-CL1PxV3z.js";
 import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BaUvVh8e.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-B4R5Bmhv.js";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { buildPassiveProbedChannelStatusSummary } from "openclaw/plugin-sdk/extension-shared";
+import { isPrivateNetworkOptInEnabled } from "openclaw/plugin-sdk/ssrf-runtime";
+import { z } from "zod";
 import { formatNormalizedAllowFromEntries } from "openclaw/plugin-sdk/allow-from";
 import { createLoggedPairingApprovalNotifier } from "openclaw/plugin-sdk/channel-pairing";
 import { createAccountStatusSink, createChannelMessageAdapterFromOutbound } from "openclaw/plugin-sdk/channel-outbound";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildChannelOutboundSessionRoute, buildThreadAwareOutboundSessionRoute, stripChannelTargetPrefix, stripTargetKindPrefix } from "openclaw/plugin-sdk/core";
 import { createChannelConfigUiHints, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
-import { buildChannelGroupsScopeTree, createDangerousNameMatchingMutableAllowlistWarningCollector, createRestrictSendersChannelSecurity, resolveScopeRequireMention } from "openclaw/plugin-sdk/channel-policy";
+import { buildChannelGroupsScopeTree, buildMutableAllowEntryDetector, collectStandardAllowlistLists, createDangerousNameMatchingMutableAllowlistWarningCollector, createRestrictSendersChannelSecurity, resolveScopeRequireMention } from "openclaw/plugin-sdk/channel-policy";
 import { attachChannelToResult, createAttachedChannelResultAdapter } from "openclaw/plugin-sdk/channel-send-result";
 import { createChannelDirectoryAdapter } from "openclaw/plugin-sdk/directory-runtime";
-import { buildPassiveProbedChannelStatusSummary } from "openclaw/plugin-sdk/extension-shared";
 import { normalizeMessagePresentation, renderMessagePresentationFallbackText, resolveMessagePresentationButtonAction, resolveMessagePresentationControlValue } from "openclaw/plugin-sdk/interactive-runtime";
 import { createLazyRuntimeModule } from "openclaw/plugin-sdk/lazy-runtime";
 import { resolvePayloadMediaUrls, sendTextMediaPayload } from "openclaw/plugin-sdk/reply-payload";
-import { isPrivateNetworkOptInEnabled } from "openclaw/plugin-sdk/ssrf-runtime";
 import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { chunkTextForOutbound, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { z } from "zod";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter } from "openclaw/plugin-sdk/channel-config-helpers";
-import { BlockStreamingCoalesceSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, buildChannelConfigSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
-import { applyAccountNameToChannelSection, applySetupAccountConfigPatch, createSetupTranslator, createStandardChannelSetupStatus, formatDocsLink, migrateBaseNameToDefaultAccount } from "openclaw/plugin-sdk/setup";
+import { BlockStreamingCoalesceSchema, DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
+import { applyAccountNameToChannelSection, applySetupAccountConfigPatch, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, migrateBaseNameToDefaultAccount, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 import { createSetupInputPresenceValidator } from "openclaw/plugin-sdk/setup-runtime";
 //#region extensions/mattermost/src/approval-auth.ts
 const MATTERMOST_USER_ID_RE = /^[a-z0-9]{26}$/;
@@ -99,9 +100,14 @@ function describeMattermostAccount(account) {
 }
 //#endregion
 //#region extensions/mattermost/src/config-schema-core.ts
-const MattermostGroupSchema = z.object({ 
-/** Whether mentions are required to trigger the bot in this group. */
-requireMention: z.boolean().optional() }).strict();
