@openclaw/nextcloud-talk 2026.7.2-beta.1 → 2026.7.2-beta.3

package/dist/api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-CYse6FwT.js";
+import { t as nextcloudTalkPlugin } from "./channel-De2OKnzd.js";
 export { nextcloudTalkPlugin };

package/dist/{channel-CYse6FwT.js → channel-De2OKnzd.js}

@@ -15,27 +15,25 @@ import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecr
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { buildChannelInboundEventContext, resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
 import { createAccountStatusSink, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveChannelStreamingBlockEnabled } from "openclaw/plugin-sdk/channel-outbound";
 import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
-import { readFileSync } from "node:fs";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { createHmac, randomBytes } from "node:crypto";
-import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+import { fileExists, safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import { clearAccountEntryFields } from "openclaw/plugin-sdk/channel-plugin-common";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-id";
-import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, ToolPolicySchema, buildChannelConfigSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
-import { formatAllowFromLowercase } from "openclaw/plugin-sdk/allow-from";
+import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
+import { formatAllowFromLowercase, resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime, runStoppablePassiveMonitor, safeParseJsonWithSchema } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
-import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { createClaimableDedupe, migratePersistentDedupeLegacyJsonFile } from "openclaw/plugin-sdk/persistent-dedupe";
+import { createChannelReplayGuard, migratePersistentDedupeLegacyJsonFile } from "openclaw/plugin-sdk/persistent-dedupe";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
-import { resolveInboundRouteEnvelopeBuilderWithRuntime } from "openclaw/plugin-sdk/inbound-envelope";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback } from "openclaw/plugin-sdk/channel-targets";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -43,9 +41,40 @@ import { createServer } from "node:http";
 import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
-import { applyAccountNameToChannelSection, createSetupTranslator, createStandardChannelSetupStatus, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
+import { applyAccountNameToChannelSection, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
 import { createSetupInputPresenceValidator, createSetupTranslator as createSetupTranslator$1, mergeAllowFromEntries, promptParsedAllowFromForAccount, resolveSetupAccountId } from "openclaw/plugin-sdk/setup-runtime";
 import { formatDocsLink as formatDocsLink$1 } from "openclaw/plugin-sdk/setup-tools";
+//#region extensions/nextcloud-talk/src/api-credentials.ts
+function resolveNextcloudTalkApiCredentialsResult(params) {
+	const apiUser = params.apiUser?.trim();
+	if (!apiUser) return { status: "missing" };
+	const inlinePassword = normalizeResolvedSecretInputString({
+		value: params.apiPassword,
+		path: "channels.nextcloud-talk.apiPassword"
+	});
+	if (inlinePassword) return {
+		status: "available",
+		value: {
+			apiUser,
+			apiPassword: inlinePassword
+		}
+	};
+	if (!params.apiPasswordFile?.trim()) return { status: "missing" };
+	const result = tryReadSecretFileSync(params.apiPasswordFile, "Nextcloud Talk API password", { rejectHardlinks: false }, { configPath: params.configPath ?? "channels.nextcloud-talk.apiPasswordFile" });
+	if (result.status === "available") return result.value ? {
+		status: "available",
+		value: {
+			apiUser,
+			apiPassword: result.value
+		}
+	} : { status: "missing" };
+	return result;
+}
+function resolveNextcloudTalkApiCredentials(params) {
