@openclaw/nextcloud-talk 2026.7.2-beta.7 → 2026.8.1-beta.3

package/dist/api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-B9yquEb1.js";
+import { t as nextcloudTalkPlugin } from "./channel-gYP-jQPr.js";
 export { nextcloudTalkPlugin };

package/dist/{channel-B9yquEb1.js → channel-gYP-jQPr.js}

@@ -1,22 +1,22 @@
 import { a as fetchWithSsrFGuard, c as resolveDefaultGroupPolicy, i as deliverFormattedTextWithAttachments, l as warnMissingProviderGroupPolicyFallbackOnce, o as logInboundDrop, r as createChannelPairingController, s as resolveAllowlistProviderRuntimeGroupPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as getNextcloudTalkRuntime } from "./runtime-api-BKsxTw4J.js";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-fNhK1wag.js";
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DGgvfVqm.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-Bda_xc6V.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Bvm0PmP3.js";
 import { createAccountListHelpers, describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createLoggedPairingApprovalNotifier, createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
-import { createAllowlistProviderRouteAllowlistWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
+import { createAllowlistProviderRouteAllowlistWarningCollector, createConditionalWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { buildWebhookChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { FormatCapabilityProfile, convertMarkdownTables, renderMarkdownWithMarkers, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries, readNonEmptyStringPreservingWhitespace } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, hasConfiguredAccountValue, normalizeAccountId, resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-core";
 import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
-import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
-import { buildChannelInboundEventContext, resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
+import { resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
 import { bindIngressLifecycleToReplyOptions, createAccountStatusSink, createChannelIngressMonitor, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveChannelStreamingBlockEnabled, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
 import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -34,12 +34,13 @@ import os from "node:os";
 import path from "node:path";
 import { migratePersistentDedupeLegacyJsonFile, resolvePersistentDedupePluginStateNamespace } from "openclaw/plugin-sdk/persistent-dedupe";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+import { channelReadyPatch } from "openclaw/plugin-sdk/gateway-runtime";
 import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback } from "openclaw/plugin-sdk/channel-targets";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createServer } from "node:http";
-import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
+import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
 import { isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
@@ -96,18 +97,26 @@ function listNextcloudTalkAccountIds(cfg) {
 	debugAccounts("listNextcloudTalkAccountIds", ids);
 	return ids;
 }
-function resolveNextcloudTalkSecret(cfg, opts) {
-	const resolvedAccountId = opts.accountId ?? resolveDefaultNextcloudTalkAccountId(cfg);
-	const merged = mergeNextcloudTalkAccountConfig(cfg, resolvedAccountId);
+function resolveNextcloudTalkSecret(accountId, merged) {
+	const configuredSecret = resolveSecretInputString({
+		value: merged.botSecret,
+		path: `channels.nextcloud-talk.accounts.${accountId}.botSecret`,
+		mode: "inspect"
+	});
+	if (configuredSecret.status === "configured_unavailable") return {
