@openclaw/nextcloud-talk 2026.3.13 → 2026.5.2-beta.1

package/src/policy.ts

@@ -1,24 +1,23 @@
-import type {
-  AllowlistMatch,
-  ChannelGroupContext,
-  GroupPolicy,
-  GroupToolPolicyConfig,
-} from "openclaw/plugin-sdk/nextcloud-talk";
 import {
   buildChannelKeyCandidates,
-  evaluateMatchedGroupAccessForPolicy,
   normalizeChannelSlug,
   resolveChannelEntryMatchWithFallback,
-  resolveMentionGatingWithBypass,
   resolveNestedAllowlistDecision,
-} from "openclaw/plugin-sdk/nextcloud-talk";
+} from "openclaw/plugin-sdk/channel-targets";
+import { evaluateMatchedGroupAccessForPolicy } from "openclaw/plugin-sdk/group-access";
+import type {
+  AllowlistMatch,
+  ChannelGroupContext,
+  GroupPolicy,
+  GroupToolPolicyConfig,
+} from "../runtime-api.js";
 import type { NextcloudTalkRoomConfig } from "./types.js";
 
 function normalizeAllowEntry(raw: string): string {
   return raw
     .trim()
-    .toLowerCase()
-    .replace(/^(nextcloud-talk|nc-talk|nc):/i, "");
+    .replace(/^(nextcloud-talk|nc-talk|nc):/i, "")
+    .toLowerCase();
 }
 
 export function normalizeNextcloudTalkAllowlist(
@@ -45,7 +44,7 @@ export function resolveNextcloudTalkAllowlistMatch(params: {
   return { allowed: false };
 }
 
-export type NextcloudTalkRoomMatch = {
+type NextcloudTalkRoomMatch = {
   roomConfig?: NextcloudTalkRoomConfig;
   wildcardConfig?: NextcloudTalkRoomConfig;
   roomKey?: string;
@@ -57,16 +56,10 @@ export type NextcloudTalkRoomMatch = {
 export function resolveNextcloudTalkRoomMatch(params: {
   rooms?: Record<string, NextcloudTalkRoomConfig>;
   roomToken: string;
-  roomName?: string | null;
 }): NextcloudTalkRoomMatch {
   const rooms = params.rooms ?? {};
   const allowlistConfigured = Object.keys(rooms).length > 0;
-  const roomName = params.roomName?.trim() || undefined;
-  const roomCandidates = buildChannelKeyCandidates(
-    params.roomToken,
-    roomName,
-    roomName ? normalizeChannelSlug(roomName) : undefined,
-  );
+  const roomCandidates = buildChannelKeyCandidates(params.roomToken);
   const match = resolveChannelEntryMatchWithFallback({
     entries: rooms,
     keys: roomCandidates,
@@ -101,11 +94,9 @@ export function resolveNextcloudTalkGroupToolPolicy(
   if (!roomToken) {
     return undefined;
   }
-  const roomName = params.groupChannel?.trim() || undefined;
   const match = resolveNextcloudTalkRoomMatch({
     rooms: cfg.channels?.["nextcloud-talk"]?.rooms,
     roomToken,
-    roomName,
   });
   return match.roomConfig?.tools ?? match.wildcardConfig?.tools;
 }
@@ -175,14 +166,15 @@ export function resolveNextcloudTalkMentionGate(params: {
   hasControlCommand: boolean;
   commandAuthorized: boolean;
 }): { shouldSkip: boolean; shouldBypassMention: boolean } {
-  const result = resolveMentionGatingWithBypass({
-    isGroup: params.isGroup,
-    requireMention: params.requireMention,
-    canDetectMention: true,
-    wasMentioned: params.wasMentioned,
-    allowTextCommands: params.allowTextCommands,
-    hasControlCommand: params.hasControlCommand,
-    commandAuthorized: params.commandAuthorized,
-  });
-  return { shouldSkip: result.shouldSkip, shouldBypassMention: result.shouldBypassMention };
+  const shouldBypassMention =
+    params.isGroup &&
+    params.requireMention &&
+    !params.wasMentioned &&
+    params.allowTextCommands &&
+    params.commandAuthorized &&
+    params.hasControlCommand;
+  return {
+    shouldBypassMention,
+    shouldSkip: params.requireMention && !params.wasMentioned && !shouldBypassMention,
+  };
 }

package/src/replay-guard.ts

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { createPersistentDedupe } from "openclaw/plugin-sdk/nextcloud-talk";
+import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 
 const DEFAULT_REPLAY_TTL_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_MEMORY_MAX_SIZE = 1_000;
@@ -22,8 +22,8 @@ function buildReplayKey(params: { roomToken: string; messageId: string }): strin
   return `${roomToken}:${messageId}`;
 }
 
