@openclaw/nextcloud-talk 2026.9.6 → 2026.9.8

package/dist/.setup/{channel-B_MT8EAm.mjs → channel-CeJpOTiY.mjs}

@@ -1,8 +1,8 @@
+import { i as __reExport, n as normalizeCompatibilityConfig, r as __exportAll, t as legacyConfigRules } from "./doctor-contract-BVJcDIeU.mjs";
 import { a as fetchWithSsrFGuard, c as resolveDefaultGroupPolicy, i as deliverFormattedTextWithAttachments, l as warnMissingProviderGroupPolicyFallbackOnce, o as logInboundDrop, r as createChannelPairingController, s as resolveAllowlistProviderRuntimeGroupPolicy, t as GROUP_POLICY_BLOCKED_LABEL, u as getNextcloudTalkRuntime } from "./runtime-api-BKsxTw4J.mjs";
-import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-Bda_xc6V.mjs";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Bvm0PmP3.mjs";
 import { createAccountListHelpers, describeWebhookAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
-import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
+import { buildChannelOutboundSessionRoute, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
 import { createLoggedPairingApprovalNotifier, createPairingPrefixStripper } from "openclaw/plugin-sdk/channel-pairing";
 import { createAllowlistProviderRouteAllowlistWarningCollector, createConditionalWarningCollector, resolveScopeRequireMention, resolveScopeToolsPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { buildWebhookChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
@@ -19,6 +19,7 @@ import { readProviderJsonResponse, readProviderTextResponse } from "openclaw/plu
 import { resolveChannelInboundRouteEnvelope } from "openclaw/plugin-sdk/channel-inbound";
 import { bindIngressLifecycleToReplyOptions, createAccountStatusSink, createChannelIngressMonitor, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, resolveChannelStreamingBlockEnabled, runPassiveAccountLifecycle } from "openclaw/plugin-sdk/channel-outbound";
 import { SsrFBlockedError, ssrfPolicyFromPrivateNetworkOptIn, ssrfPolicyFromPrivateNetworkOptIn as ssrfPolicyFromPrivateNetworkOptIn$1 } from "openclaw/plugin-sdk/ssrf-runtime";
+import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { redactToolPayloadText } from "openclaw/plugin-sdk/logging-core";
 import { requireRuntimeConfig } from "openclaw/plugin-sdk/plugin-config-runtime";
 import { resolveMarkdownTableMode } from "openclaw/plugin-sdk/markdown-table-runtime";
@@ -28,7 +29,7 @@ import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2 } from "openclaw/plugin-sdk/
 import { DmPolicySchema, GroupPolicySchema, MarkdownConfigSchema, ReplyRuntimeConfigSchemaShape, ReplyToModeSchema, buildChannelConfigSchema, buildGroupEntrySchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
 import { formatAllowFromLowercase, resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
 import { adaptScopedAccountAccessor, clearAccountFieldsFromConfigSection, createScopedChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
-import { requireChannelOpenAllowFrom, resolveLoggerBackedRuntime } from "openclaw/plugin-sdk/extension-shared";
+import { createDeferred, requireChannelOpenAllowFrom, resolveLoggerBackedRuntime } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
 import os from "node:os";
 import path from "node:path";
@@ -40,16 +41,16 @@ import { channelIngressRoutes } from "openclaw/plugin-sdk/channel-ingress-runtim
 import { safeParseJson, truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 import { buildChannelKeyCandidates, normalizeChannelSlug, resolveChannelEntryMatchWithFallback } from "openclaw/plugin-sdk/channel-targets";
 import { pruneMapToMaxSize } from "openclaw/plugin-sdk/collection-runtime";
-import { createServer } from "node:http";
-import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, createWebhookInFlightLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
-import { runHttpConnectionRequest, sendHttpRequestRejection } from "openclaw/plugin-sdk/webhook-request-guards";
+import { WEBHOOK_RATE_LIMIT_DEFAULTS, createAuthRateLimiter, createWebhookInFlightLimiter, getWebhookLegacyListener, isRequestBodyLimitError, readRequestBodyWithLimit, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
+import { sendHttpRequestRejection } from "openclaw/plugin-sdk/webhook-request-guards";
+import { canonicalizeWebhookRouteKey, registerPluginHttpRoute, registerWebhookTarget, resolveSingleWebhookTarget } from "openclaw/plugin-sdk/webhook-targets";
 import { isRecord as isRecord$1 } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, buildOutboundBaseSessionKey, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
 import { createChannelDmPolicy } from "openclaw/plugin-sdk/channel-dm-policy";
 import { defineChannelSetupContract } from "openclaw/plugin-sdk/channel-setup";
-import { applyAccountNameToChannelSection, baseUrlTextInput, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
-import { createSetupInputPresenceValidator, createSetupTranslator as createSetupTranslator$1, mergeAllowFromEntries, promptParsedAllowFromForAccount, resolveSetupAccountId } from "openclaw/plugin-sdk/setup-runtime";
+import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1 } from "openclaw/plugin-sdk/routing";
+import { applyAccountNameToChannelSection, baseUrlTextInput, createPromptParsedAllowFromForAccount, createSetupTranslator, createStandardChannelSetupStatus, defineTokenCredential, formatDocsLink, patchScopedAccountConfig, setSetupChannelEnabled } from "openclaw/plugin-sdk/setup";
+import { createSetupInputPresenceValidator, createSetupTranslator as createSetupTranslator$1, mergeAllowFromEntries } from "openclaw/plugin-sdk/setup-runtime";
 import { formatDocsLink as formatDocsLink$1 } from "openclaw/plugin-sdk/setup-tools";
 //#region extensions/nextcloud-talk/src/api-credentials.ts
 function resolveNextcloudTalkApiCredentialsResult(params) {
@@ -243,12 +244,9 @@ function verifyNextcloudTalkSignature(params) {
 	const expected = createHmac("sha256", secret).update(random + body).digest("hex");
 	return safeEqualSecret(signature, expected);
 }
-/**
-* Extract webhook headers from an incoming request.
