@openclaw/nextcloud-talk 2026.5.7 → 2026.5.9-beta.1

package/dist/api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-BVVRsVr5.js";
+import { t as nextcloudTalkPlugin } from "./channel-DOIJGKcg.js";
 export { nextcloudTalkPlugin };

package/dist/{channel-BVVRsVr5.js → channel-DOIJGKcg.js}

@@ -1,5 +1,5 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-CYlB-4Bf.js";
-import { a as fetchWithSsrFGuard, c as resolveAllowlistProviderRuntimeGroupPolicy, d as warnMissingProviderGroupPolicyFallbackOnce, f as getNextcloudTalkRuntime, i as dispatchInboundReplyWithBase, l as resolveDefaultGroupPolicy, n as createChannelPairingController, o as logInboundDrop, r as deliverFormattedTextWithAttachments, s as readStoreAllowFromForDmPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveDmGroupAccessWithCommandGate } from "./runtime-api-BcCzeRN9.js";
+import { a as fetchWithSsrFGuard, c as resolveAllowlistProviderRuntimeGroupPolicy, d as warnMissingProviderGroupPolicyFallbackOnce, f as getNextcloudTalkRuntime, i as deliverFormattedTextWithAttachments, l as resolveDefaultGroupPolicy, n as createChannelMessageReplyPipeline, o as logInboundDrop, r as createChannelPairingController, s as readStoreAllowFromForDmPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveDmGroupAccessWithCommandGate } from "./runtime-api-Cy4XTpP2.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DIa4Qbi_.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-bczDw2-2.js";
 import { describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
@@ -11,6 +11,13 @@ import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
 import { convertMarkdownTables, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
 import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
+import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter } from "openclaw/plugin-sdk/channel-message";
+import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { readFileSync } from "node:fs";
+import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { clearAccountEntryFields } from "openclaw/plugin-sdk/channel-plugin-common";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-id";
 import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, ToolPolicySchema, buildChannelConfigSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
@@ -18,19 +25,12 @@ import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime, runStoppablePassiveMonitor, safeParseJsonWithSchema } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "openclaw/plugin-sdk/zod";
-import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
 import { createAccountStatusSink } from "openclaw/plugin-sdk/channel-lifecycle";
 import os from "node:os";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback, resolveNestedAllowlistDecision } from "openclaw/plugin-sdk/channel-targets";
 import { evaluateMatchedGroupAccessForPolicy } from "openclaw/plugin-sdk/group-access";
-import { readFileSync } from "node:fs";
-import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
-import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
-import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
-import { z as z$1 } from "zod";
 import path from "node:path";
 import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
@@ -140,6 +140,195 @@ const nextcloudTalkApprovalAuth = createResolvedApproverActionAuthAdapter({
 	normalizeSenderId: (value) => normalizeNextcloudTalkApproverId(value)
 });
 //#endregion
+//#region extensions/nextcloud-talk/src/api-credentials.ts
+function resolveNextcloudTalkApiCredentials(params) {
+	const apiUser = params.apiUser?.trim();
+	if (!apiUser) return;
+	const inlinePassword = normalizeResolvedSecretInputString({
+		value: params.apiPassword,
+		path: "channels.nextcloud-talk.apiPassword"
+	});
+	if (inlinePassword) return {
+		apiUser,
+		apiPassword: inlinePassword
+	};
+	if (!params.apiPasswordFile) return;
+	try {
+		const filePassword = readFileSync(params.apiPasswordFile, "utf-8").trim();
+		return filePassword ? {
+			apiUser,
+			apiPassword: filePassword
+		} : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region extensions/nextcloud-talk/src/signature.ts
+const SIGNATURE_HEADER = "x-nextcloud-talk-signature";
+const RANDOM_HEADER = "x-nextcloud-talk-random";
+const BACKEND_HEADER = "x-nextcloud-talk-backend";
+/**
+* Verify the HMAC-SHA256 signature of an incoming webhook request.
