@openclaw/mattermost 2026.7.2-beta.1 → 2026.7.2-beta.2

package/dist/{accounts-B2NRPlqr.js → client-BzLj4dyf.js}

@@ -1,15 +1,10 @@
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { resolveChannelPreviewStreamMode, resolveChannelStreamingBlockCoalesce, resolveChannelStreamingBlockEnabled, resolveChannelStreamingChunkMode } from "openclaw/plugin-sdk/channel-outbound";
-import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { buildTimeoutAbortSignal } from "openclaw/plugin-sdk/extension-shared";
-import { fetchWithSsrFGuard, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
-import { createAccountListHelpers, hasConfiguredAccountValue } from "openclaw/plugin-sdk/account-helpers";
-import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
-import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { fetchWithSsrFGuard, ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
 import { z } from "zod";
 //#region extensions/mattermost/src/mattermost/client.ts
 const MATTERMOST_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
@@ -388,79 +383,4 @@ async function uploadMattermostFile(client, params) {
 	return info;
 }
 //#endregion
-//#region extensions/mattermost/src/mattermost/accounts.ts
-const mattermostAccountHelpers = createAccountListHelpers("mattermost", { hasImplicitDefaultAccount: (cfg) => {
-	const mattermost = cfg.channels?.mattermost;
-	return Boolean(mattermost?.baseUrl?.trim() && (hasConfiguredAccountValue(mattermost.botToken) || process.env.MATTERMOST_BOT_TOKEN?.trim()));
-} });
-function listMattermostAccountIds(cfg) {
-	return mattermostAccountHelpers.listAccountIds(cfg);
-}
-function resolveDefaultMattermostAccountId(cfg) {
-	return mattermostAccountHelpers.resolveDefaultAccountId(cfg);
-}
-function mergeMattermostAccountConfig(cfg, accountId) {
-	return resolveMergedAccountConfig({
-		channelConfig: cfg.channels?.mattermost,
-		accounts: cfg.channels?.mattermost?.accounts,
-		accountId,
-		omitKeys: ["defaultAccount"],
-		nestedObjectKeys: ["commands"]
-	});
-}
-function resolveMattermostRequireMention(config) {
-	if (config.chatmode === "oncall") return true;
-	if (config.chatmode === "onmessage") return false;
-	if (config.chatmode === "onchar") return true;
-	return config.requireMention;
-}
-function resolveMattermostAccount(params) {
-	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultMattermostAccountId(params.cfg));
-	const baseEnabled = params.cfg.channels?.mattermost?.enabled !== false;
-	const merged = mergeMattermostAccountConfig(params.cfg, accountId);
-	const accountEnabled = merged.enabled !== false;
-	const enabled = baseEnabled && accountEnabled;
-	const allowEnv = accountId === DEFAULT_ACCOUNT_ID;
-	const envToken = allowEnv ? process.env.MATTERMOST_BOT_TOKEN?.trim() : void 0;
-	const envUrl = allowEnv ? process.env.MATTERMOST_URL?.trim() : void 0;
-	const configToken = params.allowUnresolvedSecretRef ? normalizeSecretInputString(merged.botToken) : normalizeResolvedSecretInputString({
-		value: merged.botToken,
-		path: `channels.mattermost.accounts.${accountId}.botToken`
-	});
-	const configUrl = merged.baseUrl?.trim();
-	const botToken = configToken || envToken;
-	const baseUrl = normalizeMattermostBaseUrl(configUrl || envUrl);
-	const requireMention = resolveMattermostRequireMention(merged);
-	const botTokenSource = configToken ? "config" : envToken ? "env" : "none";
-	const baseUrlSource = configUrl ? "config" : envUrl ? "env" : "none";
-	return {
-		accountId,
-		enabled,
-		name: normalizeOptionalString(merged.name),
-		botToken,
-		baseUrl,
-		botTokenSource,
-		baseUrlSource,
-		config: merged,
-		chatmode: merged.chatmode,
-		oncharPrefixes: merged.oncharPrefixes,
-		requireMention,
-		textChunkLimit: merged.textChunkLimit,
-		chunkMode: resolveChannelStreamingChunkMode(merged),
-		streamingMode: resolveChannelPreviewStreamMode(merged, "partial"),
-		blockStreaming: resolveChannelStreamingBlockEnabled(merged),
-		blockStreamingCoalesce: resolveChannelStreamingBlockCoalesce(merged)
-	};
-}
-/**
-* Resolve the effective replyToMode for a given chat type.