-*/
 function extractNextcloudTalkHeaders(headers) {
 	const getHeader = (name) => {
-		const value = headers[name] ?? headers[normalizeLowercaseStringOrEmpty(name)];
+		const value = headers[name];
 		return Array.isArray(value) ? value[0] : value;
 	};
 	const signature = getHeader(SIGNATURE_HEADER);
@@ -285,10 +283,6 @@ function normalizeUrlForMatch(value) {
 		return value.trim().replace(/\/$/, "");
 	}
 }
-function coerceFeatureMask(value) {
-	if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return value;
-	return parseStrictNonNegativeInteger(value);
-}
 function formatMissingResponseFeatureMessage(bot, features) {
 	const id = bot.id == null ? "unknown" : String(bot.id);
 	return `Nextcloud Talk bot "${bot.name?.trim() || "matching bot"}" (${id}) is missing the response feature${typeof features === "number" ? ` (features=${features})` : ""}; outbound replies will fail. Run ./occ talk:bot:state --feature webhook --feature response --feature reaction ${id} 1 or reinstall the bot with --feature response.`;
@@ -354,7 +348,7 @@ async function probeNextcloudTalkBotResponseFeature(params) {
 				code: "bot_not_found",
 				message: `Nextcloud Talk bot response feature probe could not find a bot with webhook URL ${webhookUrl}.`
 			};
-			const features = coerceFeatureMask(bot.features);
+			const features = parseStrictNonNegativeInteger(bot.features);
 			if (features == null || (features & BOT_FEATURE_RESPONSE) !== BOT_FEATURE_RESPONSE) return {
 				ok: false,
 				code: "missing_response_feature",
@@ -442,8 +436,10 @@ const NextcloudTalkAccountSchemaBase = z.object({
 	apiPassword: buildSecretInputSchema().optional(),
 	apiPasswordFile: z.string().optional(),
 	dmPolicy: DmPolicySchema.optional().default("pairing"),
-	webhookPort: z.number().int().positive().optional(),
-	webhookHost: z.string().optional(),
+	legacyWebhook: z.union([z.literal(false), z.object({
+		port: z.number().int().min(1).max(65535),
+		host: z.string().optional()
+	}).strict()]).optional(),
 	webhookPath: z.string().optional(),
 	webhookPublicUrl: z.string().optional(),
 	allowFrom: z.array(z.string()).optional(),
@@ -467,18 +463,199 @@ const NextcloudTalkConfigSchema = buildMultiAccountChannelSchema(NextcloudTalkAc
 	}
 });
 //#endregion
+//#region src/gateway/gateway-http-route-contracts.ts
+const GATEWAY_PROBE_ROUTES = /* @__PURE__ */ new Map([
+	["/health", "live"],
+	["/healthz", "live"],
+	["/ready", "ready"],
+	["/readyz", "ready"],
+	["/startup", "startup"],
+	["/startupz", "startup"]
+]);
+function classifyGatewayProbePath(pathname) {
+	for (const [root, status] of GATEWAY_PROBE_ROUTES) {
+		if (pathname === root) return status;
+		if (pathname.startsWith(`${root}/`)) return "namespace";
+	}
+	return "outside";
+}
+//#endregion
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString$1(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString$1(value) {
+	return normalizeOptionalString$1(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty$1(value) {
+	return normalizeOptionalLowercaseString$1(value) ?? "";
+}
+//#endregion
+//#region src/plugins/http-path-prefix.ts
+function prefixMatchPath(pathname, prefix) {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`) || pathname.startsWith(`${prefix}%`);
+}
+//#endregion
+//#region src/gateway/security-path.ts
+const MAX_PATH_DECODE_PASSES = 32;
+function normalizePathSeparators(pathname) {
+	const collapsed = pathname.replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed;
+	return collapsed.replace(/\/+$/, "");
+}
+function resolveDotSegments(pathname) {
+	try {
+		return new URL(pathname, "http://localhost").pathname;
+	} catch {
+		return pathname;
+	}
+}
+function normalizePathForSecurity(pathname) {
+	return normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(resolveDotSegments(pathname))) || "/";
+}
+function buildCanonicalPathCandidates(pathname, maxDecodePasses = MAX_PATH_DECODE_PASSES) {
+	const candidates = /* @__PURE__ */ new Set([normalizePathForSecurity(pathname)]);
+	let decoded = pathname;
+	let malformedEncoding = false;
+	let decodePasses = 0;
+	for (let pass = 0; pass < maxDecodePasses; pass++) {
+		let nextDecoded;
+		try {
+			nextDecoded = decodeURIComponent(decoded);
+		} catch {
+			malformedEncoding = true;
+			break;
+		}
+		if (nextDecoded === decoded) break;
+		decodePasses += 1;
+		decoded = nextDecoded;
+		candidates.add(normalizePathForSecurity(decoded));
+	}
+	let decodePassLimitReached = false;
+	if (!malformedEncoding) try {
+		decodePassLimitReached = decodeURIComponent(decoded) !== decoded;
+	} catch {
+		malformedEncoding = true;
+	}
+	return {
+		candidates: [...candidates],
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding
+	};
+}
+function canonicalizePathForSecurity(pathname) {
+	const { candidates, decodePasses, decodePassLimitReached, malformedEncoding } = buildCanonicalPathCandidates(pathname);
+	return {
+		canonicalPath: candidates[candidates.length - 1] ?? "/",
+		candidates,
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding,
+		rawNormalizedPath: normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(pathname)) || "/"
+	};
+}
+const PROTECTED_PLUGIN_ROUTE_PREFIXES = ["/api/channels"];
+//#endregion
+//#region src/gateway/server/plugins-http/path-context.ts
+function normalizeProtectedPrefix(prefix) {
+	const collapsed = normalizeLowercaseStringOrEmpty$1(prefix).replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed || "/";
+	return collapsed.replace(/\/+$/, "");
+}
+const NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES = PROTECTED_PLUGIN_ROUTE_PREFIXES.map(normalizeProtectedPrefix);
+/** Returns true when any decoded path candidate targets a protected route. */
+function isProtectedPluginRoutePathFromContext(context) {
+	if (context.candidates.some((candidate) => NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(candidate, prefix)))) return true;
+	if (context.decodePassLimitReached) return true;
+	if (!context.malformedEncoding) return false;
+	return NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(context.rawNormalizedPath, prefix));
+}
+/** Builds all security-relevant decoded path candidates for a request path. */
+function resolvePluginRoutePathContext(pathname) {
+	const canonical = canonicalizePathForSecurity(pathname);