+const MattermostGroupSchema = buildGroupEntrySchema().omit({
+	tools: true,
+	toolsBySender: true,
+	skills: true,
+	enabled: true,
+	allowFrom: true,
+	systemPrompt: true
+});
 function requireMattermostOpenAllowFrom(params) {
 	requireOpenAllowFrom({
 		policy: params.policy,
@@ -151,9 +157,13 @@ const MattermostStreamingProgressSchema = z.object({
 	labels: z.array(z.string()).optional(),
 	maxLines: z.number().int().positive().optional(),
 	maxLineChars: z.number().int().positive().optional(),
-	toolProgress: z.boolean().optional()
+	toolProgress: z.boolean().optional(),
+	commandText: z.enum(["raw", "status"]).optional()
+}).strict();
+const MattermostStreamingPreviewSchema = z.object({
+	toolProgress: z.boolean().optional(),
+	commandText: z.enum(["raw", "status"]).optional()
 }).strict();
-const MattermostStreamingPreviewSchema = z.object({ toolProgress: z.boolean().optional() }).strict();
 const MattermostStreamingBlockSchema = z.object({
 	enabled: z.boolean().optional(),
 	coalesce: BlockStreamingCoalesceSchema.optional()
@@ -176,7 +186,9 @@ const MattermostReplyToModeByChatTypeSchema = z.object({
 	group: MattermostReplyToModeSchema.optional(),
 	channel: MattermostReplyToModeSchema.optional()
 }).strict();
-const MattermostAccountSchemaBase = z.object({
+//#endregion
+//#region extensions/mattermost/src/config-surface.ts
+const MattermostChannelConfigSchema = buildChannelConfigSchema(buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	capabilities: z.array(z.string()).optional(),
 	dangerouslyAllowNameMatching: z.boolean().optional(),
@@ -213,25 +225,15 @@ const MattermostAccountSchemaBase = z.object({
 	network: MattermostNetworkSchema,
 	/** Retry configuration for DM channel creation */
 	dmChannelRetry: DmChannelRetrySchema
-}).strict();
-const MattermostAccountSchema = MattermostAccountSchemaBase.superRefine((value, ctx) => {
-	requireMattermostOpenAllowFrom({
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx
-	});
-});
-//#endregion
-//#region extensions/mattermost/src/config-surface.ts
-const MattermostChannelConfigSchema = buildChannelConfigSchema(MattermostAccountSchemaBase.extend({
-	accounts: z.record(z.string(), MattermostAccountSchema.optional()).optional(),
-	defaultAccount: z.string().optional()
-}).superRefine((value, ctx) => {
-	requireMattermostOpenAllowFrom({
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx
-	});
+}).strict(), {
+	optionalAccount: true,
+	refine: (value, ctx) => {
+		requireMattermostOpenAllowFrom({
+			policy: value.dmPolicy,
+			allowFrom: value.allowFrom,
+			ctx
+		});
+	}
 }), { uiHints: {
 	"": {
 		label: "Mattermost",
@@ -270,28 +272,13 @@ const MattermostChannelConfigSchema = buildChannelConfigSchema(MattermostAccount
 		help: "Merge streamed Mattermost block replies before final delivery."
 	}
 } });
-//#endregion
-//#region extensions/mattermost/src/doctor.ts
-function isMattermostMutableAllowEntry(raw) {
-	const text = raw.trim();
-	if (!text || text === "*") return false;
-	const lowered = normalizeLowercaseStringOrEmpty(text.replace(/^(mattermost|user):/i, "").replace(/^@/, "").trim());
-	if (/^[a-z0-9]{26}$/.test(lowered)) return false;
-	return true;
-}
 const mattermostDoctor = {
 	legacyConfigRules,
 	normalizeCompatibilityConfig,
 	collectMutableAllowlistWarnings: createDangerousNameMatchingMutableAllowlistWarningCollector({
 		channel: "mattermost",
-		detector: isMattermostMutableAllowEntry,
-		collectLists: (scope) => [{
-			pathLabel: `${scope.prefix}.allowFrom`,
-			list: scope.account.allowFrom
-		}, {
-			pathLabel: `${scope.prefix}.groupAllowFrom`,
-			list: scope.account.groupAllowFrom
-		}]