+* Signature is calculated as: HMAC-SHA256(random + body, secret)
+*/
+function verifyNextcloudTalkSignature(params) {
+	const { signature, random, body, secret } = params;
+	if (!signature || !random || !secret) return false;
+	const expected = createHmac("sha256", secret).update(random + body).digest("hex");
+	const expectedBuf = Buffer.from(expected, "utf8");
+	const signatureBuf = Buffer.from(signature, "utf8");
+	const maxLen = Math.max(expectedBuf.length, signatureBuf.length);
+	const paddedExpected = Buffer.alloc(maxLen);
+	const paddedSignature = Buffer.alloc(maxLen);
+	expectedBuf.copy(paddedExpected);
+	signatureBuf.copy(paddedSignature);
+	const timingResult = timingSafeEqual(paddedExpected, paddedSignature);
+	return expectedBuf.length === signatureBuf.length && timingResult;
+}
+/**
+* Extract webhook headers from an incoming request.
+*/
+function extractNextcloudTalkHeaders(headers) {
+	const getHeader = (name) => {
+		const value = headers[name] ?? headers[normalizeLowercaseStringOrEmpty(name)];
+		return Array.isArray(value) ? value[0] : value;
+	};
+	const signature = getHeader(SIGNATURE_HEADER);
+	const random = getHeader(RANDOM_HEADER);
+	const backend = getHeader(BACKEND_HEADER);
+	if (!signature || !random || !backend) return null;
+	return {
+		signature,
+		random,
+		backend
+	};
+}
+/**
+* Generate signature headers for an outbound request to Nextcloud Talk.
+*/
+function generateNextcloudTalkSignature(params) {
+	const { body, secret } = params;
+	const random = randomBytes(32).toString("hex");
+	return {
+		random,
+		signature: createHmac("sha256", secret).update(random + body).digest("hex")
+	};
+}
+//#endregion
+//#region extensions/nextcloud-talk/src/bot-preflight.ts
+const BOT_FEATURE_RESPONSE = 2;
+function normalizeUrlForMatch(value) {
+	if (!value?.trim()) return "";
+	try {
+		const url = new URL(value.trim());
+		url.hash = "";
+		return url.toString().replace(/\/$/, "");
+	} catch {
+		return value.trim().replace(/\/$/, "");
+	}
+}
+function coerceFeatureMask(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string" && value.trim()) {
+		const parsed = Number.parseInt(value, 10);
+		return Number.isFinite(parsed) ? parsed : void 0;
+	}
+}
+function formatMissingResponseFeatureMessage(bot, features) {
+	const id = bot.id == null ? "unknown" : String(bot.id);
+	return `Nextcloud Talk bot "${bot.name?.trim() || "matching bot"}" (${id}) is missing the response feature${typeof features === "number" ? ` (features=${features})` : ""}; outbound replies will fail. Run ./occ talk:bot:state --feature webhook --feature response --feature reaction ${id} 1 or reinstall the bot with --feature response.`;
+}
+async function probeNextcloudTalkBotResponseFeature(params) {
+	const { account, timeoutMs } = params;
+	const baseUrl = account.baseUrl?.trim();
+	if (!baseUrl) return {
+		ok: true,
+		skipped: true,
+		code: "missing_base_url",
+		message: "Nextcloud Talk bot response feature probe skipped: baseUrl is not configured."
+	};
+	const webhookUrl = normalizeUrlForMatch(account.config.webhookPublicUrl);
+	if (!webhookUrl) return {
+		ok: true,
+		skipped: true,
+		code: "missing_webhook_url",
+		message: "Nextcloud Talk bot response feature probe skipped: webhookPublicUrl is not configured."
+	};
+	const credentials = resolveNextcloudTalkApiCredentials({
+		apiUser: account.config.apiUser,
+		apiPassword: account.config.apiPassword,
+		apiPasswordFile: account.config.apiPasswordFile
+	});
+	if (!credentials) return {
+		ok: true,
+		skipped: true,
+		code: "missing_api_credentials",
+		message: "Nextcloud Talk bot response feature probe skipped: apiUser/apiPassword are not configured."