-export type NextcloudTalkReplayGuardOptions = {
-  stateDir: string;
+type NextcloudTalkReplayGuardOptions = {
+  stateDir?: string;
   ttlMs?: number;
   memoryMaxSize?: number;
   fileMaxEntries?: number;
@@ -31,6 +31,22 @@ export type NextcloudTalkReplayGuardOptions = {
 };
 
 export type NextcloudTalkReplayGuard = {
+  claimMessage: (params: {
+    accountId: string;
+    roomToken: string;
+    messageId: string;
+  }) => Promise<"claimed" | "duplicate" | "inflight" | "invalid">;
+  commitMessage: (params: {
+    accountId: string;
+    roomToken: string;
+    messageId: string;
+  }) => Promise<boolean>;
+  releaseMessage: (params: {
+    accountId: string;
+    roomToken: string;
+    messageId: string;
+    error?: unknown;
+  }) => void;
   shouldProcessMessage: (params: {
     accountId: string;
     roomToken: string;
@@ -41,24 +57,71 @@ export type NextcloudTalkReplayGuard = {
 export function createNextcloudTalkReplayGuard(
   options: NextcloudTalkReplayGuardOptions,
 ): NextcloudTalkReplayGuard {
-  const stateDir = options.stateDir.trim();
-  const persistentDedupe = createPersistentDedupe({
+  const stateDir = options.stateDir?.trim();
+  const baseOptions = {
     ttlMs: options.ttlMs ?? DEFAULT_REPLAY_TTL_MS,
     memoryMaxSize: options.memoryMaxSize ?? DEFAULT_MEMORY_MAX_SIZE,
-    fileMaxEntries: options.fileMaxEntries ?? DEFAULT_FILE_MAX_ENTRIES,
-    resolveFilePath: (namespace) =>
-      path.join(stateDir, "nextcloud-talk", "replay-dedupe", `${sanitizeSegment(namespace)}.json`),
-  });
+  };
+  const dedupe = createClaimableDedupe(
+    stateDir
+      ? {
+          ...baseOptions,
+          fileMaxEntries: options.fileMaxEntries ?? DEFAULT_FILE_MAX_ENTRIES,
+          resolveFilePath: (namespace) =>
+            path.join(
+              stateDir,
+              "nextcloud-talk",
+              "replay-dedupe",
+              `${sanitizeSegment(namespace)}.json`,
+            ),
+          onDiskError: options.onDiskError,
+        }
+      : baseOptions,
+  );
 
   return {
+    claimMessage: async ({ accountId, roomToken, messageId }) => {
+      const replayKey = buildReplayKey({ roomToken, messageId });
+      if (!replayKey) {
+        return "invalid";
+      }
+      const result = await dedupe.claim(replayKey, {
+        namespace: accountId,
+      });
+      return result.kind;
+    },
+    commitMessage: async ({ accountId, roomToken, messageId }) => {
+      const replayKey = buildReplayKey({ roomToken, messageId });
+      if (!replayKey) {
+        return true;
+      }
+      return await dedupe.commit(replayKey, {
+        namespace: accountId,
+      });
+    },
+    releaseMessage: ({ accountId, roomToken, messageId, error }) => {
+      const replayKey = buildReplayKey({ roomToken, messageId });
+      if (!replayKey) {
+        return;
+      }
+      dedupe.release(replayKey, {
+        namespace: accountId,
+        error,
+      });
+    },
     shouldProcessMessage: async ({ accountId, roomToken, messageId }) => {
       const replayKey = buildReplayKey({ roomToken, messageId });
       if (!replayKey) {
         return true;
       }
-      return await persistentDedupe.checkAndRecord(replayKey, {
+      const result = await dedupe.claim(replayKey, {
+        namespace: accountId,
+      });
+      if (result.kind !== "claimed") {
+        return false;
+      }
+      return await dedupe.commit(replayKey, {
         namespace: accountId,
-        onDiskError: options.onDiskError,
       });
     },
   };