-* Direct messages stay flat unless explicitly opted into a per-chat-type mode.
-*/
-function resolveMattermostReplyToMode(account, kind) {
-	const scopedMode = account.config.replyToModeByChatType?.[kind];
-	if (scopedMode !== void 0) return scopedMode;
-	if (kind === "direct") return "off";
-	return account.config.replyToMode ?? "off";
-}
-//#endregion
-export { hasConfiguredSecretInput as C, buildSecretInputSchema as S, readMattermostError as _, MattermostPostSchema as a, updateMattermostPost as b, createMattermostPost as c, fetchMattermostChannelByName as d, fetchMattermostMe as f, normalizeMattermostBaseUrl as g, fetchMattermostUserTeams as h, resolveMattermostReplyToMode as i, deleteMattermostPost as l, fetchMattermostUserByUsername as m, resolveDefaultMattermostAccountId as n, createMattermostClient as o, fetchMattermostUser as p, resolveMattermostAccount as r, createMattermostDirectChannelWithRetry as s, listMattermostAccountIds as t, fetchMattermostChannel as u, resolveMattermostReplyDeliveryBarrierTimeoutMs as v, uploadMattermostFile as x, sendMattermostTyping as y };
+export { uploadMattermostFile as _, deleteMattermostPost as a, fetchMattermostMe as c, fetchMattermostUserTeams as d, normalizeMattermostBaseUrl as f, updateMattermostPost as g, sendMattermostTyping as h, createMattermostPost as i, fetchMattermostUser as l, resolveMattermostReplyDeliveryBarrierTimeoutMs as m, createMattermostClient as n, fetchMattermostChannel as o, readMattermostError as p, createMattermostDirectChannelWithRetry as r, fetchMattermostChannelByName as s, MattermostPostSchema as t, fetchMattermostUserByUsername as u };

package/dist/interactions-DO7J-ND1.js

@@ -0,0 +1,375 @@
+import { t as getMattermostRuntime } from "./runtime-CNB4YGqJ.js";
+import { g as updateMattermostPost } from "./client-BzLj4dyf.js";
+import { b as readRequestBodyWithLimit, m as isTrustedProxyAddress, w as resolveClientIp } from "./monitor-auth-dEHa1_On.js";
+import { createHmac } from "node:crypto";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { normalizeOptionalString, normalizeStringifiedOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/mattermost/src/mattermost/interactions.ts
+const INTERACTION_MAX_BODY_BYTES = 64 * 1024;
+const INTERACTION_BODY_TIMEOUT_MS = 1e4;
+const SIGNED_CHANNEL_ID_CONTEXT_KEY = "__openclaw_channel_id";
+const callbackUrls = /* @__PURE__ */ new Map();
+function setInteractionCallbackUrl(accountId, url) {
+	callbackUrls.set(accountId, url);
+}
+function resolveInteractionCallbackPath(accountId) {
+	return `/mattermost/interactions/${accountId}`;
+}
+function isWildcardBindHost(rawHost) {
+	const trimmed = rawHost.trim();
+	if (!trimmed) return false;
+	const host = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+	return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::0";
+}
+function normalizeCallbackBaseUrl(baseUrl) {
+	return baseUrl.trim().replace(/\/+$/, "");
+}
+function headerValue(value) {
+	if (Array.isArray(value)) return normalizeOptionalString(value[0]);
+	return normalizeOptionalString(value);
+}
+function isAllowedInteractionSource(params) {
+	const { allowedSourceIps } = params;
+	if (!allowedSourceIps?.length) return true;
+	return isTrustedProxyAddress(resolveClientIp({
+		remoteAddr: params.req.socket?.remoteAddress,
+		forwardedFor: headerValue(params.req.headers["x-forwarded-for"]),
+		realIp: headerValue(params.req.headers["x-real-ip"]),
+		trustedProxies: params.trustedProxies,
+		allowRealIpFallback: params.allowRealIpFallback
+	}), allowedSourceIps);
+}
+/**
+* Resolve the interaction callback URL for an account.
+* Falls back to computing it from interactions.callbackBaseUrl or gateway host config.