+	const result = resolveNextcloudTalkApiCredentialsResult(params);
+	return result.status === "available" ? result.value : void 0;
+}
+//#endregion
 //#region extensions/nextcloud-talk/src/accounts.ts
 function isTruthyEnvValue(value) {
 	const normalized = normalizeLowercaseStringOrEmpty(value);
@@ -81,13 +110,21 @@ function resolveNextcloudTalkSecret(cfg, opts) {
 	const envSecret = normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET);
 	if (envSecret && resolvedAccountId === DEFAULT_ACCOUNT_ID) return {
 		secret: envSecret,
-		source: "env"
+		source: "env",
+		status: "available"
 	};
-	if (merged.botSecretFile) {
-		const fileSecret = tryReadSecretFileSync(merged.botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true });
-		if (fileSecret) return {
-			secret: fileSecret,
-			source: "secretFile"
+	const botSecretFile = normalizeOptionalString(merged.botSecretFile);
+	if (botSecretFile) {
+		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecretFile` });
+		return result.status === "available" ? {
+			secret: result.value,
+			source: "secretFile",
+			status: "available"
+		} : {
+			secret: "",
+			source: "secretFile",
+			status: "configured_unavailable",
+			diagnostic: result.diagnostic
 		};
 	}
 	const inlineSecret = normalizeResolvedSecretInputString({
@@ -96,11 +133,13 @@ function resolveNextcloudTalkSecret(cfg, opts) {
 	});
 	if (inlineSecret) return {
 		secret: inlineSecret,
-		source: "config"
+		source: "config",
+		status: "available"
 	};
 	return {
 		secret: "",
-		source: "none"
+		source: "none",
+		status: "missing"
 	};
 }
 function resolveNextcloudTalkAccount(params) {
@@ -111,6 +150,13 @@ function resolveNextcloudTalkAccount(params) {
 		const accountEnabled = merged.enabled !== false;
 		const enabled = baseEnabled && accountEnabled;
 		const secretResolution = resolveNextcloudTalkSecret(params.cfg, { accountId });
+		const apiCredentialResolution = resolveNextcloudTalkApiCredentialsResult({
+			apiUser: merged.apiUser,
+			apiPassword: merged.apiPassword,
+			apiPasswordFile: merged.apiPasswordFile,
+			configPath: `channels.nextcloud-talk.accounts.${accountId}.apiPasswordFile`
+		});
+		const diagnostics = [secretResolution.diagnostic, apiCredentialResolution.status === "configured_unavailable" ? apiCredentialResolution.diagnostic : void 0].filter((diagnostic) => Boolean(diagnostic));
 		const baseUrl = merged.baseUrl?.trim()?.replace(/\/$/, "") ?? "";
 		debugAccounts("resolve", {
 			accountId,
@@ -125,6 +171,9 @@ function resolveNextcloudTalkAccount(params) {
 			baseUrl,
 			secret: secretResolution.secret,
 			secretSource: secretResolution.source,
+			tokenStatus: secretResolution.status,
+			apiCredentialStatus: apiCredentialResolution.status,
+			...diagnostics.length > 0 ? { credentialDiagnostics: diagnostics } : {},
 			config: merged
 		};
 	};
@@ -132,7 +181,7 @@ function resolveNextcloudTalkAccount(params) {
 		accountId: resolvedAccountId,
 		normalizeAccountId,
 		resolvePrimary: resolve,
-		hasCredential: (account) => account.secretSource !== "none",
+		hasCredential: (account) => account.tokenStatus !== "missing",
 		resolveDefaultAccountId: () => resolveDefaultNextcloudTalkAccountId(params.cfg)
 	});
 }
@@ -152,30 +201,6 @@ const nextcloudTalkApprovalAuth = createChannelApprovalAuth({
 	normalizeApprover: normalizeNextcloudTalkApproverId
 }).approvalAuth;
 //#endregion
-//#region extensions/nextcloud-talk/src/api-credentials.ts
-function resolveNextcloudTalkApiCredentials(params) {
-	const apiUser = params.apiUser?.trim();
-	if (!apiUser) return;
-	const inlinePassword = normalizeResolvedSecretInputString({
-		value: params.apiPassword,
-		path: "channels.nextcloud-talk.apiPassword"
-	});
-	if (inlinePassword) return {
-		apiUser,
-		apiPassword: inlinePassword
-	};
-	if (!params.apiPasswordFile) return;
-	try {
-		const filePassword = readFileSync(params.apiPasswordFile, "utf-8").trim();
-		return filePassword ? {
-			apiUser,