package/src/room-info.test.ts

@@ -0,0 +1,116 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { resolveNextcloudTalkRoomKind, __testing } from "./room-info.js";
+
+const fetchWithSsrFGuard = vi.hoisted(() => vi.fn());
+const readFileSync = vi.hoisted(() => vi.fn());
+
+vi.mock("../runtime-api.js", () => {
+  return vi
+    .importActual<typeof import("../runtime-api.js")>("../runtime-api.js")
+    .then((actual) => ({
+      ...actual,
+      fetchWithSsrFGuard,
+    }));
+});
+
+vi.mock("node:fs", () => {
+  return vi.importActual<typeof import("node:fs")>("node:fs").then((actual) => ({
+    ...actual,
+    readFileSync,
+  }));
+});
+
+afterEach(() => {
+  fetchWithSsrFGuard.mockReset();
+  readFileSync.mockReset();
+  __testing.resetRoomCache();
+});
+
+describe("nextcloud talk room info", () => {
+  it("resolves direct rooms from the room info endpoint", async () => {
+    const release = vi.fn(async () => {});
+    fetchWithSsrFGuard.mockResolvedValue({
+      response: {
+        ok: true,
+        json: async () => ({
+          ocs: {
+            data: {
+              type: 1,
+            },
+          },
+        }),
+      },
+      release,
+    });
+
+    const kind = await resolveNextcloudTalkRoomKind({
+      account: {
+        accountId: "acct-direct",
+        baseUrl: "https://nc.example.com",
+        config: {
+          apiUser: "bot",
+          apiPassword: "secret",
+        },
+      } as never,
+      roomToken: "room-direct",
+    });
+
+    expect(kind).toBe("direct");
+    expect(fetchWithSsrFGuard).toHaveBeenCalledWith(
+      expect.objectContaining({
+        url: "https://nc.example.com/ocs/v2.php/apps/spreed/api/v4/room/room-direct",
+        auditContext: "nextcloud-talk.room-info",
+      }),
+    );
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("reads the api password from a file and logs non-ok room info responses", async () => {
+    const release = vi.fn(async () => {});
+    const log = vi.fn();
+    const error = vi.fn();
+    const exit = vi.fn();
+    readFileSync.mockReturnValue("file-secret\n");
+    fetchWithSsrFGuard.mockResolvedValue({
+      response: {
+        ok: false,
+        status: 403,
+        json: async () => ({}),
+      },
+      release,
+    });
+
+    const kind = await resolveNextcloudTalkRoomKind({
+      account: {
+        accountId: "acct-group",
+        baseUrl: "https://nc.example.com",
+        config: {
+          apiUser: "bot",
+          apiPasswordFile: "/tmp/nextcloud-secret",
+        },
+      } as never,
+      roomToken: "room-group",
+      runtime: { log, error, exit },
+    });
+
+    expect(kind).toBeUndefined();
+    expect(readFileSync).toHaveBeenCalledWith("/tmp/nextcloud-secret", "utf-8");
+    expect(log).toHaveBeenCalledWith("nextcloud-talk: room lookup failed (403) token=room-group");
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("returns undefined from room info without credentials or base url", async () => {
+    await expect(
+      resolveNextcloudTalkRoomKind({
+        account: {
+          accountId: "acct-missing",
+          baseUrl: "",
+          config: {},
+        } as never,
+        roomToken: "room-missing",
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(fetchWithSsrFGuard).not.toHaveBeenCalled();
+  });
+});

package/src/room-info.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/nextcloud-talk";
-import type { RuntimeEnv } from "openclaw/plugin-sdk/nextcloud-talk";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
+import { fetchWithSsrFGuard, type RuntimeEnv } from "../runtime-api.js";
 import type { ResolvedNextcloudTalkAccount } from "./accounts.js";
 import { normalizeResolvedSecretInputString } from "./secret-input.js";
 
@@ -12,6 +13,12 @@ const roomCache = new Map<
   { kind?: "direct" | "group"; fetchedAt: number; error?: string }
 >();
 