+	};
+	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/admin`;
+	const auth = Buffer.from(`${credentials.apiUser}:${credentials.apiPassword}`, "utf-8").toString("base64");
+	try {
+		const { response, release } = await fetchWithSsrFGuard({
+			url,
+			init: {
+				method: "GET",
+				headers: {
+					Authorization: `Basic ${auth}`,
+					"OCS-APIRequest": "true",
+					Accept: "application/json"
+				}
+			},
+			auditContext: "nextcloud-talk.bot-response-preflight",
+			policy: ssrfPolicyFromPrivateNetworkOptIn$1(account.config),
+			timeoutMs
+		});
+		try {
+			if (!response.ok) {
+				const body = await response.text().catch(() => "");
+				return {
+					ok: false,
+					code: "api_error",
+					status: response.status,
+					message: `Nextcloud Talk bot response feature probe failed (${response.status})${body ? `: ${body}` : ""}`
+				};
+			}
+			const payload = await response.json();
+			const bot = (Array.isArray(payload.ocs?.data) ? payload.ocs.data : []).find((entry) => normalizeUrlForMatch(entry.url) === webhookUrl);
+			if (!bot) return {
+				ok: false,
+				code: "bot_not_found",
+				message: `Nextcloud Talk bot response feature probe could not find a bot with webhook URL ${webhookUrl}.`
+			};
+			const features = coerceFeatureMask(bot.features);
+			if (features == null || (features & BOT_FEATURE_RESPONSE) !== BOT_FEATURE_RESPONSE) return {
+				ok: false,
+				code: "missing_response_feature",
+				botId: bot.id == null ? void 0 : String(bot.id),
+				botName: bot.name,
+				features,
+				message: formatMissingResponseFeatureMessage(bot, features)
+			};
+			return {
+				ok: true,
+				code: "ok",
+				botId: bot.id == null ? void 0 : String(bot.id),
+				botName: bot.name,
+				features,
+				message: `Nextcloud Talk bot "${bot.name ?? bot.id ?? "matching bot"}" has the response feature.`
+			};
+		} finally {
+			await release();
+		}
+	} catch (error) {
+		return {
+			ok: false,
+			code: "request_failed",
+			message: `Nextcloud Talk bot response feature probe failed: ${formatErrorMessage(error)}`
+		};
+	}
+}
+//#endregion
 //#region extensions/nextcloud-talk/src/channel.adapters.ts
 const nextcloudTalkConfigAdapter = createScopedChannelConfigAdapter({
 	sectionKey: "nextcloud-talk",
@@ -229,9 +418,26 @@ const NextcloudTalkConfigSchema = NextcloudTalkAccountSchemaBase.extend({
 });
 //#endregion
 //#region extensions/nextcloud-talk/src/doctor.ts
+async function collectNextcloudTalkBotResponseWarnings(params) {
+	const warnings = [];
+	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
+		const account = resolveNextcloudTalkAccount({
+			cfg: params.cfg,
+			accountId
+		});
+		if (!account.enabled || !account.secret || !account.baseUrl) continue;
+		const result = await probeNextcloudTalkBotResponseFeature({
+			account,
+			timeoutMs: 5e3
+		});
+		if (result.code === "missing_response_feature" || result.code === "bot_not_found" || result.code === "api_error" || result.code === "request_failed") warnings.push(`- channels.nextcloud-talk.${account.accountId}: ${result.message}`);
+	}
+	return warnings;
+}
 const nextcloudTalkDoctor = {
 	legacyConfigRules,
-	normalizeCompatibilityConfig
+	normalizeCompatibilityConfig,
+	collectPreviewWarnings: async ({ cfg }) => await collectNextcloudTalkBotResponseWarnings({ cfg })
 };
 //#endregion
 //#region extensions/nextcloud-talk/src/policy.ts
@@ -338,19 +544,6 @@ const roomCache = /* @__PURE__ */ new Map();
