openclaw-groupme 0.4.3 → 0.5.0

package/src/accounts.ts

@@ -1,7 +1,4 @@
-import {
-  DEFAULT_ACCOUNT_ID,
-  normalizeAccountId,
-} from "openclaw/plugin-sdk/account-id";
+import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import type {
   CoreConfig,
   GroupMeAccountConfig,
@@ -9,13 +6,6 @@ import type {
   ResolvedGroupMeAccount,
 } from "./types.js";
 
-const ENV_BOT_ID = "GROUPME_BOT_ID";
-const ENV_ACCESS_TOKEN = "GROUPME_ACCESS_TOKEN";
-const ENV_BOT_NAME = "GROUPME_BOT_NAME";
-const ENV_CALLBACK_URL = "GROUPME_CALLBACK_URL";
-const ENV_GROUP_ID = "GROUPME_GROUP_ID";
-const ENV_PUBLIC_DOMAIN = "GROUPME_PUBLIC_DOMAIN";
-
 export function readTrimmed(value: unknown): string | undefined {
   if (typeof value !== "string") {
     return undefined;
@@ -24,6 +14,17 @@ export function readTrimmed(value: unknown): string | undefined {
   return trimmed || undefined;
 }
 
+export function hasSecretInput(value: unknown): boolean {
+  if (typeof value === "string") {
+    return Boolean(value.trim());
+  }
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+function trimSecretInput(value: GroupMeAccountConfig["botId"]): GroupMeAccountConfig["botId"] {
+  return typeof value === "string" ? readTrimmed(value) : value;
+}
+
 function listConfiguredAccountIds(cfg: CoreConfig): string[] {
   const accounts = cfg.channels?.groupme?.accounts;
   if (!accounts || typeof accounts !== "object") {
@@ -54,22 +55,15 @@ function resolveAccountConfig(
     return accounts[accountId];
   }
 
-  const hit = Object.keys(accounts).find(
-    (key) => normalizeAccountId(key) === accountId,
-  );
+  const hit = Object.keys(accounts).find((key) => normalizeAccountId(key) === accountId);
   return hit ? accounts[hit] : undefined;
 }
 
-function mergeAccountConfig(
-  cfg: CoreConfig,
-  accountId: string,
-): GroupMeAccountConfig {
+function mergeAccountConfig(cfg: CoreConfig, accountId: string): GroupMeAccountConfig {
   const raw = (cfg.channels?.groupme ?? {}) as GroupMeConfig;
   const { accounts: _ignored, defaultAccount: _ignored2, ...base } = raw;
   const account =
-    accountId === DEFAULT_ACCOUNT_ID
-      ? {}
-      : (resolveAccountConfig(cfg, accountId) ?? {});
+    accountId === DEFAULT_ACCOUNT_ID ? {} : (resolveAccountConfig(cfg, accountId) ?? {});
 
   return {
     ...base,
@@ -78,13 +72,8 @@ function mergeAccountConfig(
 }
 
 export function listGroupMeAccountIds(cfg: CoreConfig): string[] {
-  const sorted = listConfiguredAccountIds(cfg).toSorted((a, b) =>
-    a.localeCompare(b),
-  );
-  return [
-    DEFAULT_ACCOUNT_ID,
-    ...sorted.filter((id) => id !== DEFAULT_ACCOUNT_ID),
-  ];
+  const sorted = listConfiguredAccountIds(cfg).toSorted((a, b) => a.localeCompare(b));
+  return [DEFAULT_ACCOUNT_ID, ...sorted.filter((id) => id !== DEFAULT_ACCOUNT_ID)];
 }
 
 export function resolveDefaultGroupMeAccountId(cfg: CoreConfig): string {
@@ -102,64 +91,36 @@ export function resolveGroupMeAccount(params: {
 }): ResolvedGroupMeAccount {
   const normalizedRequested = normalizeAccountId(params.accountId);
   const accountId =
-    normalizedRequested ||
-    resolveDefaultGroupMeAccountId(params.cfg) ||
-    DEFAULT_ACCOUNT_ID;
+    normalizedRequested || resolveDefaultGroupMeAccountId(params.cfg) || DEFAULT_ACCOUNT_ID;
 
   const merged = mergeAccountConfig(params.cfg, accountId);
   const baseEnabled = params.cfg.channels?.groupme?.enabled !== false;
   const accountEnabled = merged.enabled !== false;
   const enabled = baseEnabled && accountEnabled;
 