+		secret: "",
+		source: "config",
+		status: "configured_unavailable"
+	};
 	const envSecret = normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET);
-	if (envSecret && resolvedAccountId === DEFAULT_ACCOUNT_ID) return {
+	if (envSecret && accountId === DEFAULT_ACCOUNT_ID) return {
 		secret: envSecret,
 		source: "env",
 		status: "available"
 	};
 	const botSecretFile = normalizeOptionalString(merged.botSecretFile);
 	if (botSecretFile) {
-		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecretFile` });
+		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${accountId}.botSecretFile` });
 		return result.status === "available" ? {
 			secret: result.value,
 			source: "secretFile",
@@ -119,12 +128,8 @@ function resolveNextcloudTalkSecret(cfg, opts) {
 			diagnostic: result.diagnostic
 		};
 	}
-	const inlineSecret = normalizeResolvedSecretInputString({
-		value: merged.botSecret,
-		path: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecret`
-	});
-	if (inlineSecret) return {
-		secret: inlineSecret,
+	if (configuredSecret.status === "available") return {
+		secret: configuredSecret.value,
 		source: "config",
 		status: "available"
 	};
@@ -141,7 +146,7 @@ function resolveNextcloudTalkAccount(params) {
 		const merged = mergeNextcloudTalkAccountConfig(params.cfg, accountId);
 		const accountEnabled = merged.enabled !== false;
 		const enabled = baseEnabled && accountEnabled;
-		const secretResolution = resolveNextcloudTalkSecret(params.cfg, { accountId });
+		const secretResolution = resolveNextcloudTalkSecret(accountId, merged);
 		const apiCredentialResolution = resolveNextcloudTalkApiCredentialsResult({
 			apiUser: merged.apiUser,
 			apiPassword: merged.apiPassword,
@@ -395,6 +400,7 @@ dangerouslyAllowPrivateNetwork: z.boolean().optional() }).strict().optional();
 const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
+	configWrites: z.boolean().optional(),
 	markdown: MarkdownConfigSchema,
 	baseUrl: z.string().optional(),
 	botSecret: buildSecretInputSchema().optional(),
@@ -593,10 +599,6 @@ function cacheRoomInfo(key, value) {
 	roomCache.set(key, value);
 	pruneMapToMaxSize(roomCache, ROOM_CACHE_MAX_ENTRIES);
 }
-function coerceRoomType(value) {
-	if (typeof value === "number" && Number.isSafeInteger(value) && value > 0) return value;
-	return parseStrictPositiveInteger(value);
-}
 function resolveRoomKindFromType(type) {
 	if (!type) return;
 	if (type === 1 || type === 5 || type === 6) return "direct";
@@ -648,7 +650,7 @@ async function resolveNextcloudTalkRoomKind(params) {
 				runtime?.log?.(`nextcloud-talk: room lookup failed (${response.status}) token=${roomToken}`);
 				return;
 			}
-			const kind = resolveRoomKindFromType(coerceRoomType((await readProviderJsonResponse(response, "Nextcloud Talk room info failed")).ocs?.data?.type));
+			const kind = resolveRoomKindFromType(parseStrictPositiveInteger((await readProviderJsonResponse(response, "Nextcloud Talk room info failed")).ocs?.data?.type));
 			cacheRoomInfo(key, {
 				fetchedAt: Date.now(),
 				kind
@@ -987,7 +989,7 @@ async function handleNextcloudTalkInbound(params) {
 	const allowFrom = normalizeStringEntries(account.config.allowFrom);
 	const outerGroupAllowFrom = account.config.groupAllowFrom?.length ? normalizeStringEntries(account.config.groupAllowFrom) : allowFrom;
 	const roomAllowFrom = normalizeStringEntries(roomConfig?.allowFrom);
-	const resolveAccess = async (wasMentioned) => await resolveStableChannelMessageIngress({
+	const resolveAccess = async (wasMentioned, contextBinding) => await resolveStableChannelMessageIngress({
 		channelId: CHANNEL_ID,
 		accountId: account.accountId,
 		identity: {