+		detector: buildMutableAllowEntryDetector({ stableIdPattern: /^(?:(?:mattermost|user):)?@?[a-z0-9]{26}$/i }),
+		collectLists: (scope) => collectStandardAllowlistLists(scope)
 	})
 };
 //#endregion
@@ -489,60 +476,50 @@ const mattermostSetupWizard = {
 			patch: {}
 		})
 	},
-	credentials: [{
+	credentials: [defineTokenCredential({
 		inputKey: "botToken",
+		configKey: "botToken",
 		providerHint: channel,
 		credentialLabel: t("wizard.mattermost.botToken"),
 		preferredEnvVar: "MATTERMOST_BOT_TOKEN",
 		envPrompt: t("wizard.mattermost.envPrompt"),
 		keepPrompt: t("wizard.mattermost.botTokenKeep"),
 		inputPrompt: t("wizard.mattermost.botTokenInput"),
-		inspect: ({ cfg, accountId }) => {
-			const resolvedAccount = resolveMattermostAccountWithSecrets(cfg, accountId);
-			return {
-				accountConfigured: isMattermostConfigured(resolvedAccount),
-				hasConfiguredValue: hasConfiguredSecretInput(resolvedAccount.config.botToken)
-			};
-		},
-		applySet: async ({ cfg, accountId, value }) => applyMattermostSetupConfigPatch({
+		resolveAccount: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId),
+		accountConfigured: isMattermostConfigured,
+		patchAccount: ({ cfg, accountId, patch }) => applyMattermostSetupConfigPatch({
 			cfg,
 			accountId,
-			patch: { botToken: value }
-		})
-	}],
-	textInputs: [{
+			patch
+		}),
+		set: {}
+	})],
+	textInputs: [baseUrlTextInput({
 		inputKey: "httpUrl",
+		configKey: "baseUrl",
 		message: t("wizard.mattermost.baseUrlPrompt"),
 		confirmCurrentValue: false,
-		currentValue: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId).baseUrl ?? process.env.MATTERMOST_URL?.trim(),
-		initialValue: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId).baseUrl ?? process.env.MATTERMOST_URL?.trim(),
+		resolveAccount: ({ cfg, accountId }) => resolveMattermostAccountWithSecrets(cfg, accountId),
+		currentValue: (account) => account.baseUrl ?? process.env.MATTERMOST_URL?.trim(),
+		includeInitialValue: true,
 		shouldPrompt: ({ cfg, accountId, credentialValues, currentValue }) => {
 			const resolvedAccount = resolveMattermostAccountWithSecrets(cfg, accountId);
 			const tokenConfigured = Boolean(resolvedAccount.botToken?.trim()) || hasConfiguredSecretInput(resolvedAccount.config.botToken);
 			return Boolean(credentialValues.botToken) || !tokenConfigured || !currentValue;
 		},
-		validate: ({ value }) => normalizeMattermostBaseUrl(value) ? void 0 : "Mattermost base URL must include a valid base URL.",
-		normalizeValue: ({ value }) => normalizeMattermostBaseUrl(value) ?? value.trim(),
-		applySet: async ({ cfg, accountId, value }) => applyMattermostSetupConfigPatch({
+		validate: (value) => normalizeMattermostBaseUrl(value) ? void 0 : "Mattermost base URL must include a valid base URL.",
+		normalize: (value) => normalizeMattermostBaseUrl(value) ?? value.trim(),
+		patchAccount: ({ cfg, accountId, patch }) => applyMattermostSetupConfigPatch({
 			cfg,
 			accountId,
-			patch: { baseUrl: value }
+			patch
 		})
-	}],
-	disable: (cfg) => ({
-		...cfg,
-		channels: {
-			...cfg.channels,
-			mattermost: {
-				...cfg.channels?.mattermost,
-				enabled: false
-			}
-		}
-	})
+	})],
+	disable: (cfg) => setSetupChannelEnabled(cfg, channel, false)
 };
 //#endregion
 //#region extensions/mattermost/src/channel.ts
-const loadMattermostChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-Cbs451W2.js"));
+const loadMattermostChannelRuntime = createLazyRuntimeModule(() => import("./channel.runtime-CKb2-z0p.js"));
 function buildMattermostPresentationButtons(presentation) {
 	return presentation.blocks.filter((block) => block.type === "buttons").map((block) => block.buttons.flatMap((button) => {
 		if (button.action) return [];
