@openclaw/nextcloud-talk 2026.3.12 → 2026.5.1-beta.2

package/package.json

@@ -1,15 +1,32 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.3.12",
+  "version": "2026.5.1-beta.2",
   "description": "OpenClaw Nextcloud Talk channel plugin",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openclaw/openclaw"
+  },
   "type": "module",
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.4.1"
+  },
+  "devDependencies": {
+    "@openclaw/plugin-sdk": "workspace:*",
+    "openclaw": "workspace:*"
+  },
+  "peerDependencies": {
+    "openclaw": ">=2026.4.25"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
+    }
   },
   "openclaw": {
     "extensions": [
       "./index.ts"
     ],
+    "setupEntry": "./setup-entry.ts",
     "channel": {
       "id": "nextcloud-talk",
       "label": "Nextcloud Talk",
@@ -26,8 +43,18 @@
     },
     "install": {
       "npmSpec": "@openclaw/nextcloud-talk",
-      "localPath": "extensions/nextcloud-talk",
-      "defaultChoice": "npm"
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.4.10"
+    },
+    "compat": {
+      "pluginApi": ">=2026.4.25"
+    },
+    "build": {
+      "openclawVersion": "2026.5.1-beta.2"
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
     }
   }
 }

package/runtime-api.ts

@@ -0,0 +1,33 @@
+// Private runtime barrel for the bundled Nextcloud Talk extension.
+// Keep this barrel thin and aligned with the local extension surface.
+
+export type { AllowlistMatch } from "openclaw/plugin-sdk/allow-from";
+export type { ChannelGroupContext } from "openclaw/plugin-sdk/channel-contract";
+export { logInboundDrop } from "openclaw/plugin-sdk/channel-logging";
+export { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
+export {
+  readStoreAllowFromForDmPolicy,
+  resolveDmGroupAccessWithCommandGate,
+} from "openclaw/plugin-sdk/channel-policy";
+export type {
+  BlockStreamingCoalesceConfig,
+  DmConfig,
+  DmPolicy,
+  GroupPolicy,
+  GroupToolPolicyConfig,
+  OpenClawConfig,
+} from "openclaw/plugin-sdk/config-types";
+export {
+  GROUP_POLICY_BLOCKED_LABEL,
+  resolveAllowlistProviderRuntimeGroupPolicy,
+  resolveDefaultGroupPolicy,
+  warnMissingProviderGroupPolicyFallbackOnce,
+} from "openclaw/plugin-sdk/runtime-group-policy";
+export { dispatchInboundReplyWithBase } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+export type { OutboundReplyPayload } from "openclaw/plugin-sdk/reply-payload";
+export { deliverFormattedTextWithAttachments } from "openclaw/plugin-sdk/reply-payload";
+export type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
+export type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+export type { SecretInput } from "openclaw/plugin-sdk/secret-input";
+export { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+export { setNextcloudTalkRuntime } from "./src/runtime.js";

package/secret-contract-api.ts

@@ -0,0 +1,5 @@
+export {
+  channelSecrets,
+  collectRuntimeConfigAssignments,
+  secretTargetRegistryEntries,
+} from "./src/secret-contract.js";

package/setup-entry.ts

@@ -0,0 +1,13 @@
+import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelSetupEntry({
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./api.js",
+    exportName: "nextcloudTalkPlugin",
+  },
+  secrets: {
+    specifier: "./secret-contract-api.js",
+    exportName: "channelSecrets",
+  },
+});

package/src/accounts.ts

@@ -1,15 +1,20 @@
-import { tryReadSecretFileSync } from "openclaw/plugin-sdk/core";
 import {
   createAccountListHelpers,
   DEFAULT_ACCOUNT_ID,
   normalizeAccountId,
   resolveAccountWithDefaultFallback,
-} from "openclaw/plugin-sdk/nextcloud-talk";
+  resolveMergedAccountConfig,
+} from "openclaw/plugin-sdk/account-core";
+import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
+import {
+  normalizeLowercaseStringOrEmpty,
+  normalizeOptionalString,
+} from "openclaw/plugin-sdk/text-runtime";
 import { normalizeResolvedSecretInputString } from "./secret-input.js";
 import type { CoreConfig, NextcloudTalkAccountConfig } from "./types.js";
 
 function isTruthyEnvValue(value?: string): boolean {
-  const normalized = (value ?? "").trim().toLowerCase();
+  const normalized = normalizeLowercaseStringOrEmpty(value);
   return normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on";
 }
 