 function resolveRoomCacheKey(params) {
 	return `${params.accountId}:${params.roomToken}`;
 }
-function readApiPassword(params) {
-	const inlinePassword = normalizeResolvedSecretInputString({
-		value: params.apiPassword,
-		path: "channels.nextcloud-talk.apiPassword"
-	});
-	if (inlinePassword) return inlinePassword;
-	if (!params.apiPasswordFile) return;
-	try {
-		return readFileSync(params.apiPasswordFile, "utf-8").trim() || void 0;
-	} catch {
-		return;
-	}
-}
 function coerceRoomType(value) {
 	if (typeof value === "number" && Number.isFinite(value)) return value;
 	if (typeof value === "string" && value.trim()) {
@@ -375,16 +568,16 @@ async function resolveNextcloudTalkRoomKind(params) {
 		if (cached.kind && age < ROOM_CACHE_TTL_MS) return cached.kind;
 		if (cached.error && age < ROOM_CACHE_ERROR_TTL_MS) return;
 	}
-	const apiUser = account.config.apiUser?.trim();
-	const apiPassword = readApiPassword({
+	const apiCredentials = resolveNextcloudTalkApiCredentials({
+		apiUser: account.config.apiUser,
 		apiPassword: account.config.apiPassword,
 		apiPasswordFile: account.config.apiPasswordFile
 	});
-	if (!apiUser || !apiPassword) return;
+	if (!apiCredentials) return;
 	const baseUrl = account.baseUrl?.trim();
 	if (!baseUrl) return;
 	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v4/room/${roomToken}`;
-	const auth = Buffer.from(`${apiUser}:${apiPassword}`, "utf-8").toString("base64");
+	const auth = Buffer.from(`${apiCredentials.apiUser}:${apiCredentials.apiPassword}`, "utf-8").toString("base64");
 	try {
 		const { response, release } = await fetchWithSsrFGuard({
 			url,
@@ -450,58 +643,6 @@ function looksLikeNextcloudTalkTargetId(raw) {
 	return /^[a-z0-9]{8,}$/i.test(trimmed);
 }
 //#endregion
-//#region extensions/nextcloud-talk/src/signature.ts
-const SIGNATURE_HEADER = "x-nextcloud-talk-signature";
-const RANDOM_HEADER = "x-nextcloud-talk-random";
-const BACKEND_HEADER = "x-nextcloud-talk-backend";
-/**
-* Verify the HMAC-SHA256 signature of an incoming webhook request.
-* Signature is calculated as: HMAC-SHA256(random + body, secret)
-*/
-function verifyNextcloudTalkSignature(params) {
-	const { signature, random, body, secret } = params;
-	if (!signature || !random || !secret) return false;
-	const expected = createHmac("sha256", secret).update(random + body).digest("hex");
-	const expectedBuf = Buffer.from(expected, "utf8");
-	const signatureBuf = Buffer.from(signature, "utf8");
-	const maxLen = Math.max(expectedBuf.length, signatureBuf.length);
-	const paddedExpected = Buffer.alloc(maxLen);
-	const paddedSignature = Buffer.alloc(maxLen);
-	expectedBuf.copy(paddedExpected);
-	signatureBuf.copy(paddedSignature);
-	const timingResult = timingSafeEqual(paddedExpected, paddedSignature);
-	return expectedBuf.length === signatureBuf.length && timingResult;
-}
-/**
-* Extract webhook headers from an incoming request.
-*/
-function extractNextcloudTalkHeaders(headers) {
-	const getHeader = (name) => {
-		const value = headers[name] ?? headers[normalizeLowercaseStringOrEmpty(name)];
-		return Array.isArray(value) ? value[0] : value;
-	};
-	const signature = getHeader(SIGNATURE_HEADER);
-	const random = getHeader(RANDOM_HEADER);
-	const backend = getHeader(BACKEND_HEADER);
-	if (!signature || !random || !backend) return null;
-	return {
-		signature,
-		random,
-		backend
-	};
-}
-/**
-* Generate signature headers for an outbound request to Nextcloud Talk.