@@ -567,7 +544,7 @@ const MATTERMOST_PRESENTATION_CAPABILITIES = {
 function hasMattermostPresentationNavigation(presentation) {
 	return presentation.blocks.some((block) => block.type === "buttons" && block.buttons.some((button) => {
 		const action = resolveMessagePresentationButtonAction(button);
-		return action?.type === "url" || action?.type === "web-app";
+		return action?.type === "url" || action?.type === "web-app" && Boolean(action.url);
 	}));
 }
 function readMattermostPresentationButtons(payload) {
@@ -705,21 +682,26 @@ const mattermostMessageActions = {
 	supportsAction: ({ action }) => {
 		return action === "send" || action === "react";
 	},
-	handleAction: async ({ action, params, cfg, accountId, mediaAccess, mediaLocalRoots, mediaReadFile }) => {
+	handleAction: async ({ action, params, cfg, accountId, mediaAccess, mediaLocalRoots, mediaReadFile, conversationReadOrigin }) => {
 		if (action === "react") {
 			const resolvedAccountId = accountId ?? resolveDefaultMattermostAccountId(cfg);
 			const mattermostConfig = cfg.channels?.mattermost;
-			if (!(resolveMattermostAccount({
+			const account = resolveMattermostAccount({
 				cfg,
 				accountId: resolvedAccountId
-			}).config.actions?.reactions ?? mattermostConfig?.actions?.reactions ?? true)) throw new Error("Mattermost reactions are disabled in config");
+			});
+			if (!account.enabled) throw new Error(`Mattermost account "${resolvedAccountId}" is disabled`);
+			if (!(account.config.actions?.reactions ?? mattermostConfig?.actions?.reactions ?? true)) throw new Error("Mattermost reactions are disabled in config");
 			const { postId, emojiName, remove } = parseMattermostReactActionParams(params);
+			const authorizedTarget = normalizeOptionalString(params.to);
 			if (remove) {
 				const result = await (await loadMattermostChannelRuntime()).removeMattermostReaction({
 					cfg,
 					postId,
 					emojiName,
-					accountId: resolvedAccountId
+					accountId: resolvedAccountId,
+					authorizedTarget,
+					conversationReadOrigin
 				});
 				if (!result.ok) throw new Error(result.error);
 				return {
@@ -734,7 +716,9 @@ const mattermostMessageActions = {
 				cfg,
 				postId,
 				emojiName,
-				accountId: resolvedAccountId
+				accountId: resolvedAccountId,
+				authorizedTarget,
+				conversationReadOrigin
 			});
 			if (!result.ok) throw new Error(result.error);
 			return {
@@ -848,13 +832,12 @@ function collectMattermostAttachmentMedia(params) {
 		readMattermostStringParam(params, "fileUrl")
 	];
 	mediaUrlCandidates.push(...readMattermostStringArrayParam(params, "mediaUrls"));
-	let hasUnsupportedAttachmentPayload = typeof params.buffer === "string" || typeof params.base64 === "string";
+	let hasUnsupportedAttachmentPayload = Boolean(readMattermostStringParam(params, "buffer") ?? readMattermostStringParam(params, "base64"));
 	if (Array.isArray(params.attachments)) for (const attachment of params.attachments) {
 		if (!attachment || typeof attachment !== "object" || Array.isArray(attachment)) continue;
 		const record = attachment;
 		mediaUrlCandidates.push(readMattermostStringParam(record, "media"), readMattermostStringParam(record, "mediaUrl"), readMattermostStringParam(record, "path"), readMattermostStringParam(record, "filePath"), readMattermostStringParam(record, "fileUrl"), readMattermostStringParam(record, "url"));
-		hasUnsupportedAttachmentPayload ||= typeof record.buffer === "string";
-		hasUnsupportedAttachmentPayload ||= typeof record.base64 === "string";
+		hasUnsupportedAttachmentPayload ||= Boolean(readMattermostStringParam(record, "buffer") ?? readMattermostStringParam(record, "base64"));
 	}
 	return {
