@openclaw/synology-chat 2026.2.22 → 2026.5.2-beta.1

package/api.ts

@@ -0,0 +1,3 @@
+export { synologyChatPlugin } from "./src/channel.js";
+export { setSynologyRuntime } from "./src/runtime.js";
+export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/channel-plugin-api.ts

@@ -0,0 +1 @@
+export { synologyChatPlugin } from "./src/channel.js";

package/contract-api.ts

@@ -0,0 +1 @@
+export { collectSynologyChatSecurityAuditFindings } from "./src/security-audit.js";

package/index.ts

@@ -1,17 +1,16 @@
-import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
-import { emptyPluginConfigSchema } from "openclaw/plugin-sdk";
-import { createSynologyChatPlugin } from "./src/channel.js";
-import { setSynologyRuntime } from "./src/runtime.js";
+import { defineBundledChannelEntry } from "openclaw/plugin-sdk/channel-entry-contract";
 
-const plugin = {
+export default defineBundledChannelEntry({
   id: "synology-chat",
   name: "Synology Chat",
   description: "Native Synology Chat channel plugin for OpenClaw",
-  configSchema: emptyPluginConfigSchema(),
-  register(api: OpenClawPluginApi) {
-    setSynologyRuntime(api.runtime);
-    api.registerChannel({ plugin: createSynologyChatPlugin() });
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./channel-plugin-api.js",
+    exportName: "synologyChatPlugin",
   },
-};
-
-export default plugin;
+  runtime: {
+    specifier: "./api.js",
+    exportName: "setSynologyRuntime",
+  },
+});

package/openclaw.plugin.json

@@ -1,9 +1,43 @@
 {
   "id": "synology-chat",
-  "channels": ["synology-chat"],
+  "activation": {
+    "onStartup": false
+  },
+  "channels": [
+    "synology-chat"
+  ],
+  "channelEnvVars": {
+    "synology-chat": [
+      "SYNOLOGY_CHAT_TOKEN",
+      "SYNOLOGY_CHAT_INCOMING_URL",
+      "SYNOLOGY_NAS_HOST",
+      "SYNOLOGY_ALLOWED_USER_IDS",
+      "SYNOLOGY_RATE_LIMIT",
+      "OPENCLAW_BOT_NAME"
+    ]
+  },
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
     "properties": {}
+  },
+  "channelConfigs": {
+    "synology-chat": {
+      "schema": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "type": "object",
+        "properties": {
+          "dangerouslyAllowNameMatching": {
+            "type": "boolean"
+          },
+          "dangerouslyAllowInheritedWebhookPath": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": {}
+      },
+      "label": "Synology Chat",
+      "description": "Connect your Synology NAS Chat to OpenClaw with full agent capabilities."
+    }
   }
 }

package/package.json

@@ -1,18 +1,23 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.2.22",
+  "version": "2026.5.2-beta.1",
   "description": "Synology Chat channel plugin for OpenClaw",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/openclaw/openclaw"
+  },
   "type": "module",
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.4.1"
   },
   "devDependencies": {
-    "openclaw": "workspace:*"
+    "@openclaw/plugin-sdk": "workspace:*"
   },
   "openclaw": {
     "extensions": [
       "./index.ts"
     ],
+    "setupEntry": "./setup-entry.ts",
     "channel": {
       "id": "synology-chat",
       "label": "Synology Chat",
@@ -24,8 +29,18 @@
     },
     "install": {
       "npmSpec": "@openclaw/synology-chat",
-      "localPath": "extensions/synology-chat",
-      "defaultChoice": "npm"
+      "defaultChoice": "npm",
+      "minHostVersion": ">=2026.4.10"
+    },
+    "compat": {
+      "pluginApi": ">=2026.5.2-beta.1"
+    },
+    "build": {
+      "openclawVersion": "2026.5.2-beta.1"
+    },
+    "release": {
+      "publishToClawHub": true,
+      "publishToNpm": true
     }
   }
 }

package/setup-api.ts

@@ -0,0 +1 @@
+export { synologyChatSetupAdapter, synologyChatSetupWizard } from "./src/setup-surface.js";

package/setup-entry.ts

@@ -0,0 +1,9 @@
+import { defineBundledChannelSetupEntry } from "openclaw/plugin-sdk/channel-entry-contract";
+
+export default defineBundledChannelSetupEntry({
+  importMetaUrl: import.meta.url,
+  plugin: {
+    specifier: "./api.js",
+    exportName: "synologyChatPlugin",
+  },
+});

package/src/accounts.ts

@@ -3,85 +3,149 @@
  * merges per-account overrides, falls back to environment variables.
  */
 