@@ -43,47 +48,30 @@ export function listNextcloudTalkAccountIds(cfg: CoreConfig): string[] {
   return ids;
 }
 
-function resolveAccountConfig(
-  cfg: CoreConfig,
-  accountId: string,
-): NextcloudTalkAccountConfig | undefined {
-  const accounts = cfg.channels?.["nextcloud-talk"]?.accounts;
-  if (!accounts || typeof accounts !== "object") {
-    return undefined;
-  }
-  const direct = accounts[accountId] as NextcloudTalkAccountConfig | undefined;
-  if (direct) {
-    return direct;
-  }
-  const normalized = normalizeAccountId(accountId);
-  const matchKey = Object.keys(accounts).find((key) => normalizeAccountId(key) === normalized);
-  return matchKey ? (accounts[matchKey] as NextcloudTalkAccountConfig | undefined) : undefined;
-}
-
 function mergeNextcloudTalkAccountConfig(
   cfg: CoreConfig,
   accountId: string,
 ): NextcloudTalkAccountConfig {
-  const {
-    accounts: _ignored,
-    defaultAccount: _ignoredDefaultAccount,
-    ...base
-  } = (cfg.channels?.["nextcloud-talk"] ?? {}) as NextcloudTalkAccountConfig & {
-    accounts?: unknown;
-    defaultAccount?: unknown;
-  };
-  const account = resolveAccountConfig(cfg, accountId) ?? {};
-  return { ...base, ...account };
+  return resolveMergedAccountConfig<NextcloudTalkAccountConfig>({
+    channelConfig: cfg.channels?.["nextcloud-talk"] as NextcloudTalkAccountConfig | undefined,
+    accounts: cfg.channels?.["nextcloud-talk"]?.accounts as
+      | Record<string, Partial<NextcloudTalkAccountConfig>>
+      | undefined,
+    accountId,
+    omitKeys: ["defaultAccount"],
+    normalizeAccountId,
+  });
 }
 
 function resolveNextcloudTalkSecret(
   cfg: CoreConfig,
   opts: { accountId?: string },
 ): { secret: string; source: ResolvedNextcloudTalkAccount["secretSource"] } {
-  const merged = mergeNextcloudTalkAccountConfig(cfg, opts.accountId ?? DEFAULT_ACCOUNT_ID);
+  const resolvedAccountId = opts.accountId ?? resolveDefaultNextcloudTalkAccountId(cfg);
+  const merged = mergeNextcloudTalkAccountConfig(cfg, resolvedAccountId);
 
-  const envSecret = process.env.NEXTCLOUD_TALK_BOT_SECRET?.trim();
-  if (envSecret && (!opts.accountId || opts.accountId === DEFAULT_ACCOUNT_ID)) {
+  const envSecret = normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET);
+  if (envSecret && resolvedAccountId === DEFAULT_ACCOUNT_ID) {
     return { secret: envSecret, source: "env" };
   }
 