-			apiPassword: filePassword
-		} : void 0;
-	} catch {
-		return;
-	}
-}
-//#endregion
 //#region extensions/nextcloud-talk/src/signature.ts
 const SIGNATURE_HEADER = "x-nextcloud-talk-signature";
 const RANDOM_HEADER = "x-nextcloud-talk-random";
@@ -362,18 +387,11 @@ const nextcloudTalkPairingTextAdapter = {
 };
 //#endregion
 //#region extensions/nextcloud-talk/src/config-schema.ts
-const NextcloudTalkRoomSchema = z.object({
-	requireMention: z.boolean().optional(),
-	tools: ToolPolicySchema,
-	skills: z.array(z.string()).optional(),
-	enabled: z.boolean().optional(),
-	allowFrom: z.array(z.string()).optional(),
-	systemPrompt: z.string().optional()
-}).strict();
+const NextcloudTalkRoomSchema = buildGroupEntrySchema({ allowFrom: z.array(z.string()).optional() }).omit({ toolsBySender: true });
 const NextcloudTalkNetworkSchema = z.object({ 
 /** Dangerous opt-in for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 dangerouslyAllowPrivateNetwork: z.boolean().optional() }).strict().optional();
-const NextcloudTalkAccountSchemaBase = z.object({
+const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	markdown: MarkdownConfigSchema,
@@ -395,27 +413,17 @@ const NextcloudTalkAccountSchemaBase = z.object({
 	/** Network policy overrides for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 	network: NextcloudTalkNetworkSchema,
 	...ReplyRuntimeConfigSchemaShape
-}).strict();
-const NextcloudTalkAccountSchema = NextcloudTalkAccountSchemaBase.superRefine((value, ctx) => {
-	requireChannelOpenAllowFrom({
-		channel: "nextcloud-talk",
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx,
-		requireOpenAllowFrom
-	});
-});
-const NextcloudTalkConfigSchema = NextcloudTalkAccountSchemaBase.extend({
-	accounts: z.record(z.string(), NextcloudTalkAccountSchema.optional()).optional(),
-	defaultAccount: z.string().optional()
-}).superRefine((value, ctx) => {
-	requireChannelOpenAllowFrom({
-		channel: "nextcloud-talk",
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx,
-		requireOpenAllowFrom
-	});
+}).strict(), {
+	optionalAccount: true,
+	refine: (value, ctx) => {
+		requireChannelOpenAllowFrom({
+			channel: "nextcloud-talk",
+			policy: value.dmPolicy,
+			allowFrom: value.allowFrom,
+			ctx,
+			requireOpenAllowFrom
+		});
+	}
 });
 //#endregion
 //#region extensions/nextcloud-talk/src/replay-guard.ts
@@ -424,7 +432,7 @@ const NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX = "replay-dedupe";
 const DEFAULT_REPLAY_TTL_MS = 1440 * 60 * 1e3;
 const DEFAULT_MEMORY_MAX_SIZE = 1e3;
 const DEFAULT_STATE_MAX_ENTRIES = 1e4;
-function buildReplayKey(params) {
+function buildNextcloudTalkReplayKey(params) {
 	const roomToken = params.roomToken.trim();
 	const messageId = params.messageId.trim();
 	if (!roomToken || !messageId) return null;
@@ -436,55 +444,21 @@ function createNextcloudTalkReplayGuard(options) {
 		ttlMs: options.ttlMs ?? DEFAULT_REPLAY_TTL_MS,
 		memoryMaxSize: options.memoryMaxSize ?? DEFAULT_MEMORY_MAX_SIZE
 	};
-	const dedupe = createClaimableDedupe(stateDir ? {
-		...baseOptions,
-		pluginId: NEXTCLOUD_TALK_PLUGIN_ID,
-		namespacePrefix: NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX,
-		stateMaxEntries: options.stateMaxEntries ?? options.fileMaxEntries ?? DEFAULT_STATE_MAX_ENTRIES,
-		env: {
-			...process.env,
-			OPENCLAW_STATE_DIR: stateDir
-		},
-		onDiskError: options.onDiskError
-	} : baseOptions);
-	return {
-		claimMessage: async ({ accountId, roomToken, messageId }) => {
-			const replayKey = buildReplayKey({
-				roomToken,
-				messageId
-			});
-			if (!replayKey) return "invalid";
-			return (await dedupe.claim(replayKey, { namespace: accountId })).kind;
-		},
-		commitMessage: async ({ accountId, roomToken, messageId }) => {
-			const replayKey = buildReplayKey({
-				roomToken,
-				messageId
-			});
-			if (!replayKey) return true;
-			return await dedupe.commit(replayKey, { namespace: accountId });
-		},
-		releaseMessage: ({ accountId, roomToken, messageId, error }) => {
