@openclaw/nextcloud-talk 2026.9.1-beta.1 → 2026.9.2

package/dist/api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-tgvjpexV.js";
+import { t as nextcloudTalkPlugin } from "./channel-B3OgVClw.js";
 export { nextcloudTalkPlugin };

package/dist/{channel-tgvjpexV.js → channel-B3OgVClw.js}

@@ -7,41 +7,43 @@ import { createLoggedPairingApprovalNotifier, createPairingPrefixStripper } from
 import { createAllowlistProviderRouteAllowlistWarningCollector, createConditionalWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { buildWebhookChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { FormatCapabilityProfile, convertMarkdownTables, renderMarkdownWithMarkers, sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
-import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries, readNonEmptyStringPreservingWhitespace } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { DEFAULT_ACCOUNT_ID, hasConfiguredAccountValue, normalizeAccountId, resolveAccountWithDefaultFallback } from "openclaw/plugin-sdk/account-core";
 import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
-import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { buildSecretInputSchema, hasConfiguredSecretInput, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { isRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries, readNonEmptyStringPreservingWhitespace } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
-import { readProviderJsonResponse, readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { readProviderJsonResponse, readProviderTextResponse } from "openclaw/plugin-sdk/provider-http";
 import { resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
 import { bindIngressLifecycleToReplyOptions, createAccountStatusSink, createChannelIngressMonitor, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveChannelStreamingBlockEnabled, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
-import { ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { SsrFBlockedError, ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
 import { createHmac, randomBytes } from "node:crypto";
-import { fileExists, safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
-import { clearAccountEntryFields } from "openclaw/plugin-sdk/channel-plugin-common";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/account-id";
 import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, ReplyToModeSchema, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
 import { formatAllowFromLowercase, resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
-import { adaptScopedAccountAccessor, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
+import { adaptScopedAccountAccessor, clearAccountFieldsFromConfigSection, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
 import os from "node:os";
 import path from "node:path";
+import { fileExists } from "openclaw/plugin-sdk/file-access-runtime";
 import { migratePersistentDedupeLegacyJsonFile, resolvePersistentDedupePluginStateNamespace } from "openclaw/plugin-sdk/persistent-dedupe";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { channelReadyPatch } from "openclaw/plugin-sdk/gateway-runtime";
 import { channelIngressRoutes, resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
+import { safeParseJson, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback } from "openclaw/plugin-sdk/channel-targets";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
-import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { createServer } from "node:http";
 import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
-import { isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+import { sendHttpRequestRejection } from "openclaw/plugin-sdk/webhook-request-guards";
+import { isRecord as isRecord$1 } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
 import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
@@ -53,17 +55,19 @@ import { formatDocsLink as formatDocsLink$1 } from "openclaw/plugin-sdk/setup-to
 function resolveNextcloudTalkApiCredentialsResult(params) {
 	const apiUser = params.apiUser?.trim();
 	if (!apiUser) return { status: "missing" };
-	const inlinePassword = normalizeResolvedSecretInputString({
+	const inlinePassword = resolveSecretInputString({