-*/
-function generateNextcloudTalkSignature(params) {
-	const { body, secret } = params;
-	const random = randomBytes(32).toString("hex");
-	return {
-		random,
-		signature: createHmac("sha256", secret).update(random + body).digest("hex")
-	};
-}
-//#endregion
 //#region extensions/nextcloud-talk/src/send.ts
 function resolveCredentials(explicit, account) {
 	const baseUrl = explicit.baseUrl?.trim() ?? account.baseUrl;
@@ -546,6 +687,18 @@ function recordNextcloudTalkOutboundActivity(accountId) {
 		if (!(error instanceof Error) || error.message !== "Nextcloud Talk runtime not initialized") throw error;
 	}
 }
+function createNextcloudTalkSendReceipt(params) {
+	const messageId = params.messageId.trim();
+	return createMessageReceiptFromOutboundResults({
+		results: messageId && messageId !== "unknown" ? [{
+			channel: "nextcloud-talk",
+			messageId,
+			conversationId: params.roomToken
+		}] : [],
+		kind: "text",
+		...params.replyTo ? { replyToId: params.replyTo } : {}
+	});
+}
 async function sendMessageNextcloudTalk(to, text, opts) {
 	const { cfg, account, baseUrl, secret } = resolveNextcloudTalkSendContext(opts);
 	const roomToken = normalizeRoomToken(to);
@@ -584,7 +737,7 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 			const status = response.status;
 			let errorMsg = `Nextcloud Talk send failed (${status})`;
 			if (status === 400) errorMsg = `Nextcloud Talk: bad request - ${errorBody || "invalid message format"}`;
-			else if (status === 401) errorMsg = "Nextcloud Talk: authentication failed - check bot secret";
+			else if (status === 401) errorMsg = "Nextcloud Talk: bot send was rejected - check the bot secret and ensure the bot was installed with --feature response";
 			else if (status === 403) errorMsg = "Nextcloud Talk: forbidden - bot may not have permission in this room";
 			else if (status === 404) errorMsg = `Nextcloud Talk: room not found (token=${roomToken})`;
 			else if (errorBody) errorMsg = `Nextcloud Talk send failed: ${errorBody}`;
@@ -602,6 +755,11 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 		return {
 			messageId,
 			roomToken,
+			receipt: createNextcloudTalkSendReceipt({
+				messageId,
+				roomToken,
+				...opts.replyTo ? { replyTo: opts.replyTo } : {}
+			}),
 			timestamp
 		};
 	} finally {
@@ -815,33 +973,46 @@ async function handleNextcloudTalkInbound(params) {
 		OriginatingTo: `nextcloud-talk:${roomToken}`,
 		CommandAuthorized: commandAuthorized
 	});
-	await dispatchInboundReplyWithBase({
+	const { onModelSelected, ...replyPipeline } = createChannelMessageReplyPipeline({
 		cfg: config,
+		agentId: route.agentId,
+		channel: CHANNEL_ID,
+		accountId: account.accountId
+	});
+	await core.channel.turn.runPrepared({
 		channel: CHANNEL_ID,
 		accountId: account.accountId,
-		route,
+		routeSessionKey: route.sessionKey,
 		storePath,
 		ctxPayload,
-		core,
-		deliver: async (payload) => {
-			await deliverNextcloudTalkReply({
-				cfg: config,
-				payload,
-				roomToken,
-				accountId: account.accountId,
-				statusSink
-			});
-		},
-		onRecordError: (err) => {
+		recordInboundSession: core.channel.session.recordInboundSession,
+		runDispatch: async () => await core.channel.reply.dispatchReplyWithBufferedBlockDispatcher({
+			ctx: ctxPayload,
+			cfg: config,
+			dispatcherOptions: {
+				...replyPipeline,
+				deliver: async (payload) => {
+					await deliverNextcloudTalkReply({
+						cfg: config,
+						payload,
+						roomToken,
+						accountId: account.accountId,
+						statusSink
+					});
+				},
+				onError: (err, info) => {
+					runtime.error?.(`nextcloud-talk ${info.kind} reply failed: ${String(err)}`);
+				}
+			},
+			replyOptions: {
+				onModelSelected,
+				skillFilter: roomConfig?.skills,
+				disableBlockStreaming: typeof account.config.blockStreaming === "boolean" ? !account.config.blockStreaming : void 0
+			}
+		}),
+		record: { onRecordError: (err) => {
