adp-openclaw 0.0.4 → 0.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adp-openclaw",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "OpenClaw demo channel plugin (Go WebSocket backend)",
   "type": "module",
   "dependencies": {

package/src/channel.ts

@@ -12,7 +12,6 @@ export type AdpOpenclawChannelConfig = {
   enabled?: boolean;
   serverUrl?: string;
   wsUrl?: string;
-  apiToken?: string;
   clientToken?: string;
   pollIntervalMs?: number;
 };
@@ -23,13 +22,13 @@ export type ResolvedAdpOpenclawAccount = {
   enabled: boolean;
   configured: boolean;
   serverUrl: string;
-  apiToken: string;
+  clientToken: string;
   pollIntervalMs: number;
 };
 
 function resolveAdpOpenclawCredentials(channelCfg?: AdpOpenclawChannelConfig): {
   serverUrl: string;
-  apiToken: string;
+  clientToken: string;
   pollIntervalMs: number;
 } | null {
   // Get serverUrl: support both serverUrl and wsUrl
@@ -45,23 +44,20 @@ function resolveAdpOpenclawCredentials(channelCfg?: AdpOpenclawChannelConfig): {
     serverUrl = process.env.ADP_OPENCLAW_SERVER_URL || "";
   }
 
-  // Get apiToken: support both apiToken and clientToken
-  let apiToken = channelCfg?.apiToken?.trim();
-  if (!apiToken && channelCfg?.clientToken) {
-    apiToken = channelCfg.clientToken.trim();
-  }
-  if (!apiToken) {
-    apiToken = process.env.ADP_OPENCLAW_API_TOKEN || "";
+  // Get clientToken from config or env
+  let clientToken = channelCfg?.clientToken?.trim();
+  if (!clientToken) {
+    clientToken = process.env.ADP_OPENCLAW_CLIENT_TOKEN || "";
   }
 
   // Both are required for configured status
-  if (!serverUrl || !apiToken) {
+  if (!serverUrl || !clientToken) {
     return null;
   }
 
   const pollIntervalMs = channelCfg?.pollIntervalMs ?? 1000;
 
-  return { serverUrl, apiToken, pollIntervalMs };
+  return { serverUrl, clientToken, pollIntervalMs };
 }
 
 function resolveAccount(cfg: ClawdbotConfig, accountId?: string): ResolvedAdpOpenclawAccount {
@@ -75,7 +71,7 @@ function resolveAccount(cfg: ClawdbotConfig, accountId?: string): ResolvedAdpOpe
     enabled,
     configured: Boolean(creds),
     serverUrl: creds?.serverUrl || "http://localhost:9876",
-    apiToken: creds?.apiToken || "",
+    clientToken: creds?.clientToken || "",
     pollIntervalMs: creds?.pollIntervalMs || 1000,
   };
 }
@@ -106,7 +102,6 @@ export const adpOpenclawPlugin: ChannelPlugin<ResolvedAdpOpenclawAccount> = {
         enabled: { type: "boolean" },
         serverUrl: { type: "string" },
         wsUrl: { type: "string" },
-        apiToken: { type: "string" },
         clientToken: { type: "string" },
         pollIntervalMs: { type: "integer", minimum: 100 },
       },
@@ -222,7 +217,7 @@ export const adpOpenclawPlugin: ChannelPlugin<ResolvedAdpOpenclawAccount> = {
       const { monitorAdpOpenclaw } = await import("./monitor.js");
       return monitorAdpOpenclaw({
         serverUrl: account.serverUrl,
-        apiToken: account.apiToken,
+        clientToken: account.clientToken,
         pollIntervalMs: account.pollIntervalMs,
         abortSignal: ctx.abortSignal,
         log: ctx.log,
@@ -256,7 +251,7 @@ export const adpOpenclawPlugin: ChannelPlugin<ResolvedAdpOpenclawAccount> = {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          Authorization: `Bearer ${account.apiToken}`,
+          Authorization: `Bearer ${account.clientToken}`,
         },
         body: JSON.stringify({
           to: target,