 		mediaUrls: collectNonBlankStrings(mediaUrlCandidates),
@@ -1013,6 +996,8 @@ const mattermostPlugin = createChatChannelPlugin({
 		}),
 		messaging: {
 			targetPrefixes: ["mattermost"],
+			directTargetStyle: "user-prefixed",
+			targetIdComparison: "case-sensitive",
 			defaultMarkdownTableMode: "off",
 			normalizeTarget: normalizeMattermostMessagingTarget,
 			resolveDeliveryTarget: ({ conversationId, parentConversationId }) => {
@@ -1140,4 +1125,4 @@ const mattermostPlugin = createChatChannelPlugin({
 	outbound: mattermostOutbound
 });
 //#endregion
-export { describeMattermostAccount as a, mattermostMeta as c, MattermostChannelConfigSchema as i, mattermostSetupWizard as n, isMattermostConfigured$1 as o, mattermostSetupAdapter as r, mattermostConfigAdapter as s, mattermostPlugin as t };
+export { MattermostChannelConfigSchema as a, mattermostConfigAdapter as c, normalizeMattermostMessagingTarget as i, mattermostMeta as l, mattermostSetupWizard as n, describeMattermostAccount as o, mattermostSetupAdapter as r, isMattermostConfigured$1 as s, mattermostPlugin as t };

package/dist/channel-plugin-runtime.js

@@ -1,2 +1,2 @@
-import { t as mattermostPlugin } from "./channel-plugin-runtime-BkzZgYxP.js";
+import { t as mattermostPlugin } from "./channel-plugin-runtime-BXmjNn6B.js";
 export { mattermostPlugin };

package/dist/{channel.runtime-Cbs451W2.js → channel.runtime-CKb2-z0p.js}

@@ -1,25 +1,28 @@
-import { C as resolveChannelMediaMaxBytes, E as warnMissingProviderGroupPolicyFallbackOnce, S as resolveAllowlistProviderRuntimeGroupPolicy, T as resolveDefaultGroupPolicy, _ as logInboundDrop, c as buildAgentMediaPayload, d as createChannelMessageReplyPipeline, f as createChannelPairingController, h as listSkillCommandsForAgents, i as normalizeMattermostAllowEntry, l as buildModelsProviderData, n as formatMattermostDirectMessageDropLog, o as resolveMattermostMonitorInboundAccess, s as DEFAULT_GROUP_HISTORY_LIMIT, t as authorizeMattermostCommandInvocation, u as createChannelHistoryWindow, v as logTypingFailure, x as registerPluginHttpRoute, y as parseTcpPort } from "./monitor-auth-BiDuyvOc.js";
-import { _ as readMattermostError, a as MattermostPostSchema, b as updateMattermostPost, c as createMattermostPost, f as fetchMattermostMe, g as normalizeMattermostBaseUrl, h as fetchMattermostUserTeams, i as resolveMattermostReplyToMode, l as deleteMattermostPost, o as createMattermostClient, p as fetchMattermostUser, r as resolveMattermostAccount, t as listMattermostAccountIds, u as fetchMattermostChannel, y as sendMattermostTyping } from "./accounts-B2NRPlqr.js";
 import { n as getOptionalMattermostRuntime, t as getMattermostRuntime } from "./runtime-CNB4YGqJ.js";
-import { C as registerSlashCommands, S as isSlashCommandsEnabled, T as resolveSlashCommandConfig, _ as renderMattermostModelsPickerView, a as sendMessageMattermost, b as DEFAULT_COMMAND_SPECS, c as computeInteractionCallbackUrl, d as setInteractionCallbackUrl, f as setInteractionSecret, g as parseMattermostModelPickerContext, h as buildMattermostAllowedModelRefs, l as createMattermostInteractionHandler, m as deliverMattermostReplyPayload, n as deactivateSlashCommands, o as resolveMattermostOpaqueTarget, p as createMattermostReplyDeliveryBarrier, r as getSlashCommandState, s as buildButtonProps, t as activateSlashCommands, u as resolveInteractionCallbackPath, v as renderMattermostProviderPickerView, w as resolveCallbackUrl, x as cleanupSlashCommands, y as resolveMattermostModelPickerCurrentModel } from "./slash-state-Cr58Xd12.js";
+import { a as deleteMattermostPost, c as fetchMattermostMe, d as fetchMattermostUserTeams, f as normalizeMattermostBaseUrl, g as updateMattermostPost, h as sendMattermostTyping, i as createMattermostPost, l as fetchMattermostUser, n as createMattermostClient, o as fetchMattermostChannel, p as readMattermostError, t as MattermostPostSchema } from "./client-BzLj4dyf.js";
+import { C as resolveChannelMediaMaxBytes, E as warnMissingProviderGroupPolicyFallbackOnce, S as resolveAllowlistProviderRuntimeGroupPolicy, T as resolveDefaultGroupPolicy, _ as logInboundDrop, c as buildAgentMediaPayload, d as createChannelMessageReplyPipeline, f as createChannelPairingController, h as listSkillCommandsForAgents, i as normalizeMattermostAllowEntry, l as buildModelsProviderData, n as formatMattermostDirectMessageDropLog, o as resolveMattermostMonitorInboundAccess, s as DEFAULT_GROUP_HISTORY_LIMIT, t as authorizeMattermostCommandInvocation, u as createChannelHistoryWindow, v as logTypingFailure, x as registerPluginHttpRoute, y as parseTcpPort } from "./monitor-auth-dEHa1_On.js";
+import { a as resolveInteractionCallbackPath, c as setInteractionSecret, i as createMattermostInteractionHandler, n as buildButtonProps, r as computeInteractionCallbackUrl, s as setInteractionCallbackUrl } from "./interactions-DO7J-ND1.js";
+import { i as resolveMattermostReplyToMode, r as resolveMattermostAccount, t as listMattermostAccountIds } from "./accounts-C4Azn6rA.js";
+import { i as normalizeMattermostMessagingTarget } from "./channel-plugin-runtime-BXmjNn6B.js";
+import { _ as registerSlashCommands, a as sendMessageMattermost, c as deliverMattermostReplyPayload, d as renderMattermostModelsPickerView, f as renderMattermostProviderPickerView, g as isSlashCommandsEnabled, h as cleanupSlashCommands, l as buildMattermostAllowedModelRefs, m as DEFAULT_COMMAND_SPECS, n as deactivateSlashCommands, o as resolveMattermostOpaqueTarget, p as resolveMattermostModelPickerCurrentModel, r as getSlashCommandState, s as createMattermostReplyDeliveryBarrier, t as activateSlashCommands, u as parseMattermostModelPickerContext, v as resolveCallbackUrl, y as resolveSlashCommandConfig } from "./slash-state-C9bpBN40.js";
+import { randomUUID } from "node:crypto";
+import { resolvePinnedMainDmOwnerFromAllowlist } from "openclaw/plugin-sdk/security-runtime";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, normalizeStringEntries, normalizeTrimmedStringList, uniqueStrings } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { safeParseJsonWithSchema, safeParseWithSchema } from "openclaw/plugin-sdk/extension-shared";
+import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
+import { fetchWithSsrFGuard, isPrivateNetworkOptInEnabled, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
+import { z } from "zod";
 import { formatInboundFromLabel, formatInboundMediaUnavailableText } from "openclaw/plugin-sdk/channel-inbound";
 import { buildChannelProgressDraftLineForEntry, createChannelProgressDraftCompositor, createFinalizableDraftLifecycle, defineFinalizableLivePreviewAdapter, deliverWithFinalizableLivePreviewAdapter, resolveChannelStreamingPreviewToolProgress } from "openclaw/plugin-sdk/channel-outbound";
 import { rawDataToString } from "openclaw/plugin-sdk/webhook-ingress";
-import { asDateTimestampMs, resolveExpiresAtMsFromDurationMs, resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
-import { safeParseJsonWithSchema, safeParseWithSchema } from "openclaw/plugin-sdk/extension-shared";
 import { buildTtsSupplementMediaPayload, countOutboundMedia, getReplyPayloadTtsSupplement, isReasoningReplyPayload } from "openclaw/plugin-sdk/reply-payload";
-import { fetchWithSsrFGuard, isPrivateNetworkOptInEnabled, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
-import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