-  const isDefaultAccount = accountId === DEFAULT_ACCOUNT_ID;
-  const botId =
-    readTrimmed(merged.botId) ||
-    (isDefaultAccount ? readTrimmed(process.env[ENV_BOT_ID]) : undefined) ||
-    "";
-  const accessToken =
-    readTrimmed(merged.accessToken) ||
-    (isDefaultAccount
-      ? readTrimmed(process.env[ENV_ACCESS_TOKEN])
-      : undefined) ||
-    "";
-  const botName =
-    readTrimmed(merged.botName) ||
-    (isDefaultAccount ? readTrimmed(process.env[ENV_BOT_NAME]) : undefined) ||
-    undefined;
-  const groupId =
-    readTrimmed(merged.groupId) ||
-    (isDefaultAccount
-      ? readTrimmed(process.env[ENV_GROUP_ID])
-      : undefined) ||
-    undefined;
-  const callbackUrl =
-    readTrimmed(merged.callbackUrl) ||
-    (isDefaultAccount
-      ? readTrimmed(process.env[ENV_CALLBACK_URL])
-      : undefined) ||
-    undefined;
-  const publicDomain =
-    readTrimmed(merged.publicDomain) ||
-    (isDefaultAccount
-      ? readTrimmed(process.env[ENV_PUBLIC_DOMAIN])
-      : undefined) ||
-    undefined;
+  const botId = readTrimmed(merged.botId) ?? "";
+  const accessToken = readTrimmed(merged.accessToken) ?? "";
+  const botName = readTrimmed(merged.botName);
+  const groupId = readTrimmed(merged.groupId);
+  const webhookPath = readTrimmed(merged.webhookPath);
+  const publicDomain = readTrimmed(merged.publicDomain);
 
   const config: GroupMeAccountConfig = {
     ...merged,
-    botId,
-    accessToken,
+    botId: trimSecretInput(merged.botId),
+    accessToken: trimSecretInput(merged.accessToken),
+    callbackToken: trimSecretInput(merged.callbackToken),
     botName,
     groupId,
     publicDomain,
-    callbackUrl,
+    webhookPath,
   };
 
   return {
     accountId,
     name: readTrimmed(merged.name),
     enabled,
-    configured: Boolean(botId),
+    configured: hasSecretInput(merged.botId),
     botId,
     accessToken,
     config,

package/src/channel.ts

@@ -1,23 +1,18 @@
+import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
 import {
   applyAccountNameToChannelSection,
   buildChannelConfigSchema,
+  type ChannelPlugin,
   DEFAULT_ACCOUNT_ID,
   deleteAccountFromConfigSection,
   migrateBaseNameToDefaultAccount,
-  missingTargetError,
   normalizeAccountId,
-  registerPluginHttpRoute,
   setAccountEnabledInConfigSection,
-  type ChannelPlugin,
-  type ChannelSetupAdapter,
-} from "openclaw/plugin-sdk";
-import type {
-  CoreConfig,
-  GroupMeConfig,
-  GroupMeProbe,
-  ResolvedGroupMeAccount,
-} from "./types.js";
+} from "openclaw/plugin-sdk/core";
+import type { ChannelSetupAdapter } from "openclaw/plugin-sdk/setup";
+import { registerPluginHttpRoute } from "openclaw/plugin-sdk/webhook-ingress";
 import {
+  hasSecretInput,
   listGroupMeAccountIds,
   resolveDefaultGroupMeAccountId,
   resolveGroupMeAccount,
@@ -25,22 +20,18 @@ import {
 import { GroupMeConfigSchema } from "./config-schema.js";
 import { createGroupMeWebhookHandler } from "./monitor.js";
 import {
+  looksLikeGroupMeTargetId,
   normalizeGroupMeAllowEntry,
   normalizeGroupMeTarget,
-  looksLikeGroupMeTargetId,
 } from "./normalize.js";
 import { groupmeOnboardingAdapter } from "./onboarding.js";
 import { getGroupMeRuntime } from "./runtime.js";
-import { redactCallbackUrl, resolveGroupMeSecurity } from "./security.js";
-import {
-  GROUPME_MAX_TEXT_LENGTH,
-  sendGroupMeMedia,
-  sendGroupMeText,
-} from "./send.js";
+import { GROUPME_MAX_TEXT_LENGTH, sendGroupMeMedia, sendGroupMeText } from "./send.js";
+import type { CoreConfig, GroupMeConfig, GroupMeProbe, ResolvedGroupMeAccount } from "./types.js";
 