+*/
+function computeInteractionCallbackUrl(accountId, cfg) {
+	const path = resolveInteractionCallbackPath(accountId);
+	const callbackBaseUrl = normalizeOptionalString(cfg?.interactions?.callbackBaseUrl) ?? normalizeOptionalString(cfg?.channels?.mattermost?.interactions?.callbackBaseUrl);
+	if (callbackBaseUrl) return `${normalizeCallbackBaseUrl(callbackBaseUrl)}${path}`;
+	const port = typeof cfg?.gateway?.port === "number" ? cfg.gateway.port : 18789;
+	let host = cfg?.gateway?.customBindHost && !isWildcardBindHost(cfg.gateway.customBindHost) ? cfg.gateway.customBindHost.trim() : "localhost";
+	if (host.includes(":") && !(host.startsWith("[") && host.endsWith("]"))) host = `[${host}]`;
+	return `http://${host}:${port}${path}`;
+}
+/**
+* Resolve the interaction callback URL for an account.
+* Prefers the in-memory registered URL (set by the gateway monitor) so callers outside the
+* monitor lifecycle can reuse the runtime-validated callback destination.
+*/
+function resolveInteractionCallbackUrl(accountId, cfg) {
+	const cached = callbackUrls.get(accountId);
+	if (cached) return cached;
+	return computeInteractionCallbackUrl(accountId, cfg);
+}
+const interactionSecrets = /* @__PURE__ */ new Map();
+let defaultInteractionSecret;
+function deriveInteractionSecret(botToken) {
+	return createHmac("sha256", "openclaw-mattermost-interactions").update(botToken).digest("hex");
+}
+function setInteractionSecret(accountIdOrBotToken, botToken) {
+	if (typeof botToken === "string") {
+		interactionSecrets.set(accountIdOrBotToken, deriveInteractionSecret(botToken));
+		return;
+	}
+	defaultInteractionSecret = deriveInteractionSecret(accountIdOrBotToken);
+}
+function getInteractionSecret(accountId) {
+	const scoped = accountId ? interactionSecrets.get(accountId) : void 0;
+	if (scoped) return scoped;
+	if (defaultInteractionSecret) return defaultInteractionSecret;
+	if (interactionSecrets.size === 1) {
+		const first = interactionSecrets.values().next().value;
+		if (typeof first === "string") return first;
+	}
+	throw new Error("Interaction secret not initialized — call setInteractionSecret(accountId, botToken) first");
+}
+function canonicalizeInteractionContext(value) {
+	if (Array.isArray(value)) return value.map((item) => canonicalizeInteractionContext(item));
+	if (value && typeof value === "object") {
+		const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, canonicalizeInteractionContext(entryValue)]);
+		return Object.fromEntries(entries);
+	}
+	return value;
+}
+function generateInteractionToken(context, accountId) {
+	const secret = getInteractionSecret(accountId);
+	const payload = JSON.stringify(canonicalizeInteractionContext(context));
+	return createHmac("sha256", secret).update(payload).digest("hex");
+}
+function verifyInteractionToken(context, token, accountId) {
+	return safeEqualSecret(generateInteractionToken(context, accountId), token);
+}
+/**
+* Build Mattermost `props.attachments` with interactive buttons.
+*
+* Each button includes an HMAC token in its integration context so the
+* callback handler can verify the request originated from a legitimate
+* button click (Mattermost's recommended security pattern).
+*/
+/**
+* Sanitize a button ID so Mattermost's action router can match it.
+* Mattermost uses the action ID in the URL path `/api/v4/posts/{id}/actions/{actionId}`
+* and IDs containing hyphens or underscores break the server-side routing.