+	return {
+		pathname,
+		canonicalPath: canonical.canonicalPath,
+		candidates: canonical.candidates,
+		malformedEncoding: canonical.malformedEncoding,
+		decodePassLimitReached: canonical.decodePassLimitReached,
+		rawNormalizedPath: canonical.rawNormalizedPath
+	};
+}
+//#endregion
+//#region \0openclaw:bundled-sdk:openclaw/plugin-sdk/gateway-config-runtime
+var gateway_config_runtime_exports = /* @__PURE__ */ __exportAll({
+	classifyGatewayProbePath: () => classifyGatewayProbePath,
+	isProtectedPluginRoutePathFromContext: () => isProtectedPluginRoutePathFromContext,
+	resolvePluginRoutePathContext: () => resolvePluginRoutePathContext
+});
+import * as import_openclaw_plugin_sdk_gateway_config_runtime from "openclaw/plugin-sdk/gateway-config-runtime";
+__reExport(gateway_config_runtime_exports, import_openclaw_plugin_sdk_gateway_config_runtime);
+//#endregion
 //#region extensions/nextcloud-talk/src/replay-migration-contract.ts
 const NEXTCLOUD_TALK_PLUGIN_ID = "nextcloud-talk";
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_NAMESPACE_PREFIX = "replay-dedupe";
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_TTL_MS = 864e5;
 const NEXTCLOUD_TALK_REPLAY_DEDUPE_MAX_ENTRIES = 1e4;
 //#endregion
+//#region extensions/nextcloud-talk/src/webhook-route.ts
+const DEFAULT_NEXTCLOUD_TALK_WEBHOOK_PATH = "/nextcloud-talk-webhook";
+function resolveNextcloudTalkLegacyWebhook(config) {
+	const listener = config.legacyWebhook;
+	if (listener === false) return;
+	return {
+		port: listener?.port ?? 8788,
+		host: listener?.host ?? "0.0.0.0"
+	};
+}
+function describeNextcloudTalkWebhookRouteConflict(path, gatewayPort) {
+	const pathname = URL.parse(path, "http://localhost")?.pathname ?? path;
+	const probe = classifyGatewayProbePath(pathname);
+	const reason = probe !== "outside" && probe !== "namespace" ? "is reserved for Gateway probes" : isProtectedPluginRoutePathFromContext(resolvePluginRoutePathContext(pathname)) ? "requires Gateway authentication" : void 0;
+	if (!reason) return;
+	return `Webhook path "${path}" ${reason} and cannot receive Nextcloud callbacks on the Gateway port. Set webhookPath to "${DEFAULT_NEXTCLOUD_TALK_WEBHOOK_PATH}" and update the Nextcloud bot callback and reverse-proxy upstream to Gateway port ${gatewayPort}${DEFAULT_NEXTCLOUD_TALK_WEBHOOK_PATH}.`;
+}
+//#endregion
 //#region extensions/nextcloud-talk/src/doctor.ts
 function sanitizeLegacyReplaySegment(value) {
 	const trimmed = value.trim();
 	if (!trimmed) return "default";
 	return trimmed.replace(/[^a-zA-Z0-9_-]/g, "_");
 }
+function runNextcloudTalkDoctorSequence(params) {
+	const infoNotes = [];
+	const warningNotes = [];
+	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
+		const account = resolveNextcloudTalkAccount({
+			cfg: params.cfg,
+			accountId
+		});
+		if (!account.enabled || !isNextcloudTalkAccountConfigured(account)) continue;
+		const gatewayPort = (0, gateway_config_runtime_exports.resolveGatewayPort)({ gateway: params.cfg.gateway }, params.env);
+		const webhookPath = account.config.webhookPath ?? "/nextcloud-talk-webhook";
+		const destination = `Gateway port ${gatewayPort}${webhookPath}`;
+		const legacyListener = resolveNextcloudTalkLegacyWebhook(account.config);
+		const routeConflict = describeNextcloudTalkWebhookRouteConflict(webhookPath, gatewayPort);
+		if (routeConflict) warningNotes.push(`- channels.nextcloud-talk.${account.accountId}: ${routeConflict}` + (legacyListener ? ` Legacy webhook listener ${legacyListener.host}:${legacyListener.port} remains available; verify the new route before setting legacyWebhook: false.` : " This account cannot start until the callback path is changed."));
+		else if (legacyListener) infoNotes.push(`- channels.nextcloud-talk.${account.accountId}: legacy webhook listener ${legacyListener.host}:${legacyListener.port} forwards to the Gateway route. Point the Nextcloud callback or reverse-proxy upstream to ${destination}, verify delivery, then set legacyWebhook: false to disable this account's legacy forwarding.`);
+		else infoNotes.push(`- channels.nextcloud-talk.${account.accountId}: legacyWebhook is false; use ${destination} for the Nextcloud callback or reverse-proxy upstream.`);
+	}
+	return {
+		changeNotes: [],
+		warningNotes,
+		infoNotes
+	};
+}
 async function collectNextcloudTalkBotResponseWarnings(params) {
 	const warnings = [];
 	for (const accountId of listNextcloudTalkAccountIds(params.cfg)) {
@@ -528,7 +705,8 @@ async function repairNextcloudTalkReplayDedupeState(params) {
 const nextcloudTalkDoctor = {
 	legacyConfigRules,
 	normalizeCompatibilityConfig,
-	collectPreviewWarnings: async ({ cfg }) => await collectNextcloudTalkBotResponseWarnings({ cfg }),
+	runConfigSequence: runNextcloudTalkDoctorSequence,
+	collectPreviewWarnings: collectNextcloudTalkBotResponseWarnings,
 	repairConfig: async ({ cfg, env }) => {
 		const repair = await repairNextcloudTalkReplayDedupeState({
 			cfg,
@@ -703,15 +881,7 @@ async function resolveNextcloudTalkRoomKind(params) {
 //#endregion
 //#region extensions/nextcloud-talk/src/normalize.ts
 function stripNextcloudTalkTargetPrefix(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return;
-	let normalized = trimmed;
-	if (/^nextcloud-talk:/i.test(normalized)) normalized = normalized.slice(15).trim();
-	else if (/^nc-talk:/i.test(normalized)) normalized = normalized.slice(8).trim();
-	else if (/^nc:/i.test(normalized)) normalized = normalized.slice(3).trim();
-	if (/^room:/i.test(normalized)) normalized = normalized.slice(5).trim();
-	if (!normalized) return;
-	return normalized;
+	return raw.trim().replace(/^(nextcloud-talk|nc-talk|nc):/i, "").trim().replace(/^room:/i, "").trim() || void 0;
 }
 function normalizeNextcloudTalkMessagingTarget(raw) {
 	const normalized = stripNextcloudTalkTargetPrefix(raw);
@@ -751,31 +921,16 @@ function collapseErrorSnippet(text) {
 	if (collapsed.length > NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS) return `${truncateUtf16Safe(collapsed, NEXTCLOUD_TALK_ERROR_SNIPPET_MAX_CHARS)}…`;
 	return collapsed;
 }
-function resolveCredentials(explicit, account) {
-	const baseUrl = explicit.baseUrl?.trim() ?? account.baseUrl;
-	const secret = explicit.secret?.trim() ?? account.secret;