 const CHANNEL_ID = "groupme" as const;
 
-function normalizeCallbackUrl(raw: string | undefined): string {
+function normalizeWebhookPath(raw: string | undefined): string {
   const trimmed = raw?.trim() ?? "";
   if (!trimmed) {
     return "/groupme";
@@ -49,24 +40,37 @@ function normalizeCallbackUrl(raw: string | undefined): string {
     const parsed = new URL(trimmed, "http://localhost");
     return parsed.pathname || "/groupme";
   } catch {
-    const noQuery = trimmed.split("?")[0] ?? trimmed;
+    // Unparseable input (e.g. "http://%"): strip any query/fragment and ensure a
+    // leading slash so we still return a route-shaped path rather than throwing.
+    // This is a display/registration fallback for malformed config, not a parser.
+    // The `?? trimmed` and empty-`noQuery` guards are defensive: split() always yields
+    // a [0], and a non-empty trimmed string can't reduce to an empty noQuery here.
+    /* v8 ignore start */
+    const noQuery = trimmed.split(/[?#]/)[0] ?? trimmed;
     if (!noQuery) {
       return "/groupme";
     }
+    /* v8 ignore stop */
     return noQuery.startsWith("/") ? noQuery : `/${noQuery}`;
   }
 }
 
-function redactWebhookPath(
-  account: ResolvedGroupMeAccount,
-  callbackUrl: string | undefined,
-): string {
-  const normalized = callbackUrl?.trim() || "/groupme";
-  const security = resolveGroupMeSecurity(account.config);
-  if (!security.logging.redactSecrets) {
-    return normalized;
+function parseWebhookSetupInput(raw: string): {
+  webhookPath: string;
+  callbackToken?: string;
+} {
+  try {
+    const parsed = new URL(raw.trim(), "http://localhost");
+    const callbackToken = parsed.searchParams.get("k")?.trim() || undefined;
+    return {
+      webhookPath: parsed.pathname || "/groupme",
+      callbackToken,
+    };
+  } catch {
+    return {
+      webhookPath: normalizeWebhookPath(raw),
+    };
   }
-  return redactCallbackUrl(normalized, security);
 }
 
 const meta = {
@@ -81,13 +85,10 @@ const meta = {
   quickstartAllowFrom: true,
 };
 
-export const groupmePlugin: ChannelPlugin<
-  ResolvedGroupMeAccount,
-  GroupMeProbe
-> = {
+export const groupmePlugin: ChannelPlugin<ResolvedGroupMeAccount, GroupMeProbe> = {
   id: CHANNEL_ID,
   meta,
-  onboarding: groupmeOnboardingAdapter,
+  setupWizard: groupmeOnboardingAdapter,
   setup: {
     resolveAccountId: ({ accountId }) => normalizeAccountId(accountId),
 