+export const __testing = {
+  resetRoomCache() {
+    roomCache.clear();
+  },
+};
+
 function resolveRoomCacheKey(params: { accountId: string; roomToken: string }) {
   return `${params.accountId}:${params.roomToken}`;
 }
@@ -106,6 +113,7 @@ export async function resolveNextcloudTalkRoomKind(params: {
         },
       },
       auditContext: "nextcloud-talk.room-info",
+      policy: ssrfPolicyFromPrivateNetworkOptIn(account.config),
     });
     try {
       if (!response.ok) {
@@ -132,7 +140,7 @@ export async function resolveNextcloudTalkRoomKind(params: {
   } catch (err) {
     roomCache.set(key, {
       fetchedAt: Date.now(),
-      error: err instanceof Error ? err.message : String(err),
+      error: formatErrorMessage(err),
     });
     runtime?.error?.(`nextcloud-talk: room lookup error: ${String(err)}`);
     return undefined;

package/src/runtime.ts

@@ -1,6 +1,9 @@
-import { createPluginRuntimeStore } from "openclaw/plugin-sdk/compat";
-import type { PluginRuntime } from "openclaw/plugin-sdk/nextcloud-talk";
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
+import type { PluginRuntime } from "openclaw/plugin-sdk/runtime-store";
 
 const { setRuntime: setNextcloudTalkRuntime, getRuntime: getNextcloudTalkRuntime } =
-  createPluginRuntimeStore<PluginRuntime>("Nextcloud Talk runtime not initialized");
+  createPluginRuntimeStore<PluginRuntime>({
+    pluginId: "nextcloud-talk",
+    errorMessage: "Nextcloud Talk runtime not initialized",
+  });
 export { getNextcloudTalkRuntime, setNextcloudTalkRuntime };

package/src/secret-contract.ts

@@ -0,0 +1,103 @@
+import {
+  collectConditionalChannelFieldAssignments,
+  getChannelSurface,
+  hasOwnProperty,
+  type ChannelAccountEntry,
+  type ResolverContext,
+  type SecretDefaults,
+} from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+
+export const secretTargetRegistryEntries: import("openclaw/plugin-sdk/channel-secret-basic-runtime").SecretTargetRegistryEntry[] =
+  [
+    {
+      id: "channels.nextcloud-talk.accounts.*.apiPassword",
+      targetType: "channels.nextcloud-talk.accounts.*.apiPassword",
+      configFile: "openclaw.json",
+      pathPattern: "channels.nextcloud-talk.accounts.*.apiPassword",
+      secretShape: "secret_input",
+      expectedResolvedValue: "string",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+    },
+    {
+      id: "channels.nextcloud-talk.accounts.*.botSecret",
+      targetType: "channels.nextcloud-talk.accounts.*.botSecret",
+      configFile: "openclaw.json",
+      pathPattern: "channels.nextcloud-talk.accounts.*.botSecret",
+      secretShape: "secret_input",
+      expectedResolvedValue: "string",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+    },
+    {
+      id: "channels.nextcloud-talk.apiPassword",
+      targetType: "channels.nextcloud-talk.apiPassword",
+      configFile: "openclaw.json",
+      pathPattern: "channels.nextcloud-talk.apiPassword",
+      secretShape: "secret_input",
+      expectedResolvedValue: "string",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+    },
+    {
+      id: "channels.nextcloud-talk.botSecret",
+      targetType: "channels.nextcloud-talk.botSecret",
+      configFile: "openclaw.json",
+      pathPattern: "channels.nextcloud-talk.botSecret",
+      secretShape: "secret_input",
+      expectedResolvedValue: "string",
+      includeInPlan: true,
+      includeInConfigure: true,
+      includeInAudit: true,
+    },
+  ];
+
+export function collectRuntimeConfigAssignments(params: {
+  config: { channels?: Record<string, unknown> };
+  defaults?: SecretDefaults;
+  context: ResolverContext;
+}): void {
+  const resolved = getChannelSurface(params.config, "nextcloud-talk");
+  if (!resolved) {
+    return;
+  }
+  const { channel: nextcloudTalk, surface } = resolved;
+  const inheritsField =
+    (field: string) =>
+    ({ account, enabled }: ChannelAccountEntry) =>
+      enabled && !hasOwnProperty(account, field);
+  collectConditionalChannelFieldAssignments({
+    channelKey: "nextcloud-talk",
+    field: "botSecret",
+    channel: nextcloudTalk,
+    surface,
+    defaults: params.defaults,
+    context: params.context,
+    topLevelActiveWithoutAccounts: true,
+    topLevelInheritedAccountActive: inheritsField("botSecret"),
+    accountActive: ({ enabled }) => enabled,
+    topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level botSecret.",
+    accountInactiveReason: "Nextcloud Talk account is disabled.",
+  });
+  collectConditionalChannelFieldAssignments({
+    channelKey: "nextcloud-talk",
+    field: "apiPassword",
+    channel: nextcloudTalk,
+    surface,
+    defaults: params.defaults,
+    context: params.context,
+    topLevelActiveWithoutAccounts: true,
+    topLevelInheritedAccountActive: inheritsField("apiPassword"),
+    accountActive: ({ enabled }) => enabled,
+    topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level apiPassword.",
+    accountInactiveReason: "Nextcloud Talk account is disabled.",
+  });
+}
+
+export const channelSecrets = {
+  secretTargetRegistryEntries,
+  collectRuntimeConfigAssignments,
+};