-import { z } from "zod";
 import { resolveInboundLastRouteSessionKey, resolveThreadSessionKeys } from "openclaw/plugin-sdk/routing";
-import { resolvePinnedMainDmOwnerFromAllowlist } from "openclaw/plugin-sdk/security-runtime";
 import { sliceUtf16Safe, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { randomUUID } from "node:crypto";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { isLoopbackHost } from "openclaw/plugin-sdk/gateway-runtime";
 import { chunkMarkdownTextWithMode } from "openclaw/plugin-sdk/reply-chunking";
-import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
+import { createChannelReplayGuard } from "openclaw/plugin-sdk/persistent-dedupe";
 import { captureWsEvent, createDebugProxyWebSocketAgent, resolveDebugProxySettings } from "openclaw/plugin-sdk/proxy-capture";
 import WebSocket from "ws";
 import { createPersistentDedupeCache } from "openclaw/plugin-sdk/dedupe-runtime";
@@ -620,34 +623,28 @@ function stripOncharPrefix(text, prefixes) {
 }
 //#endregion
 //#region extensions/mattermost/src/mattermost/monitor-replay.ts
-const recentInboundMessages = createClaimableDedupe({
-	ttlMs: 5 * 6e4,
-	memoryMaxSize: 2e3
-});
+const RECENT_MATTERMOST_MESSAGE_TTL_MS = 5 * 6e4;
+const RECENT_MATTERMOST_MESSAGE_MAX = 2e3;
 function buildMattermostInboundReplayKeys(params) {
-	return uniqueStrings(params.messageIds.map((id) => `${params.accountId}:${id.trim()}`)).filter((key) => !key.endsWith(":"));
+	return params.messageIds.map((id) => id.trim() ? `${params.accountId}:${id.trim()}` : "");
+}
+function createMattermostInboundReplayGuard() {
+	return createChannelReplayGuard({
+		dedupe: {
+			ttlMs: RECENT_MATTERMOST_MESSAGE_TTL_MS,
+			memoryMaxSize: RECENT_MATTERMOST_MESSAGE_MAX
+		},
+		buildReplayKey: buildMattermostInboundReplayKeys
+	});
 }
+const recentInboundMessages = createMattermostInboundReplayGuard();
 async function processMattermostReplayGuardedPost(params) {
 	const replayGuard = params.replayGuard ?? recentInboundMessages;
-	const replayKeys = buildMattermostInboundReplayKeys({
+	const event = {
 		accountId: params.accountId,
 		messageIds: params.messageIds
-	});
-	if (replayKeys.length === 0) {
-		await params.handlePost();
-		return "processed";
-	}
-	const claimedKeys = [];
-	for (const replayKey of replayKeys) if ((await replayGuard.claim(replayKey)).kind === "claimed") claimedKeys.push(replayKey);
-	if (claimedKeys.length === 0) return "duplicate";
-	try {
-		await params.handlePost();
-		await Promise.all(claimedKeys.map((replayKey) => replayGuard.commit(replayKey)));
-		return "processed";
-	} catch (error) {
-		await Promise.all(claimedKeys.map((replayKey) => replayGuard.commit(replayKey)));
-		throw error;
-	}
+	};
+	return (await replayGuard.processGuarded(event, params.handlePost, { onError: "commit" })).kind === "processed" ? "processed" : "duplicate";
 }
 //#endregion
 //#region extensions/mattermost/src/mattermost/monitor-resources.ts
@@ -887,6 +884,7 @@ async function registerMattermostMonitorSlashCommands(params) {
 //#endregion
 //#region extensions/mattermost/src/mattermost/monitor-websocket.ts
 const MATTERMOST_WEBSOCKET_MAX_PAYLOAD_BYTES = 16 * 1024 * 1024;
+const MATTERMOST_WEBSOCKET_HANDSHAKE_TIMEOUT_MS = 3e4;
 const MattermostEventPayloadSchema = z.object({
 	event: z.string().optional(),
 	data: z.object({
@@ -920,11 +918,11 @@ var WebSocketClosedBeforeOpenError = class extends Error {
 		this.name = "WebSocketClosedBeforeOpenError";
 	}
 };
-const defaultMattermostWebSocketFactory = (url) => {
+const defaultMattermostWebSocketFactory = (url, options) => {
 	const agent = createDebugProxyWebSocketAgent(resolveDebugProxySettings());
 	return new WebSocket(url, {