-import type { SynologyChatChannelConfig, ResolvedSynologyChatAccount } from "./types.js";
+import {
+  DEFAULT_ACCOUNT_ID,
+  listCombinedAccountIds,
+  resolveMergedAccountConfig,
+  type OpenClawConfig,
+} from "openclaw/plugin-sdk/account-resolution";
+import { resolveDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
+import type {
+  SynologyChatChannelConfig,
+  ResolvedSynologyChatAccount,
+  SynologyWebhookPathSource,
+} from "./types.js";
 
 /** Extract the channel config from the full OpenClaw config object. */
-function getChannelConfig(cfg: any): SynologyChatChannelConfig | undefined {
-  return cfg?.channels?.["synology-chat"];
+function getChannelConfig(cfg: OpenClawConfig): SynologyChatChannelConfig | undefined {
+  return cfg?.channels?.["synology-chat"] as SynologyChatChannelConfig | undefined;
+}
+
+function resolveImplicitAccountId(channelCfg: SynologyChatChannelConfig): string | undefined {
+  return channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN ? DEFAULT_ACCOUNT_ID : undefined;
+}
+
+function getRawAccountConfig(
+  channelCfg: SynologyChatChannelConfig,
+  accountId: string,
+): SynologyChatChannelConfig {
+  if (accountId === DEFAULT_ACCOUNT_ID) {
+    return channelCfg;
+  }
+  return channelCfg.accounts?.[accountId] ?? {};
+}
+
+function hasExplicitWebhookPath(rawAccount: SynologyChatChannelConfig | undefined): boolean {
+  return typeof rawAccount?.webhookPath === "string" && rawAccount.webhookPath.trim().length > 0;
+}
+
+function resolveWebhookPathSource(params: {
+  accountId: string;
+  channelCfg: SynologyChatChannelConfig;
+  rawAccount: SynologyChatChannelConfig;
+}): SynologyWebhookPathSource {
+  if (hasExplicitWebhookPath(params.rawAccount)) {
+    return "explicit";
+  }
+  if (params.accountId !== DEFAULT_ACCOUNT_ID && hasExplicitWebhookPath(params.channelCfg)) {
+    return "inherited-base";
+  }
+  return "default";
 }
 
 /** Parse allowedUserIds from string or array to string[]. */
 function parseAllowedUserIds(raw: string | string[] | undefined): string[] {
-  if (!raw) return [];
-  if (Array.isArray(raw)) return raw.filter(Boolean);
+  if (!raw) {
+    return [];
+  }
+  if (Array.isArray(raw)) {
+    return raw.filter(Boolean);
+  }
   return raw
     .split(",")
     .map((s) => s.trim())
     .filter(Boolean);
 }
 
+function parseRateLimitPerMinute(raw: string | undefined): number {
+  if (raw == null) {
+    return 30;
+  }
+  const trimmed = raw.trim();
+  if (!/^-?\d+$/.test(trimmed)) {
+    return 30;
+  }
+  return Number.parseInt(trimmed, 10);
+}
+
 /**
  * List all configured account IDs for this channel.
  * Returns ["default"] if there's a base config, plus any named accounts.
  */
-export function listAccountIds(cfg: any): string[] {
+export function listAccountIds(cfg: OpenClawConfig): string[] {
   const channelCfg = getChannelConfig(cfg);
-  if (!channelCfg) return [];
-
-  const ids = new Set<string>();
-
-  // If base config has a token, there's a "default" account
-  const hasBaseToken = channelCfg.token || process.env.SYNOLOGY_CHAT_TOKEN;
-  if (hasBaseToken) {
-    ids.add("default");
-  }
-
-  // Named accounts
-  if (channelCfg.accounts) {
-    for (const id of Object.keys(channelCfg.accounts)) {
-      ids.add(id);
-    }
+  if (!channelCfg) {
+    return [];
   }
 