 			runtime.error?.(`nextcloud-talk: failed updating session meta: ${String(err)}`);
-		},
-		onDispatchError: (err, info) => {
-			runtime.error?.(`nextcloud-talk ${info.kind} reply failed: ${String(err)}`);
-		},
-		replyOptions: {
-			skillFilter: roomConfig?.skills,
-			disableBlockStreaming: typeof account.config.blockStreaming === "boolean" ? !account.config.blockStreaming : void 0
-		}
+		} }
 	});
 }
 //#endregion
@@ -851,28 +1022,28 @@ const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 64 * 1024;
 const PREAUTH_WEBHOOK_BODY_TIMEOUT_MS = 5e3;
 const HEALTH_PATH = "/healthz";
 const WEBHOOK_AUTH_RATE_LIMIT_SCOPE = "nextcloud-talk-webhook-auth";
-const NextcloudTalkWebhookPayloadSchema = z$1.object({
-	type: z$1.enum([
+const NextcloudTalkWebhookPayloadSchema = z.object({
+	type: z.enum([
 		"Create",
 		"Update",
 		"Delete"
 	]),
-	actor: z$1.object({
-		type: z$1.literal("Person"),
-		id: z$1.string().min(1),
-		name: z$1.string()
+	actor: z.object({
+		type: z.literal("Person"),
+		id: z.string().min(1),
+		name: z.string()
 	}),
-	object: z$1.object({
-		type: z$1.literal("Note"),
-		id: z$1.string().min(1),
-		name: z$1.string(),
-		content: z$1.string(),
-		mediaType: z$1.string()
+	object: z.object({
+		type: z.literal("Note"),
+		id: z.string().min(1),
+		name: z.string(),
+		content: z.string(),
+		mediaType: z.string()
 	}),
-	target: z$1.object({
-		type: z$1.literal("Collection"),
-		id: z$1.string().min(1),
-		name: z$1.string()
+	target: z.object({
+		type: z.literal("Collection"),
+		id: z.string().min(1),
+		name: z.string()
 	})
 });
 const WEBHOOK_ERRORS = {
@@ -1334,6 +1505,28 @@ const nextcloudTalkGatewayAdapter = {
 	}
 };
 //#endregion
+//#region extensions/nextcloud-talk/src/message-adapter.ts
+const nextcloudTalkMessageAdapter = defineChannelMessageAdapter({
+	id: "nextcloud-talk",
+	durableFinal: { capabilities: {
+		text: true,
+		media: true,
+		replyTo: true
+	} },
+	send: {
+		text: async ({ cfg, to, text, accountId, replyToId }) => await sendMessageNextcloudTalk(to, text, {
+			accountId: accountId ?? void 0,
+			replyTo: replyToId ?? void 0,
+			cfg
+		}),
+		media: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => await sendMessageNextcloudTalk(to, mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text, {
+			accountId: accountId ?? void 0,
+			replyTo: replyToId ?? void 0,
+			cfg
+		})
+	}
+});
+//#endregion
 //#region extensions/nextcloud-talk/src/session-route.ts
 function resolveNextcloudTalkOutboundSessionRoute(params) {
 	const roomId = stripNextcloudTalkTargetPrefix(params.target);
@@ -1538,7 +1731,7 @@ const nextcloudTalkSetupWizard = {
 		title: "Nextcloud Talk bot setup",
 		lines: [
 			"1) SSH into your Nextcloud server",
-			"2) Run: ./occ talk:bot:install \"OpenClaw\" \"<shared-secret>\" \"<webhook-url>\" --feature reaction",
+			"2) Run: ./occ talk:bot:install \"OpenClaw\" \"<shared-secret>\" \"<webhook-url>\" --feature webhook --feature response --feature reaction",
 			"3) Copy the shared secret you used in the command",
 			"4) Enable the bot in your Nextcloud Talk room settings",
 			"Tip: you can also set NEXTCLOUD_TALK_BOT_SECRET in your env.",
@@ -1740,6 +1933,21 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		status: createComputedAccountStatusAdapter({
 			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID$2),
 			buildChannelSummary: ({ snapshot }) => buildWebhookChannelStatusSummary(snapshot, { secretSource: snapshot.secretSource ?? "none" }),
+			collectStatusIssues: (accounts) => accounts.flatMap((account) => {
+				const probe = account.probe;
+				if (!probe || probe.ok !== false || probe.code !== "missing_response_feature" || !probe.message) return [];
+				return [{
+					channel: "nextcloud-talk",
+					accountId: account.accountId ?? DEFAULT_ACCOUNT_ID$2,
+					kind: "config",
+					message: probe.message,
+					fix: "Add --feature response to the Talk bot."