@@ -123,12 +124,15 @@ export const groupmePlugin: ChannelPlugin<
 
       const updates: Record<string, unknown> = { enabled: true };
       if (input.token?.trim()) updates.botId = input.token.trim();
-      if (input.accessToken?.trim())
-        updates.accessToken = input.accessToken.trim();
+      if (input.accessToken?.trim()) updates.accessToken = input.accessToken.trim();
       if (input.webhookUrl?.trim()) {
-        updates.callbackUrl = input.webhookUrl.trim();
+        const parsed = parseWebhookSetupInput(input.webhookUrl);
+        updates.webhookPath = parsed.webhookPath;
+        if (parsed.callbackToken) updates.callbackToken = parsed.callbackToken;
       } else if (input.webhookPath?.trim()) {
-        updates.callbackUrl = input.webhookPath.trim();
+        const parsed = parseWebhookSetupInput(input.webhookPath);
+        updates.webhookPath = parsed.webhookPath;
+        if (parsed.callbackToken) updates.callbackToken = parsed.callbackToken;
       }
 
       const section = (next.channels?.groupme ?? {}) as GroupMeConfig;
@@ -185,8 +189,7 @@ export const groupmePlugin: ChannelPlugin<
     listAccountIds: (cfg) => listGroupMeAccountIds(cfg as CoreConfig),
     resolveAccount: (cfg, accountId) =>
       resolveGroupMeAccount({ cfg: cfg as CoreConfig, accountId }),
-    defaultAccountId: (cfg) =>
-      resolveDefaultGroupMeAccountId(cfg as CoreConfig),
+    defaultAccountId: (cfg) => resolveDefaultGroupMeAccountId(cfg as CoreConfig),
     setAccountEnabled: ({ cfg, accountId, enabled }) =>
       setAccountEnabledInConfigSection({
         cfg: cfg as CoreConfig,
@@ -204,10 +207,11 @@ export const groupmePlugin: ChannelPlugin<
           "name",
           "botId",
           "accessToken",
+          "callbackToken",
           "botName",
           "groupId",
           "publicDomain",
-          "callbackUrl",
+          "webhookPath",
           "mentionPatterns",
           "requireMention",
           "historyLimit",
@@ -223,15 +227,15 @@ export const groupmePlugin: ChannelPlugin<
       name: account.name,
       enabled: account.enabled,
       configured: account.configured,
-      botId: account.botId ? "***" : "",
+      botId: hasSecretInput(account.config.botId) ? "***" : "",
       publicDomain: account.config.publicDomain ?? "",
-      callbackUrl: redactWebhookPath(account, account.config.callbackUrl),
+      webhookPath: normalizeWebhookPath(account.config.webhookPath),
+      callbackToken: hasSecretInput(account.config.callbackToken) ? "***" : "",
     }),
     resolveAllowFrom: ({ cfg, accountId }) =>
-      (
-        resolveGroupMeAccount({ cfg: cfg as CoreConfig, accountId }).config
-          .allowFrom ?? []
-      ).map((entry) => String(entry)),
+      (resolveGroupMeAccount({ cfg: cfg as CoreConfig, accountId }).config.allowFrom ?? []).map(
+        (entry) => String(entry),
+      ),
     formatAllowFrom: ({ allowFrom }) =>
       allowFrom
         .map((entry) => normalizeGroupMeAllowEntry(String(entry)))
@@ -248,8 +252,7 @@ export const groupmePlugin: ChannelPlugin<
   },
   outbound: {
     deliveryMode: "direct",
-    chunker: (text, limit) =>
-      getGroupMeRuntime().channel.text.chunkMarkdownText(text, limit),
+    chunker: (text, limit) => getGroupMeRuntime().channel.text.chunkMarkdownText(text, limit),
     chunkerMode: "markdown",
     textChunkLimit: GROUPME_MAX_TEXT_LENGTH,
     resolveTarget: ({ to }) => {
@@ -355,7 +358,7 @@ export const groupmePlugin: ChannelPlugin<
     buildChannelSummary: ({ snapshot }) => ({
       configured: snapshot.configured ?? false,
       running: snapshot.running ?? false,
-      callbackUrl: snapshot.webhookPath ?? null,
+      webhookPath: snapshot.webhookPath ?? null,
       lastStartAt: snapshot.lastStartAt ?? null,
       lastStopAt: snapshot.lastStopAt ?? null,
       lastInboundAt: snapshot.lastInboundAt ?? null,
@@ -367,9 +370,9 @@ export const groupmePlugin: ChannelPlugin<
       name: account.name,
       enabled: account.enabled,
       configured: account.configured,
-      botId: account.botId ? "***" : "",
-      tokenSource: account.accessToken ? "configured" : "none",
-      webhookPath: redactWebhookPath(account, account.config.callbackUrl),
+      botId: hasSecretInput(account.config.botId) ? "***" : "",
+      tokenSource: hasSecretInput(account.config.accessToken) ? "configured" : "none",
+      webhookPath: normalizeWebhookPath(account.config.webhookPath),
       running: runtime?.running ?? false,
       lastStartAt: runtime?.lastStartAt ?? null,
       lastStopAt: runtime?.lastStopAt ?? null,
@@ -388,11 +391,7 @@ export const groupmePlugin: ChannelPlugin<
         );
       }
 