 		value: params.apiPassword,
-		path: "channels.nextcloud-talk.apiPassword"
+		path: "channels.nextcloud-talk.apiPassword",
+		mode: params.mode
 	});
-	if (inlinePassword) return {
+	if (inlinePassword.status === "available") return {
 		status: "available",
 		value: {
 			apiUser,
-			apiPassword: inlinePassword
+			apiPassword: inlinePassword.value
 		}
 	};
+	if (inlinePassword.status === "configured_unavailable") return { status: "configured_unavailable" };
 	if (!params.apiPasswordFile?.trim()) return { status: "missing" };
 	const result = tryReadSecretFileSync(params.apiPasswordFile, "Nextcloud Talk API password", { rejectHardlinks: false }, { configPath: params.configPath ?? "channels.nextcloud-talk.apiPasswordFile" });
 	if (result.status === "available") return result.value ? {
@@ -180,15 +184,21 @@ function inspectNextcloudTalkAccount(params) {
 		apiUser: account.config.apiUser,
 		apiPassword: account.config.apiPassword,
 		apiPasswordFile: account.config.apiPasswordFile,
-		configPath: `channels.nextcloud-talk.accounts.${account.accountId}.apiPasswordFile`
+		configPath: `channels.nextcloud-talk.accounts.${account.accountId}.apiPasswordFile`,
+		mode: "inspect"
 	});
-	const credentialDiagnostics = [...account.credentialDiagnostics ?? [], ...apiCredentialResolution.status === "configured_unavailable" ? [apiCredentialResolution.diagnostic] : []];
+	const credentialDiagnostics = [...account.credentialDiagnostics ?? [], ...apiCredentialResolution.status === "configured_unavailable" && apiCredentialResolution.diagnostic ? [apiCredentialResolution.diagnostic] : []];
 	return {
 		...account,
+		configured: isNextcloudTalkAccountConfigured(account),
+		mode: "webhook",
 		apiCredentialStatus: apiCredentialResolution.status,
 		...credentialDiagnostics.length > 0 ? { credentialDiagnostics } : {}
 	};
 }
+function isNextcloudTalkAccountConfigured(account) {
+	return Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim());
+}
 //#endregion
 //#region extensions/nextcloud-talk/src/approval-auth.ts
 function normalizeNextcloudTalkApproverId(value) {
@@ -210,6 +220,18 @@ async function releaseNextcloudTalkGuardedResponse(params) {
 	if (!params.response.bodyUsed) await params.response.body?.cancel().catch(() => void 0);
 	await params.release();
 }
+async function readNextcloudTalkErrorBody(response, ...credentials) {
+	try {
+		let body = await readProviderTextResponse(response, "Nextcloud Talk error", {
+			maxBytes: 8192,
+			chunkTimeoutMs: 1e4
+		});
+		for (const credential of credentials) body = body.replaceAll(credential, "***");
+		return redactToolPayloadText(body);
+	} catch {
+		return "";
+	}
+}
 //#endregion
 //#region extensions/nextcloud-talk/src/signature.ts
 const SIGNATURE_HEADER = "x-nextcloud-talk-signature";
@@ -222,7 +244,8 @@ const BACKEND_HEADER = "x-nextcloud-talk-backend";
 function verifyNextcloudTalkSignature(params) {
 	const { signature, random, body, secret } = params;
 	if (!signature || !random || !secret) return false;
-	return safeEqualSecret(signature, createHmac("sha256", secret).update(random + body).digest("hex"));
+	const expected = createHmac("sha256", secret).update(random + body).digest("hex");
+	return safeEqualSecret(signature, expected);
 }
 /**
 * Extract webhook headers from an incoming request.
@@ -256,7 +279,6 @@ function generateNextcloudTalkSignature(params) {
 //#endregion
 //#region extensions/nextcloud-talk/src/bot-preflight.ts
 const BOT_FEATURE_RESPONSE = 2;
-const BOT_PREFLIGHT_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 function normalizeUrlForMatch(value) {
 	if (!value?.trim()) return "";
 	try {
@@ -321,7 +343,7 @@ async function probeNextcloudTalkBotResponseFeature(params) {
 		});
 		try {
 			if (!response.ok) {
-				const body = await readResponseTextLimited(response, BOT_PREFLIGHT_ERROR_BODY_LIMIT_BYTES).catch(() => "");
+				const body = await readNextcloudTalkErrorBody(response, auth, credentials.apiPassword);
 				return {
 					ok: false,
 					code: "api_error",
@@ -373,7 +395,16 @@ const nextcloudTalkConfigAdapter = createScopedChannelConfigAdapter({
 	sectionKey: "nextcloud-talk",
 	listAccountIds: listNextcloudTalkAccountIds,
 	resolveAccount: adaptScopedAccountAccessor(resolveNextcloudTalkAccount),