+				}];
+			}),
+			probeAccount: async ({ account, timeoutMs }) => await probeNextcloudTalkBotResponseFeature({
+				account,
+				timeoutMs
+			}),
 			resolveAccountSnapshot: ({ account }) => ({
 				accountId: account.accountId,
 				name: account.name,
@@ -1752,7 +1960,8 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 				}
 			})
 		}),
-		gateway: nextcloudTalkGatewayAdapter
+		gateway: nextcloudTalkGatewayAdapter,
+		message: nextcloudTalkMessageAdapter
 	},
 	pairing: { text: {
 		...nextcloudTalkPairingTextAdapter,
@@ -1771,15 +1980,20 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		},
 		attachedResults: {
 			channel: "nextcloud-talk",
-			sendText: async ({ cfg, to, text, accountId, replyToId }) => await sendMessageNextcloudTalk(to, text, {
-				accountId: accountId ?? void 0,
-				replyTo: replyToId ?? void 0,
-				cfg
+			sendText: async ({ cfg, to, text, accountId, replyToId }) => await nextcloudTalkMessageAdapter.send.text({
+				cfg,
+				to,
+				text,
+				accountId,
+				replyToId
 			}),
-			sendMedia: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => await sendMessageNextcloudTalk(to, mediaUrl ? `${text}\n\nAttachment: ${mediaUrl}` : text, {
-				accountId: accountId ?? void 0,
-				replyTo: replyToId ?? void 0,
-				cfg
+			sendMedia: async ({ cfg, to, text, mediaUrl, accountId, replyToId }) => await nextcloudTalkMessageAdapter.send.media({
+				cfg,
+				to,
+				text,
+				mediaUrl: mediaUrl ?? "",
+				accountId,
+				replyToId
 			})
 		}
 	}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-BVVRsVr5.js";
+import { t as nextcloudTalkPlugin } from "./channel-DOIJGKcg.js";
 export { nextcloudTalkPlugin };

package/dist/doctor-contract-api.js

@@ -1,2 +1,2 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-CYlB-4Bf.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-DIa4Qbi_.js";
 export { legacyConfigRules, normalizeCompatibilityConfig };

package/dist/{runtime-api-BcCzeRN9.js → runtime-api-Cy4XTpP2.js}

@@ -1,10 +1,10 @@
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { readStoreAllowFromForDmPolicy, resolveDmGroupAccessWithCommandGate } from "openclaw/plugin-sdk/channel-policy";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { logInboundDrop } from "openclaw/plugin-sdk/channel-logging";
 import { GROUP_POLICY_BLOCKED_LABEL, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, warnMissingProviderGroupPolicyFallbackOnce } from "openclaw/plugin-sdk/runtime-group-policy";
-import { dispatchInboundReplyWithBase } from "openclaw/plugin-sdk/inbound-reply-dispatch";
+import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-message";
 import { deliverFormattedTextWithAttachments } from "openclaw/plugin-sdk/reply-payload";
+import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 //#region extensions/nextcloud-talk/src/runtime.ts
 const { setRuntime: setNextcloudTalkRuntime, getRuntime: getNextcloudTalkRuntime } = createPluginRuntimeStore({
@@ -12,4 +12,4 @@ const { setRuntime: setNextcloudTalkRuntime, getRuntime: getNextcloudTalkRuntime
 	errorMessage: "Nextcloud Talk runtime not initialized"
 });
 //#endregion