-  return Array.from(ids);
+  return listCombinedAccountIds({
+    configuredAccountIds: Object.keys(channelCfg.accounts ?? {}),
+    implicitAccountId: resolveImplicitAccountId(channelCfg),
+  });
 }
 
 /**
  * Resolve a specific account by ID with full defaults applied.
  * Falls back to env vars for the "default" account.
  */
-export function resolveAccount(cfg: any, accountId?: string | null): ResolvedSynologyChatAccount {
+export function resolveAccount(
+  cfg: OpenClawConfig,
+  accountId?: string | null,
+): ResolvedSynologyChatAccount {
   const channelCfg = getChannelConfig(cfg) ?? {};
-  const id = accountId || "default";
-
-  // Account-specific overrides (if named account exists)
-  const accountOverride = channelCfg.accounts?.[id] ?? {};
+  const id = accountId || DEFAULT_ACCOUNT_ID;
+  const accountOverrides =
+    id === DEFAULT_ACCOUNT_ID ? undefined : (channelCfg.accounts?.[id] ?? undefined);
+  const rawAccount = getRawAccountConfig(channelCfg, id);
+  const merged = resolveMergedAccountConfig<Record<string, unknown> & SynologyChatChannelConfig>({
+    channelConfig: channelCfg as Record<string, unknown> & SynologyChatChannelConfig,
+    accounts: channelCfg.accounts as
+      | Record<string, Partial<Record<string, unknown> & SynologyChatChannelConfig>>
+      | undefined,
+    accountId: id,
+  });
 
   // Env var fallbacks (primarily for the "default" account)
   const envToken = process.env.SYNOLOGY_CHAT_TOKEN ?? "";
   const envIncomingUrl = process.env.SYNOLOGY_CHAT_INCOMING_URL ?? "";
   const envNasHost = process.env.SYNOLOGY_NAS_HOST ?? "localhost";
   const envAllowedUserIds = process.env.SYNOLOGY_ALLOWED_USER_IDS ?? "";
-  const envRateLimit = process.env.SYNOLOGY_RATE_LIMIT;
+  const envRateLimitValue = parseRateLimitPerMinute(process.env.SYNOLOGY_RATE_LIMIT);
   const envBotName = process.env.OPENCLAW_BOT_NAME ?? "OpenClaw";
+  const webhookPathSource = resolveWebhookPathSource({ accountId: id, channelCfg, rawAccount });
+  const dangerouslyAllowInheritedWebhookPath =
+    rawAccount.dangerouslyAllowInheritedWebhookPath ??
+    channelCfg.dangerouslyAllowInheritedWebhookPath ??
+    false;
 
   // Merge: account override > base channel config > env var
   return {
     accountId: id,
-    enabled: accountOverride.enabled ?? channelCfg.enabled ?? true,
-    token: accountOverride.token ?? channelCfg.token ?? envToken,
-    incomingUrl: accountOverride.incomingUrl ?? channelCfg.incomingUrl ?? envIncomingUrl,
-    nasHost: accountOverride.nasHost ?? channelCfg.nasHost ?? envNasHost,
-    webhookPath: accountOverride.webhookPath ?? channelCfg.webhookPath ?? "/webhook/synology",
-    dmPolicy: accountOverride.dmPolicy ?? channelCfg.dmPolicy ?? "allowlist",
-    allowedUserIds: parseAllowedUserIds(
-      accountOverride.allowedUserIds ?? channelCfg.allowedUserIds ?? envAllowedUserIds,
-    ),
-    rateLimitPerMinute:
-      accountOverride.rateLimitPerMinute ??
-      channelCfg.rateLimitPerMinute ??
-      (envRateLimit ? parseInt(envRateLimit, 10) || 30 : 30),
-    botName: accountOverride.botName ?? channelCfg.botName ?? envBotName,
-    allowInsecureSsl: accountOverride.allowInsecureSsl ?? channelCfg.allowInsecureSsl ?? false,
+    enabled: merged.enabled ?? true,
+    token: merged.token ?? envToken,
+    incomingUrl: merged.incomingUrl ?? envIncomingUrl,
+    nasHost: merged.nasHost ?? envNasHost,
+    webhookPath: merged.webhookPath ?? "/webhook/synology",
+    webhookPathSource,
+    dangerouslyAllowNameMatching: resolveDangerousNameMatchingEnabled({
+      providerConfig: channelCfg,
+      accountConfig: accountOverrides,
+    }),
+    dangerouslyAllowInheritedWebhookPath,
+    dmPolicy: merged.dmPolicy ?? "allowlist",
+    allowedUserIds: parseAllowedUserIds(merged.allowedUserIds ?? envAllowedUserIds),
+    rateLimitPerMinute: merged.rateLimitPerMinute ?? envRateLimitValue,
+    botName: merged.botName ?? envBotName,
+    allowInsecureSsl: merged.allowInsecureSsl ?? false,
   };
 }