package/src/config-schema.ts

@@ -3,6 +3,6 @@ import { z } from "zod";
 export const AdpOpenclawConfigSchema = z.object({
   enabled: z.boolean().optional(),
   serverUrl: z.string().optional(),
-  apiToken: z.string().optional(),
+  clientToken: z.string().optional(),
   pollIntervalMs: z.number().optional(),
 });

package/src/monitor.ts

@@ -7,7 +7,7 @@ import crypto from "crypto";
 
 export type MonitorParams = {
   serverUrl: string;
-  apiToken: string;
+  clientToken: string;
   pollIntervalMs: number; // Used as reconnect delay
   abortSignal?: AbortSignal;
   log?: PluginLogger;
@@ -63,9 +63,10 @@ type AuthResultPayload = {
   message?: string;
 };
 
-// Generate HMAC-SHA256 signature for extra security
-function generateSignature(token: string, nonce: string): string {
-  return crypto.createHash("sha256").update(`${token}:${nonce}`).digest("hex");
+// Generate HMAC-SHA256 signature for authentication (includes timestamp for anti-replay)
+function generateSignature(token: string, nonce: string, timestamp: number): string {
+  // Use HMAC-SHA256 with token as the key, and "nonce:timestamp" as the message
+  return crypto.createHmac("sha256", token).update(`${nonce}:${timestamp}`).digest("hex");
 }
 
 // Generate random nonce
@@ -79,7 +80,7 @@ function generateRequestId(): string {
 }
 
 export async function monitorAdpOpenclaw(params: MonitorParams): Promise<void> {
-  const { serverUrl, apiToken, pollIntervalMs, abortSignal, log, cfg } = params;
+  const { serverUrl, clientToken, pollIntervalMs, abortSignal, log, cfg } = params;
   const runtime = getAdpOpenclawRuntime();
 
   // Convert HTTP URL to WebSocket URL
@@ -91,7 +92,7 @@ export async function monitorAdpOpenclaw(params: MonitorParams): Promise<void> {
     try {
       await connectAndHandle({
         wsUrl,
-        apiToken,
+        clientToken,
         serverUrl,
         abortSignal,
         log,
@@ -115,7 +116,7 @@ export async function monitorAdpOpenclaw(params: MonitorParams): Promise<void> {
 
 type ConnectParams = {
   wsUrl: string;
-  apiToken: string;
+  clientToken: string;
   serverUrl: string;
   abortSignal?: AbortSignal;
   log?: PluginLogger;
@@ -124,7 +125,7 @@ type ConnectParams = {
 };
 
 async function connectAndHandle(params: ConnectParams): Promise<void> {
-  const { wsUrl, apiToken, serverUrl, abortSignal, log, runtime, cfg } = params;
+  const { wsUrl, clientToken, serverUrl, abortSignal, log, runtime, cfg } = params;
 
   // Dynamic import for WebSocket (works in both Node.js and browser)
   const WebSocket = (await import("ws")).default;
@@ -144,19 +145,21 @@ async function connectAndHandle(params: ConnectParams): Promise<void> {
     ws.on("open", () => {
       log?.info(`[adp-openclaw] WebSocket connected, authenticating...`);
 
-      // Send authentication message with signature
+      // Send authentication message with signature (includes timestamp for anti-replay)
       const nonce = generateNonce();
-      const signature = generateSignature(apiToken, nonce);
+      const timestamp = Date.now();
+      const signature = generateSignature(clientToken, nonce, timestamp);
 
       const authMsg: WSMessage = {
         type: MsgType.Auth,
         requestId: generateRequestId(),
         payload: {
-          token: apiToken,
+          token: clientToken,
           nonce,
           signature,
+          timestamp, // Include timestamp in payload for server verification
         },
-        timestamp: Date.now(),
+        timestamp,
       };
 
       ws.send(JSON.stringify(authMsg));

package/src/runtime.ts

@@ -8,7 +8,6 @@ export type PluginConfig = {
   wsUrl?: string;
   clientToken?: string;
   serverUrl?: string;
-  apiToken?: string;
   pollIntervalMs?: number;
 };