@openclaw/nextcloud-talk 2026.8.1-beta.2 → 2026.8.1-beta.3

package/dist/api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-CojgyJSq.js";
+import { t as nextcloudTalkPlugin } from "./channel-gYP-jQPr.js";
 export { nextcloudTalkPlugin };

package/dist/{channel-CojgyJSq.js → channel-gYP-jQPr.js}

@@ -4,7 +4,7 @@ import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries
 import { createAccountListHelpers, describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createLoggedPairingApprovalNotifier, createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
-import { createAllowlistProviderRouteAllowlistWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
+import { createAllowlistProviderRouteAllowlistWarningCollector, createConditionalWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { buildWebhookChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { FormatCapabilityProfile, convertMarkdownTables, renderMarkdownWithMarkers, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
@@ -12,7 +12,7 @@ import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, norm
 import { DEFAULT_ACCOUNT_ID, hasConfiguredAccountValue, normalizeAccountId, resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-core";
 import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
-import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
 import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
@@ -40,7 +40,7 @@ import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMat
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createServer } from "node:http";
-import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
+import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
 import { isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
@@ -97,18 +97,26 @@ function listNextcloudTalkAccountIds(cfg) {
 	debugAccounts("listNextcloudTalkAccountIds", ids);
 	return ids;
 }
-function resolveNextcloudTalkSecret(cfg, opts) {
-	const resolvedAccountId = opts.accountId ?? resolveDefaultNextcloudTalkAccountId(cfg);
-	const merged = mergeNextcloudTalkAccountConfig(cfg, resolvedAccountId);
+function resolveNextcloudTalkSecret(accountId, merged) {
+	const configuredSecret = resolveSecretInputString({
+		value: merged.botSecret,
+		path: `channels.nextcloud-talk.accounts.${accountId}.botSecret`,
+		mode: "inspect"
+	});
+	if (configuredSecret.status === "configured_unavailable") return {
+		secret: "",
+		source: "config",
+		status: "configured_unavailable"
+	};
 	const envSecret = normalizeOptionalString(process.env.NEXTCLOUD_TALK_BOT_SECRET);
-	if (envSecret && resolvedAccountId === DEFAULT_ACCOUNT_ID) return {
+	if (envSecret && accountId === DEFAULT_ACCOUNT_ID) return {
 		secret: envSecret,
 		source: "env",
 		status: "available"
 	};
 	const botSecretFile = normalizeOptionalString(merged.botSecretFile);
 	if (botSecretFile) {
-		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecretFile` });
+		const result = tryReadSecretFileSync(botSecretFile, "Nextcloud Talk bot secret file", { rejectSymlink: true }, { configPath: `channels.nextcloud-talk.accounts.${accountId}.botSecretFile` });
 		return result.status === "available" ? {
 			secret: result.value,
 			source: "secretFile",
@@ -120,12 +128,8 @@ function resolveNextcloudTalkSecret(cfg, opts) {
 			diagnostic: result.diagnostic
 		};
 	}
-	const inlineSecret = normalizeResolvedSecretInputString({
-		value: merged.botSecret,
-		path: `channels.nextcloud-talk.accounts.${resolvedAccountId}.botSecret`
-	});
-	if (inlineSecret) return {
-		secret: inlineSecret,
+	if (configuredSecret.status === "available") return {
+		secret: configuredSecret.value,
 		source: "config",
 		status: "available"
 	};
@@ -142,7 +146,7 @@ function resolveNextcloudTalkAccount(params) {
 		const merged = mergeNextcloudTalkAccountConfig(params.cfg, accountId);
 		const accountEnabled = merged.enabled !== false;
 		const enabled = baseEnabled && accountEnabled;
-		const secretResolution = resolveNextcloudTalkSecret(params.cfg, { accountId });
+		const secretResolution = resolveNextcloudTalkSecret(accountId, merged);
 		const apiCredentialResolution = resolveNextcloudTalkApiCredentialsResult({
 			apiUser: merged.apiUser,
 			apiPassword: merged.apiPassword,
@@ -1352,7 +1356,7 @@ function createNextcloudTalkWebhookServer(opts) {
 				res.end();
 				return;
 			}
-			const clientIp = req.socket.remoteAddress ?? "unknown";
+			const clientIp = resolveRequestClientIp(req, opts.trustedProxies, opts.allowRealIpFallback) ?? req.socket.remoteAddress ?? "unknown";
 			if (!webhookAuthRateLimiter.check(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE).allowed) {
 				res.writeHead(429);
 				res.end("Too Many Requests");
@@ -1647,6 +1651,8 @@ async function monitorNextcloudTalkProvider(opts) {
 		onError: (error) => {
 			logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
 		},
+		trustedProxies: cfg.gateway?.trustedProxies,
+		allowRealIpFallback: cfg.gateway?.allowRealIpFallback,
 		abortSignal: opts.abortSignal
 	});
 	let stopPromise;
@@ -2192,6 +2198,12 @@ const collectNextcloudTalkSecurityWarnings = createAllowlistProviderRouteAllowli
 		groupAllowFromPath: "channels.nextcloud-talk.groupAllowFrom"
 	}
 });
+const collectNextcloudTalkOpenGroupFindings = createConditionalWarningCollector.findings({
+	collectWarnings: collectNextcloudTalkSecurityWarnings,
+	checkId: "channels.nextcloud-talk.groups.open",
+	severity: "critical",
+	title: "Nextcloud Talk security warning"
+});
 const nextcloudTalkPlugin = createChatChannelPlugin({
 	base: {
 		id: "nextcloud-talk",
@@ -2288,7 +2300,7 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 	} },
 	security: {
 		...nextcloudTalkSecurityAdapter,
-		collectWarnings: collectNextcloudTalkSecurityWarnings
+		collectWarnings: collectNextcloudTalkOpenGroupFindings
 	},
 	outbound: {
 		base: {

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-CojgyJSq.js";
+import { t as nextcloudTalkPlugin } from "./channel-gYP-jQPr.js";
 export { nextcloudTalkPlugin };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.8.1-beta.2",
+  "version": "2026.8.1-beta.3",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.2"
+    "openclaw": ">=2026.8.1-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -127,10 +127,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.2"
+      "pluginApi": ">=2026.8.1-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.2"
+      "openclawVersion": "2026.8.1-beta.3"
     },
     "release": {
       "publishToClawHub": true,