@openclaw/synology-chat 2026.7.1-beta.6 → 2026.7.2-beta.1

package/dist/api.js

@@ -1,3 +1,3 @@
-import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-C6bhvNZi.js";
+import { n as setSynologyRuntime, t as synologyChatPlugin } from "./channel-DJNRGYkN.js";
 import { t as collectSynologyChatSecurityAuditFindings } from "./security-audit-DIsaxIaB.js";
 export { collectSynologyChatSecurityAuditFindings, setSynologyRuntime, synologyChatPlugin };

package/dist/{channel-C6bhvNZi.js → channel-DJNRGYkN.js}

@@ -8,8 +8,9 @@ import { composeWarningCollectors, createConditionalWarningCollector, projectAcc
 import { createEmptyChannelDirectoryAdapter } from "openclaw/plugin-sdk/directory-runtime";
 import { finiteSecondsToTimerSafeMilliseconds, parseStrictNonNegativeInteger } from "openclaw/plugin-sdk/number-runtime";
 import { normalizeLowercaseStringOrEmpty, normalizeStringEntriesLower } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { sanitizeAssistantVisibleText } from "openclaw/plugin-sdk/text-chunking";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-resolution";
-import { createResolvedApproverActionAuthAdapter, resolveApprovalApprovers } from "openclaw/plugin-sdk/approval-auth-runtime";
+import { createChannelApprovalAuth } from "openclaw/plugin-sdk/approval-auth-runtime";
 import * as http from "node:http";
 import * as https from "node:https";
 import { safeParseJsonWithSchema, safeParseWithSchema } from "openclaw/plugin-sdk/extension-shared";
@@ -17,7 +18,7 @@ import { sleep } from "openclaw/plugin-sdk/runtime-env";
 import { formatErrorMessage, resolvePinnedHostnameWithPolicy } from "openclaw/plugin-sdk/ssrf-runtime";
 import { z } from "zod";
 import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
-import { beginWebhookRequestPipelineOrReject, createFixedWindowRateLimiter, createWebhookInFlightLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, registerPluginHttpRoute, requestBodyErrorToText } from "openclaw/plugin-sdk/webhook-ingress";
+import { beginWebhookRequestPipelineOrReject, createFixedWindowRateLimiter, createWebhookInFlightLimiter, isRequestBodyLimitError, readRequestBodyWithLimit, registerPluginHttpRoute, requestBodyErrorToText, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { buildAgentSessionKey } from "openclaw/plugin-sdk/routing";
 import * as querystring from "node:querystring";
@@ -29,16 +30,13 @@ function normalizeSynologyChatApproverId(value) {
 	const trimmed = String(value).trim();
 	return /^\d+$/.test(trimmed) ? trimmed : void 0;
 }
-const synologyChatApprovalAuth = createResolvedApproverActionAuthAdapter({
+const synologyChatApprovalAuth = createChannelApprovalAuth({
 	channelLabel: "Synology Chat",
-	resolveApprovers: ({ cfg, accountId }) => {
-		return resolveApprovalApprovers({
-			allowFrom: resolveAccount(cfg ?? {}, accountId).allowedUserIds,
-			normalizeApprover: normalizeSynologyChatApproverId
-		});
+	resolveInputs: ({ cfg, accountId }) => {
+		return { allowFrom: resolveAccount(cfg ?? {}, accountId).allowedUserIds };
 	},
-	normalizeSenderId: (value) => normalizeSynologyChatApproverId(value)
-});
+	normalizeApprover: normalizeSynologyChatApproverId
+}).approvalAuth;
 //#endregion
 //#region extensions/synology-chat/src/client.ts
 /**
@@ -554,8 +552,8 @@ function getInvalidTokenRateLimiter(account) {
 	}
 	return rl;
 }
-function getSynologyWebhookInvalidTokenRateLimitKey(req) {
-	return req.socket?.remoteAddress ?? "unknown";
+function getSynologyWebhookInvalidTokenRateLimitKey(params) {
+	return resolveRequestClientIp(params.req, params.trustedProxies, params.allowRealIpFallback === true) ?? params.req.socket?.remoteAddress ?? "unknown";
 }
 function getSynologyWebhookInFlightKey(account) {
 	return account.accountId;