+* See: https://github.com/mattermost/mattermost/issues/25747
+*/
+function sanitizeActionId(id) {
+	return id.replace(/[-_]/g, "");
+}
+function buildButtonAttachments(params) {
+	const actions = params.buttons.map((btn) => {
+		const safeId = sanitizeActionId(btn.id);
+		const context = {
+			action_id: safeId,
+			...btn.context
+		};
+		const token = generateInteractionToken(context, params.accountId);
+		return {
+			id: safeId,
+			type: "button",
+			name: btn.name,
+			style: btn.style,
+			integration: {
+				url: params.callbackUrl,
+				context: {
+					...context,
+					_token: token
+				}
+			}
+		};
+	});
+	return [{
+		text: params.text ?? "",
+		actions
+	}];
+}
+function buildButtonProps(params) {
+	const buttons = params.buttons.flatMap((item) => Array.isArray(item) ? item : [item]).map((btn) => ({
+		id: normalizeStringifiedOptionalString(btn.id ?? btn.callback_data) ?? "",
+		name: normalizeStringifiedOptionalString(btn.text ?? btn.name ?? btn.label) ?? "",
+		style: btn.style ?? "default",
+		context: typeof btn.context === "object" && btn.context !== null ? {
+			...btn.context,
+			[SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId
+		} : { [SIGNED_CHANNEL_ID_CONTEXT_KEY]: params.channelId }
+	})).filter((btn) => btn.id && btn.name);
+	if (buttons.length === 0) return;
+	return { attachments: buildButtonAttachments({
+		callbackUrl: params.callbackUrl,
+		accountId: params.accountId,
+		buttons,
+		text: params.text
+	}) };
+}
+function readInteractionBody(req) {
+	return readRequestBodyWithLimit(req, {
+		maxBytes: INTERACTION_MAX_BODY_BYTES,
+		timeoutMs: INTERACTION_BODY_TIMEOUT_MS
+	});
+}
+function createMattermostInteractionHandler(params) {
+	const { client, accountId, log } = params;
+	const core = getMattermostRuntime();
+	function parseInteractionPayload(raw) {
+		try {
+			return JSON.parse(raw);
+		} catch {
+			throw new Error("Mattermost interaction body was malformed JSON");
+		}
+	}
+	return async (req, res) => {
+		if (req.method !== "POST") {
+			res.statusCode = 405;
+			res.setHeader("Allow", "POST");
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Method Not Allowed" }));
+			return;
+		}
+		if (!isAllowedInteractionSource({
+			req,
+			allowedSourceIps: params.allowedSourceIps,
+			trustedProxies: params.trustedProxies,
+			allowRealIpFallback: params.allowRealIpFallback
+		})) {
+			log?.(`mattermost interaction: rejected callback source remote=${req.socket?.remoteAddress ?? "?"}`);
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Forbidden origin" }));
+			return;
+		}
+		let payload;
+		try {
+			payload = parseInteractionPayload(await readInteractionBody(req));
+		} catch (err) {
+			log?.(`mattermost interaction: failed to parse body: ${String(err)}`);
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Invalid request body" }));
+			return;
+		}
+		const context = payload.context;
+		if (!context) {
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing context" }));
+			return;
+		}
+		const token = context["_token"];
+		if (typeof token !== "string") {
+			log?.("mattermost interaction: missing _token in context");
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing token" }));
+			return;
+		}
+		const { _token, ...contextWithoutToken } = context;
+		if (!verifyInteractionToken(contextWithoutToken, token, accountId)) {
+			log?.("mattermost interaction: invalid _token");
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Invalid token" }));
+			return;
+		}
+		const actionId = context.action_id;
+		if (typeof actionId !== "string") {
+			res.statusCode = 400;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Missing action_id in context" }));
+			return;
+		}
+		const signedChannelId = typeof contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY] === "string" ? contextWithoutToken[SIGNED_CHANNEL_ID_CONTEXT_KEY].trim() : "";
+		if (signedChannelId && signedChannelId !== payload.channel_id) {
+			log?.(`mattermost interaction: signed channel mismatch payload=${payload.channel_id} signed=${signedChannelId}`);
+			res.statusCode = 403;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Channel mismatch" }));
+			return;
+		}
+		const userName = payload.user_name ?? payload.user_id;
+		let originalMessage;
+		let originalPost;
+		let clickedButtonName = null;
+		try {
+			originalPost = await client.request(`/posts/${payload.post_id}`);
+			const postChannelId = originalPost.channel_id?.trim();
+			if (!postChannelId || postChannelId !== payload.channel_id) {
+				log?.(`mattermost interaction: post channel mismatch payload=${payload.channel_id} post=${postChannelId ?? "<missing>"}`);
+				res.statusCode = 403;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Post/channel mismatch" }));