@@ -1003,6 +1005,7 @@ async function handleNextcloudTalkInbound(params) {
 			kind: isGroup ? "group" : "direct",
 			id: isGroup ? roomToken : senderId
 		},
+		contextBinding,
 		route: roomRoutes({
 			isGroup,
 			groupPolicy,
@@ -1090,11 +1093,6 @@ async function handleNextcloudTalkInbound(params) {
 	}
 	const mentionRegexes = core.channel.mentions.buildMentionRegexes(config);
 	const wasMentioned = mentionRegexes.length ? core.channel.mentions.matchesMentionPatterns(rawBody, mentionRegexes) : false;
-	if (isGroup) access = await resolveAccess(wasMentioned);
-	if (isGroup && access.activationAccess.shouldSkip) {
-		runtime.log?.(`nextcloud-talk: drop room ${roomToken} (no mention)`);
-		return;
-	}
 	const { route, buildEnvelope } = resolveChannelInboundRouteEnvelope({
 		cfg: config,
 		channel: CHANNEL_ID,
@@ -1104,6 +1102,16 @@ async function handleNextcloudTalkInbound(params) {
 			id: isGroup ? roomToken : senderId
 		}
 	});
+	access = await resolveAccess(isGroup ? wasMentioned : void 0, {
+		agentId: route.agentId,
+		sessionKey: route.sessionKey,
+		messageId: message.messageId,
+		inboundEventKind: "user_request"
+	});
+	if (access.ingress.admission !== "dispatch") {
+		runtime.log?.(isGroup && access.activationAccess.shouldSkip ? `nextcloud-talk: drop room ${roomToken} (no mention)` : `nextcloud-talk: drop ${isGroup ? "room" : "DM"} ${roomToken} (authorization changed)`);
+		return;
+	}
 	const fromLabel = isGroup ? `room:${roomName || roomToken}` : senderName || `user:${senderId}`;
 	const body = buildEnvelope({
 		channel: "Nextcloud Talk",
@@ -1113,7 +1121,8 @@ async function handleNextcloudTalkInbound(params) {
 	});
 	const groupSystemPrompt = normalizeOptionalString(roomConfig?.systemPrompt);
 	const blockStreamingEnabled = resolveChannelStreamingBlockEnabled(account.config);
-	const ctxPayload = buildChannelInboundEventContext({
+	const ctxPayload = core.channel.inbound.buildContext({
+		channelIngress: access,
 		channel: CHANNEL_ID,
 		accountId: route.accountId,
 		messageId: message.messageId,
@@ -1125,7 +1134,7 @@ async function handleNextcloudTalkInbound(params) {
 		},
 		conversation: {
 			kind: isGroup ? "group" : "direct",
-			id: roomToken,
+			id: isGroup ? roomToken : senderId,
 			label: fromLabel
 		},
 		route: {
@@ -1276,10 +1285,6 @@ const WEBHOOK_ERRORS = {
 	payloadTooLarge: "Payload too large",
 	internalServerError: "Internal server error"
 };
-function formatError(err) {
-	if (err instanceof Error) return err.message;
-	return typeof err === "string" ? err : JSON.stringify(err);
-}
 function writeJsonResponse(res, status, body) {
 	if (body) {
 		res.writeHead(status, { "Content-Type": "application/json" });
@@ -1351,7 +1356,7 @@ function createNextcloudTalkWebhookServer(opts) {
 				res.end();
 				return;
 			}
-			const clientIp = req.socket.remoteAddress ?? "unknown";
+			const clientIp = resolveRequestClientIp(req, opts.trustedProxies, opts.allowRealIpFallback) ?? req.socket.remoteAddress ?? "unknown";
 			if (!webhookAuthRateLimiter.check(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE).allowed) {
 				res.writeHead(429);
 				res.end("Too Many Requests");
@@ -1388,7 +1393,7 @@ function createNextcloudTalkWebhookServer(opts) {
 					writeWebhookError(res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
 					return;
 				}
-				const error = err instanceof Error ? err : new Error(formatError(err));
+				const error = err instanceof Error ? err : new Error(formatErrorMessage(err));
 				onError?.(error);
 				writeWebhookError(res, 500, WEBHOOK_ERRORS.internalServerError);
 			}
@@ -1536,12 +1541,12 @@ function createNextcloudTalkWebhookSpool(options) {
 			await options.deliver(message, lifecycle);
 		},
