@openclaw/nextcloud-talk 2026.3.13 → 2026.5.1-beta.2

package/src/inbound.behavior.test.ts

@@ -0,0 +1,202 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { PluginRuntime, RuntimeEnv } from "../runtime-api.js";
+import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
+import { handleNextcloudTalkInbound } from "./inbound.js";
+import { setNextcloudTalkRuntime } from "./runtime.js";
+import type { CoreConfig, NextcloudTalkInboundMessage } from "./types.js";
+
+const {
+  createChannelPairingControllerMock,
+  dispatchInboundReplyWithBaseMock,
+  readStoreAllowFromForDmPolicyMock,
+  resolveDmGroupAccessWithCommandGateMock,
+  resolveAllowlistProviderRuntimeGroupPolicyMock,
+  resolveDefaultGroupPolicyMock,
+  warnMissingProviderGroupPolicyFallbackOnceMock,
+} = vi.hoisted(() => {
+  return {
+    createChannelPairingControllerMock: vi.fn(),
+    dispatchInboundReplyWithBaseMock: vi.fn(),
+    readStoreAllowFromForDmPolicyMock: vi.fn(),
+    resolveDmGroupAccessWithCommandGateMock: vi.fn(),
+    resolveAllowlistProviderRuntimeGroupPolicyMock: vi.fn(),
+    resolveDefaultGroupPolicyMock: vi.fn(),
+    warnMissingProviderGroupPolicyFallbackOnceMock: vi.fn(),
+  };
+});
+
+const sendMessageNextcloudTalkMock = vi.hoisted(() => vi.fn());
+const resolveNextcloudTalkRoomKindMock = vi.hoisted(() => vi.fn());
+
+vi.mock("../runtime-api.js", async () => {
+  const actual = await vi.importActual<typeof import("../runtime-api.js")>("../runtime-api.js");
+  return {
+    ...actual,
+    createChannelPairingController: createChannelPairingControllerMock,
+    dispatchInboundReplyWithBase: dispatchInboundReplyWithBaseMock,
+    readStoreAllowFromForDmPolicy: readStoreAllowFromForDmPolicyMock,
+    resolveDmGroupAccessWithCommandGate: resolveDmGroupAccessWithCommandGateMock,
+    resolveAllowlistProviderRuntimeGroupPolicy: resolveAllowlistProviderRuntimeGroupPolicyMock,
+    resolveDefaultGroupPolicy: resolveDefaultGroupPolicyMock,
+    warnMissingProviderGroupPolicyFallbackOnce: warnMissingProviderGroupPolicyFallbackOnceMock,
+  };
+});
+
+vi.mock("./send.js", () => ({
+  sendMessageNextcloudTalk: sendMessageNextcloudTalkMock,
+}));
+
+vi.mock("./room-info.js", async () => {
+  const actual = await vi.importActual<typeof import("./room-info.js")>("./room-info.js");
+  return {
+    ...actual,
+    resolveNextcloudTalkRoomKind: resolveNextcloudTalkRoomKindMock,
+  };
+});
+
+function installRuntime(params?: {
+  buildMentionRegexes?: () => RegExp[];
+  matchesMentionPatterns?: (body: string, regexes: RegExp[]) => boolean;
+}) {
+  setNextcloudTalkRuntime({
+    channel: {
+      pairing: {
+        readAllowFromStore: vi.fn(async () => []),
+        upsertPairingRequest: vi.fn(async () => ({ code: "123456", created: true })),
+      },
+      commands: {
+        shouldHandleTextCommands: vi.fn(() => false),
+      },
+      text: {
+        hasControlCommand: vi.fn(() => false),
+      },
+      mentions: {
+        buildMentionRegexes: params?.buildMentionRegexes ?? vi.fn(() => []),
+        matchesMentionPatterns: params?.matchesMentionPatterns ?? vi.fn(() => false),
+      },
+    },
+  } as unknown as PluginRuntime);
+}
+
+function createRuntimeEnv() {
+  return {
+    log: vi.fn(),
+    error: vi.fn(),
+  } as unknown as RuntimeEnv;
+}
+
+function createAccount(
+  overrides?: Partial<ResolvedNextcloudTalkAccount>,
+): ResolvedNextcloudTalkAccount {
+  return {
+    accountId: "default",
+    enabled: true,
+    baseUrl: "https://cloud.example.com",
+    secret: "secret",
+    secretSource: "config",
+    config: {
+      dmPolicy: "pairing",
+      allowFrom: [],
+      groupPolicy: "allowlist",
+      groupAllowFrom: [],
+    },
+    ...overrides,
+  };
+}
+
+function createMessage(
+  overrides?: Partial<NextcloudTalkInboundMessage>,
+): NextcloudTalkInboundMessage {
+  return {
+    messageId: "msg-1",
+    roomToken: "room-1",
+    roomName: "Room 1",
+    senderId: "user-1",
+    senderName: "Alice",
+    text: "hello",
+    mediaType: "text/plain",
+    timestamp: Date.now(),
+    isGroupChat: false,
+    ...overrides,
+  };
+}
+
+describe("nextcloud-talk inbound behavior", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    installRuntime();
+    resolveNextcloudTalkRoomKindMock.mockResolvedValue("direct");
+    resolveDefaultGroupPolicyMock.mockReturnValue("allowlist");
+    resolveAllowlistProviderRuntimeGroupPolicyMock.mockReturnValue({
+      groupPolicy: "allowlist",
+      providerMissingFallbackApplied: false,
+    });
+    warnMissingProviderGroupPolicyFallbackOnceMock.mockReturnValue(undefined);
+    readStoreAllowFromForDmPolicyMock.mockResolvedValue([]);
+  });
+
+  // The DM pairing assertion currently depends on a mocked runtime barrel that Vitest
+  // does not bind reliably for this extension package.
+  it.skip("issues a DM pairing challenge and sends the challenge text", async () => {
+    createChannelPairingControllerMock.mockReturnValue({
+      readStoreForDmPolicy: vi.fn(),
+      issueChallenge: vi.fn(),
+    });
+    resolveDmGroupAccessWithCommandGateMock.mockReturnValue({
+      decision: "pairing",
+      reason: "pairing_required",
+      commandAuthorized: false,
+      effectiveGroupAllowFrom: [],
+    });
+    sendMessageNextcloudTalkMock.mockResolvedValue(undefined);
+
+    const statusSink = vi.fn();
+    await handleNextcloudTalkInbound({
+      message: createMessage(),
+      account: createAccount(),
+      config: { channels: { "nextcloud-talk": {} } } as CoreConfig,
+      runtime: createRuntimeEnv(),
+      statusSink,
+    });
+  });
+
+  it("drops unmentioned group traffic before dispatch", async () => {
+    installRuntime({
+      buildMentionRegexes: vi.fn(() => [/@openclaw/i]),
+      matchesMentionPatterns: vi.fn(() => false),
+    });
+    createChannelPairingControllerMock.mockReturnValue({
+      readStoreForDmPolicy: vi.fn(),
+      issueChallenge: vi.fn(),
+    });
+    resolveNextcloudTalkRoomKindMock.mockResolvedValue("group");
+    resolveDmGroupAccessWithCommandGateMock.mockReturnValue({
+      decision: "allow",
+      reason: "allow",
+      commandAuthorized: false,
+      effectiveGroupAllowFrom: ["user-1"],
+    });
+    const runtime = createRuntimeEnv();
+
+    await handleNextcloudTalkInbound({
+      message: createMessage({
+        roomToken: "room-group",
+        roomName: "Ops",
+        isGroupChat: true,
+      }),
+      account: createAccount({
+        config: {
+          dmPolicy: "pairing",
+          allowFrom: [],
+          groupPolicy: "allowlist",
+          groupAllowFrom: ["user-1"],
+        },
+      }),
+      config: { channels: { "nextcloud-talk": {} } } as CoreConfig,
+      runtime,
+    });
+
+    expect(dispatchInboundReplyWithBaseMock).not.toHaveBeenCalled();
+    expect(runtime.log).toHaveBeenCalledWith("nextcloud-talk: drop room room-group (no mention)");
+  });
+});

package/src/inbound.ts

@@ -1,20 +1,19 @@
+import { normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
 import {
   GROUP_POLICY_BLOCKED_LABEL,
-  createScopedPairingAccess,
+  createChannelPairingController,
+  deliverFormattedTextWithAttachments,
   dispatchInboundReplyWithBase,
-  formatTextWithAttachmentLinks,
-  issuePairingChallenge,
   logInboundDrop,
   readStoreAllowFromForDmPolicy,
-  resolveDmGroupAccessWithCommandGate,
-  resolveOutboundMediaUrls,
   resolveAllowlistProviderRuntimeGroupPolicy,
   resolveDefaultGroupPolicy,
+  resolveDmGroupAccessWithCommandGate,
   warnMissingProviderGroupPolicyFallbackOnce,
-  type OutboundReplyPayload,
   type OpenClawConfig,
+  type OutboundReplyPayload,
   type RuntimeEnv,
-} from "openclaw/plugin-sdk/nextcloud-talk";
+} from "../runtime-api.js";
 import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
 import {
   normalizeNextcloudTalkAllowlist,
@@ -27,27 +26,29 @@ import {
 import { resolveNextcloudTalkRoomKind } from "./room-info.js";
 import { getNextcloudTalkRuntime } from "./runtime.js";
 import { sendMessageNextcloudTalk } from "./send.js";
-import type { CoreConfig, GroupPolicy, NextcloudTalkInboundMessage } from "./types.js";
+import type { CoreConfig, NextcloudTalkInboundMessage } from "./types.js";
 
 const CHANNEL_ID = "nextcloud-talk" as const;
 
 async function deliverNextcloudTalkReply(params: {
+  cfg: CoreConfig;
   payload: OutboundReplyPayload;
   roomToken: string;
   accountId: string;
   statusSink?: (patch: { lastOutboundAt?: number }) => void;
 }): Promise<void> {
-  const { payload, roomToken, accountId, statusSink } = params;
-  const combined = formatTextWithAttachmentLinks(payload.text, resolveOutboundMediaUrls(payload));
-  if (!combined) {
-    return;
-  }
-
-  await sendMessageNextcloudTalk(roomToken, combined, {
-    accountId,
-    replyTo: payload.replyToId,
+  const { cfg, payload, roomToken, accountId, statusSink } = params;
+  await deliverFormattedTextWithAttachments({
+    payload,
+    send: async ({ text, replyToId }) => {
+      await sendMessageNextcloudTalk(roomToken, text, {
+        cfg,
+        accountId,
+        replyTo: replyToId,
+      });
+      statusSink?.({ lastOutboundAt: Date.now() });
+    },
   });
-  statusSink?.({ lastOutboundAt: Date.now() });
 }
 
 export async function handleNextcloudTalkInbound(params: {
@@ -59,7 +60,7 @@ export async function handleNextcloudTalkInbound(params: {
 }): Promise<void> {
   const { message, account, config, runtime, statusSink } = params;
   const core = getNextcloudTalkRuntime();
-  const pairing = createScopedPairingAccess({
+  const pairing = createChannelPairingController({
     core,
     channel: CHANNEL_ID,
     accountId: account.accountId,
@@ -90,7 +91,7 @@ export async function handleNextcloudTalkInbound(params: {
       providerConfigPresent:
         ((config.channels as Record<string, unknown> | undefined)?.["nextcloud-talk"] ??
           undefined) !== undefined,
-      groupPolicy: account.config.groupPolicy as GroupPolicy | undefined,
+      groupPolicy: account.config.groupPolicy,
       defaultGroupPolicy,
     });
   warnMissingProviderGroupPolicyFallbackOnce({
@@ -114,7 +115,6 @@ export async function handleNextcloudTalkInbound(params: {
   const roomMatch = resolveNextcloudTalkRoomMatch({
     rooms: account.config.rooms,
     roomToken,
-    roomName,
   });
   const roomConfig = roomMatch.roomConfig;
   if (isGroup && !roomMatch.allowed) {
@@ -174,14 +174,15 @@ export async function handleNextcloudTalkInbound(params: {
   } else {
     if (access.decision !== "allow") {
       if (access.decision === "pairing") {
-        await issuePairingChallenge({
-          channel: CHANNEL_ID,
+        await pairing.issueChallenge({
           senderId,
           senderIdLine: `Your Nextcloud user id: ${senderId}`,
           meta: { name: senderName || undefined },
-          upsertPairingRequest: pairing.upsertPairingRequest,
           sendPairingReply: async (text) => {
-            await sendMessageNextcloudTalk(roomToken, text, { accountId: account.accountId });
+            await sendMessageNextcloudTalk(roomToken, text, {
+              cfg: config,
+              accountId: account.accountId,
+            });
             statusSink?.({ lastOutboundAt: Date.now() });
           },
           onReplyError: (err) => {
@@ -258,7 +259,7 @@ export async function handleNextcloudTalkInbound(params: {
     body: rawBody,
   });
 
-  const groupSystemPrompt = roomConfig?.systemPrompt?.trim() || undefined;
+  const groupSystemPrompt = normalizeOptionalString(roomConfig?.systemPrompt);
 
   const ctxPayload = core.channel.reply.finalizeInboundContext({
     Body: body,
@@ -295,6 +296,7 @@ export async function handleNextcloudTalkInbound(params: {
     core,
     deliver: async (payload) => {
       await deliverNextcloudTalkReply({
+        cfg: config,
         payload,
         roomToken,
         accountId: account.accountId,