-      const callbackPath = normalizeCallbackUrl(account.config.callbackUrl);
-      const redactedCallbackPath = redactWebhookPath(
-        account,
-        account.config.callbackUrl ?? callbackPath,
-      );
+      const callbackPath = normalizeWebhookPath(account.config.webhookPath);
       const unregister = registerPluginHttpRoute({
         path: callbackPath,
         fallbackPath: "/groupme",
@@ -400,9 +399,12 @@ export const groupmePlugin: ChannelPlugin<
           account,
           config: ctx.cfg as CoreConfig,
           runtime: ctx.runtime,
-          statusSink: (patch) =>
-            ctx.setStatus({ accountId: account.accountId, ...patch }),
+          // Thin setStatus adapter; exercised end-to-end through the live gateway, not in
+          // unit isolation (the webhook-flow tests drive the handler with their own sink).
+          /* v8 ignore next */
+          statusSink: (patch) => ctx.setStatus({ accountId: account.accountId, ...patch }),
         }),
+        auth: "plugin",
         pluginId: CHANNEL_ID,
         accountId: account.accountId,
         log: (message) => ctx.log?.info(message),
@@ -412,17 +414,24 @@ export const groupmePlugin: ChannelPlugin<
         accountId: account.accountId,
         running: true,
         mode: "webhook",
-        webhookPath: redactedCallbackPath,
+        webhookPath: callbackPath,
         lastStartAt: Date.now(),
         lastError: null,
       });
 
-      ctx.log?.info(
-        `[${account.accountId}] GroupMe webhook listening on ${redactedCallbackPath}`,
-      );
+      ctx.log?.info(`[${account.accountId}] GroupMe webhook listening on ${callbackPath}`);
+
+      const markStopped = () => {
+        ctx.setStatus({
+          accountId: account.accountId,
+          running: false,
+          lastStopAt: Date.now(),
+        });
+      };
 
       if (ctx.abortSignal.aborted) {
         unregister();
+        markStopped();
         return;
       }
 
@@ -431,6 +440,7 @@ export const groupmePlugin: ChannelPlugin<
           "abort",
           () => {
             unregister();
+            markStopped();
             resolve();
           },
           { once: true },

package/src/config-schema.ts

@@ -1,10 +1,12 @@
 import {
   BlockStreamingCoalesceSchema,
   MarkdownConfigSchema,
-} from "openclaw/plugin-sdk";
+} from "openclaw/plugin-sdk/channel-config-primitives";
+import { buildOptionalSecretInputSchema } from "openclaw/plugin-sdk/secret-input";
 import { z } from "zod";
 
 const allowFromEntry = z.union([z.string(), z.number()]);
+const optionalSecretInput = buildOptionalSecretInputSchema();
 
 const GroupMeReplaySchema = z
   .object({
@@ -50,9 +52,7 @@ const GroupMeProxySecuritySchema = z
     trustedProxyCidrs: z.array(z.string()).optional(),
     allowedPublicHosts: z.array(z.string()).optional(),
     requireHttpsProto: z.boolean().optional().default(false),
-    rejectStatus: z
-      .union([z.literal(400), z.literal(403), z.literal(404)])
-      .optional(),
+    rejectStatus: z.union([z.literal(400), z.literal(403), z.literal(404)]).optional(),
   })
   .strict();
 