 		pollIntervalMs: options.pollIntervalMs ?? NEXTCLOUD_TALK_INGRESS_POLL_INTERVAL_MS,
-		waitForDeliveryIdleBeforeRepump: true,
 		retention: {
 			completedMaxEntries: 1e4,
 			failedMaxEntries: 1e4
 		},
 		drain: {
+			startLimit: 32,
 			resolveNonRetryableFailure,
 			...options.adoptionStallTimeoutMs === void 0 ? {} : { adoptionStallTimeoutMs: options.adoptionStallTimeoutMs },
 			onLog: (message) => options.runtime.log?.(`nextcloud-talk ${message}`)
@@ -1646,6 +1651,8 @@ async function monitorNextcloudTalkProvider(opts) {
 		onError: (error) => {
 			logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
 		},
+		trustedProxies: cfg.gateway?.trustedProxies,
+		allowRealIpFallback: cfg.gateway?.allowRealIpFallback,
 		abortSignal: opts.abortSignal
 	});
 	let stopPromise;
@@ -1672,6 +1679,7 @@ async function monitorNextcloudTalkProvider(opts) {
 		await stop();
 		return { stop };
 	}
+	opts.statusSink?.(channelReadyPatch());
 	const publicUrl = account.config.webhookPublicUrl ?? `http://${host === "0.0.0.0" ? "localhost" : host}:${port}${path}`;
 	logger.info(`[nextcloud-talk:${account.accountId}] webhook listening on ${publicUrl}`);
 	return { stop };
@@ -1857,9 +1865,6 @@ function resolveNextcloudTalkOutboundSessionRoute(params) {
 //#region extensions/nextcloud-talk/src/setup-core.ts
 const t$1 = createSetupTranslator$1();
 const channel$1 = "nextcloud-talk";
-function readOptionalString(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
 function normalizeNextcloudTalkBaseUrl(value) {
 	return value?.trim().replace(/\/+$/, "") ?? "";
 }
@@ -1924,46 +1929,6 @@ const nextcloudTalkDmPolicy = createChannelDmPolicy({
 	applyPatch: ({ cfg, account, patch }) => setNextcloudTalkAccountConfig(cfg, account.accountId, patch),
 	promptAllowFrom: promptNextcloudTalkAllowFromForAccount
 });
-const nextcloudTalkSetupAdapter = {
-	singleAccountKeysToMove: ["rooms"],
-	resolveAccountId: ({ accountId }) => normalizeAccountId$1(accountId),
-	prepareAccountConfigInput: ({ input }) => {
-		const setupInput = input;
-		return {
-			...setupInput,
-			baseUrl: setupInput.baseUrl ?? readOptionalString(setupInput.url),
-			secret: setupInput.secret ?? readOptionalString(setupInput.token) ?? readOptionalString(setupInput.password),
-			secretFile: setupInput.secretFile ?? readOptionalString(setupInput.tokenFile)
-		};
-	},
-	applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
-		cfg,
-		channelKey: channel$1,
-		accountId,
-		name
-	}),
-	validateInput: createSetupInputPresenceValidator({
-		defaultAccountOnlyEnvError: "NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.",
-		validate: ({ input }) => {
-			const setupInput = input;
-			if (!setupInput.useEnv && !setupInput.secret && !setupInput.secretFile) return "Nextcloud Talk requires bot secret or --secret-file (or --use-env).";
-			if (!setupInput.baseUrl) return "Nextcloud Talk requires --base-url.";
-			return null;
-		}
-	}),
-	applyAccountConfig: ({ cfg, accountId, input }) => {
-		const setupInput = input;
-		return setNextcloudTalkAccountConfig(applyAccountNameToChannelSection({
-			cfg,
-			channelKey: channel$1,
-			accountId,
-			name: setupInput.name
-		}), accountId, {
-			baseUrl: normalizeNextcloudTalkBaseUrl(setupInput.baseUrl),
-			...setupInput.useEnv ? {} : setupInput.secretFile ? { botSecretFile: setupInput.secretFile } : setupInput.secret ? { botSecret: setupInput.secret } : {}
-		}, setupInput.useEnv ? ["botSecret", "botSecretFile"] : void 0);
-	}
-};
 const nextcloudTalkSetupContract = defineChannelSetupContract({
 	fields: {
 		baseUrl: {
@@ -2025,10 +1990,53 @@ const nextcloudTalkSetupContract = defineChannelSetupContract({
 			cli: {
 				flags: "--use-env",
 				description: "Use Nextcloud Talk environment credentials"