-	inspectAccount: adaptScopedAccountAccessor(inspectNextcloudTalkAccount),
+	inspectAccount: (cfg, accountId) => {
+		const account = inspectNextcloudTalkAccount({
+			cfg,
+			accountId
+		});
+		return {
+			...account,
+			baseUrl: account.baseUrl ? "[set]" : "[missing]"
+		};
+	},
 	defaultAccountId: resolveDefaultNextcloudTalkAccountId,
 	clearBaseFields: [
 		"botSecret",
@@ -405,7 +436,7 @@ const NextcloudTalkRoomSchema = buildGroupEntrySchema({ allowFrom: z.array(z.str
 const NextcloudTalkNetworkSchema = z.object({ 
 /** Dangerous opt-in for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 dangerouslyAllowPrivateNetwork: z.boolean().optional() }).strict().optional();
-const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
+const NextcloudTalkAccountSchemaBase = z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	configWrites: z.boolean().optional(),
@@ -429,7 +460,8 @@ const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
 	/** Network policy overrides for self-hosted Nextcloud Talk on trusted private/internal hosts. */
 	network: NextcloudTalkNetworkSchema,
 	...ReplyRuntimeConfigSchemaShape
-}).strict(), {
+}).strict();
+const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(NextcloudTalkAccountSchemaBase, {
 	optionalAccount: true,
 	refine: (value, ctx) => {
 		requireChannelOpenAllowFrom({
@@ -445,7 +477,7 @@ const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(z.object({
 //#region extensions/nextcloud-talk/src/replay-migration-contract.ts
 const NEXTCLOUD_TALK_PLUGIN_ID = "nextcloud-talk";
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX = "replay-dedupe";
-const NEXTCLOUD_TALK_REPLAY_DEDUPE_TTL_MS = 1440 * 60 * 1e3;
+const NEXTCLOUD_TALK_REPLAY_DEDUPE_TTL_MS = 864e5;
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_MAX_ENTRIES = 1e4;
 //#endregion
 //#region extensions/nextcloud-talk/src/doctor.ts
@@ -525,10 +557,12 @@ function normalizeNextcloudTalkAllowlist(values) {
 	return (values ?? []).map((value) => normalizeNextcloudTalkAllowEntry(String(value))).filter(Boolean);
 }
 function resolveNextcloudTalkAllowlistMatch(params) {
+	const allowFrom = normalizeNextcloudTalkAllowlist(params.allowFrom);
+	const senderId = normalizeNextcloudTalkAllowEntry(params.senderId);
 	return resolveAllowlistMatchByCandidates({
-		allowList: normalizeNextcloudTalkAllowlist(params.allowFrom),
+		allowList: allowFrom,
 		candidates: [{
-			value: normalizeNextcloudTalkAllowEntry(params.senderId),
+			value: senderId,
 			source: "id"
 		}]
 	});
@@ -596,17 +630,18 @@ function resolveNextcloudTalkGroupRequireMention(params) {
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/room-info.ts
-const ROOM_CACHE_TTL_MS = 300 * 1e3;
-const ROOM_CACHE_ERROR_TTL_MS = 30 * 1e3;
+const ROOM_CACHE_TTL_MS = 3e5;
+const ROOM_CACHE_ERROR_TTL_MS = 3e4;
 const ROOM_CACHE_MAX_ENTRIES = 1e3;
 const NEXTCLOUD_TALK_ROOM_INFO_TIMEOUT_MS = 3e4;
 const roomCache = /* @__PURE__ */ new Map();
-function resolveRoomCacheKey(params) {
-	return `${params.accountId}:${params.roomToken}`;
-}
-function cacheRoomInfo(key, value) {
-	roomCache.set(key, value);
+function cacheRoomInfo(key, kind, ttlMs) {
+	roomCache.set(key, {
+		kind,
+		expiresAt: Date.now() + ttlMs
+	});
 	pruneMapToMaxSize(roomCache, ROOM_CACHE_MAX_ENTRIES);
+	return kind;
 }
 function resolveRoomKindFromType(type) {
 	if (!type) return;
@@ -615,29 +650,28 @@ function resolveRoomKindFromType(type) {
 }
 async function resolveNextcloudTalkRoomKind(params) {
 	const { account, roomToken, runtime } = params;
-	const key = resolveRoomCacheKey({
-		accountId: account.accountId,
-		roomToken
-	});
+	const key = `${account.accountId}:${roomToken}`;
 	const cached = roomCache.get(key);
-	if (cached) {
-		const age = Date.now() - cached.fetchedAt;
-		if (cached.kind && age < ROOM_CACHE_TTL_MS) return cached.kind;
-		if (cached.error && age < ROOM_CACHE_ERROR_TTL_MS) return;
-	}
+	if (cached && Date.now() < cached.expiresAt) return cached.kind;
+	roomCache.delete(key);
 	const apiCredentials = resolveNextcloudTalkApiCredentials({
 		apiUser: account.config.apiUser,
 		apiPassword: account.config.apiPassword,
 		apiPasswordFile: account.config.apiPasswordFile
 	});
-	if (!apiCredentials) return;