package/src/secret-input.ts

@@ -1,13 +1,4 @@
-import {
-  buildSecretInputSchema,
-  hasConfiguredSecretInput,
-  normalizeResolvedSecretInputString,
-  normalizeSecretInputString,
-} from "openclaw/plugin-sdk/nextcloud-talk";
-
 export {
   buildSecretInputSchema,
-  hasConfiguredSecretInput,
   normalizeResolvedSecretInputString,
-  normalizeSecretInputString,
-};
+} from "openclaw/plugin-sdk/secret-input";

package/src/send.cfg-threading.test.ts

@@ -0,0 +1,153 @@
+import {
+  createSendCfgThreadingRuntime,
+  expectProvidedCfgSkipsRuntimeLoad,
+} from "openclaw/plugin-sdk/channel-test-helpers";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const hoisted = vi.hoisted(() => ({
+  loadConfig: vi.fn(),
+  resolveMarkdownTableMode: vi.fn(() => "preserve"),
+  convertMarkdownTables: vi.fn((text: string) => text),
+  record: vi.fn(),
+  resolveNextcloudTalkAccount: vi.fn(),
+  ssrfPolicyFromPrivateNetworkOptIn: vi.fn(() => undefined),
+  generateNextcloudTalkSignature: vi.fn(() => ({
+    random: "r",
+    signature: "s",
+  })),
+  mockFetchGuard: vi.fn(),
+}));
+
+vi.mock("./send.runtime.js", () => {
+  return {
+    convertMarkdownTables: hoisted.convertMarkdownTables,
+    fetchWithSsrFGuard: hoisted.mockFetchGuard,
+    generateNextcloudTalkSignature: hoisted.generateNextcloudTalkSignature,
+    getNextcloudTalkRuntime: () => createSendCfgThreadingRuntime(hoisted),
+    requireRuntimeConfig: (cfg: unknown, context: string) => {
+      if (cfg) {
+        return cfg;
+      }
+      throw new Error(`${context} requires a resolved runtime config`);
+    },
+    resolveNextcloudTalkAccount: hoisted.resolveNextcloudTalkAccount,
+    resolveMarkdownTableMode: hoisted.resolveMarkdownTableMode,
+    ssrfPolicyFromPrivateNetworkOptIn: hoisted.ssrfPolicyFromPrivateNetworkOptIn,
+  };
+});
+
+const { sendMessageNextcloudTalk, sendReactionNextcloudTalk } = await import("./send.js");
+
+function expectProvidedMessageCfgThreading(cfg: unknown): void {
+  expectProvidedCfgSkipsRuntimeLoad({
+    loadConfig: hoisted.loadConfig,
+    resolveAccount: hoisted.resolveNextcloudTalkAccount,
+    cfg,
+    accountId: "work",
+  });
+  expect(hoisted.resolveMarkdownTableMode).toHaveBeenCalledWith({
+    cfg,
+    channel: "nextcloud-talk",
+    accountId: "default",
+  });
+  expect(hoisted.convertMarkdownTables).toHaveBeenCalledWith("hello", "preserve");
+}
+
+describe("nextcloud-talk send cfg threading", () => {
+  const fetchMock = vi.fn<typeof fetch>();
+  const defaultAccount = {
+    accountId: "default",
+    baseUrl: "https://nextcloud.example.com",
+    secret: "secret-value",
+  };
+
+  function mockNextcloudMessageResponse(messageId: number, timestamp: number): void {
+    fetchMock.mockResolvedValueOnce(
+      new Response(
+        JSON.stringify({
+          ocs: { data: { id: messageId, timestamp } },
+        }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      ),
+    );
+  }
+
+  beforeEach(() => {
+    vi.stubGlobal("fetch", fetchMock);
+    // Route the SSRF guard mock through the global fetch mock.
+    hoisted.mockFetchGuard.mockImplementation(async (p: { url: string; init?: RequestInit }) => {
