@openclaw/nextcloud-talk 2026.3.12 → 2026.5.1-beta.2

package/src/types.ts

@@ -4,9 +4,7 @@ import type {
   DmPolicy,
   GroupPolicy,
   SecretInput,
-} from "openclaw/plugin-sdk/nextcloud-talk";
-
-export type { DmPolicy, GroupPolicy };
+} from "../runtime-api.js";
 
 export type NextcloudTalkRoomConfig = {
   requireMention?: boolean;
@@ -22,6 +20,11 @@ export type NextcloudTalkRoomConfig = {
   systemPrompt?: string;
 };
 
+type NextcloudTalkNetworkConfig = {
+  /** Dangerous opt-in for self-hosted Nextcloud Talk on trusted private/internal hosts. */
+  dangerouslyAllowPrivateNetwork?: boolean;
+};
+
 export type NextcloudTalkAccountConfig = {
   /** Optional display name for this account (used in CLI/UI lists). */
   name?: string;
@@ -75,9 +78,11 @@ export type NextcloudTalkAccountConfig = {
   responsePrefix?: string;
   /** Media upload max size in MB. */
   mediaMaxMb?: number;
+  /** Network policy overrides for self-hosted Nextcloud Talk on trusted private/internal hosts. */
+  network?: NextcloudTalkNetworkConfig;
 };
 
-export type NextcloudTalkConfig = {
+type NextcloudTalkConfig = {
   /** Optional per-account Nextcloud Talk configuration (multi-account). */
   accounts?: Record<string, NextcloudTalkAccountConfig>;
   /** Optional default account id when multiple accounts are configured. */
@@ -97,7 +102,7 @@ export type CoreConfig = {
  */
 
 /** Actor in the activity (the message sender). */
-export type NextcloudTalkActor = {
+type NextcloudTalkActor = {
   type: "Person";
   /** User ID in Nextcloud. */
   id: string;
@@ -106,7 +111,7 @@ export type NextcloudTalkActor = {
 };
 
 /** The message object in the activity. */
-export type NextcloudTalkObject = {
+type NextcloudTalkObject = {
   type: "Note";
   /** Message ID. */
   id: string;
@@ -119,7 +124,7 @@ export type NextcloudTalkObject = {
 };
 
 /** Target conversation/room. */
-export type NextcloudTalkTarget = {
+type NextcloudTalkTarget = {
   type: "Collection";
   /** Room token. */
   id: string;
@@ -172,19 +177,17 @@ export type NextcloudTalkWebhookServerOptions = {
   path: string;
   secret: string;
   maxBodyBytes?: number;
+  authRateLimit?: {
+    maxRequests?: number;
+    windowMs?: number;
+  };
   readBody?: (req: import("node:http").IncomingMessage, maxBodyBytes: number) => Promise<string>;
   isBackendAllowed?: (backend: string) => boolean;
   shouldProcessMessage?: (message: NextcloudTalkInboundMessage) => boolean | Promise<boolean>;
+  processMessage?: (
+    message: NextcloudTalkInboundMessage,
+  ) => void | "processed" | "duplicate" | Promise<void | "processed" | "duplicate">;
   onMessage: (message: NextcloudTalkInboundMessage) => void | Promise<void>;
   onError?: (error: Error) => void;
   abortSignal?: AbortSignal;
 };
-
-/** Options for sending a message. */
-export type NextcloudTalkSendOptions = {
-  baseUrl: string;
-  secret: string;
-  roomToken: string;
-  message: string;
-  replyTo?: string;
-};

package/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "extends": "../tsconfig.package-boundary.base.json",
+  "compilerOptions": {
+    "rootDir": "."
+  },
+  "include": ["./*.ts", "./src/**/*.ts"],
+  "exclude": [
+    "./**/*.test.ts",
+    "./dist/**",
+    "./node_modules/**",
+    "./src/test-support/**",
+    "./src/**/*test-helpers.ts",
+    "./src/**/*test-harness.ts",
+    "./src/**/*test-support.ts"
+  ]
+}

package/src/accounts.test.ts

@@ -1,30 +0,0 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { describe, expect, it } from "vitest";
-import { resolveNextcloudTalkAccount } from "./accounts.js";
-import type { CoreConfig } from "./types.js";
-
-describe("resolveNextcloudTalkAccount", () => {
-  it.runIf(process.platform !== "win32")("rejects symlinked botSecretFile paths", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "openclaw-nextcloud-talk-"));
-    const secretFile = path.join(dir, "secret.txt");
-    const secretLink = path.join(dir, "secret-link.txt");
-    fs.writeFileSync(secretFile, "bot-secret\n", "utf8");
-    fs.symlinkSync(secretFile, secretLink);
-
-    const cfg = {
-      channels: {
-        "nextcloud-talk": {
-          baseUrl: "https://cloud.example.com",
-          botSecretFile: secretLink,
-        },
-      },
-    } as CoreConfig;
-
-    const account = resolveNextcloudTalkAccount({ cfg });
-    expect(account.secret).toBe("");
-    expect(account.secretSource).toBe("none");
-    fs.rmSync(dir, { recursive: true, force: true });
-  });
-});

package/src/channel.startup.test.ts

@@ -1,83 +0,0 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { createStartAccountContext } from "../../test-utils/start-account-context.js";
-import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
-
-const hoisted = vi.hoisted(() => ({
-  monitorNextcloudTalkProvider: vi.fn(),
-}));
-
-vi.mock("./monitor.js", async () => {
-  const actual = await vi.importActual<typeof import("./monitor.js")>("./monitor.js");
-  return {
-    ...actual,
-    monitorNextcloudTalkProvider: hoisted.monitorNextcloudTalkProvider,
-  };
-});
-
-import { nextcloudTalkPlugin } from "./channel.js";
-
-function buildAccount(): ResolvedNextcloudTalkAccount {
-  return {
-    accountId: "default",
-    enabled: true,
-    baseUrl: "https://nextcloud.example.com",
-    secret: "secret", // pragma: allowlist secret
-    secretSource: "config", // pragma: allowlist secret
-    config: {
-      baseUrl: "https://nextcloud.example.com",
-      botSecret: "secret", // pragma: allowlist secret
-      webhookPath: "/nextcloud-talk-webhook",
-      webhookPort: 8788,
-    },
-  };
-}
-
-describe("nextcloudTalkPlugin gateway.startAccount", () => {
-  afterEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("keeps startAccount pending until abort, then stops the monitor", async () => {
-    const stop = vi.fn();
-    hoisted.monitorNextcloudTalkProvider.mockResolvedValue({ stop });
-    const abort = new AbortController();
-
-    const task = nextcloudTalkPlugin.gateway!.startAccount!(
-      createStartAccountContext({
-        account: buildAccount(),
-        abortSignal: abort.signal,
-      }),
-    );
-    let settled = false;
-    void task.then(() => {
-      settled = true;
-    });
-    await vi.waitFor(() => {
-      expect(hoisted.monitorNextcloudTalkProvider).toHaveBeenCalledOnce();
-    });
-    expect(settled).toBe(false);
-    expect(stop).not.toHaveBeenCalled();
-
-    abort.abort();
-    await task;
-
-    expect(stop).toHaveBeenCalledOnce();
-  });
-
-  it("stops immediately when startAccount receives an already-aborted signal", async () => {
-    const stop = vi.fn();
-    hoisted.monitorNextcloudTalkProvider.mockResolvedValue({ stop });
-    const abort = new AbortController();
-    abort.abort();
-
-    await nextcloudTalkPlugin.gateway!.startAccount!(
-      createStartAccountContext({
-        account: buildAccount(),
-        abortSignal: abort.signal,
-      }),
-    );
-
-    expect(hoisted.monitorNextcloudTalkProvider).toHaveBeenCalledOnce();
-    expect(stop).toHaveBeenCalledOnce();
-  });
-});

package/src/config-schema.test.ts

@@ -1,36 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { NextcloudTalkConfigSchema } from "./config-schema.js";
-
-describe("NextcloudTalkConfigSchema SecretInput", () => {
-  it("accepts SecretRef botSecret and apiPassword at top-level", () => {
-    const result = NextcloudTalkConfigSchema.safeParse({
-      baseUrl: "https://cloud.example.com",
-      botSecret: { source: "env", provider: "default", id: "NEXTCLOUD_TALK_BOT_SECRET" },
-      apiUser: "bot",
-      apiPassword: { source: "env", provider: "default", id: "NEXTCLOUD_TALK_API_PASSWORD" },
-    });
-    expect(result.success).toBe(true);
-  });
-
-  it("accepts SecretRef botSecret and apiPassword on account", () => {
-    const result = NextcloudTalkConfigSchema.safeParse({
-      accounts: {
-        main: {
-          baseUrl: "https://cloud.example.com",
-          botSecret: {
-            source: "env",
-            provider: "default",
-            id: "NEXTCLOUD_TALK_MAIN_BOT_SECRET",
-          },
-          apiUser: "bot",
-          apiPassword: {
-            source: "env",
-            provider: "default",
-            id: "NEXTCLOUD_TALK_MAIN_API_PASSWORD",
-          },
-        },
-      },
-    });
-    expect(result.success).toBe(true);
-  });
-});

package/src/format.ts

@@ -1,79 +0,0 @@
-/**
- * Format utilities for Nextcloud Talk messages.
- *
- * Nextcloud Talk supports markdown natively, so most formatting passes through.
- * This module handles any edge cases or transformations needed.
- */
-
-/**
- * Convert markdown to Nextcloud Talk compatible format.
- * Nextcloud Talk supports standard markdown, so minimal transformation needed.
- */
-export function markdownToNextcloudTalk(text: string): string {
-  return text.trim();
-}
-
-/**
- * Escape special characters in text to prevent markdown interpretation.
- */
-export function escapeNextcloudTalkMarkdown(text: string): string {
-  return text.replace(/([*_`~[\]()#>+\-=|{}!\\])/g, "\\$1");
-}
-
-/**
- * Format a mention for a Nextcloud user.
- * Nextcloud Talk uses @user format for mentions.
- */
-export function formatNextcloudTalkMention(userId: string): string {
-  return `@${userId.replace(/^@/, "")}`;
-}
-
-/**
- * Format a code block for Nextcloud Talk.
- */
-export function formatNextcloudTalkCodeBlock(code: string, language?: string): string {
-  const lang = language ?? "";
-  return `\`\`\`${lang}\n${code}\n\`\`\``;
-}
-
-/**
- * Format inline code for Nextcloud Talk.
- */
-export function formatNextcloudTalkInlineCode(code: string): string {
-  if (code.includes("`")) {
-    return `\`\` ${code} \`\``;
-  }
-  return `\`${code}\``;
-}
-
-/**
- * Strip Nextcloud Talk specific formatting from text.
- * Useful for extracting plain text content.
- */
-export function stripNextcloudTalkFormatting(text: string): string {
-  return text
-    .replace(/```[\s\S]*?```/g, "")
-    .replace(/`[^`]+`/g, "")
-    .replace(/\*\*([^*]+)\*\*/g, "$1")
-    .replace(/\*([^*]+)\*/g, "$1")
-    .replace(/_([^_]+)_/g, "$1")
-    .replace(/~~([^~]+)~~/g, "$1")
-    .replace(/\[([^\]]+)\]\([^)]+\)/g, "$1")
-    .replace(/\s+/g, " ")
-    .trim();
-}
-
-/**
- * Truncate text to a maximum length, preserving word boundaries.
- */
-export function truncateNextcloudTalkText(text: string, maxLength: number, suffix = "..."): string {
-  if (text.length <= maxLength) {
-    return text;
-  }
-  const truncated = text.slice(0, maxLength - suffix.length);
-  const lastSpace = truncated.lastIndexOf(" ");
-  if (lastSpace > maxLength * 0.7) {
-    return truncated.slice(0, lastSpace) + suffix;
-  }
-  return truncated + suffix;
-}

package/src/monitor.auth-order.test.ts

@@ -1,28 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { startWebhookServer } from "./monitor.test-harness.js";
-
-describe("createNextcloudTalkWebhookServer auth order", () => {
-  it("rejects missing signature headers before reading request body", async () => {
-    const readBody = vi.fn(async () => {
-      throw new Error("should not be called for missing signature headers");
-    });
-    const harness = await startWebhookServer({
-      path: "/nextcloud-auth-order",
-      maxBodyBytes: 128,
-      readBody,
-      onMessage: vi.fn(),
-    });
-
-    const response = await fetch(harness.webhookUrl, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-      },
-      body: "{}",
-    });
-
-    expect(response.status).toBe(400);
-    expect(await response.json()).toEqual({ error: "Missing signature headers" });
-    expect(readBody).not.toHaveBeenCalled();
-  });
-});

package/src/monitor.backend.test.ts

@@ -1,27 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { createSignedCreateMessageRequest } from "./monitor.test-fixtures.js";
-import { startWebhookServer } from "./monitor.test-harness.js";
-
-describe("createNextcloudTalkWebhookServer backend allowlist", () => {
-  it("rejects requests from unexpected backend origins", async () => {
-    const onMessage = vi.fn(async () => {});
-    const harness = await startWebhookServer({
-      path: "/nextcloud-backend-check",
-      isBackendAllowed: (backend) => backend === "https://nextcloud.expected",
-      onMessage,
-    });
-
-    const { body, headers } = createSignedCreateMessageRequest({
-      backend: "https://nextcloud.unexpected",
-    });
-    const response = await fetch(harness.webhookUrl, {
-      method: "POST",
-      headers,
-      body,
-    });
-
-    expect(response.status).toBe(401);
-    expect(await response.json()).toEqual({ error: "Invalid backend" });
-    expect(onMessage).not.toHaveBeenCalled();
-  });
-});

package/src/monitor.read-body.test.ts

@@ -1,16 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createMockIncomingRequest } from "../../../test/helpers/mock-incoming-request.js";
-import { readNextcloudTalkWebhookBody } from "./monitor.js";
-
-describe("readNextcloudTalkWebhookBody", () => {
-  it("reads valid body within max bytes", async () => {
-    const req = createMockIncomingRequest(['{"type":"Create"}']);
-    const body = await readNextcloudTalkWebhookBody(req, 1024);
-    expect(body).toBe('{"type":"Create"}');
-  });
-
-  it("rejects when payload exceeds max bytes", async () => {
-    const req = createMockIncomingRequest(["x".repeat(300)]);
-    await expect(readNextcloudTalkWebhookBody(req, 128)).rejects.toThrow("PayloadTooLarge");
-  });
-});