@@ -100,7 +88,7 @@ function resolveNextcloudTalkSecret(
 
   const inlineSecret = normalizeResolvedSecretInputString({
     value: merged.botSecret,
-    path: `channels.nextcloud-talk.accounts.${opts.accountId ?? DEFAULT_ACCOUNT_ID}.botSecret`,
+    path: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecret`,
   });
   if (inlineSecret) {
     return { secret: inlineSecret, source: "config" };
@@ -114,6 +102,7 @@ export function resolveNextcloudTalkAccount(params: {
   accountId?: string | null;
 }): ResolvedNextcloudTalkAccount {
   const baseEnabled = params.cfg.channels?.["nextcloud-talk"]?.enabled !== false;
+  const resolvedAccountId = params.accountId ?? resolveDefaultNextcloudTalkAccountId(params.cfg);
 
   const resolve = (accountId: string) => {
     const merged = mergeNextcloudTalkAccountConfig(params.cfg, accountId);
@@ -132,7 +121,7 @@ export function resolveNextcloudTalkAccount(params: {
     return {
       accountId,
       enabled,
-      name: merged.name?.trim() || undefined,
+      name: normalizeOptionalString(merged.name),
       baseUrl,
       secret: secretResolution.secret,
       secretSource: secretResolution.source,
@@ -141,16 +130,10 @@ export function resolveNextcloudTalkAccount(params: {
   };
 
   return resolveAccountWithDefaultFallback({
-    accountId: params.accountId,
+    accountId: resolvedAccountId,
     normalizeAccountId,
     resolvePrimary: resolve,
     hasCredential: (account) => account.secretSource !== "none",
     resolveDefaultAccountId: () => resolveDefaultNextcloudTalkAccountId(params.cfg),
   });
 }
-
-export function listEnabledNextcloudTalkAccounts(cfg: CoreConfig): ResolvedNextcloudTalkAccount[] {
-  return listNextcloudTalkAccountIds(cfg)
-    .map((accountId) => resolveNextcloudTalkAccount({ cfg, accountId }))
-    .filter((account) => account.enabled);
-}

package/src/approval-auth.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { nextcloudTalkApprovalAuth } from "./approval-auth.js";
+
+describe("nextcloudTalkApprovalAuth", () => {
+  it("matches Nextcloud Talk actor ids case-insensitively", () => {
+    const cfg = { channels: { "nextcloud-talk": { allowFrom: ["Owner"] } } };
+
+    expect(
+      nextcloudTalkApprovalAuth.authorizeActorAction({
+        cfg,
+        senderId: "owner",
+        action: "approve",
+        approvalKind: "exec",
+      }),
+    ).toEqual({ authorized: true });
+  });
+});

package/src/approval-auth.ts

@@ -0,0 +1,27 @@
+import {
+  createResolvedApproverActionAuthAdapter,
+  resolveApprovalApprovers,
+} from "openclaw/plugin-sdk/approval-auth-runtime";
+import { normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/text-runtime";
+import { resolveNextcloudTalkAccount } from "./accounts.js";
+import type { CoreConfig } from "./types.js";
+
+function normalizeNextcloudTalkApproverId(value: string | number): string | undefined {
+  return normalizeOptionalLowercaseString(
+    String(value)
+      .trim()
+      .replace(/^(nextcloud-talk|nc-talk|nc):/i, ""),
+  );
+}
+
+export const nextcloudTalkApprovalAuth = createResolvedApproverActionAuthAdapter({
+  channelLabel: "Nextcloud Talk",
+  resolveApprovers: ({ cfg, accountId }) => {
+    const account = resolveNextcloudTalkAccount({ cfg: cfg as CoreConfig, accountId });
+    return resolveApprovalApprovers({
+      allowFrom: account.config.allowFrom,
+      normalizeApprover: normalizeNextcloudTalkApproverId,
+    });
+  },
+  normalizeSenderId: (value) => normalizeNextcloudTalkApproverId(value),
+});

package/src/channel-api.ts

@@ -0,0 +1,5 @@
+export type { ChannelPlugin } from "openclaw/plugin-sdk/channel-plugin-common";
+export type { OpenClawConfig } from "openclaw/plugin-sdk/config-types";
+export { clearAccountEntryFields } from "openclaw/plugin-sdk/channel-plugin-common";
+export { DEFAULT_ACCOUNT_ID } from "openclaw/plugin-sdk/account-id";
+export { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";