-	if (!baseUrl) throw new Error(`Nextcloud Talk baseUrl missing for account "${account.accountId}" (set channels.nextcloud-talk.baseUrl).`);
-	if (!secret) throw new Error(account.tokenStatus === "configured_unavailable" ? `Nextcloud Talk bot secret is configured but unavailable for account "${account.accountId}" (check the configured channels.nextcloud-talk.botSecret/botSecretFile).` : `Nextcloud Talk bot secret missing for account "${account.accountId}" (set channels.nextcloud-talk.botSecret/botSecretFile or NEXTCLOUD_TALK_BOT_SECRET for default).`);
-	return {
-		baseUrl,
-		secret
-	};
-}
-function normalizeRoomToken(to) {
-	const normalized = stripNextcloudTalkTargetPrefix(to);
-	if (!normalized) throw new Error("Room token is required for Nextcloud Talk sends");
-	return normalized;
-}
 function resolveNextcloudTalkSendContext(opts) {
 	const cfg = requireRuntimeConfig(opts.cfg, "Nextcloud Talk send");
 	const account = resolveNextcloudTalkAccount({
 		cfg,
 		accountId: opts.accountId
 	});
-	const { baseUrl, secret } = resolveCredentials({
-		baseUrl: opts.baseUrl,
-		secret: opts.secret
-	}, account);
+	const baseUrl = opts.baseUrl?.trim() ?? account.baseUrl;
+	const secret = opts.secret?.trim() ?? account.secret;
+	if (!baseUrl) throw new Error(`Nextcloud Talk baseUrl missing for account "${account.accountId}" (set channels.nextcloud-talk.baseUrl).`);
+	if (!secret) throw new Error(account.tokenStatus === "configured_unavailable" ? `Nextcloud Talk bot secret is configured but unavailable for account "${account.accountId}" (check the configured channels.nextcloud-talk.botSecret/botSecretFile).` : `Nextcloud Talk bot secret missing for account "${account.accountId}" (set channels.nextcloud-talk.botSecret/botSecretFile or NEXTCLOUD_TALK_BOT_SECRET for default).`);
 	return {
 		cfg,
 		account,
@@ -783,6 +938,11 @@ function resolveNextcloudTalkSendContext(opts) {
 		secret
 	};
 }
+function normalizeRoomToken(to) {
+	const normalized = stripNextcloudTalkTargetPrefix(to);
+	if (!normalized) throw new Error("Room token is required for Nextcloud Talk sends");
+	return normalized;
+}
 function recordNextcloudTalkOutboundActivity(accountId) {
 	try {
 		getNextcloudTalkRuntime().channel.activity.record({
@@ -949,20 +1109,6 @@ function roomRoutes(params) {
 		}
 	});
 }
-async function deliverNextcloudTalkReply(params) {
-	const { cfg, payload, roomToken, accountId, statusSink } = params;
-	return { visibleReplySent: await deliverFormattedTextWithAttachments({
-		payload,
-		send: async ({ text, replyToId }) => {
-			await sendMessageNextcloudTalk(roomToken, text, {
-				cfg,
-				accountId,
-				replyTo: replyToId
-			});
-			statusSink?.({ lastOutboundAt: Date.now() });
-		}
-	}) };
-}
 async function handleNextcloudTalkInbound(params) {
 	const { message, account, config, runtime, statusSink } = params;
 	const core = getNextcloudTalkRuntime();
@@ -1209,13 +1355,17 @@ async function handleNextcloudTalkInbound(params) {
 				text: sanitizeAssistantVisibleText(payload.text)
 			},
 			deliver: async (payload) => {
-				return await deliverNextcloudTalkReply({
-					cfg: config,
+				return { visibleReplySent: await deliverFormattedTextWithAttachments({
 					payload,
-					roomToken,
-					accountId: account.accountId,
-					statusSink
-				});
+					send: async ({ text, replyToId }) => {
+						await sendMessageNextcloudTalk(roomToken, text, {
+							cfg: config,
+							accountId: account.accountId,
+							replyTo: replyToId
+						});
+						statusSink?.({ lastOutboundAt: Date.now() });
+					}
+				}) };
 			},
 			onError: (err, info) => {
 				runtime.error?.(`nextcloud-talk ${info.kind} reply failed: ${String(err)}`);
@@ -1299,211 +1449,226 @@ async function migrateNextcloudTalkLegacyReplayState(params) {
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/monitor.ts
-const DEFAULT_WEBHOOK_MAX_BODY_BYTES = 1048576;
 const PREAUTH_WEBHOOK_MAX_BODY_BYTES = 65536;
 const NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_HEADER = "x-openclaw-delivery-accepted";
 const NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_VALUE = "durable";
 const PREAUTH_WEBHOOK_BODY_TIMEOUT_MS = 5e3;
 const PREAUTH_WEBHOOK_MAX_IN_FLIGHT = 64;
 const WEBHOOK_IN_FLIGHT_KEY = "nextcloud-talk-webhook";
-const HEALTH_PATH = "/healthz";
 const WEBHOOK_AUTH_RATE_LIMIT_SCOPE = "nextcloud-talk-webhook-auth";
-const WEBHOOK_ERRORS = {
-	missingSignatureHeaders: "Missing signature headers",
-	invalidBackend: "Invalid backend",
-	invalidSignature: "Invalid signature",
-	invalidPayloadFormat: "Invalid payload format",
-	payloadTooLarge: "Payload too large",
-	internalServerError: "Internal server error"
-};
-function writeJsonResponse(res, status, body) {
-	if (body) {
-		res.writeHead(status, { "Content-Type": "application/json" });
-		res.end(JSON.stringify(body));
-		return;
-	}
-	res.writeHead(status);
-	res.end();
-}
 function writeWebhookError(res, status, error) {
 	if (res.headersSent) return;
-	writeJsonResponse(res, status, { error });
-}
-function validateWebhookHeaders(params) {
-	const headers = extractNextcloudTalkHeaders(params.req.headers);
-	if (!headers) {
-		writeWebhookError(params.res, 400, WEBHOOK_ERRORS.missingSignatureHeaders);
-		return null;
-	}
-	if (params.isBackendAllowed && !params.isBackendAllowed(headers.backend)) {
-		writeWebhookError(params.res, 401, WEBHOOK_ERRORS.invalidBackend);
-		return null;
-	}
-	return headers;
-}
-function verifyWebhookSignature(params) {
-	if (!verifyNextcloudTalkSignature({
-		signature: params.headers.signature,
-		random: params.headers.random,
-		body: params.body,
-		secret: params.secret
-	})) {
-		params.authRateLimiter.recordFailure(params.clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
-		writeWebhookError(params.res, 401, WEBHOOK_ERRORS.invalidSignature);
-		return false;
-	}
-	params.authRateLimiter.reset(params.clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
-	return true;
-}
-function readNextcloudTalkWebhookBody(req, maxBodyBytes) {
-	return readRequestBodyWithLimit(req, {
-		maxBytes: Math.min(maxBodyBytes, PREAUTH_WEBHOOK_MAX_BODY_BYTES),
-		timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS,
-		destroyOnLimit: false
-	});
+	res.writeHead(status, { "Content-Type": "application/json" });
+	res.end(JSON.stringify({ error }));
 }
 async function rejectWebhookRequest(req, res, status, error) {
 	if (res.headersSent) return;
 	await sendHttpRequestRejection(req, res, status, JSON.stringify({ error }), "application/json");
 }
-function createNextcloudTalkWebhookServer(opts) {
-	const { port, host, path, secret, onWebhook, onError, abortSignal } = opts;
-	const maxBodyBytes = typeof opts.maxBodyBytes === "number" && Number.isFinite(opts.maxBodyBytes) && opts.maxBodyBytes > 0 ? Math.floor(opts.maxBodyBytes) : DEFAULT_WEBHOOK_MAX_BODY_BYTES;
-	const readBody = opts.readBody ?? readNextcloudTalkWebhookBody;
-	const isBackendAllowed = opts.isBackendAllowed;
-	const authRateLimitMaxRequests = typeof opts.authRateLimit?.maxRequests === "number" ? opts.authRateLimit.maxRequests : WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests;
-	const authRateLimitWindowMs = typeof opts.authRateLimit?.windowMs === "number" ? opts.authRateLimit.windowMs : WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs;
-	const webhookAuthRateLimiter = createAuthRateLimiter({
-		maxAttempts: authRateLimitMaxRequests,
-		windowMs: authRateLimitWindowMs,
-		lockoutMs: authRateLimitWindowMs,
-		exemptLoopback: false,
-		pruneIntervalMs: authRateLimitWindowMs
-	});
-	const webhookInFlightLimiter = createWebhookInFlightLimiter({
-		maxInFlightPerKey: PREAUTH_WEBHOOK_MAX_IN_FLIGHT,
-		maxTrackedKeys: 1
-	});
-	const handleWebhookRequest = async (req, res) => {
-		if (req.url === HEALTH_PATH) {
-			res.writeHead(200, { "Content-Type": "text/plain" });
-			res.end("ok");
+function createWebhookGuards() {
+	return {
+		authRateLimiter: createAuthRateLimiter({
+			maxAttempts: WEBHOOK_RATE_LIMIT_DEFAULTS.maxRequests,
+			windowMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs,
+			lockoutMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs,
+			exemptLoopback: false,
+			pruneIntervalMs: WEBHOOK_RATE_LIMIT_DEFAULTS.windowMs
+		}),
+		inFlightLimiter: createWebhookInFlightLimiter({
+			maxInFlightPerKey: PREAUTH_WEBHOOK_MAX_IN_FLIGHT,
+			maxTrackedKeys: 1
+		})
+	};
+}
+async function handleWebhookRequest(req, res, targetsByPath, path) {
+	const legacyListener = getWebhookLegacyListener(req);
+	const requestTargets = (targetsByPath.get(path) ?? []).filter((entry) => entry.rawPath === req.url && (!legacyListener || entry.legacyListener?.port === legacyListener.port && entry.legacyListener.host === legacyListener.host));
+	if (req.method !== "POST" || requestTargets.length === 0) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+	const servingTargets = requestTargets.filter((entry) => !entry.stopping);
+	const firstTarget = servingTargets[0];
+	if (!firstTarget) {
+		res.writeHead(503, { "Retry-After": "1" });
+		res.end();
+		return;
+	}
+	const responseOwners = /* @__PURE__ */ new Map();
+	if (!res.destroyed && !res.writableFinished) {
+		for (const entry of servingTargets) {
+			const responseDone = createDeferred();
+			entry.pendingResponses.add(responseDone.promise);
+			responseOwners.set(entry, () => {
+				entry.pendingResponses.delete(responseDone.promise);
+				responseOwners.delete(entry);
+				responseDone.resolve();
+			});
+		}
+		const complete = () => {
+			res.off("finish", complete);
+			res.off("close", complete);
+			for (const release of responseOwners.values()) release();
+		};
+		res.once("finish", complete);
+		res.once("close", complete);
+	}
+	const guards = legacyListener ? firstTarget.legacyGuards : firstTarget.gatewayGuards;
+	if (!guards) {
+		res.writeHead(503, { "Retry-After": "1" });
+		res.end();
+		return;
+	}
+	const { authRateLimiter: webhookAuthRateLimiter, inFlightLimiter: webhookInFlightLimiter } = guards;
+	const { onError, trustedProxies, allowRealIpFallback } = firstTarget;
+	const clientIp = resolveRequestClientIp(req, trustedProxies, allowRealIpFallback) ?? req.socket.remoteAddress ?? "unknown";
+	if (!webhookAuthRateLimiter.check(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE).allowed) {
+		res.writeHead(429);
+		res.end("Too Many Requests");
+		return;
+	}
+	if (!webhookInFlightLimiter.tryAcquire(WEBHOOK_IN_FLIGHT_KEY)) {
+		await sendHttpRequestRejection(req, res, 429, "Too Many Requests");
+		return;
+	}
+	let body;
+	let target;
+	try {
+		const headers = extractNextcloudTalkHeaders(req.headers);
+		if (!headers) {
+			writeWebhookError(res, 400, "Missing signature headers");
 			return;
 		}
-		if (req.url !== path || req.method !== "POST") {
-			res.writeHead(404);
+		const targets = requestTargets.filter((entry) => !entry.isBackendAllowed || entry.isBackendAllowed(headers.backend));
+		if (targets.length === 0) {
+			writeWebhookError(res, 401, "Invalid backend");
+			return;
+		}
+		body = await readRequestBodyWithLimit(req, {
+			maxBytes: PREAUTH_WEBHOOK_MAX_BODY_BYTES,
+			timeoutMs: PREAUTH_WEBHOOK_BODY_TIMEOUT_MS,
+			destroyOnLimit: false
+		});
+		const matchesSignature = (entry) => verifyNextcloudTalkSignature({
+			...headers,
+			body,
+			secret: entry.secret
+		});
+		const match = resolveSingleWebhookTarget(targets, (entry) => servingTargets.includes(entry) && matchesSignature(entry));
+		if (match.kind === "none" && targets.some((entry) => !servingTargets.includes(entry) && matchesSignature(entry))) {
+			res.writeHead(503, { "Retry-After": "1" });
 			res.end();
 			return;
 		}
-		const clientIp = resolveRequestClientIp(req, opts.trustedProxies, opts.allowRealIpFallback) ?? req.socket.remoteAddress ?? "unknown";
-		if (!webhookAuthRateLimiter.check(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE).allowed) {
-			res.writeHead(429);
-			res.end("Too Many Requests");
+		if (match.kind !== "single") {
+			webhookAuthRateLimiter.recordFailure(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
+			writeWebhookError(res, 401, "Invalid signature");
 			return;
 		}
-		if (!webhookInFlightLimiter.tryAcquire(WEBHOOK_IN_FLIGHT_KEY)) {
-			await sendHttpRequestRejection(req, res, 429, "Too Many Requests");
+		target = match.target;
+		for (const [entry, release] of responseOwners) if (entry !== target) release();
+		if (!targetsByPath.get(path)?.includes(target)) {
+			res.writeHead(503, { "Retry-After": "1" });
+			res.end();
 			return;
 		}
-		let body;
-		try {