@@ -67,16 +67,17 @@ const GroupMeSecuritySchema = z
   })
   .strict();
 
-export const GroupMeAccountSchemaBase = z
+const GroupMeAccountSchemaBase = z
   .object({
     name: z.string().optional(),
     enabled: z.boolean().optional(),
-    botId: z.string().optional(),
-    accessToken: z.string().optional(),
+    botId: optionalSecretInput,
+    accessToken: optionalSecretInput,
+    callbackToken: optionalSecretInput,
     botName: z.string().optional(),
     groupId: z.string().optional(),
     publicDomain: z.string().optional(),
-    callbackUrl: z.string().optional(),
+    webhookPath: z.string().optional(),
     mentionPatterns: z.array(z.string()).optional(),
     requireMention: z.boolean().optional().default(true),
     historyLimit: z.number().int().nonnegative().optional(),
@@ -92,8 +93,6 @@ export const GroupMeAccountSchemaBase = z
   .strict();
 
 export const GroupMeConfigSchema = GroupMeAccountSchemaBase.extend({
-  accounts: z
-    .record(z.string(), GroupMeAccountSchemaBase.optional())
-    .optional(),
+  accounts: z.record(z.string(), GroupMeAccountSchemaBase.optional()).optional(),
   defaultAccount: z.string().optional(),
 }).strict();

package/src/groupme-api.ts

@@ -2,6 +2,13 @@ import type { GroupMeApiBot, GroupMeApiGroup } from "./types.js";
 
 const GROUPME_API_BASE = "https://api.groupme.com/v3";
 
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+
+type GroupMeApiOptions = {
+  fetchFn?: FetchLike;
+  apiBaseUrl?: string;
+};
+
 async function readApiError(response: Response): Promise<string> {
   const fallback = `GroupMe API error: ${response.status} ${response.statusText}`;
   try {
@@ -38,18 +45,23 @@ function readBotResponse(payload: unknown): GroupMeApiBot {
   return bot as GroupMeApiBot;
 }
 
-export async function fetchGroups(accessToken: string): Promise<GroupMeApiGroup[]> {
+export async function fetchGroups(
+  accessToken: string,
+  options: GroupMeApiOptions = {},
+): Promise<GroupMeApiGroup[]> {
+  const fetchFn = options.fetchFn ?? fetch;
+  const apiBaseUrl = options.apiBaseUrl ?? GROUPME_API_BASE;
   const groups: GroupMeApiGroup[] = [];
   let page = 1;
 
   while (true) {
-    const url = new URL(`${GROUPME_API_BASE}/groups`);
+    const url = new URL(`${apiBaseUrl}/groups`);
     url.searchParams.set("token", accessToken);
     url.searchParams.set("per_page", "100");
     url.searchParams.set("omit", "memberships");
     url.searchParams.set("page", String(page));
 
-    const response = await fetch(url);
+    const response = await fetchFn(url);
     if (!response.ok) {
       throw new Error(await readApiError(response));
     }
@@ -72,11 +84,15 @@ export async function createBot(params: {
   name: string;
   groupId: string;
   callbackUrl: string;
+  fetchFn?: FetchLike;
+  apiBaseUrl?: string;
 }): Promise<GroupMeApiBot> {
-  const url = new URL(`${GROUPME_API_BASE}/bots`);
+  const fetchFn = params.fetchFn ?? fetch;
+  const apiBaseUrl = params.apiBaseUrl ?? GROUPME_API_BASE;
+  const url = new URL(`${apiBaseUrl}/bots`);
   url.searchParams.set("token", params.accessToken);
 
-  const response = await fetch(url, {
+  const response = await fetchFn(url, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({

package/src/history.ts

@@ -1,4 +1,4 @@
-import type { HistoryEntry } from "openclaw/plugin-sdk";
+import type { HistoryEntry } from "openclaw/plugin-sdk/core";
 
 export const DEFAULT_GROUPME_HISTORY_LIMIT = 20;