 	const baseUrl = account.baseUrl?.trim();
-	if (!baseUrl) return;
-	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v4/room/${roomToken}`;
+	if (!apiCredentials || !baseUrl) return;
+	const fallback = (error) => {
+		runtime?.error?.(`nextcloud-talk: room lookup error: ${String(error)}`);
+		return cacheRoomInfo(key, void 0, ROOM_CACHE_ERROR_TTL_MS);
+	};
+	const parsedBaseUrl = URL.parse(baseUrl);
+	if (!parsedBaseUrl || !["http:", "https:"].includes(parsedBaseUrl.protocol)) return fallback(/* @__PURE__ */ new Error("Nextcloud Talk room lookup requires an HTTP(S) base URL"));
 	const auth = Buffer.from(`${apiCredentials.apiUser}:${apiCredentials.apiPassword}`, "utf-8").toString("base64");
+	let guarded;
 	try {
-		const { response, release } = await fetchWithSsrFGuard({
-			url,
+		guarded = await fetchWithSsrFGuard({
+			url: `${baseUrl}/ocs/v2.php/apps/spreed/api/v4/room/${roomToken}`,
 			init: {
 				method: "GET",
 				headers: {
@@ -650,34 +684,30 @@ async function resolveNextcloudTalkRoomKind(params) {
 			policy: ssrfPolicyFromPrivateNetworkOptIn(account.config),
 			timeoutMs: params.timeoutMs ?? NEXTCLOUD_TALK_ROOM_INFO_TIMEOUT_MS
 		});
+	} catch (error) {
+		if (error instanceof SsrFBlockedError) return fallback(error);
+		throw error;
+	}
+	const { response, release } = guarded;
+	try {
+		if (!response.ok) {
+			const status = response.status;
+			if (status === 408 || status === 429 || status >= 500 && status <= 599) throw new Error(`Nextcloud Talk room lookup failed (${status})`);
+			runtime?.log?.(`nextcloud-talk: room lookup failed (${status}) token=${roomToken}`);
+			return cacheRoomInfo(key, void 0, ROOM_CACHE_ERROR_TTL_MS);
+		}
 		try {
-			if (!response.ok) {
-				cacheRoomInfo(key, {
-					fetchedAt: Date.now(),
-					error: `status:${response.status}`
-				});
-				runtime?.log?.(`nextcloud-talk: room lookup failed (${response.status}) token=${roomToken}`);
-				return;
-			}
-			const kind = resolveRoomKindFromType(parseStrictPositiveInteger((await readProviderJsonResponse(response, "Nextcloud Talk room info failed")).ocs?.data?.type));
-			cacheRoomInfo(key, {
-				fetchedAt: Date.now(),
-				kind
-			});
-			return kind;
-		} finally {
-			await releaseNextcloudTalkGuardedResponse({
-				response,
-				release
-			});
+			const payload = await readProviderJsonResponse(response, "Nextcloud Talk room info failed");
+			const kind = resolveRoomKindFromType(parseStrictPositiveInteger(payload.ocs?.data?.type));
+			return kind ? cacheRoomInfo(key, kind, ROOM_CACHE_TTL_MS) : void 0;
+		} catch (error) {
+			return fallback(error);
 		}
-	} catch (err) {
-		cacheRoomInfo(key, {
-			fetchedAt: Date.now(),
-			error: formatErrorMessage(err)
+	} finally {
+		await releaseNextcloudTalkGuardedResponse({
+			response,
+			release
 		});
-		runtime?.error?.(`nextcloud-talk: room lookup error: ${String(err)}`);
-		return;
 	}
 }
 //#endregion
@@ -705,7 +735,6 @@ function looksLikeNextcloudTalkTargetId(raw) {
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/send.ts
-const NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_BYTES = 8 * 1024;
 const NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS = 200;
 const NEXTCLOUD_TALK_SEND_TIMEOUT_MS = 3e4;
 const NEXTCLOUD_TALK_FORMAT_PROFILE = FormatCapabilityProfile.define({
@@ -726,20 +755,12 @@ function renderNextcloudTalkMarkdown(markdown) {
 		escapeText: (text) => text
 	}, NEXTCLOUD_TALK_FORMAT_PROFILE);
 }
-/** Collapses whitespace and caps an error-body prefix to a short, log-safe snippet. */
+/** Collapses and caps an already-redacted error body for display. */
 function collapseErrorSnippet(text) {
 	const collapsed = text.replace(/\s+/g, " ").trim();
 	if (collapsed.length > NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS) return `${truncateUtf16Safe(collapsed, NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS)}…`;
 	return collapsed;
 }
-/** Reads a bounded, collapsed error-body snippet without buffering hostile responses. */
-async function readNextcloudTalkErrorSnippet(response) {
-	try {
-		return collapseErrorSnippet(await readResponseTextLimited(response, NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_BYTES));
-	} catch {
-		return "";
-	}
-}
 function resolveCredentials(explicit, account) {