+      const response = await globalThis.fetch(p.url, p.init);
+      return { response, release: async () => {}, finalUrl: p.url };
+    });
+    hoisted.loadConfig.mockReset();
+    hoisted.resolveMarkdownTableMode.mockClear();
+    hoisted.convertMarkdownTables.mockClear();
+    hoisted.record.mockReset();
+    hoisted.ssrfPolicyFromPrivateNetworkOptIn.mockClear();
+    hoisted.generateNextcloudTalkSignature.mockClear();
+    hoisted.resolveNextcloudTalkAccount.mockReset();
+    hoisted.resolveNextcloudTalkAccount.mockReturnValue(defaultAccount);
+  });
+
+  afterEach(() => {
+    fetchMock.mockReset();
+    hoisted.mockFetchGuard.mockReset();
+    vi.unstubAllGlobals();
+  });
+
+  it("uses provided cfg for sendMessage and skips runtime loadConfig", async () => {
+    const cfg = { source: "provided" } as const;
+    mockNextcloudMessageResponse(12345, 1_706_000_000);
+
+    const result = await sendMessageNextcloudTalk("room:abc123", "hello", {
+      cfg,
+      accountId: "work",
+    });
+
+    expectProvidedMessageCfgThreading(cfg);
+    expect(hoisted.record).toHaveBeenCalledWith({
+      channel: "nextcloud-talk",
+      accountId: "default",
+      direction: "outbound",
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({
+      messageId: "12345",
+      roomToken: "abc123",
+      timestamp: 1_706_000_000,
+    });
+  });
+
+  it("sends with provided cfg even when the runtime store is not initialized", async () => {
+    const cfg = { source: "provided" } as const;
+    hoisted.record.mockImplementation(() => {
+      throw new Error("Nextcloud Talk runtime not initialized");
+    });
+    mockNextcloudMessageResponse(12346, 1_706_000_001);
+
+    const result = await sendMessageNextcloudTalk("room:abc123", "hello", {
+      cfg,
+      accountId: "work",
+    });
+
+    expectProvidedMessageCfgThreading(cfg);
+    expect(result).toEqual({
+      messageId: "12346",
+      roomToken: "abc123",
+      timestamp: 1_706_000_001,
+    });
+  });
+
+  it("fails hard for sendReaction when cfg is omitted", async () => {
+    fetchMock.mockResolvedValueOnce(new Response("{}", { status: 200 }));
+
+    await expect(
+      sendReactionNextcloudTalk("room:ops", "m-1", "👍", {
+        accountId: "default",
+      } as never),
+    ).rejects.toThrow("Nextcloud Talk send requires a resolved runtime config");
+
+    expect(hoisted.loadConfig).not.toHaveBeenCalled();
+    expect(hoisted.resolveNextcloudTalkAccount).not.toHaveBeenCalled();
+  });
+});

package/src/send.runtime.ts

@@ -0,0 +1,8 @@
+export { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
+export { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
+export { ssrfPolicyFromPrivateNetworkOptIn } from "openclaw/plugin-sdk/ssrf-runtime";
+export { convertMarkdownTables } from "openclaw/plugin-sdk/text-runtime";
+export { fetchWithSsrFGuard } from "../runtime-api.js";
+export { resolveNextcloudTalkAccount } from "./accounts.js";
+export { getNextcloudTalkRuntime } from "./runtime.js";
+export { generateNextcloudTalkSignature } from "./signature.js";