-			const replayKey = buildReplayKey({
-				roomToken,
-				messageId
-			});
-			if (!replayKey) return;
-			dedupe.release(replayKey, {
-				namespace: accountId,
-				error
-			});
-		},
-		shouldProcessMessage: async ({ accountId, roomToken, messageId }) => {
-			const replayKey = buildReplayKey({
-				roomToken,
-				messageId
-			});
-			if (!replayKey) return true;
-			if ((await dedupe.claim(replayKey, { namespace: accountId })).kind !== "claimed") return false;
-			return await dedupe.commit(replayKey, { namespace: accountId });
-		}
-	};
+	return createChannelReplayGuard({
+		dedupe: stateDir ? {
+			...baseOptions,
+			pluginId: NEXTCLOUD_TALK_PLUGIN_ID,
+			namespacePrefix: NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX,
+			stateMaxEntries: options.stateMaxEntries ?? options.fileMaxEntries ?? DEFAULT_STATE_MAX_ENTRIES,
+			env: {
+				...process.env,
+				OPENCLAW_STATE_DIR: stateDir
+			},
+			onDiskError: options.onDiskError
+		} : baseOptions,
+		buildReplayKey: buildNextcloudTalkReplayKey,
+		namespace: (event) => event.accountId
+	});
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/doctor.ts
@@ -495,14 +469,6 @@ function sanitizeLegacyReplaySegment(value) {
 	if (!trimmed) return "default";
 	return trimmed.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
-async function fileExists(filePath) {
-	try {
-		await fs.access(filePath);
-		return true;
-	} catch {
-		return false;
-	}
-}
 async function collectNextcloudTalkBotResponseWarnings(params) {
 	const warnings = [];
 	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
@@ -527,7 +493,7 @@ async function repairNextcloudTalkReplayDedupeState(params) {
 	const replayDir = path.join(stateDir, "nextcloud-talk", "replay-dedupe");
 	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
 		const legacyPath = path.join(replayDir, `${sanitizeLegacyReplaySegment(accountId)}.json`);
-		if (!await fileExists(legacyPath)) continue;
+		if (!fileExists(legacyPath)) continue;
 		try {
 			const result = await migratePersistentDedupeLegacyJsonFile({
 				filePath: legacyPath,
@@ -574,19 +540,13 @@ function normalizeNextcloudTalkAllowlist(values) {
 	return (values ?? []).map((value) => normalizeNextcloudTalkAllowEntry(String(value))).filter(Boolean);
 }
 function resolveNextcloudTalkAllowlistMatch(params) {
-	const allowFrom = normalizeNextcloudTalkAllowlist(params.allowFrom);
-	if (allowFrom.length === 0) return { allowed: false };
-	if (allowFrom.includes("*")) return {
-		allowed: true,
-		matchKey: "*",
-		matchSource: "wildcard"
-	};
-	const senderId = normalizeNextcloudTalkAllowEntry(params.senderId);
-	return allowFrom.includes(senderId) ? {
-		allowed: true,
-		matchKey: senderId,
-		matchSource: "id"
-	} : { allowed: false };
+	return resolveAllowlistMatchByCandidates({
+		allowList: normalizeNextcloudTalkAllowlist(params.allowFrom),
+		candidates: [{
+			value: normalizeNextcloudTalkAllowEntry(params.senderId),
+			source: "id"
+		}]
+	});
 }
 function resolveNextcloudTalkRoomMatch(params) {
 	const rooms = params.rooms ?? {};
@@ -1138,19 +1098,17 @@ async function handleNextcloudTalkInbound(params) {
 		runtime.log?.(`nextcloud-talk: drop room ${roomToken} (no mention)`);
 		return;
 	}
-	const { route, buildEnvelope } = resolveInboundRouteEnvelopeBuilderWithRuntime({
+	const { route, buildEnvelope } = resolveChannelInboundRouteEnvelope({
 		cfg: config,
 		channel: CHANNEL_ID,
 		accountId: account.accountId,
 		peer: {
 			kind: isGroup ? "group" : "direct",
 			id: isGroup ? roomToken : senderId
-		},
-		runtime: core.channel,
-		sessionStore: config.session?.store
+		}
 	});
 	const fromLabel = isGroup ? `room:${roomName || roomToken}` : senderName || `user:${senderId}`;
-	const { storePath, body } = buildEnvelope({
+	const body = buildEnvelope({
 		channel: "Nextcloud Talk",
 		from: fromLabel,
 		timestamp: message.timestamp,
@@ -1158,40 +1116,58 @@ async function handleNextcloudTalkInbound(params) {