package/src/monitor-runtime.ts

@@ -0,0 +1,138 @@
+import os from "node:os";
+import { resolveLoggerBackedRuntime } from "openclaw/plugin-sdk/extension-shared";
+import type { RuntimeEnv } from "openclaw/plugin-sdk/runtime";
+import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
+import { resolveNextcloudTalkAccount } from "./accounts.js";
+import { handleNextcloudTalkInbound } from "./inbound.js";
+import {
+  createNextcloudTalkWebhookServer,
+  processNextcloudTalkReplayGuardedMessage,
+} from "./monitor.js";
+import { createNextcloudTalkReplayGuard } from "./replay-guard.js";
+import { getNextcloudTalkRuntime } from "./runtime.js";
+import type { CoreConfig, NextcloudTalkInboundMessage } from "./types.js";
+
+const DEFAULT_WEBHOOK_PORT = 8788;
+const DEFAULT_WEBHOOK_HOST = "0.0.0.0";
+const DEFAULT_WEBHOOK_PATH = "/nextcloud-talk-webhook";
+
+function normalizeOrigin(value: string): string | null {
+  try {
+    return normalizeLowercaseStringOrEmpty(new URL(value).origin);
+  } catch {
+    return null;
+  }
+}
+
+type NextcloudTalkMonitorOptions = {
+  accountId?: string;
+  config?: CoreConfig;
+  runtime?: RuntimeEnv;
+  abortSignal?: AbortSignal;
+  onMessage?: (message: NextcloudTalkInboundMessage) => void | Promise<void>;
+  statusSink?: (patch: { lastInboundAt?: number; lastOutboundAt?: number }) => void;
+};
+
+export async function monitorNextcloudTalkProvider(
+  opts: NextcloudTalkMonitorOptions,
+): Promise<{ stop: () => void }> {
+  const core = getNextcloudTalkRuntime();
+  const cfg = opts.config ?? (core.config.current() as CoreConfig);
+  const account = resolveNextcloudTalkAccount({
+    cfg,
+    accountId: opts.accountId,
+  });
+  const runtime: RuntimeEnv = resolveLoggerBackedRuntime(
+    opts.runtime,
+    core.logging.getChildLogger(),
+  );
+
+  if (!account.secret) {
+    throw new Error(`Nextcloud Talk bot secret not configured for account "${account.accountId}"`);
+  }
+
+  const port = account.config.webhookPort ?? DEFAULT_WEBHOOK_PORT;
+  const host = account.config.webhookHost ?? DEFAULT_WEBHOOK_HOST;
+  const path = account.config.webhookPath ?? DEFAULT_WEBHOOK_PATH;
+
+  const logger = core.logging.getChildLogger({
+    channel: "nextcloud-talk",
+    accountId: account.accountId,
+  });
+  const expectedBackendOrigin = normalizeOrigin(account.baseUrl);
+  const replayGuard = createNextcloudTalkReplayGuard({
+    stateDir: core.state.resolveStateDir(process.env, os.homedir),
+    onDiskError: (error) => {
+      logger.warn(
+        `[nextcloud-talk:${account.accountId}] replay guard disk error: ${String(error)}`,
+      );
+    },
+  });
+
+  const { start, stop } = createNextcloudTalkWebhookServer({
+    port,
+    host,
+    path,
+    secret: account.secret,
+    isBackendAllowed: (backend) => {
+      if (!expectedBackendOrigin) {
+        return true;
+      }
+      const backendOrigin = normalizeOrigin(backend);
+      return backendOrigin === expectedBackendOrigin;
+    },
+    processMessage: async (message) => {
+      const result = await processNextcloudTalkReplayGuardedMessage({
+        replayGuard,
+        accountId: account.accountId,
+        message,
+        handleMessage: async () => {
+          core.channel.activity.record({
+            channel: "nextcloud-talk",
+            accountId: account.accountId,
+            direction: "inbound",
+            at: message.timestamp,
+          });
+          if (opts.onMessage) {
+            await opts.onMessage(message);
+          } else {
+            await handleNextcloudTalkInbound({
+              message,
+              account,
+              config: cfg,
+              runtime,
+              statusSink: opts.statusSink,
+            });
+          }
+        },
+      });
+      if (result === "duplicate") {
+        logger.warn(
+          `[nextcloud-talk:${account.accountId}] replayed webhook ignored room=${message.roomToken} messageId=${message.messageId}`,
+        );
+        return;
+      }
+    },
+    onMessage: async () => {},
+    onError: (error) => {
+      logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
+    },
+    abortSignal: opts.abortSignal,
+  });
+
+  if (opts.abortSignal?.aborted) {
+    return { stop };
+  }
+  await start();
+  if (opts.abortSignal?.aborted) {
+    stop();
+    return { stop };
+  }
+
+  const publicUrl =
+    account.config.webhookPublicUrl ??
+    `http://${host === "0.0.0.0" ? "localhost" : host}:${port}${path}`;
+  logger.info(`[nextcloud-talk:${account.accountId}] webhook listening on ${publicUrl}`);
+
+  return { stop };
+}