-			}
+			},
+			envVars: ["NEXTCLOUD_TALK_BOT_SECRET"]
 		}
 	},
-	legacyAdapter: nextcloudTalkSetupAdapter
+	legacyAdapter: {
+		singleAccountKeysToMove: ["rooms"],
+		resolveAccountId: ({ accountId }) => normalizeAccountId$1(accountId),
+		prepareAccountConfigInput: ({ input }) => {
+			const setupInput = input;
+			return {
+				...setupInput,
+				baseUrl: setupInput.baseUrl ?? readNonEmptyStringPreservingWhitespace(setupInput.url),
+				secret: setupInput.secret ?? readNonEmptyStringPreservingWhitespace(setupInput.token) ?? readNonEmptyStringPreservingWhitespace(setupInput.password),
+				secretFile: setupInput.secretFile ?? readNonEmptyStringPreservingWhitespace(setupInput.tokenFile)
+			};
+		},
+		applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
+			cfg,
+			channelKey: channel$1,
+			accountId,
+			name
+		}),
+		validateInput: createSetupInputPresenceValidator({
+			defaultAccountOnlyEnvError: "NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.",
+			validate: ({ input }) => {
+				const setupInput = input;
+				if (!setupInput.useEnv && !setupInput.secret && !setupInput.secretFile) return "Nextcloud Talk requires bot secret or --secret-file (or --use-env).";
+				const normalizedBaseUrl = normalizeNextcloudTalkBaseUrl(setupInput.baseUrl);
+				if (!normalizedBaseUrl) return "Nextcloud Talk requires --base-url.";
+				const baseUrlError = validateNextcloudTalkBaseUrl(normalizedBaseUrl);
+				if (baseUrlError) return baseUrlError;
+				return null;
+			}
+		}),
+		applyAccountConfig: ({ cfg, accountId, input }) => {
+			const setupInput = input;
+			return setNextcloudTalkAccountConfig(applyAccountNameToChannelSection({
+				cfg,
+				channelKey: channel$1,
+				accountId,
+				name: setupInput.name
+			}), accountId, {
+				baseUrl: normalizeNextcloudTalkBaseUrl(setupInput.baseUrl),
+				...setupInput.useEnv ? {} : setupInput.secretFile ? { botSecretFile: setupInput.secretFile } : setupInput.secret ? { botSecret: setupInput.secret } : {}
+			}, setupInput.useEnv ? ["botSecret", "botSecretFile"] : void 0);
+		}
+	}
 });
 //#endregion
 //#region extensions/nextcloud-talk/src/setup-surface.ts
@@ -2190,6 +2198,12 @@ const collectNextcloudTalkSecurityWarnings = createAllowlistProviderRouteAllowli
 		groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom"
 	}
 });
+const collectNextcloudTalkOpenGroupFindings = createConditionalWarningCollector.findings({
+	collectWarnings: collectNextcloudTalkSecurityWarnings,
+	checkId: "channels.nextcloud-talk.groups.open",
+	severity: "critical",
+	title: "Nextcloud Talk security warning"
+});
 const nextcloudTalkPlugin = createChatChannelPlugin({
 	base: {
 		id: "nextcloud-talk",
@@ -2232,6 +2246,7 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 				"nc"
 			],
 			normalizeTarget: normalizeNextcloudTalkMessagingTarget,
+			inferTargetChatType: ({ to }) => normalizeNextcloudTalkMessagingTarget(to) ? "group" : void 0,
 			resolveOutboundSessionRoute: (params) => resolveNextcloudTalkOutboundSessionRoute(params),
 			targetResolver: {
 				looksLikeId: looksLikeNextcloudTalkTargetId,
@@ -2242,7 +2257,6 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 			secretTargetRegistryEntries,
 			collectRuntimeConfigAssignments
 		},
-		setup: nextcloudTalkSetupAdapter,
 		setupContract: nextcloudTalkSetupContract,
 		status: createComputedAccountStatusAdapter({
 			defaultRuntime: createDefaultChannelRuntimeState(DEFAULT_ACCOUNT_ID$2),
@@ -2286,7 +2300,7 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 	} },
 	security: {
 		...nextcloudTalkSecurityAdapter,
-		collectWarnings: collectNextcloudTalkSecurityWarnings
+		collectWarnings: collectNextcloudTalkOpenGroupFindings
 	},
 	outbound: {
 		base: {