+				return;
+			}
+			originalMessage = originalPost.message ?? "";
+			const postAttachments = Array.isArray(originalPost?.props?.attachments) ? originalPost.props.attachments : [];
+			for (const att of postAttachments) {
+				const match = att.actions?.find((a) => a.id === actionId);
+				if (match?.name) {
+					clickedButtonName = match.name;
+					break;
+				}
+			}
+			if (clickedButtonName === null) {
+				log?.(`mattermost interaction: action ${actionId} not found in post ${payload.post_id}`);
+				res.statusCode = 403;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify({ error: "Unknown action" }));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: failed to validate post ${payload.post_id}: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Failed to validate interaction" }));
+			return;
+		}
+		if (!originalPost) {
+			log?.(`mattermost interaction: missing fetched post ${payload.post_id}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Failed to load interaction post" }));
+			return;
+		}
+		log?.(`mattermost interaction: action=${actionId} user=${payload.user_name ?? payload.user_id} post=${payload.post_id} channel=${payload.channel_id}`);
+		if (params.authorizeButtonClick) try {
+			const authorization = await params.authorizeButtonClick({
+				payload,
+				post: originalPost
+			});
+			if (!authorization.ok) {
+				res.statusCode = authorization.statusCode ?? 200;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify(authorization.response ?? { ephemeral_text: "You are not allowed to use this action here." }));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: authorization failed: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Interaction authorization failed" }));
+			return;
+		}
+		if (params.handleInteraction) try {
+			const response = await params.handleInteraction({
+				payload,
+				userName,
+				actionId,
+				actionName: clickedButtonName,
+				originalMessage,
+				context: contextWithoutToken,
+				post: originalPost
+			});
+			if (response !== null) {
+				res.statusCode = 200;
+				res.setHeader("Content-Type", "application/json");
+				res.end(JSON.stringify(response));
+				return;
+			}
+		} catch (err) {
+			log?.(`mattermost interaction: custom handler failed: ${String(err)}`);
+			res.statusCode = 500;
+			res.setHeader("Content-Type", "application/json");
+			res.end(JSON.stringify({ error: "Interaction handler failed" }));
+			return;
+		}
+		try {
+			const eventLabel = `Mattermost button click: action="${actionId}" by ${payload.user_name ?? payload.user_id} in channel ${payload.channel_id}`;
+			const sessionKey = params.resolveSessionKey ? await params.resolveSessionKey({
+				channelId: payload.channel_id,
+				userId: payload.user_id,
+				post: originalPost
+			}) : `agent:main:mattermost:${accountId}:${payload.channel_id}`;
+			core.system.enqueueSystemEvent(eventLabel, {
+				sessionKey,
+				contextKey: `mattermost:interaction:${payload.post_id}:${actionId}`
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: system event dispatch failed: ${String(err)}`);
+		}
+		try {
+			await updateMattermostPost(client, payload.post_id, {
+				message: originalMessage,
+				props: { attachments: [{ text: `✓ **${clickedButtonName}** selected by @${userName}` }] }
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: failed to update post ${payload.post_id}: ${String(err)}`);
+		}
+		res.statusCode = 200;
+		res.setHeader("Content-Type", "application/json");
+		res.end("{}");
+		if (params.dispatchButtonClick) try {
+			await params.dispatchButtonClick({
+				channelId: payload.channel_id,
+				userId: payload.user_id,
+				userName,
+				actionId,
+				actionName: clickedButtonName,
+				postId: payload.post_id,
+				post: originalPost
+			});
+		} catch (err) {
+			log?.(`mattermost interaction: dispatchButtonClick failed: ${String(err)}`);
+		}
+	};
+}
+//#endregion
+export { resolveInteractionCallbackPath as a, setInteractionSecret as c, createMattermostInteractionHandler as i, buildButtonProps as n, resolveInteractionCallbackUrl as o, computeInteractionCallbackUrl as r, setInteractionCallbackUrl as s, buildButtonAttachments as t };

package/dist/policy-api.js

@@ -1,2 +1,2 @@
-import { r as isMattermostSenderAllowed } from "./monitor-auth-BiDuyvOc.js";
+import { r as isMattermostSenderAllowed } from "./monitor-auth-dEHa1_On.js";
 export { isMattermostSenderAllowed };

package/dist/slash-route-api.js

@@ -1,2 +1,2 @@
-import { i as registerSlashCommandRoute } from "./slash-state-Cr58Xd12.js";
+import { i as registerSlashCommandRoute } from "./slash-state-C9bpBN40.js";
 export { registerSlashCommandRoute };