 	const baseUrl = explicit.baseUrl?.trim() ?? account.baseUrl;
 	const secret = explicit.secret?.trim() ?? account.secret;
@@ -812,8 +833,9 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 		body: message,
 		secret
 	});
+	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${roomToken}/message`;
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${roomToken}/message`,
+		url,
 		init: {
 			method: "POST",
 			headers: {
@@ -830,7 +852,7 @@ async function sendMessageNextcloudTalk(to, text, opts) {
 	});
 	try {
 		if (!response.ok) {
-			const errorBody = await readNextcloudTalkErrorSnippet(response);
+			const errorBody = collapseErrorSnippet(await readNextcloudTalkErrorBody(response, signature));
 			const status = response.status;
 			let errorMsg = `Nextcloud Talk send failed (${status})`;
 			if (status === 400) errorMsg = `Nextcloud Talk: bad request - ${errorBody || "invalid message format"}`;
@@ -874,8 +896,9 @@ async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
 		body: reaction,
 		secret
 	});
+	const url = `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${normalizedToken}/reaction/${messageId}`;
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/ocs/v2.php/apps/spreed/api/v1/bot/${normalizedToken}/reaction/${messageId}`,
+		url,
 		init: {
 			method: "POST",
 			headers: {
@@ -892,7 +915,7 @@ async function sendReactionNextcloudTalk(roomToken, messageId, reaction, opts) {
 	});
 	try {
 		if (!response.ok) {
-			const errorBody = await readNextcloudTalkErrorSnippet(response);
+			const errorBody = collapseErrorSnippet(await readNextcloudTalkErrorBody(response, signature));
 			throw new Error(`Nextcloud Talk reaction failed: ${response.status} ${errorBody}`.trim());
 		}
 		return { ok: true };
@@ -963,7 +986,15 @@ async function handleNextcloudTalkInbound(params) {
 		accountId: account.accountId
 	});
 	const rawBody = message.text?.trim() ?? "";
-	if (!rawBody) return;
+	if (!rawBody) {
+		logInboundDrop({
+			log: (messageLocal) => runtime.log?.(messageLocal),
+			channel: CHANNEL_ID,
+			reason: `empty message body (mediaType=${message.mediaType})`,
+			target: message.senderId
+		});
+		return;
+	}
 	const roomKind = await resolveNextcloudTalkRoomKind({
 		account,
 		roomToken: message.roomToken,
@@ -984,7 +1015,10 @@ async function handleNextcloudTalkInbound(params) {
 		cfg: config,
 		surface: CHANNEL_ID
 	});
-	const hasControlCommand = core.channel.text.hasControlCommand(rawBody, config);
+	const structuredBody = rawBody.startsWith("{") ? safeParseJson(rawBody) : void 0;
+	const structuredText = isRecord(structuredBody) && Object.hasOwn(structuredBody, "parameters") ? normalizeOptionalString(structuredBody.message) : void 0;
+	const commandBody = structuredText?.startsWith("/") ? structuredText : rawBody;
+	const hasControlCommand = core.channel.text.hasControlCommand(commandBody, config);
 	const shouldRequireMention = isGroup ? resolveNextcloudTalkGroupRequireMention({
 		cfg: config,
 		accountId: account.accountId,
@@ -1160,7 +1194,7 @@ async function handleNextcloudTalkInbound(params) {
 			body,
 			bodyForAgent: rawBody,
 			rawBody,
-			commandBody: rawBody
+			commandBody
 		},
 		access: {
 			commands: { authorized: commandAuthorized },
@@ -1225,7 +1259,7 @@ function parseRawObject(rawEvent) {
 	} catch (error) {
 		throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook contains invalid JSON.", { cause: error });
 	}
-	if (!isRecord(parsed)) throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook must be a JSON object.");
+	if (!isRecord$1(parsed)) throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook must be a JSON object.");
 	return parsed;
 }
 function requiredString(value, field) {
@@ -1235,10 +1269,10 @@ function requiredString(value, field) {
 function inspectNextcloudTalkWebhookEnvelope(rawEvent) {
 	const envelope = parseRawObject(rawEvent);
 	if (envelope.type !== "Create") return null;
-	const object = isRecord(envelope.object) ? envelope.object : null;
+	const object = isRecord$1(envelope.object) ? envelope.object : null;
 	if (object?.type !== void 0 && object.type !== "Note") return null;
 	if (!object) throw new NextcloudTalkWebhookPayloadError("Nextcloud Talk webhook is missing object.");