 	});
 	const groupSystemPrompt = normalizeOptionalString(roomConfig?.systemPrompt);
 	const blockStreamingEnabled = resolveChannelStreamingBlockEnabled(account.config);
-	const ctxPayload = core.channel.reply.finalizeInboundContext({
-		Body: body,
-		BodyForAgent: rawBody,
-		RawBody: rawBody,
-		CommandBody: rawBody,
-		From: isGroup ? `nextcloud-talk:room:${roomToken}` : `nextcloud-talk:${senderId}`,
-		To: `nextcloud-talk:${roomToken}`,
-		SessionKey: route.sessionKey,
-		AccountId: route.accountId,
-		ChatType: isGroup ? "group" : "direct",
-		ConversationLabel: fromLabel,
-		SenderName: senderName || void 0,
-		SenderId: senderId,
-		GroupSubject: isGroup ? roomName || roomToken : void 0,
-		GroupSystemPrompt: isGroup ? groupSystemPrompt : void 0,
-		Provider: CHANNEL_ID,
-		Surface: CHANNEL_ID,
-		WasMentioned: isGroup ? wasMentioned : void 0,
-		MessageSid: message.messageId,
-		Timestamp: message.timestamp,
-		OriginatingChannel: CHANNEL_ID,
-		OriginatingTo: `nextcloud-talk:${roomToken}`,
-		CommandAuthorized: commandAuthorized
+	const ctxPayload = buildChannelInboundEventContext({
+		channel: CHANNEL_ID,
+		accountId: route.accountId,
+		messageId: message.messageId,
+		timestamp: message.timestamp,
+		from: isGroup ? `nextcloud-talk:room:${roomToken}` : `nextcloud-talk:${senderId}`,
+		sender: {
+			id: senderId,
+			name: senderName || void 0
+		},
+		conversation: {
+			kind: isGroup ? "group" : "direct",
+			id: roomToken,
+			label: fromLabel
+		},
+		route: {
+			agentId: route.agentId,
+			dmScope: route.dmScope,
+			accountId: route.accountId,
+			routeSessionKey: route.sessionKey
+		},
+		reply: {
+			to: `nextcloud-talk:${roomToken}`,
+			originatingTo: `nextcloud-talk:${roomToken}`
+		},
+		message: {
+			body,
+			bodyForAgent: rawBody,
+			rawBody,
+			commandBody: rawBody
+		},
+		access: {
+			commands: { authorized: commandAuthorized },
+			mentions: {
+				canDetectMention: isGroup,
+				wasMentioned: isGroup && wasMentioned
+			}
+		},
+		extra: {
+			GroupSubject: isGroup ? roomName || roomToken : void 0,
+			GroupSystemPrompt: isGroup ? groupSystemPrompt : void 0
+		}
 	});
-	await core.channel.inbound.dispatchReply({
+	await core.channel.inbound.dispatch({
 		cfg: config,
 		channel: CHANNEL_ID,
 		accountId: account.accountId,
-		agentId: route.agentId,
-		routeSessionKey: route.sessionKey,
-		storePath,
+		route: {
+			agentId: route.agentId,
+			sessionKey: route.sessionKey
+		},
 		ctxPayload,
-		recordInboundSession: core.channel.session.recordInboundSession,
-		dispatchReplyWithBufferedBlockDispatcher: core.channel.reply.dispatchReplyWithBufferedBlockDispatcher,
 		delivery: {
 			preparePayload: (payload) => payload.text === void 0 ? payload : {
 				...payload,
@@ -1263,40 +1239,12 @@ const WEBHOOK_ERRORS = {
 	payloadTooLarge: "Payload too large",
 	internalServerError: "Internal server error"
 };
-var NextcloudTalkRetryableWebhookError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "NextcloudTalkRetryableWebhookError";
-	}
-};
 async function processNextcloudTalkReplayGuardedMessage(params) {
-	if (await params.replayGuard.claimMessage({
+	return (await params.replayGuard.processGuarded({
 		accountId: params.accountId,
 		roomToken: params.message.roomToken,
 		messageId: params.message.messageId
-	}) !== "claimed") return "duplicate";
-	try {
-		await params.handleMessage();
-		await params.replayGuard.commitMessage({
-			accountId: params.accountId,
-			roomToken: params.message.roomToken,
-			messageId: params.message.messageId
-		});
-		return "processed";
-	} catch (error) {
-		if (error instanceof NextcloudTalkRetryableWebhookError) params.replayGuard.releaseMessage({
-			accountId: params.accountId,
-			roomToken: params.message.roomToken,
-			messageId: params.message.messageId,
-			error
-		});
-		else await params.replayGuard.commitMessage({
-			accountId: params.accountId,
-			roomToken: params.message.roomToken,