-			const headers = validateWebhookHeaders({
-				req,
-				res,
-				isBackendAllowed
-			});
-			if (!headers) return;
-			body = await readBody(req, maxBodyBytes);
-			if (!verifyWebhookSignature({
-				headers,
-				body,
-				secret,
-				res,
-				clientIp,
-				authRateLimiter: webhookAuthRateLimiter
-			})) return;
-		} catch (err) {
-			if (isRequestBodyLimitError(err, "PAYLOAD_TOO_LARGE")) {
-				await rejectWebhookRequest(req, res, 413, WEBHOOK_ERRORS.payloadTooLarge);
-				return;
-			}
-			if (isRequestBodyLimitError(err, "REQUEST_BODY_TIMEOUT")) {
-				await rejectWebhookRequest(req, res, 408, requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
-				return;
-			}
-			if (err instanceof NextcloudTalkWebhookPayloadError) {
-				writeWebhookError(res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
-				return;
-			}
-			const error = err instanceof Error ? err : new Error(formatErrorMessage(err));
-			onError?.(error);
-			writeWebhookError(res, 500, WEBHOOK_ERRORS.internalServerError);
+		webhookAuthRateLimiter.reset(clientIp, WEBHOOK_AUTH_RATE_LIMIT_SCOPE);
+	} catch (err) {
+		if (isRequestBodyLimitError(err, "PAYLOAD_TOO_LARGE")) {
+			await rejectWebhookRequest(req, res, 413, "Payload too large");
 			return;
-		} finally {
-			webhookInFlightLimiter.release(WEBHOOK_IN_FLIGHT_KEY);
 		}
-		try {
-			if (await onWebhook(body) === "accepted") res.setHeader(NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_HEADER, NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_VALUE);
-			writeJsonResponse(res, 200);
-		} catch (err) {
-			if (err instanceof NextcloudTalkWebhookPayloadError) {
-				writeWebhookError(res, 400, WEBHOOK_ERRORS.invalidPayloadFormat);
-				return;
-			}
-			const error = err instanceof Error ? err : new Error(formatErrorMessage(err));
-			onError?.(error);
-			writeWebhookError(res, 500, WEBHOOK_ERRORS.internalServerError);
+		if (isRequestBodyLimitError(err, "REQUEST_BODY_TIMEOUT")) {
+			await rejectWebhookRequest(req, res, 408, requestBodyErrorToText("REQUEST_BODY_TIMEOUT"));
+			return;
 		}
-	};
-	const server = createServer((req, res) => {
-		runHttpConnectionRequest(req, () => handleWebhookRequest(req, res), res).catch((error) => {
-			onError?.(error instanceof Error ? error : new Error(formatErrorMessage(error)));
-			if (!res.destroyed && typeof res.destroy === "function") res.destroy();
-		});
+		const error = err instanceof Error ? err : new Error(formatErrorMessage(err));
+		onError?.(error);
+		writeWebhookError(res, 500, "Internal server error");
+		return;
+	} finally {
+		webhookInFlightLimiter.release(WEBHOOK_IN_FLIGHT_KEY);
+	}
+	try {
+		if (await target.onWebhook(body) === "accepted") res.setHeader(NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_HEADER, NEXTCLOUD_TALK_WEBHOOK_ACCEPTED_VALUE);
+		res.writeHead(200);
+		res.end();
+	} catch (err) {
+		if (err instanceof NextcloudTalkWebhookPayloadError) {
+			writeWebhookError(res, 400, "Invalid payload format");
+			return;
+		}
+		const error = err instanceof Error ? err : new Error(formatErrorMessage(err));
+		target.onError?.(error);
+		writeWebhookError(res, 500, "Internal server error");
+	}
+}
+const webhookState = createPluginRuntimeStore({
+	key: "nextcloud-talk:webhook-routes",
+	errorMessage: "Nextcloud Talk webhook routes are not registered"
+});
+function registerNextcloudTalkWebhook(target) {
+	let targets = webhookState.tryGetRuntime();
+	if (!targets) {
+		targets = /* @__PURE__ */ new Map();
+		webhookState.setRuntime(targets);
+	}
+	const path = canonicalizeWebhookRouteKey(target.path);
+	const gatewayGuards = targets.get(path)?.[0]?.gatewayGuards ?? createWebhookGuards();
+	const endpoint = target.legacyListener;
+	const legacyGuards = endpoint ? [...targets.values()].flat().find((entry) => entry.legacyListener?.port === endpoint.port && entry.legacyListener.host === endpoint.host)?.legacyGuards ?? createWebhookGuards() : void 0;
+	const registration = registerWebhookTarget(targets, {
+		...target,
+		path,
+		rawPath: target.path,
+		stopping: false,
+		pendingResponses: /* @__PURE__ */ new Set(),
+		gatewayGuards,
+		legacyGuards
 	});
-	let stopRequested = false;
-	let listenerActive = false;
-	let closePromise;
-	const closeIfListening = () => {
-		if (closePromise) return closePromise;
-		if (!listenerActive) return Promise.resolve();
-		closePromise = new Promise((resolve) => {
-			server.close(() => resolve());
-		}).finally(() => {
-			listenerActive = false;
-			closePromise = void 0;
-		});
-		return closePromise;
-	};
-	const stop = async () => {
-		stopRequested = true;
-		await closeIfListening();
-		webhookAuthRateLimiter.dispose();
+	const removeTarget = () => {
+		registration.unregister();
+		const remaining = [...targets.values()].flat();
+		for (const guards of [gatewayGuards, legacyGuards]) if (guards && !remaining.some((entry) => entry.gatewayGuards === guards || entry.legacyGuards === guards)) guards.authRateLimiter.dispose();
 	};
-	const start = () => {
-		if (stopRequested) return Promise.resolve();
-		return new Promise((resolve, reject) => {
-			const onListenError = (error) => reject(error);
-			server.once("error", onListenError);
-			server.listen(port, host, () => {
-				listenerActive = true;
-				server.off("error", onListenError);
-				(async () => {
-					if (stopRequested) await closeIfListening();
-					resolve();
-				})().catch(reject);
-			});
+	try {
+		const unregister = registerPluginHttpRoute({
+			path,
+			auth: "plugin",
+			pluginId: "nextcloud-talk",
+			source: "webhook",
+			accountId: target.accountId,
+			handler: (req, res) => handleWebhookRequest(req, res, targets, path),
+			legacyListener: target.legacyListener ? {
+				...target.legacyListener,
+				health: {
+					path: "/healthz",
+					contentType: "text/plain"
+				}
+			} : void 0,
+			reuseExistingSameOwner: true,
+			throwOnFailure: true
 		});
-	};
-	if (abortSignal) {
-		if (abortSignal.aborted) stop();
-		else abortSignal.addEventListener("abort", () => void stop(), { once: true });
+		let stopPromise;
+		return () => {
+			if (stopPromise) return stopPromise;
+			registration.target.stopping = true;
+			const release = () => {
+				removeTarget();
+				unregister();
+			};