package/src/channel.adapters.ts

@@ -0,0 +1,52 @@
+import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
+import {
+  adaptScopedAccountAccessor,
+  createScopedChannelConfigAdapter,
+  createScopedDmSecurityResolver,
+} from "openclaw/plugin-sdk/channel-config-helpers";
+import { createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
+import {
+  listNextcloudTalkAccountIds,
+  resolveDefaultNextcloudTalkAccountId,
+  resolveNextcloudTalkAccount,
+  type ResolvedNextcloudTalkAccount,
+} from "./accounts.js";
+import type { CoreConfig } from "./types.js";
+
+export const nextcloudTalkConfigAdapter = createScopedChannelConfigAdapter<
+  ResolvedNextcloudTalkAccount,
+  ResolvedNextcloudTalkAccount,
+  CoreConfig
+>({
+  sectionKey: "nextcloud-talk",
+  listAccountIds: listNextcloudTalkAccountIds,
+  resolveAccount: adaptScopedAccountAccessor(resolveNextcloudTalkAccount),
+  defaultAccountId: resolveDefaultNextcloudTalkAccountId,
+  clearBaseFields: ["botSecret", "botSecretFile", "baseUrl", "name"],
+  resolveAllowFrom: (account) => account.config.allowFrom,
+  formatAllowFrom: (allowFrom) =>
+    formatAllowFromLowercase({
+      allowFrom,
+      stripPrefixRe: /^(nextcloud-talk|nc-talk|nc):/i,
+    }),
+});
+
+export const nextcloudTalkSecurityAdapter = {
+  resolveDmPolicy: createScopedDmSecurityResolver<ResolvedNextcloudTalkAccount>({
+    channelKey: "nextcloud-talk",
+    resolvePolicy: (account) => account.config.dmPolicy,
+    resolveAllowFrom: (account) => account.config.allowFrom,
+    policyPathSuffix: "dmPolicy",
+    normalizeEntry: (raw) =>
+      normalizeLowercaseStringOrEmpty(raw.trim().replace(/^(nextcloud-talk|nc-talk|nc):/i, "")),
+  }),
+};
+
+export const nextcloudTalkPairingTextAdapter = {
+  idLabel: "nextcloudUserId",
+  message: "OpenClaw: your access has been approved.",
+  normalizeAllowEntry: createPairingPrefixStripper(/^(nextcloud-talk|nc-talk|nc):/i, (entry) =>
+    normalizeLowercaseStringOrEmpty(entry),
+  ),
+};

package/src/channel.core.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import {
+  nextcloudTalkConfigAdapter,
+  nextcloudTalkPairingTextAdapter,
+  nextcloudTalkSecurityAdapter,
+} from "./channel.adapters.js";
+import { NextcloudTalkConfigSchema } from "./config-schema.js";
+import type { CoreConfig } from "./types.js";
+
+describe("nextcloud talk channel core", () => {
+  it("accepts SecretRef botSecret and apiPassword at top-level", () => {
+    const result = NextcloudTalkConfigSchema.safeParse({
+      baseUrl: "https://cloud.example.com",
+      botSecret: { source: "env", provider: "default", id: "NEXTCLOUD_TALK_BOT_SECRET" },
+      apiUser: "bot",
+      apiPassword: { source: "env", provider: "default", id: "NEXTCLOUD_TALK_API_PASSWORD" },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("accepts SecretRef botSecret and apiPassword on account", () => {
+    const result = NextcloudTalkConfigSchema.safeParse({
+      accounts: {
+        main: {
+          baseUrl: "https://cloud.example.com",
+          botSecret: {
+            source: "env",
+            provider: "default",
+            id: "NEXTCLOUD_TALK_MAIN_BOT_SECRET",
+          },
+          apiUser: "bot",
+          apiPassword: {
+            source: "env",
+            provider: "default",
+            id: "NEXTCLOUD_TALK_MAIN_API_PASSWORD",
+          },
+        },
+      },
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it("normalizes trimmed DM allowlist prefixes to lowercase ids", () => {
+    const resolveDmPolicy = nextcloudTalkSecurityAdapter.resolveDmPolicy;
+    if (!resolveDmPolicy) {
+      throw new Error("resolveDmPolicy unavailable");
+    }
+
+    const cfg = {
+      channels: {
+        "nextcloud-talk": {
+          baseUrl: "https://cloud.example.com",
+          botSecret: "secret",
+          dmPolicy: "allowlist",
+          allowFrom: ["  nc:User-Id  "],
+        },
+      },
+    } as CoreConfig;
+
+    const result = resolveDmPolicy({
+      cfg,
+      account: nextcloudTalkConfigAdapter.resolveAccount(cfg, "default"),
+    });
+    if (!result) {
+      throw new Error("nextcloud-talk resolveDmPolicy returned null");
+    }
+
+    expect(result.policy).toBe("allowlist");
+    expect(result.allowFrom).toEqual(["  nc:User-Id  "]);
+    expect(result.normalizeEntry?.("  nc:User-Id  ")).toBe("user-id");
+    expect(nextcloudTalkPairingTextAdapter.normalizeAllowEntry("  nextcloud-talk:User-Id  ")).toBe(
+      "user-id",
+    );
+  });
+});