-export { fetchWithSsrFGuard as a, resolveAllowlistProviderRuntimeGroupPolicy as c, warnMissingProviderGroupPolicyFallbackOnce as d, getNextcloudTalkRuntime as f, dispatchInboundReplyWithBase as i, resolveDefaultGroupPolicy as l, createChannelPairingController as n, logInboundDrop as o, setNextcloudTalkRuntime as p, deliverFormattedTextWithAttachments as r, readStoreAllowFromForDmPolicy as s, GROUP_POLICY_BLOCKED_LABEL as t, resolveDmGroupAccessWithCommandGate as u };
+export { fetchWithSsrFGuard as a, resolveAllowlistProviderRuntimeGroupPolicy as c, warnMissingProviderGroupPolicyFallbackOnce as d, getNextcloudTalkRuntime as f, deliverFormattedTextWithAttachments as i, resolveDefaultGroupPolicy as l, createChannelMessageReplyPipeline as n, logInboundDrop as o, setNextcloudTalkRuntime as p, createChannelPairingController as r, readStoreAllowFromForDmPolicy as s, GROUP_POLICY_BLOCKED_LABEL as t, resolveDmGroupAccessWithCommandGate as u };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { a as fetchWithSsrFGuard, c as resolveAllowlistProviderRuntimeGroupPolicy, d as warnMissingProviderGroupPolicyFallbackOnce, i as dispatchInboundReplyWithBase, l as resolveDefaultGroupPolicy, n as createChannelPairingController, o as logInboundDrop, p as setNextcloudTalkRuntime, r as deliverFormattedTextWithAttachments, s as readStoreAllowFromForDmPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveDmGroupAccessWithCommandGate } from "./runtime-api-BcCzeRN9.js";
-export { GROUP_POLICY_BLOCKED_LABEL, createChannelPairingController, deliverFormattedTextWithAttachments, dispatchInboundReplyWithBase, fetchWithSsrFGuard, logInboundDrop, readStoreAllowFromForDmPolicy, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, resolveDmGroupAccessWithCommandGate, setNextcloudTalkRuntime, warnMissingProviderGroupPolicyFallbackOnce };
+import { a as fetchWithSsrFGuard, c as resolveAllowlistProviderRuntimeGroupPolicy, d as warnMissingProviderGroupPolicyFallbackOnce, i as deliverFormattedTextWithAttachments, l as resolveDefaultGroupPolicy, n as createChannelMessageReplyPipeline, o as logInboundDrop, p as setNextcloudTalkRuntime, r as createChannelPairingController, s as readStoreAllowFromForDmPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as resolveDmGroupAccessWithCommandGate } from "./runtime-api-Cy4XTpP2.js";
+export { GROUP_POLICY_BLOCKED_LABEL, createChannelMessageReplyPipeline, createChannelPairingController, deliverFormattedTextWithAttachments, fetchWithSsrFGuard, logInboundDrop, readStoreAllowFromForDmPolicy, resolveAllowlistProviderRuntimeGroupPolicy, resolveDefaultGroupPolicy, resolveDmGroupAccessWithCommandGate, setNextcloudTalkRuntime, warnMissingProviderGroupPolicyFallbackOnce };

package/package.json

@@ -1,21 +1,18 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.5.7",
+  "version": "2026.5.9-beta.1",
   "description": "OpenClaw Nextcloud Talk channel plugin",
   "repository": {
     "type": "git",
     "url": "https://github.com/openclaw/openclaw"
   },
   "type": "module",
-  "dependencies": {
-    "zod": "^4.4.3"
-  },
   "devDependencies": {
     "@openclaw/plugin-sdk": "workspace:*",
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.7"
+    "openclaw": ">=2026.5.9-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -47,10 +44,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.7"
+      "pluginApi": ">=2026.5.9-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.7"
+      "openclawVersion": "2026.5.9-beta.1"
     },
     "release": {
       "publishToClawHub": true,