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-B9yquEb1.js";
+import { t as nextcloudTalkPlugin } from "./channel-gYP-jQPr.js";
 export { nextcloudTalkPlugin };

package/dist/{doctor-contract-fNhK1wag.js → doctor-contract-Bda_xc6V.js}

@@ -1,5 +1,4 @@
-import { createLegacyPrivateNetworkDoctorContract } from "openclaw/plugin-sdk/ssrf-runtime";
-import { defineChannelAliasMigration } from "openclaw/plugin-sdk/runtime-doctor";
+import { createLegacyPrivateNetworkDoctorContract, defineChannelAliasMigration } from "openclaw/plugin-sdk/runtime-doctor-migrations";
 //#region extensions/nextcloud-talk/src/doctor-contract.ts
 const networkContract = createLegacyPrivateNetworkDoctorContract({ channelKey: "nextcloud-talk" });
 const streamingAliasMigration = defineChannelAliasMigration({

package/dist/doctor-contract-api.js

@@ -1,2 +1,2 @@
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-fNhK1wag.js";
+import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-Bda_xc6V.js";
 export { legacyConfigRules, normalizeCompatibilityConfig };

package/dist/secret-contract-Bvm0PmP3.js

@@ -0,0 +1,15 @@
+import { createSimpleChannelSecretContract } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+//#region extensions/nextcloud-talk/src/secret-contract.ts
+const channelSecrets = createSimpleChannelSecretContract({
+	channelKey: "nextcloud-talk",
+	label: "Nextcloud Talk",
+	accountFields: ["apiPassword", "botSecret"],
+	channelFields: ["apiPassword", "botSecret"],
+	mode: {
+		kind: "surface-inheritance",
+		collectionFields: ["botSecret", "apiPassword"]
+	}
+});
+const { secretTargetRegistryEntries, collectRuntimeConfigAssignments } = channelSecrets;
+//#endregion
+export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-DGgvfVqm.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Bvm0PmP3.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/openclaw.plugin.json