package/src/channel.lifecycle.test.ts

@@ -0,0 +1,81 @@
+import { createStartAccountContext } from "openclaw/plugin-sdk/channel-test-helpers";
+import {
+  expectStopPendingUntilAbort,
+  startAccountAndTrackLifecycle,
+  waitForStartedMocks,
+} from "openclaw/plugin-sdk/channel-test-helpers";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
+
+const hoisted = vi.hoisted(() => ({
+  monitorNextcloudTalkProvider: vi.fn(),
+}));
+
+vi.mock("./monitor-runtime.js", () => ({
+  monitorNextcloudTalkProvider: hoisted.monitorNextcloudTalkProvider,
+}));
+
+const { nextcloudTalkGatewayAdapter } = await import("./gateway.js");
+
+function buildAccount(): ResolvedNextcloudTalkAccount {
+  return {
+    accountId: "default",
+    enabled: true,
+    baseUrl: "https://nextcloud.example.com",
+    secret: "secret", // pragma: allowlist secret
+    secretSource: "config", // pragma: allowlist secret
+    config: {
+      baseUrl: "https://nextcloud.example.com",
+      botSecret: "secret", // pragma: allowlist secret
+      webhookPath: "/nextcloud-talk-webhook",
+      webhookPort: 8788,
+    },
+  };
+}
+
+function mockStartedMonitor() {
+  const stop = vi.fn();
+  hoisted.monitorNextcloudTalkProvider.mockResolvedValue({ stop });
+  return stop;
+}
+
+function startNextcloudAccount(abortSignal?: AbortSignal) {
+  return nextcloudTalkGatewayAdapter.startAccount!(
+    createStartAccountContext({
+      account: buildAccount(),
+      abortSignal,
+    }),
+  );
+}
+
+describe("nextcloud-talk startAccount lifecycle", () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("keeps startAccount pending until abort, then stops the monitor", async () => {
+    const stop = mockStartedMonitor();
+    const { abort, task, isSettled } = startAccountAndTrackLifecycle({
+      startAccount: nextcloudTalkGatewayAdapter.startAccount!,
+      account: buildAccount(),
+    });
+    await expectStopPendingUntilAbort({
+      waitForStarted: waitForStartedMocks(hoisted.monitorNextcloudTalkProvider),
+      isSettled,
+      abort,
+      task,
+      stop,
+    });
+  });
+
+  it("stops immediately when startAccount receives an already-aborted signal", async () => {
+    const stop = mockStartedMonitor();
+    const abort = new AbortController();
+    abort.abort();
+
+    await startNextcloudAccount(abort.signal);
+
+    expect(hoisted.monitorNextcloudTalkProvider).toHaveBeenCalledOnce();
+    expect(stop).toHaveBeenCalledOnce();
+  });
+});