+			const pending = registration.target.pendingResponses;
+			if (pending.size === 0) {
+				release();
+				stopPromise = Promise.resolve();
+			} else stopPromise = Promise.all(pending).then(release);
+			return stopPromise;
+		};
+	} catch (error) {
+		removeTarget();
+		throw error;
 	}
-	return {
-		server,
-		start,
-		stop
-	};
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/webhook-spool.ts
@@ -1667,9 +1832,6 @@ function createNextcloudTalkWebhookSpool(options) {
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/monitor-runtime.ts
-const DEFAULT_WEBHOOK_PORT = 8788;
-const DEFAULT_WEBHOOK_HOST = "0.0.0.0";
-const DEFAULT_WEBHOOK_PATH = "/nextcloud-talk-webhook";
 function normalizeOrigin(value) {
 	try {
 		return normalizeLowercaseStringOrEmpty(new URL(value).origin);
@@ -1686,9 +1848,11 @@ async function monitorNextcloudTalkProvider(opts) {
 	});
 	const runtime = resolveLoggerBackedRuntime(opts.runtime, core.logging.getChildLogger());
 	if (!account.secret) throw new Error(`Nextcloud Talk bot secret not configured for account "${account.accountId}"`);
-	const port = account.config.webhookPort ?? DEFAULT_WEBHOOK_PORT;
-	const host = account.config.webhookHost ?? DEFAULT_WEBHOOK_HOST;
-	const path = account.config.webhookPath ?? DEFAULT_WEBHOOK_PATH;
+	const path = account.config.webhookPath ?? "/nextcloud-talk-webhook";
+	const gatewayPort = (0, gateway_config_runtime_exports.resolveGatewayPort)({ gateway: cfg.gateway });
+	const legacyListener = resolveNextcloudTalkLegacyWebhook(account.config);
+	const routeConflict = describeNextcloudTalkWebhookRouteConflict(path, gatewayPort);
+	if (routeConflict && !legacyListener) throw new Error(`[nextcloud-talk:${account.accountId}] ${routeConflict}`);
 	const logger = core.logging.getChildLogger({
 		channel: "nextcloud-talk",
 		accountId: account.accountId
@@ -1716,27 +1880,12 @@ async function monitorNextcloudTalkProvider(opts) {
 			});
 		}
 	});
-	const server = (opts.createServer ?? createNextcloudTalkWebhookServer)({
-		port,
-		host,
-		path,
-		secret: account.secret,
-		isBackendAllowed: (backend) => {
-			if (!expectedBackendOrigin) return true;
-			return normalizeOrigin(backend) === expectedBackendOrigin;
-		},
-		onWebhook: spool.receive,
-		onError: (error) => {
-			logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
-		},
-		trustedProxies: cfg.gateway?.trustedProxies,
-		allowRealIpFallback: cfg.gateway?.allowRealIpFallback,
-		abortSignal: opts.abortSignal
-	});
+	let unregister;
 	let stopPromise;
 	const stop = () => {
 		stopPromise ??= (async () => {
-			await server.stop();
+			await unregister?.();
+			unregister = void 0;
 			await spool.stop();
 		})();
 		return stopPromise;
@@ -1748,7 +1897,26 @@ async function monitorNextcloudTalkProvider(opts) {
 	}
 	try {
 		await spool.ready();
-		await server.start();
+		if (opts.abortSignal?.aborted) {
+			await stop();
+			return { stop };
+		}
+		unregister = registerNextcloudTalkWebhook({
+			accountId: account.accountId,
+			legacyListener,
+			path,
+			secret: account.secret,
+			isBackendAllowed: (backend) => {
+				if (!expectedBackendOrigin) return true;
+				return normalizeOrigin(backend) === expectedBackendOrigin;
+			},
+			onWebhook: spool.receive,
+			onError: (error) => {
+				logger.error(`[nextcloud-talk:${account.accountId}] webhook error: ${error.message}`);
+			},
+			trustedProxies: cfg.gateway?.trustedProxies,
+			allowRealIpFallback: cfg.gateway?.allowRealIpFallback
+		});
 	} catch (error) {
 		await stop();
 		throw error;
@@ -1758,8 +1926,12 @@ async function monitorNextcloudTalkProvider(opts) {
 		return { stop };
 	}
 	opts.statusSink?.(channelReadyPatch());
-	const publicUrl = account.config.webhookPublicUrl ?? `http://${host === "0.0.0.0" ? "localhost" : host}:${port}${path}`;
-	logger.info(`[nextcloud-talk:${account.accountId}] webhook listening on ${publicUrl}`);
+	if (routeConflict && legacyListener) {
+		logger.warn(`[nextcloud-talk:${account.accountId}] ${routeConflict} Legacy webhook listener ${legacyListener.host}:${legacyListener.port} remains available; verify the new route before setting legacyWebhook: false.`);
+		return { stop };
+	}
+	logger.info(`[nextcloud-talk:${account.accountId}] Gateway webhook route ready at port ${gatewayPort}${path}; point the Nextcloud bot callback or reverse-proxy upstream here.`);
+	if (legacyListener) logger.info(`[nextcloud-talk:${account.accountId}] legacy webhook listener ${legacyListener.host}:${legacyListener.port} forwards to the Gateway route. After verifying the callback or proxy upstream uses the Gateway port, set legacyWebhook: false to disable this account's legacy forwarding.`);
 	return { stop };
 }
 //#endregion
@@ -1768,7 +1940,7 @@ const nextcloudTalkGatewayAdapter = {
 	startAccount: async (ctx) => {
 		const account = ctx.account;
 		if (!account.secret || !account.baseUrl) throw new Error(`Nextcloud Talk not configured for account "${account.accountId}" (missing secret or baseUrl)`);
-		ctx.log?.info(`[${account.accountId}] starting Nextcloud Talk webhook server`);
+		ctx.log?.info(`[${account.accountId}] starting Nextcloud Talk Gateway webhook route`);
 		const statusSink = createAccountStatusSink({
 			accountId: ctx.accountId,
 			setStatus: ctx.setStatus
@@ -1865,6 +2037,15 @@ const nextcloudTalkMessageActions = {
 };
 //#endregion
 //#region extensions/nextcloud-talk/src/message-adapter.ts
+function sendNextcloudTalkMessage(ctx, text = ctx.text) {
+	return sendMessageNextcloudTalk(ctx.to, text, {
+		accountId: ctx.accountId ?? void 0,
+		replyTo: ctx.replyToId ?? void 0,
+		cfg: ctx.cfg,
+		onPlatformSendDispatch: ctx.onPlatformSendDispatch,
+		assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff
+	});
+}
 const nextcloudTalkMessageAdapter = defineChannelMessageAdapter({
 	id: "nextcloud-talk",
 	durableFinal: { capabilities: {
@@ -1873,20 +2054,8 @@ const nextcloudTalkMessageAdapter = defineChannelMessageAdapter({
 		replyTo: true
 	} },
 	send: {
-		text: async (ctx) => await sendMessageNextcloudTalk(ctx.to, ctx.text, {
-			accountId: ctx.accountId ?? void 0,
-			replyTo: ctx.replyToId ?? void 0,
-			cfg: ctx.cfg,
-			onPlatformSendDispatch: ctx.onPlatformSendDispatch,
-			assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff
-		}),
-		media: async (ctx) => await sendMessageNextcloudTalk(ctx.to, ctx.mediaUrl ? `${ctx.text}\n\nAttachment: ${ctx.mediaUrl}` : ctx.text, {
-			accountId: ctx.accountId ?? void 0,
-			replyTo: ctx.replyToId ?? void 0,
-			cfg: ctx.cfg,
-			onPlatformSendDispatch: ctx.onPlatformSendDispatch,
-			assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff
-		})
+		text: sendNextcloudTalkMessage,
+		media: (ctx) => sendNextcloudTalkMessage(ctx, ctx.mediaUrl ? `${ctx.text}\n\nAttachment: ${ctx.mediaUrl}` : ctx.text)
 	}
 });
 //#endregion
@@ -1894,19 +2063,11 @@ const nextcloudTalkMessageAdapter = defineChannelMessageAdapter({
 function resolveNextcloudTalkOutboundSessionRoute(params) {
 	const roomId = stripNextcloudTalkTargetPrefix(params.target);
 	if (!roomId) return null;
-	const baseSessionKey = buildOutboundBaseSessionKey({
+	return buildChannelOutboundSessionRoute({
 		cfg: params.cfg,
 		agentId: params.agentId,
 		channel: "nextcloud-talk",
 		accountId: params.accountId,
-		peer: {
-			kind: "group",
-			id: roomId
-		}
-	});
-	return {
-		sessionKey: baseSessionKey,
-		baseSessionKey,
 		recipientSessionExact: false,
 		peer: {
 			kind: "group",
@@ -1915,7 +2076,7 @@ function resolveNextcloudTalkOutboundSessionRoute(params) {
 		chatType: "group",
 		from: `nextcloud-talk:room:${roomId}`,
 		to: `nextcloud-talk:${roomId}`
-	};
+	});
 }
 //#endregion
 //#region extensions/nextcloud-talk/src/setup-core.ts
@@ -1937,44 +2098,28 @@ function setNextcloudTalkAccountConfig(cfg, accountId, updates, clearFields) {
 		...clearFields ? { clearFields } : {}
 	});
 }
-async function promptNextcloudTalkAllowFrom(params) {
-	return await promptParsedAllowFromForAccount({
-		cfg: params.cfg,
-		accountId: params.accountId,
-		defaultAccountId: params.accountId,
-		prompter: params.prompter,
-		noteTitle: t$1("wizard.nextcloudTalk.userIdTitle"),
-		noteLines: [
-			t$1("wizard.nextcloudTalk.userIdHelpAdmin"),
-			t$1("wizard.nextcloudTalk.userIdHelpLogs"),
-			t$1("wizard.nextcloudTalk.userIdHelpLowercase"),
-			t$1("wizard.channels.docs", { link: formatDocsLink$1("/channels/nextcloud-talk", "nextcloud-talk") })
-		],
-		message: t$1("wizard.nextcloudTalk.allowFromPrompt"),
-		placeholder: "username",
-		parseEntries: (raw) => ({ entries: raw.split(/[\n,;]+/g).map(normalizeLowercaseStringOrEmpty).filter(Boolean) }),
-		getExistingAllowFrom: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
-			cfg,
-			accountId
-		}).config.allowFrom ?? [],
-		mergeEntries: ({ existing, parsed }) => mergeAllowFromEntries(existing.map((value) => normalizeLowercaseStringOrEmpty(String(value))), parsed),
-		applyAllowFrom: ({ cfg, accountId, allowFrom }) => setNextcloudTalkAccountConfig(cfg, accountId, {
-			dmPolicy: "allowlist",
-			allowFrom
-		})
-	});
-}
-async function promptNextcloudTalkAllowFromForAccount(params) {
-	const accountId = resolveSetupAccountId({
-		accountId: params.accountId,
-		defaultAccountId: resolveDefaultNextcloudTalkAccountId(params.cfg)
-	});
-	return await promptNextcloudTalkAllowFrom({
-		cfg: params.cfg,
-		prompter: params.prompter,
+const promptNextcloudTalkAllowFrom = async (params) => await createPromptParsedAllowFromForAccount({
+	defaultAccountId: resolveDefaultNextcloudTalkAccountId,
+	noteTitle: t$1("wizard.nextcloudTalk.userIdTitle"),
+	noteLines: [
+		t$1("wizard.nextcloudTalk.userIdHelpAdmin"),
+		t$1("wizard.nextcloudTalk.userIdHelpLogs"),
+		t$1("wizard.nextcloudTalk.userIdHelpLowercase"),
+		t$1("wizard.channels.docs", { link: formatDocsLink$1("/channels/nextcloud-talk", "nextcloud-talk") })
+	],
+	message: t$1("wizard.nextcloudTalk.allowFromPrompt"),
+	placeholder: "username",
+	parseEntries: (raw) => ({ entries: raw.split(/[\n,;]+/g).map(normalizeLowercaseStringOrEmpty).filter(Boolean) }),
+	getExistingAllowFrom: ({ cfg, accountId }) => resolveNextcloudTalkAccount({
+		cfg,
 		accountId
-	});
-}
+	}).config.allowFrom ?? [],
+	mergeEntries: ({ existing, parsed }) => mergeAllowFromEntries(existing.map((value) => normalizeLowercaseStringOrEmpty(String(value))), parsed),
+	applyAllowFrom: ({ cfg, accountId, allowFrom }) => setNextcloudTalkAccountConfig(cfg, accountId, {
+		dmPolicy: "allowlist",
+		allowFrom
+	})
+})(params);
 const nextcloudTalkDmPolicy = createChannelDmPolicy({
 	label: "Nextcloud Talk",
 	channel: channel$1,
@@ -1983,7 +2128,7 @@ const nextcloudTalkDmPolicy = createChannelDmPolicy({
 		accountId: accountId ?? resolveDefaultNextcloudTalkAccountId(cfg)
 	}),
 	applyPatch: ({ cfg, account, patch }) => setNextcloudTalkAccountConfig(cfg, account.accountId, patch),
-	promptAllowFrom: promptNextcloudTalkAllowFromForAccount
+	promptAllowFrom: promptNextcloudTalkAllowFrom
 });
 const nextcloudTalkSetupAdapter = {
 	singleAccountKeysToMove: ["rooms"],
@@ -2304,7 +2449,7 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 			],
 			normalizeTarget: normalizeNextcloudTalkMessagingTarget,
 			inferTargetChatType: ({ to }) => normalizeNextcloudTalkMessagingTarget(to) ? "group" : void 0,
-			resolveOutboundSessionRoute: (params) => resolveNextcloudTalkOutboundSessionRoute(params),
+			resolveOutboundSessionRoute: resolveNextcloudTalkOutboundSessionRoute,
 			targetResolver: {
 				looksLikeId: looksLikeNextcloudTalkTargetId,
 				hint: "<roomToken>"
@@ -2369,24 +2514,11 @@ const nextcloudTalkPlugin = createChatChannelPlugin({
 		},
 		attachedResults: {
 			channel: "nextcloud-talk",
-			sendText: async (ctx) => await nextcloudTalkMessageAdapter.send.text({
-				cfg: ctx.cfg,
-				to: ctx.to,
-				text: ctx.text,
-				accountId: ctx.accountId,
-				replyToId: ctx.replyToId,
-				onPlatformSendDispatch: ctx.onPlatformSendDispatch,
-				assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff
-			}),
-			sendMedia: async (ctx) => await nextcloudTalkMessageAdapter.send.media({
-				cfg: ctx.cfg,
-				to: ctx.to,
-				text: ctx.text,
+			sendText: nextcloudTalkMessageAdapter.send.text,
+			sendMedia: (ctx) => nextcloudTalkMessageAdapter.send.media({
+				...ctx,
 				mediaUrl: ctx.mediaUrl ?? "",
-				accountId: ctx.accountId,
-				replyToId: ctx.replyToId,
-				onPlatformSendDispatch: ctx.onPlatformSendDispatch,
-				assertDirectAdapterHandoff: ctx.assertDirectAdapterHandoff
+				onDeliveryResult: void 0
 			})
 		}
 	}