-			messageId: params.message.messageId
-		});
-		throw error;
-	}
+	}, params.handleMessage, { onError: "commit" })).kind === "processed" ? "processed" : "duplicate";
 }
 function formatError(err) {
 	if (err instanceof Error) return err.message;
@@ -1959,8 +1907,10 @@ const nextcloudTalkSetupWizard = {
 			[CONFIGURE_API_FLAG]: "1"
 		} };
 	},
-	credentials: [{
+	credentials: [defineTokenCredential({
 		inputKey: "token",
+		configKey: "botSecret",
+		configuredFields: ["botSecret", "botSecretFile"],
 		providerHint: channel,
 		credentialLabel: t("wizard.nextcloudTalk.botSecret"),
 		preferredEnvVar: "NEXTCLOUD_TALK_BOT_SECRET",
@@ -1968,61 +1918,56 @@ const nextcloudTalkSetupWizard = {
 		keepPrompt: t("wizard.nextcloudTalk.botSecretKeep"),
 		inputPrompt: t("wizard.nextcloudTalk.botSecretInput"),
 		allowEnv: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1,
-		inspect: ({ cfg, accountId }) => {
-			const resolvedAccount = resolveNextcloudTalkAccount({
-				cfg,
-				accountId
-			});
-			return {
-				accountConfigured: Boolean(resolvedAccount.secret && resolvedAccount.baseUrl),
-				hasConfiguredValue: Boolean(hasConfiguredSecretInput(resolvedAccount.config.botSecret) || resolvedAccount.config.botSecretFile),
-				resolvedValue: resolvedAccount.secret || void 0,
-				envValue: accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET) : void 0
-			};
+		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
+			cfg,
+			accountId
+		}),
+		accountConfigured: (account) => Boolean(account.secret && account.baseUrl),
+		hasConfiguredValue: (account) => Boolean(hasConfiguredSecretInput(account.config.botSecret) || account.config.botSecretFile),
+		resolvedValue: (account) => account.secret || void 0,
+		envValue: ({ accountId }) => accountId === DEFAULT_ACCOUNT_ID$1 ? normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET) : void 0,
+		patchAccount: ({ cfg, accountId, patch, clearFields }) => {
+			return setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(cfg, accountId, clearFields), accountId, patch);
 		},
-		applyUseEnv: async (params) => {
-			const resolvedAccount = resolveNextcloudTalkAccount({
-				cfg: params.cfg,
-				accountId: params.accountId
-			});
-			return setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["botSecret", "botSecretFile"]), params.accountId, { baseUrl: resolvedAccount.baseUrl });
+		useEnv: {
+			clearFields: ["botSecret", "botSecretFile"],
+			patch: (account) => ({ baseUrl: account.baseUrl })
 		},
-		applySet: async (params) => setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["botSecret", "botSecretFile"]), params.accountId, { botSecret: params.value })
-	}, {
+		set: { clearFields: ["botSecret", "botSecretFile"] }
+	}), defineTokenCredential({
 		inputKey: "password",
+		configKey: "apiPassword",
+		configuredFields: ["apiPassword", "apiPasswordFile"],
 		providerHint: "nextcloud-talk-api",
 		credentialLabel: t("wizard.nextcloudTalk.apiPassword"),
 		preferredEnvVar: "NEXTCLOUD_TALK_API_PASSWORD",
 		envPrompt: "",
 		keepPrompt: t("wizard.nextcloudTalk.apiPasswordKeep"),
 		inputPrompt: t("wizard.nextcloudTalk.apiPasswordInput"),
-		inspect: ({ cfg, accountId }) => {
-			const resolvedAccount = resolveNextcloudTalkAccount({
-				cfg,
-				accountId
-			});
-			const apiUser = resolvedAccount.config.apiUser?.trim();
-			const apiPasswordConfigured = Boolean(hasConfiguredSecretInput(resolvedAccount.config.apiPassword) || resolvedAccount.config.apiPasswordFile);
-			return {
-				accountConfigured: Boolean(apiUser && apiPasswordConfigured),
-				hasConfiguredValue: apiPasswordConfigured
-			};
-		},
+		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
+			cfg,
+			accountId
+		}),
+		accountConfigured: (account) => Boolean(account.config.apiUser?.trim() && (hasConfiguredSecretInput(account.config.apiPassword) || account.config.apiPasswordFile)),
+		hasConfiguredValue: (account) => Boolean(hasConfiguredSecretInput(account.config.apiPassword) || account.config.apiPasswordFile),