package/src/approval-auth.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { synologyChatApprovalAuth } from "./approval-auth.js";
+
+describe("synologyChatApprovalAuth", () => {
+  it("authorizes numeric Synology Chat user ids", () => {
+    const cfg = { channels: { "synology-chat": { allowedUserIds: ["123"] } } };
+
+    expect(
+      synologyChatApprovalAuth.authorizeActorAction({
+        cfg,
+        senderId: "123",
+        action: "approve",
+        approvalKind: "plugin",
+      }),
+    ).toEqual({ authorized: true });
+  });
+});

package/src/approval-auth.ts

@@ -0,0 +1,22 @@
+import {
+  createResolvedApproverActionAuthAdapter,
+  resolveApprovalApprovers,
+} from "openclaw/plugin-sdk/approval-auth-runtime";
+import { resolveAccount } from "./accounts.js";
+
+function normalizeSynologyChatApproverId(value: string | number): string | undefined {
+  const trimmed = String(value).trim();
+  return /^\d+$/.test(trimmed) ? trimmed : undefined;
+}
+
+export const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
+  channelLabel: "Synology Chat",
+  resolveApprovers: ({ cfg, accountId }) => {
+    const account = resolveAccount(cfg ?? {}, accountId);
+    return resolveApprovalApprovers({
+      allowFrom: account.allowedUserIds,
+      normalizeApprover: normalizeSynologyChatApproverId,
+    });
+  },
+  normalizeSenderId: (value) => normalizeSynologyChatApproverId(value),
+});