-	const target = isRecord(envelope.target) ? envelope.target : null;
+	const target = isRecord$1(envelope.target) ? envelope.target : null;
 	return {
 		eventId: requiredString(object.id, "object.id"),
 		laneKey: `room:${requiredString(target?.id, "target.id")}`
@@ -1279,8 +1313,8 @@ async function migrateNextcloudTalkLegacyReplayState(params) {
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/monitor.ts
-const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1024 * 1024;
-const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 64 * 1024;
+const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1048576;
+const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 65536;
 const NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_HEADER = "x-openclaw-delivery-accepted";
 const NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_VALUE = "durable";
 const PREAUTH_WEBHOOK_BODY_TIMEOUT_MS = 5e3;
@@ -1336,9 +1370,14 @@ function verifyWebhookSignature(params) {
 function readNextcloudTalkWebhookBody(req, maxBodyBytes) {
 	return readRequestBodyWithLimit(req, {
 		maxBytes: Math.min(maxBodyBytes, PREAUTH_WEBHOOK_MAX_BODY_BYTES),
-		timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS
+		timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS,
+		destroyOnLimit: false
 	});
 }
+async function rejectWebhookRequest(req, res, status, error) {
+	if (res.headersSent) return;
+	await sendHttpRequestRejection(req, res, status, JSON.stringify({ error }), "application/json");
+}
 function createNextcloudTalkWebhookServer(opts) {
 	const { port, host, path, secret, onWebhook, onError, abortSignal } = opts;
 	const maxBodyBytes = typeof opts.maxBodyBytes === "number" && Number.isFinite(opts.maxBodyBytes) && opts.maxBodyBytes > 0 ? Math.floor(opts.maxBodyBytes) : DEFAULT_WEBHOOK_MAX_BODY_BYTES;
@@ -1391,11 +1430,11 @@ function createNextcloudTalkWebhookServer(opts) {
 				writeJsonResponse(res, 200);
 			} catch (err) {
 				if (isRequestBodyLimitError(err, "PAYLOAD_TOO_LARGE")) {
-					writeWebhookError(res, 413, WEBHOOK_ERRORS.payloadTooLarge);
+					await rejectWebhookRequest(req, res, 413, WEBHOOK_ERRORS.payloadTooLarge);
 					return;
 				}
 				if (isRequestBodyLimitError(err, "REQUEST_BODY_TIMEOUT")) {
-					writeWebhookError(res, 408, requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
+					await rejectWebhookRequest(req, res, 408, requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
 					return;
 				}
 				if (err instanceof NextcloudTalkWebhookPayloadError) {
@@ -1439,8 +1478,10 @@ function createNextcloudTalkWebhookServer(opts) {
 			});
 		});
 	};
-	if (abortSignal) if (abortSignal.aborted) stop();
-	else abortSignal.addEventListener("abort", () => void stop(), { once: true });
+	if (abortSignal) {
+		if (abortSignal.aborted) stop();
+		else abortSignal.addEventListener("abort", () => void stop(), { once: true });
+	}
 	return {
 		server,
 		start,
@@ -1450,6 +1491,12 @@ function createNextcloudTalkWebhookServer(opts) {
 //#endregion
 //#region extensions/nextcloud-talk/src/webhook-spool.ts
 const NEXTCLOUD_TALK_INGRESS_POLL_INTERVAL_MS = 500;
+function describeIgnoredWebhookEvent(rawEvent) {
+	const envelope = parseRawObject(rawEvent);
+	const type = typeof envelope.type === "string" ? envelope.type : "unknown";
+	const object = isRecord$1(envelope.object) ? envelope.object : null;
+	return `type=${type} objectType=${typeof object?.type === "string" ? object.type : "unknown"}`;
+}
 const NextcloudTalkWebhookPayloadSchema = z.object({
 	type: z.enum([
 		"Create",
@@ -1576,7 +1623,11 @@ function createNextcloudTalkWebhookSpool(options) {
 			if (stopping) return Promise.reject(/* @__PURE__ */ new Error("Nextcloud Talk ingress stopped"));
 			const receiveTask = (async () => {
 				await startAfterMigration;
-				return (await monitor.admit(rawEvent)).kind === "ignored" ? "ignored" : "accepted";
+				if ((await monitor.admit(rawEvent)).kind === "ignored") {
+					options.runtime.log?.(`nextcloud-talk: ignored non-message webhook event (${describeIgnoredWebhookEvent(rawEvent)})`);
+					return "ignored";
+				}
+				return "accepted";
 			})();
 			inFlightReceives.add(receiveTask);
 			receiveTask.then(() => inFlightReceives.delete(receiveTask), () => inFlightReceives.delete(receiveTask));
@@ -1720,44 +1771,18 @@ const nextcloudTalkGatewayAdapter = {
 		});
 	},
 	logoutAccount: async ({ accountId, cfg }) => {
-		const nextCfg = { ...cfg };
-		const nextSection = cfg.channels?.["nextcloud-talk"] ? { ...cfg.channels["nextcloud-talk"] } : void 0;
-		let cleared = false;
-		let changed = false;
-		if (nextSection) {
-			if (accountId === DEFAULT_ACCOUNT_ID$2 && nextSection.botSecret) {
-				delete nextSection.botSecret;
-				cleared = true;
-				changed = true;
-			}
-			const accountCleanup = clearAccountEntryFields({
-				accounts: nextSection.accounts,
-				accountId,
-				fields: ["botSecret"]
-			});
-			if (accountCleanup.changed) {
-				changed = true;
-				if (accountCleanup.cleared) cleared = true;
-				if (accountCleanup.nextAccounts) nextSection.accounts = accountCleanup.nextAccounts;
-				else delete nextSection.accounts;
-			}
-		}
-		if (changed) if (nextSection && Object.keys(nextSection).length > 0) nextCfg.channels = {
-			...nextCfg.channels,
-			"nextcloud-talk": nextSection
-		};
-		else {
-			const nextChannels = { ...nextCfg.channels };
-			delete nextChannels["nextcloud-talk"];
-			if (Object.keys(nextChannels).length > 0) nextCfg.channels = nextChannels;
-			else delete nextCfg.channels;
-		}
+		const { nextConfig, changed, cleared } = clearAccountFieldsFromConfigSection({
+			cfg,
+			sectionKey: "nextcloud-talk",
+			accountId,
+			fields: ["botSecret"]
+		});
 		const loggedOut = resolveNextcloudTalkAccount({
-			cfg: changed ? nextCfg : cfg,
+			cfg: nextConfig,
 			accountId
 		}).secretSource === "none";
 		if (changed) await getNextcloudTalkRuntime().config.replaceConfigFile({
-			nextConfig: nextCfg,
+			nextConfig,
 			afterWrite: { mode: "auto" }
 		});
 		return {
@@ -1939,6 +1964,49 @@ const nextcloudTalkDmPolicy = createChannelDmPolicy({
 	applyPatch: ({ cfg, account, patch }) => setNextcloudTalkAccountConfig(cfg, account.accountId, patch),
 	promptAllowFrom: promptNextcloudTalkAllowFromForAccount
 });
+const nextcloudTalkSetupAdapter = {
+	singleAccountKeysToMove: ["rooms"],
+	resolveAccountId: ({ accountId }) => normalizeAccountId$1(accountId),
+	prepareAccountConfigInput: ({ input }) => {
+		const setupInput = input;
+		return {
+			...setupInput,
+			baseUrl: setupInput.baseUrl ?? readNonEmptyStringPreservingWhitespace(setupInput.url),
+			secret: setupInput.secret ?? readNonEmptyStringPreservingWhitespace(setupInput.token) ?? readNonEmptyStringPreservingWhitespace(setupInput.password),
+			secretFile: setupInput.secretFile ?? readNonEmptyStringPreservingWhitespace(setupInput.tokenFile)
+		};
+	},
+	applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
+		cfg,
+		channelKey: channel$1,
+		accountId,
+		name
+	}),
+	validateInput: createSetupInputPresenceValidator({
+		defaultAccountOnlyEnvError: "NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.",
+		validate: ({ input }) => {
+			const setupInput = input;
+			if (!setupInput.useEnv && !setupInput.secret && !setupInput.secretFile) return "Nextcloud Talk requires bot secret or --secret-file (or --use-env).";
+			const normalizedBaseUrl = normalizeNextcloudTalkBaseUrl(setupInput.baseUrl);
+			if (!normalizedBaseUrl) return "Nextcloud Talk requires --base-url.";
+			const baseUrlError = validateNextcloudTalkBaseUrl(normalizedBaseUrl);
+			if (baseUrlError) return baseUrlError;
+			return null;
+		}
+	}),
+	applyAccountConfig: ({ cfg, accountId, input }) => {
+		const setupInput = input;
+		return setNextcloudTalkAccountConfig(applyAccountNameToChannelSection({
+			cfg,
+			channelKey: channel$1,
+			accountId,
+			name: setupInput.name
+		}), accountId, {
+			baseUrl: normalizeNextcloudTalkBaseUrl(setupInput.baseUrl),
+			...setupInput.useEnv ? {} : setupInput.secretFile ? { botSecretFile: setupInput.secretFile } : setupInput.secret ? { botSecret: setupInput.secret } : {}
+		}, setupInput.useEnv ? ["botSecret", "botSecretFile"] : void 0);
+	}
+};
 const nextcloudTalkSetupContract = defineChannelSetupContract({
 	fields: {
 		baseUrl: {
@@ -2004,49 +2072,7 @@ const nextcloudTalkSetupContract = defineChannelSetupContract({
 			envVars: ["NEXTCLOUD_TALK_BOT_SECRET"]
 		}
 	},
-	legacyAdapter: {
-		singleAccountKeysToMove: ["rooms"],
-		resolveAccountId: ({ accountId }) => normalizeAccountId$1(accountId),
-		prepareAccountConfigInput: ({ input }) => {
-			const setupInput = input;
-			return {
-				...setupInput,
-				baseUrl: setupInput.baseUrl ?? readNonEmptyStringPreservingWhitespace(setupInput.url),
-				secret: setupInput.secret ?? readNonEmptyStringPreservingWhitespace(setupInput.token) ?? readNonEmptyStringPreservingWhitespace(setupInput.password),
-				secretFile: setupInput.secretFile ?? readNonEmptyStringPreservingWhitespace(setupInput.tokenFile)
-			};
-		},
-		applyAccountName: ({ cfg, accountId, name }) => applyAccountNameToChannelSection({
-			cfg,
-			channelKey: channel$1,
-			accountId,
-			name
-		}),
-		validateInput: createSetupInputPresenceValidator({
-			defaultAccountOnlyEnvError: "NEXTCLOUD_TALK_BOT_SECRET can only be used for the default account.",
-			validate: ({ input }) => {
-				const setupInput = input;
-				if (!setupInput.useEnv && !setupInput.secret && !setupInput.secretFile) return "Nextcloud Talk requires bot secret or --secret-file (or --use-env).";
-				const normalizedBaseUrl = normalizeNextcloudTalkBaseUrl(setupInput.baseUrl);
-				if (!normalizedBaseUrl) return "Nextcloud Talk requires --base-url.";
-				const baseUrlError = validateNextcloudTalkBaseUrl(normalizedBaseUrl);
-				if (baseUrlError) return baseUrlError;
-				return null;
-			}
-		}),
-		applyAccountConfig: ({ cfg, accountId, input }) => {
-			const setupInput = input;
-			return setNextcloudTalkAccountConfig(applyAccountNameToChannelSection({
-				cfg,
-				channelKey: channel$1,
-				accountId,
-				name: setupInput.name
-			}), accountId, {
-				baseUrl: normalizeNextcloudTalkBaseUrl(setupInput.baseUrl),
-				...setupInput.useEnv ? {} : setupInput.secretFile ? { botSecretFile: setupInput.secretFile } : setupInput.secret ? { botSecret: setupInput.secret } : {}
-			}, setupInput.useEnv ? ["botSecret", "botSecretFile"] : void 0);
-		}
-	}
+	legacyAdapter: nextcloudTalkSetupAdapter
 });
 //#endregion
 //#region extensions/nextcloud-talk/src/setup-surface.ts
@@ -2231,10 +2257,10 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		configSchema: buildChannelConfigSchema(NextcloudTalkConfigSchema),
 		config: {
 			...nextcloudTalkConfigAdapter,
-			isConfigured: (account) => Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+			isConfigured: isNextcloudTalkAccountConfigured,
 			describeAccount: (account) => describeWebhookAccountSnapshot({
 				account,
-				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+				configured: isNextcloudTalkAccountConfigured(account),
 				extra: {
 					secretSource: account.secretSource,
 					tokenStatus: account.tokenStatus,
@@ -2290,7 +2316,7 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 				accountId: account.accountId,
 				name: account.name,
 				enabled: account.enabled,
-				configured: Boolean(account.tokenStatus !== "missing" && account.baseUrl?.trim()),
+				configured: isNextcloudTalkAccountConfigured(account),
 				extra: {
 					secretSource: account.secretSource,
 					tokenStatus: account.tokenStatus,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as nextcloudTalkPlugin } from "./channel-tgvjpexV.js";
+import { t as nextcloudTalkPlugin } from "./channel-B3OgVClw.js";
 export { nextcloudTalkPlugin };

package/openclaw.plugin.json

@@ -5,7 +5,6 @@
   },
   "name": "Nextcloud Talk",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
-  "icon": "https://cdn.simpleicons.org/nextcloud",
   "activation": {
     "onStartup": false
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/nextcloud-talk",
-  "version": "2026.9.1-beta.1",
+  "version": "2026.9.2",
   "description": "OpenClaw Nextcloud Talk channel plugin for conversations.",
   "repository": {
     "type": "git",
@@ -8,7 +8,7 @@
   },
   "type": "module",
   "peerDependencies": {
-    "openclaw": ">=2026.9.1-beta.1"
+    "openclaw": ">=2026.9.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -129,10 +129,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.9.1-beta.1"
+      "pluginApi": ">=2026.9.2"
     },
     "build": {
-      "openclawVersion": "2026.9.1-beta.1"
+      "openclawVersion": "2026.9.2"
     },
     "release": {
       "publishToClawHub": true,