@@ -1,5 +1,8 @@
 {
   "id": "nextcloud-talk",
+  "doctorContract": {
+    "configRepair": true
+  },
   "name": "Nextcloud Talk",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
   "icon": "https://cdn.simpleicons.org/nextcloud",
@@ -26,6 +29,9 @@
           "enabled": {
             "type": "boolean"
           },
+          "configWrites": {
+            "type": "boolean"
+          },
           "markdown": {
             "type": "object",
             "properties": {
@@ -74,6 +80,29 @@
                     ],
                     "additionalProperties": false
                   },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "source": {
+                        "type": "string",
+                        "const": "store"
+                      },
+                      "provider": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$"
+                      },
+                      "id": {
+                        "type": "string",
+                        "pattern": "^[A-Z][A-Z0-9_]{0,127}$"
+                      }
+                    },
+                    "required": [
+                      "source",
+                      "provider",
+                      "id"
+                    ],
+                    "additionalProperties": false
+                  },
                   {
                     "type": "object",
                     "properties": {
@@ -158,6 +187,29 @@
                     ],
                     "additionalProperties": false
                   },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "source": {
+                        "type": "string",
+                        "const": "store"
+                      },
+                      "provider": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$"
+                      },
+                      "id": {
+                        "type": "string",
+                        "pattern": "^[A-Z][A-Z0-9_]{0,127}$"
+                      }
+                    },
+                    "required": [
+                      "source",
+                      "provider",
+                      "id"
+                    ],
+                    "additionalProperties": false
+                  },
                   {
                     "type": "object",
                     "properties": {
@@ -424,6 +476,9 @@
                 "enabled": {
                   "type": "boolean"
                 },
+                "configWrites": {
+                  "type": "boolean"
+                },
                 "markdown": {
                   "type": "object",
                   "properties": {
@@ -472,6 +527,29 @@
                           ],
                           "additionalProperties": false
                         },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "source": {
+                              "type": "string",
+                              "const": "store"
+                            },
+                            "provider": {
+                              "type": "string",
+                              "pattern": "^[a-z][a-z0-9_-]{0,63}$"
+                            },
+                            "id": {
+                              "type": "string",
+                              "pattern": "^[A-Z][A-Z0-9_]{0,127}$"
+                            }
+                          },
+                          "required": [
+                            "source",
+                            "provider",
+                            "id"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "object",
                           "properties": {
@@ -556,6 +634,29 @@
                           ],
                           "additionalProperties": false
                         },
+                        {
+                          "type": "object",
+                          "properties": {
+                            "source": {
+                              "type": "string",
+                              "const": "store"
+                            },
+                            "provider": {
+                              "type": "string",
+                              "pattern": "^[a-z][a-z0-9_-]{0,63}$"
+                            },
+                            "id": {
+                              "type": "string",
+                              "pattern": "^[A-Z][A-Z0-9_]{0,127}$"
+                            }
+                          },
+                          "required": [
+                            "source",
+                            "provider",
+                            "id"
+                          ],
+                          "additionalProperties": false
+                        },
                         {
                           "type": "object",
                           "properties": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.7.2-beta.7",
+  "version": "2026.8.1-beta.3",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.7.2-beta.7"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -113,7 +113,10 @@
             "cli": {
               "flags": "--use-env",
               "description": "Use Nextcloud Talk environment credentials"
-            }
+            },
+            "envVars": [
+              "NEXTCLOUD_TALK_BOT_SECRET"
+            ]
           }
         ]
       }
@@ -124,10 +127,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.7.2-beta.7"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.7.2-beta.7"
+      "openclawVersion": "2026.8.1-beta.3"
     },
     "release": {
       "publishToClawHub": true,

package/dist/secret-contract-DGgvfVqm.js

@@ -1,45 +0,0 @@
-import { collectConditionalChannelFieldAssignments, createChannelSecretTargetRegistryEntries, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
-//#region extensions/nextcloud-talk/src/secret-contract.ts
-const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
-	channelKey: "nextcloud-talk",
-	account: ["apiPassword", "botSecret"],
-	channel: ["apiPassword", "botSecret"]
-});
-function collectRuntimeConfigAssignments(params) {
-	const resolved = getChannelSurface(params.config, "nextcloud-talk");
-	if (!resolved) return;
-	const { channel: nextcloudTalk, surface } = resolved;
-	const inheritsField = (field) => ({ account, enabled }) => enabled && !hasOwnProperty(account, field);
-	collectConditionalChannelFieldAssignments({
-		channelKey: "nextcloud-talk",
-		field: "botSecret",
-		channel: nextcloudTalk,
-		surface,
-		defaults: params.defaults,
-		context: params.context,
-		topLevelActiveWithoutAccounts: true,
-		topLevelInheritedAccountActive: inheritsField("botSecret"),
-		accountActive: ({ enabled }) => enabled,
-		topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level botSecret.",
-		accountInactiveReason: "Nextcloud Talk account is disabled."
-	});
-	collectConditionalChannelFieldAssignments({
-		channelKey: "nextcloud-talk",
-		field: "apiPassword",
-		channel: nextcloudTalk,
-		surface,
-		defaults: params.defaults,
-		context: params.context,
-		topLevelActiveWithoutAccounts: true,
-		topLevelInheritedAccountActive: inheritsField("apiPassword"),
-		accountActive: ({ enabled }) => enabled,
-		topInactiveReason: "no enabled Nextcloud Talk surface inherits this top-level apiPassword.",
-		accountInactiveReason: "Nextcloud Talk account is disabled."
-	});
-}
-const channelSecrets = {
-	secretTargetRegistryEntries,
-	collectRuntimeConfigAssignments
-};
-//#endregion
-export { collectRuntimeConfigAssignments as n, secretTargetRegistryEntries as r, channelSecrets as t };