package/src/channel.integration.test.ts

@@ -0,0 +1,191 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  buildChannelTurnContextMock,
+  dispatchReplyWithBufferedBlockDispatcher,
+  finalizeInboundContextMock,
+  registerPluginHttpRouteMock,
+  resolveAgentRouteMock,
+  setSynologyRuntimeConfigForTest,
+} from "./channel.test-mocks.js";
+import { makeFormBody, makeReq, makeRes } from "./test-http-utils.js";
+
+type _RegisteredRoute = {
+  path: string;
+  accountId: string;
+  handler: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+};
+
+let createSynologyChatPlugin: typeof import("./channel.js").createSynologyChatPlugin;
+
+function makeStartContext<T>(cfg: T, accountId: string, abortSignal: AbortSignal) {
+  setSynologyRuntimeConfigForTest(cfg);
+  return {
+    cfg,
+    accountId,
+    log: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    abortSignal,
+  };
+}
+
+describe("Synology channel wiring integration", () => {
+  beforeAll(async () => {
+    ({ createSynologyChatPlugin } = await import("./channel.js"));
+  });
+
+  beforeEach(() => {
+    registerPluginHttpRouteMock.mockClear();
+    dispatchReplyWithBufferedBlockDispatcher.mockClear();
+    buildChannelTurnContextMock.mockClear();
+    finalizeInboundContextMock.mockClear();
+    resolveAgentRouteMock.mockClear();
+    setSynologyRuntimeConfigForTest({});
+  });
+
+  it("registers real webhook handler with resolved account config and enforces allowlist", async () => {
+    const plugin = createSynologyChatPlugin();
+    const abortController = new AbortController();
+    const cfg = {
+      channels: {
+        "synology-chat": {
+          enabled: true,
+          accounts: {
+            alerts: {
+              enabled: true,
+              token: "valid-token",
+              incomingUrl: "https://nas.example.com/incoming",
+              webhookPath: "/webhook/synology-alerts",
+              dmPolicy: "allowlist",
+              allowedUserIds: ["456"],
+            },
+          },
+        },
+      },
+    };
+
+    const started = plugin.gateway.startAccount(
+      makeStartContext(cfg, "alerts", abortController.signal),
+    );
+    expect(registerPluginHttpRouteMock).toHaveBeenCalledTimes(1);
+
+    const firstCall = registerPluginHttpRouteMock.mock.calls[0];
+    expect(firstCall).toBeTruthy();
+    if (!firstCall) {
+      throw new Error("Expected registerPluginHttpRoute to be called");
+    }
+    const registered = firstCall[0];
+    expect(registered.path).toBe("/webhook/synology-alerts");
+    expect(registered.accountId).toBe("alerts");
+
+    const req = makeReq(
+      "POST",
+      makeFormBody({
+        token: "valid-token",
+        user_id: "123",
+        username: "unauthorized-user",
+        text: "Hello",
+      }),
+    );
+    const res = makeRes();
+    await registered.handler(req, res);
+
+    expect(res._status).toBe(403);
+    expect(res._body).toContain("not authorized");
+    expect(dispatchReplyWithBufferedBlockDispatcher).not.toHaveBeenCalled();
+    abortController.abort();
+    await started;
+  });
+
+  it("isolates same user_id across different accounts", async () => {
+    const plugin = createSynologyChatPlugin();
+    const alphaAbortController = new AbortController();
+    const betaAbortController = new AbortController();
+    const cfg = {
+      channels: {
+        "synology-chat": {
+          enabled: true,
+          accounts: {
+            alpha: {
+              enabled: true,
+              token: "token-alpha",
+              incomingUrl: "https://nas.example.com/incoming-alpha",
+              webhookPath: "/webhook/synology-alpha",
+              dmPolicy: "open",
+              allowedUserIds: ["*"],
+            },
+            beta: {
+              enabled: true,
+              token: "token-beta",
+              incomingUrl: "https://nas.example.com/incoming-beta",
+              webhookPath: "/webhook/synology-beta",
+              dmPolicy: "open",
+              allowedUserIds: ["*"],
+            },
+          },
+        },
+      },
+      session: {
+        dmScope: "main" as const,
+      },
+    };
+
+    const alphaStarted = plugin.gateway.startAccount(
+      makeStartContext(cfg, "alpha", alphaAbortController.signal),
+    );
+    const betaStarted = plugin.gateway.startAccount(
+      makeStartContext(cfg, "beta", betaAbortController.signal),
+    );
+
+    expect(registerPluginHttpRouteMock).toHaveBeenCalledTimes(2);
+    const alphaRoute = registerPluginHttpRouteMock.mock.calls[0]?.[0];
+    const betaRoute = registerPluginHttpRouteMock.mock.calls[1]?.[0];
+    if (!alphaRoute || !betaRoute) {
+      throw new Error("Expected both Synology Chat routes to register");
+    }
+
+    const alphaReq = makeReq(
+      "POST",
+      makeFormBody({
+        token: "token-alpha",
+        user_id: "123",
+        username: "alice",
+        text: "alpha secret",
+      }),
+    );
+    const alphaRes = makeRes();
+    await alphaRoute.handler(alphaReq, alphaRes);
+
+    const betaReq = makeReq(
+      "POST",
+      makeFormBody({
+        token: "token-beta",
+        user_id: "123",
+        username: "bob",
+        text: "beta secret",
+      }),
+    );
+    const betaRes = makeRes();
+    await betaRoute.handler(betaReq, betaRes);
+
+    expect(alphaRes._status).toBe(204);
+    expect(betaRes._status).toBe(204);
+    expect(dispatchReplyWithBufferedBlockDispatcher).toHaveBeenCalledTimes(2);
+    expect(finalizeInboundContextMock).toHaveBeenCalledTimes(2);
+
+    const alphaCtx = finalizeInboundContextMock.mock.calls[0]?.[0];
+    const betaCtx = finalizeInboundContextMock.mock.calls[1]?.[0];
+    expect(alphaCtx).toMatchObject({
+      AccountId: "alpha",
+      SessionKey: "agent:agent-alpha:synology-chat:alpha:direct:123",
+    });
+    expect(betaCtx).toMatchObject({
+      AccountId: "beta",
+      SessionKey: "agent:agent-beta:synology-chat:beta:direct:123",
+    });
+
+    alphaAbortController.abort();
+    betaAbortController.abort();
+    await alphaStarted;
+    await betaStarted;
+  });
+});