 		shouldPrompt: ({ credentialValues }) => credentialValues[CONFIGURE_API_FLAG] === "1",
-		applySet: async (params) => setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(params.cfg, params.accountId, ["apiPassword", "apiPasswordFile"]), params.accountId, { apiPassword: params.value })
-	}],
-	textInputs: [{
+		patchAccount: ({ cfg, accountId, patch, clearFields }) => setNextcloudTalkAccountConfig(clearNextcloudTalkAccountFields(cfg, accountId, clearFields), accountId, patch),
+		set: { clearFields: ["apiPassword", "apiPasswordFile"] }
+	})],
+	textInputs: [baseUrlTextInput({
 		inputKey: "httpUrl",
+		configKey: "baseUrl",
 		message: t("wizard.nextcloudTalk.instanceUrlPrompt"),
-		currentValue: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
+		resolveAccount: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
 			cfg,
 			accountId
-		}).baseUrl || void 0,
+		}),
+		currentValue: (account) => account.baseUrl || void 0,
 		shouldPrompt: ({ currentValue }) => !currentValue,
-		validate: ({ value }) => validateNextcloudTalkBaseUrl(value),
-		normalizeValue: ({ value }) => normalizeNextcloudTalkBaseUrl(value),
-		applySet: async (params) => setNextcloudTalkAccountConfig(params.cfg, params.accountId, { baseUrl: params.value })
-	}, {
+		validate: validateNextcloudTalkBaseUrl,
+		normalize: normalizeNextcloudTalkBaseUrl,
+		patchAccount: ({ cfg, accountId, patch }) => setNextcloudTalkAccountConfig(cfg, accountId, patch)
+	}), {
 		inputKey: "userId",
 		message: t("wizard.nextcloudTalk.apiUserPrompt"),
 		currentValue: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
@@ -2084,12 +2029,14 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		configSchema: buildChannelConfigSchema(NextcloudTalkConfigSchema),
 		config: {
 			...nextcloudTalkConfigAdapter,
-			isConfigured: (account) => Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+			isConfigured: (account) => Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
 			describeAccount: (account) => describeWebhookAccountSnapshot({
 				account,
-				configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
 				extra: {
 					secretSource: account.secretSource,
+					tokenStatus: account.tokenStatus,
+					apiCredentialStatus: account.apiCredentialStatus,
 					baseUrl: account.baseUrl ? "[set]" : "[missing]"
 				}
 			})
@@ -2140,9 +2087,11 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 				accountId: account.accountId,
 				name: account.name,
 				enabled: account.enabled,
-				configured: Boolean(account.secret?.trim() && account.baseUrl?.trim()),
+				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
 				extra: {
 					secretSource: account.secretSource,
+					tokenStatus: account.tokenStatus,
+					apiCredentialStatus: account.apiCredentialStatus,
 					baseUrl: account.baseUrl ? "[set]" : "[missing]",
 					mode: "webhook"
 				}

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-CYse6FwT.js";
+import { t as nextcloudTalkPlugin } from "./channel-De2OKnzd.js";
 export { nextcloudTalkPlugin };

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.7.2-beta.1",
+  "version": "2026.7.2-beta.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/nextcloud-talk",
-      "version": "2026.7.2-beta.1",
+      "version": "2026.7.2-beta.3",
       "dependencies": {
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.7.2-beta.1"
+        "openclaw": ">=2026.7.2-beta.3"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.7.2-beta.1",
+  "version": "2026.7.2-beta.3",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.1"
+    "openclaw": ">=2026.7.2-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -40,10 +40,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.1"
+      "pluginApi": ">=2026.7.2-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.1"
+      "openclawVersion": "2026.7.2-beta.3"
     },
     "release": {
       "publishToClawHub": true,