-		...agent ? { agent } : {},
-		maxPayload: MATTERMOST_WEBSOCKET_MAX_PAYLOAD_BYTES
+		...options,
+		...agent ? { agent } : {}
 	});
 };
 function parsePostedPayload(payload) {
@@ -945,7 +943,10 @@ function createMattermostConnectOnce(opts) {
 	const pongTimeoutMs = opts.pongTimeoutMs ?? 1e4;
 	return async () => {
 		const flowId = randomUUID();
-		const ws = webSocketFactory(opts.wsUrl);
+		const ws = webSocketFactory(opts.wsUrl, {
+			maxPayload: MATTERMOST_WEBSOCKET_MAX_PAYLOAD_BYTES,
+			handshakeTimeout: MATTERMOST_WEBSOCKET_HANDSHAKE_TIMEOUT_MS
+		});
 		const onAbort = () => ws.terminate();
 		opts.abortSignal?.addEventListener("abort", onAbort, { once: true });
 		const getBotUpdateAt = opts.getBotUpdateAt;
@@ -2818,6 +2819,42 @@ async function removeMattermostReaction(params) {
 		mutation: deleteReaction
 	});
 }
+function parseAuthorizedReactionTarget(rawTarget) {
+	const normalized = rawTarget ? normalizeMattermostMessagingTarget(rawTarget) : void 0;
+	if (!normalized) return null;
+	if (normalized.startsWith("channel:")) {
+		const id = normalized.slice(8).trim();
+		return id ? {
+			kind: "channel",
+			id
+		} : null;
+	}
+	if (normalized.startsWith("user:")) {
+		const id = normalized.slice(5).trim();
+		return id ? {
+			kind: "user",
+			id
+		} : null;
+	}
+	return null;
+}
+async function authorizeMattermostReactionResource(params) {
+	const target = parseAuthorizedReactionTarget(params.authorizedTarget);
+	if (!target) throw new Error("Mattermost delegated reactions require a canonical authorized conversation target.");
+	const postChannelId = (await params.client.request(`/posts/${encodeURIComponent(params.postId)}`)).channel_id?.trim();
+	if (!postChannelId) throw new Error("Mattermost reaction post is missing its conversation binding.");
+	if (target.kind === "channel") {
+		if (postChannelId !== target.id) throw new Error("Mattermost reaction post belongs to a different conversation.");
+		return;
+	}
+	const botUserId = await resolveBotUserId(params.client, params.cacheKey);
+	if (!botUserId) throw new Error("Mattermost reactions failed: could not resolve bot user id.");
+	const channel = await fetchMattermostChannel(params.client, postChannelId);
+	const participants = channel.name?.split("__").map((entry) => entry.trim()).filter(Boolean).toSorted() ?? [];
+	const authorizedParticipants = [botUserId, target.id].toSorted();
+	if (channel.type !== "D" || participants.length !== 2 || participants[0] !== authorizedParticipants[0] || participants[1] !== authorizedParticipants[1]) throw new Error("Mattermost reaction post belongs to a different direct conversation.");
+	return botUserId;
+}
 async function runMattermostReaction(params, options) {
 	const resolved = resolveMattermostAccount({
 		cfg: params.cfg,
@@ -2835,12 +2872,18 @@ async function runMattermostReaction(params, options) {
 		fetchImpl: params.fetchImpl,
 		allowPrivateNetwork: isPrivateNetworkOptInEnabled(resolved.config)
 	});
-	const userId = await resolveBotUserId(client, `${baseUrl}:${botToken}`);
-	if (!userId) return {
-		ok: false,
-		error: "Mattermost reactions failed: could not resolve bot user id."
-	};
+	const cacheKey = `${baseUrl}:${botToken}`;
 	try {
+		const userId = (params.conversationReadOrigin === "direct-operator" ? void 0 : await authorizeMattermostReactionResource({
+			client,
+			cacheKey,
+			postId: params.postId,
+			authorizedTarget: params.authorizedTarget
+		})) ?? await resolveBotUserId(client, cacheKey);
+		if (!userId) return {
+			ok: false,
+			error: "Mattermost reactions failed: could not resolve bot user id."
+		};
 		await options.mutation(client, {
 			userId,
 			postId: params.postId,