@@ -736,7 +734,11 @@ async function parseWebhookPayloadRequest(params) {
 	};
 }
 async function authorizeSynologyWebhook(params) {
-	const invalidTokenRateLimitKey = getSynologyWebhookInvalidTokenRateLimitKey(params.req);
+	const invalidTokenRateLimitKey = getSynologyWebhookInvalidTokenRateLimitKey({
+		req: params.req,
+		trustedProxies: params.trustedProxies,
+		allowRealIpFallback: params.allowRealIpFallback
+	});
 	if (params.invalidTokenRateLimiter.isLocked(invalidTokenRateLimitKey)) {
 		params.log?.warn(`Rate limit exceeded for remote IP: ${invalidTokenRateLimitKey}`);
 		return {
@@ -815,6 +817,8 @@ async function parseAndAuthorizeSynologyWebhook(params) {
 		payload: parsed.payload,
 		invalidTokenRateLimiter: params.invalidTokenRateLimiter,
 		rateLimiter: params.rateLimiter,
+		trustedProxies: params.trustedProxies,
+		allowRealIpFallback: params.allowRealIpFallback,
 		log: params.log
 	});
 	if (!authorized.ok) {
@@ -902,6 +906,8 @@ function createWebhookHandler(deps) {
 				account,
 				invalidTokenRateLimiter,
 				rateLimiter,
+				trustedProxies: deps.trustedProxies,
+				allowRealIpFallback: deps.allowRealIpFallback,
 				log,
 				bodyTimeoutMs: deps.bodyTimeoutMs
 			});
@@ -988,7 +994,7 @@ function validateSynologyGatewayAccountStartup(params) {
 	return { ok: true };
 }
 function registerSynologyWebhookRoute(params) {
-	const { account, log } = params;
+	const { cfg, account, log } = params;
 	const routeKey = getRouteKey(account);
 	const prevUnregister = activeRouteUnregisters.get(routeKey);
 	if (prevUnregister) {
@@ -998,6 +1004,8 @@ function registerSynologyWebhookRoute(params) {
 	}
 	const handler = createWebhookHandler({
 		account,
+		trustedProxies: cfg.gateway?.trustedProxies,
+		allowRealIpFallback: cfg.gateway?.allowRealIpFallback === true,
 		deliver: async (msg) => await dispatchSynologyChatInboundEvent({
 			account,
 			msg,
@@ -1198,6 +1206,7 @@ function createSynologyChatPlugin() {
 					}).ok) return waitUntilAbort(abortSignal);
 					log?.info?.(`Starting Synology Chat channel (account: ${accountId}, path: ${account.webhookPath})`);
 					const unregister = registerSynologyWebhookRoute({
+						cfg,
 						account,
 						accountId,
 						log
@@ -1255,6 +1264,7 @@ function createSynologyChatPlugin() {
 		outbound: {
 			deliveryMode: "gateway",
 			textChunkLimit: 2e3,
+			sanitizeText: ({ text }) => sanitizeAssistantVisibleText(text),
 			sendText: sendSynologyChatText,
 			sendMedia: async (ctx) => {
 				if (!ctx.mediaUrl) throw new Error("Synology Chat media send requires mediaUrl");

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as synologyChatPlugin } from "./channel-C6bhvNZi.js";
+import { t as synologyChatPlugin } from "./channel-DJNRGYkN.js";
 export { synologyChatPlugin };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.7.1-beta.6",
+  "version": "2026.7.2-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/synology-chat",
-      "version": "2026.7.1-beta.6",
+      "version": "2026.7.2-beta.1",
       "dependencies": {
         "zod": "4.4.3"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/synology-chat",
-  "version": "2026.7.1-beta.6",
+  "version": "2026.7.2-beta.1",
   "description": "Synology Chat channel plugin for OpenClaw channels and direct messages.",
   "repository": {
     "type": "git",
@@ -27,10 +27,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1-beta.6"
+      "pluginApi": ">=2026.7.2-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.7.1-beta.6"
+      "openclawVersion": "2026.7.2-beta.1"
     },
     "release": {
       "publishToClawHub": true,
@@ -51,7 +51,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.1-beta.6"
+    "openclaw": ">=2026.7.2-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {