openclaw-nostr 2026.7.30

package/src/channel-actions.ts

@@ -0,0 +1,199 @@
+import { jsonResult, readStringParam, resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
+import type {
+  ChannelMessageActionAdapter,
+  ChannelMessageActionContext,
+  ChannelMessageActionName,
+} from "openclaw/plugin-sdk/channel-contract";
+import type { NostrBusHandle, SendGroupMessageOptions } from "./nostr-bus.js";
+import type { NostrRoomChannelMap } from "./config-schema.js";
+
+export const NOSTR_REACTION_REMOVAL_ERROR =
+  "Nostr reactions are immutable; to remove a reaction, delete the reaction event using the `delete` action instead";
+
+type NostrBusResolver = (accountId?: string | null) => NostrBusHandle | undefined;
+
+const NOSTR_MESSAGE_ACTIONS = new Set<ChannelMessageActionName>(["send", "react", "delete"]);
+
+function normalizeChannelName(value: string): string {
+  return value.replace(/^nostr:/i, "").trim();
+}
+
+function readChannelName(ctx: ChannelMessageActionContext): string {
+  const explicit =
+    readStringParam(ctx.params, "to") ??
+    readStringParam(ctx.params, "channelName") ??
+    readStringParam(ctx.params, "channelId") ??
+    readStringParam(ctx.params, "roomId");
+  if (explicit) {
+    return normalizeChannelName(explicit);
+  }
+
+  const currentChannelId = ctx.toolContext?.currentChannelId;
+  if (currentChannelId !== undefined && currentChannelId !== null) {
+    const normalized = normalizeChannelName(String(currentChannelId));
+    if (normalized) {
+      return normalized;
+    }
+  }
+
+  throw new Error("Nostr room channel required (provide to, channelName, channelId, or roomId)");
+}
+
+function readTargetEventId(ctx: ChannelMessageActionContext): string {
+  const explicit =
+    readStringParam(ctx.params, "targetEventId") ??
+    readStringParam(ctx.params, "eventId") ??
+    resolveReactionMessageId({ args: ctx.params, toolContext: ctx.toolContext });
+  if (explicit !== undefined && explicit !== null && String(explicit).trim()) {
+    return String(explicit).trim();
+  }
+  throw new Error("targetEventId or messageId required");
+}
+
+function readDeleteEventId(ctx: ChannelMessageActionContext): string {
+  const explicit =
+    readStringParam(ctx.params, "targetEventId") ??
+    readStringParam(ctx.params, "eventId") ??
+    resolveReactionMessageId({ args: ctx.params, toolContext: ctx.toolContext });
+  if (explicit !== undefined && explicit !== null && String(explicit).trim()) {
+    return String(explicit).trim();
+  }
+  throw new Error("eventId or messageId required");
+}
+
+function resolveBus(resolveBus: NostrBusResolver, accountId?: string | null): NostrBusHandle {
+  const bus = resolveBus(accountId);
+  if (!bus) {
+    throw new Error(`Nostr bus not running for account ${accountId ?? "default"}`);
+  }
+  return bus;
+}
+
+export interface NostrSendActionDeps {
+  resolveBus: NostrBusResolver;
+  loadConfig: () => { channels?: { nostr?: { nostr_channels?: NostrRoomChannelMap } } };
+  resolveMarkdownTableMode: (params: { cfg: unknown; channel: string; accountId: string }) => string;
+  convertMarkdownTables: (text: string, mode: string) => string;
+  normalizePubkey: (value: string) => string;
+  extractMentionPubkeys: (text: string) => string[];
+}
+
+export function createNostrMessageActions(
+  resolveNostrBus: NostrBusResolver,
+  sendDeps?: NostrSendActionDeps,
+): ChannelMessageActionAdapter {
+  return {
+    describeMessageTool: () => ({
+      actions: ["send", "react", "delete"],
+      capabilities: [],
+      schema: null,
+    }),
+    supportsAction: ({ action }) => NOSTR_MESSAGE_ACTIONS.has(action),
+    resolveExecutionMode: () => "local",
+    handleAction: async (ctx) => {
+      if (ctx.action === "send") {
+        if (!sendDeps) {
+          throw new Error("Nostr send action requires runtime dependencies");
+        }
+        const target =
+          readStringParam(ctx.params, "target") ??
+          readStringParam(ctx.params, "to") ??
+          readStringParam(ctx.params, "channelName") ??
+          readStringParam(ctx.params, "channelId");
+        if (!target) {
+          throw new Error("target or to parameter required for Nostr send action");
+        }
+        const text =
+          readStringParam(ctx.params, "text") ??
+          readStringParam(ctx.params, "message") ??
+          "";
+        const replyToId = readStringParam(ctx.params, "replyToId") ?? undefined;
+        const threadId = readStringParam(ctx.params, "threadId") ?? undefined;
+        const aid = ctx.accountId ?? "default";
+        const bus = resolveBus(sendDeps.resolveBus, aid);
+        const cfg = sendDeps.loadConfig();
+        const tableMode = sendDeps.resolveMarkdownTableMode({
+          cfg,
+          channel: "nostr",
+          accountId: aid,
+        });
+        const message = sendDeps.convertMarkdownTables(text, tableMode);
+        const rawTo = target.replace(/^nostr:/i, "").trim();
+
+        // Check if target is a configured NIP-29 room
+        const roomCfg = (cfg.channels?.nostr?.nostr_channels as
+          Record<string, { kind?: string; enabled?: boolean }> | undefined)?.[rawTo];
+        if (roomCfg?.kind === "nip29" && roomCfg.enabled !== false) {
+          const sendOpts: SendGroupMessageOptions = {
+            mentionPubkeys: sendDeps.extractMentionPubkeys(message),
+          };
+          if (replyToId?.trim()) {
+            sendOpts.replyToEventId = replyToId.trim();
+          }
+          if (threadId?.trim()) {
+            sendOpts.threadEventId = threadId.trim();
+          }
+          const result = await bus.sendGroupMessage(rawTo, message, sendOpts);
+          return jsonResult({
+            ok: true,
+            action: "send",
+            channel: "nostr",
+            to: rawTo,
+            messageId: result.eventId,
+            relay: result.relay,
+            groupId: result.groupId,
+          });
+        }
+
+        // DM path
+        const normalizedTo = sendDeps.normalizePubkey(rawTo);
+        const result = await bus.sendDm(normalizedTo, message);
+        return jsonResult({
+          ok: true,
+          action: "send",
+          channel: "nostr",
+          to: normalizedTo,
+          messageId: result.publishedEventIds?.[0] ?? result.eventId,
+        });
+      }
+
+      if (ctx.action === "react") {
+        if (ctx.params.remove === true) {
+          throw new Error(NOSTR_REACTION_REMOVAL_ERROR);
+        }
+        const channelName = readChannelName(ctx);
+        const targetEventId = readTargetEventId(ctx);
+        const emoji = readStringParam(ctx.params, "emoji", { required: true });
+        const bus = resolveBus(resolveNostrBus, ctx.accountId);
+        const result = await bus.sendGroupReaction(channelName, emoji, { targetEventId });
+        return jsonResult({
+          ok: true,
+          action: "react",
+          channelName,
+          targetEventId,
+          reactionEventId: result.eventId,
+          relay: result.relay,
+          groupId: result.groupId,
+        });
+      }
+
+      if (ctx.action === "delete") {
+        const channelName = readChannelName(ctx);
+        const eventId = readDeleteEventId(ctx);
+        const bus = resolveBus(resolveNostrBus, ctx.accountId);
+        const result = await bus.deleteGroupEvent(channelName, eventId);
+        return jsonResult({
+          ok: true,
+          action: "delete",
+          channelName,
+          deletedEventId: eventId,
+          deletionEventId: result.eventId,
+          relay: result.relay,
+          groupId: result.groupId,
+        });
+      }
+
+      throw new Error(`Unsupported Nostr action: ${ctx.action}`);
+    },
+  };
+}

package/src/channel.dm-access.test.ts

@@ -0,0 +1,387 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createStartAccountContext } from "../test/helpers/extensions/start-account-context.js";
+import type { PluginRuntime } from "../runtime-api.js";
+import { getActiveNostrBuses, nostrPlugin } from "./channel.js";
+import { setNostrRuntime } from "./runtime.js";
+
+const SENDER = "bb".repeat(32);
+const OPERATOR = "aa".repeat(32);
+
+const mocks = vi.hoisted(() => ({
+  startNostrBus: vi.fn(),
+  createNip51FleetService: vi.fn(),
+  readNostrProfileState: vi.fn(async () => null),
+  writeNostrProfileState: vi.fn(async () => {}),
+}));
+
+vi.mock("./nostr-bus.js", () => ({
+  DEFAULT_RELAYS: ["wss://relay.example.com"],
+  getPublicKeyFromPrivate: vi.fn(() => "pubkey"),
+  normalizePubkey: vi.fn((value: string) => {
+    const cleaned = value.replace(/^nostr:/i, "").trim();
+    if (/^[0-9a-fA-F]{64}$/.test(cleaned)) return cleaned.toLowerCase();
+    throw new Error("invalid pubkey");
+  }),
+  startNostrBus: mocks.startNostrBus,
+}));
+
+vi.mock("./nip51-lists.js", () => ({
+  createNip51FleetService: mocks.createNip51FleetService,
+}));
+
+vi.mock("./nostr-state-store.js", () => ({
+  readNostrProfileState: mocks.readNostrProfileState,
+  writeNostrProfileState: mocks.writeNostrProfileState,
+}));
+
+type HarnessOptions = {
+  dmPolicy?: "pairing" | "allowlist" | "open" | "disabled";
+  allowFrom?: string[];
+  pairedPubkeys?: string[];
+  fleetTiers?: string[];
+  muted?: boolean;
+  pairingCreated?: boolean;
+  pairingUpsertError?: Error;
+  accountId?: string;
+};
+
+async function startDmHarness(options: HarnessOptions = {}) {
+  const accountId = options.accountId ?? "default";
+  const cfg = {
+    channels: {
+      nostr: {
+        privateKey: "resolved-nostr-private-key", // pragma: allowlist secret
+        dmPolicy: options.dmPolicy,
+        allowFrom: options.allowFrom,
+      },
+    },
+  };
+  const finalizeInboundContext = vi.fn((payload) => payload);
+  const dispatchReplyWithBufferedBlockDispatcher = vi.fn(async () => ({
+    queuedFinal: false,
+    counts: { tool: 0, block: 0, final: 0 },
+  }));
+  const readAllowFromStore = vi.fn(async () => options.pairedPubkeys ?? []);
+  const upsertPairingRequest = options.pairingUpsertError
+    ? vi.fn(async () => { throw options.pairingUpsertError; })
+    : vi.fn(async () => ({
+        code: "PAIR1234",
+        created: options.pairingCreated ?? true,
+      }));
+  const recordInboundSession = vi.fn(async () => undefined);
+
+  setNostrRuntime({
+    config: { loadConfig: vi.fn(() => cfg) },
+    channel: {
+      routing: {
+        resolveAgentRoute: vi.fn(() => ({
+          agentId: "main",
+          accountId,
+          sessionKey: `nostr:dm:${SENDER}`,
+        })),
+      },
+      reply: {
+        finalizeInboundContext,
+        resolveHumanDelayConfig: vi.fn(() => undefined),
+        dispatchReplyWithBufferedBlockDispatcher,
+      },
+      session: {
+        resolveStorePath: vi.fn(() => "/tmp/nostr-dm-access-sessions.json"),
+        recordInboundSession,
+      },
+      pairing: {
+        buildPairingReply: vi.fn(),
+        readAllowFromStore,
+        upsertPairingRequest,
+      },
+    },
+    reply: {},
+  } as unknown as PluginRuntime);
+
+  const directory = {
+    get: vi.fn((pubkey: string) => {
+      if (pubkey !== SENDER || !options.fleetTiers) return undefined;
+      return {
+        pubkey,
+        tiers: [...options.fleetTiers],
+        relayHints: [],
+        sources: [],
+        capabilities: [],
+      };
+    }),
+    list: vi.fn(() => []),
+    hasTier: vi.fn(() => false),
+    isMuted: vi.fn((pubkey: string) => pubkey === SENDER && options.muted === true),
+    subscribe: vi.fn(() => () => {}),
+  };
+  const nip51Service = {
+    publicKey: OPERATOR,
+    directory,
+    start: vi.fn(async () => ({ initialSync: "eose" as const })),
+    getRelaySet: vi.fn(),
+    subscribeRelaySets: vi.fn(() => () => {}),
+    replaceMuteList: vi.fn(),
+    setMuted: vi.fn(),
+    replaceTierMembers: vi.fn(),
+    replaceRelaySet: vi.fn(),
+    close: vi.fn(async () => {}),
+  };
+  mocks.createNip51FleetService.mockResolvedValueOnce(nip51Service);
+
+  const bus = {
+    sendDm: vi.fn(async () => ({ eventId: "dm-id", publishedEventIds: ["dm-id"] })),
+    sendGroupMessage: vi.fn(),
+    close: vi.fn(async () => {}),
+    getMetrics: vi.fn(() => ({ counters: {} })),
+    publishProfile: vi.fn(),
+    publishRelayList: vi.fn(async () => ({
+      eventId: "relay-list",
+      createdAt: 1,
+      successes: [],
+      failures: [],
+    })),
+    publishDmRelayList: vi.fn(async () => ({
+      eventId: "dm-relay-list",
+      createdAt: 1,
+      successes: [],
+      failures: [],
+    })),
+    getProfileState: vi.fn(async () => null),
+  };
+  mocks.startNostrBus.mockResolvedValueOnce(bus);
+
+  const abortController = new AbortController();
+  const startPromise = nostrPlugin.gateway!.startAccount!(
+    createStartAccountContext({
+      account: {
+        accountId,
+        enabled: true,
+        configured: true,
+        privateKey: "01".repeat(32), // pragma: allowlist secret
+        publicKey: OPERATOR,
+        relays: ["wss://relay.example.com"],
+        config: {
+          dmPolicy: options.dmPolicy,
+          allowFrom: options.allowFrom,
+        },
+        ...(options.fleetTiers || options.muted
+          ? {
+              nip51: {
+                enabled: true,
+                relays: ["wss://relay.example.com"],
+                capabilitySync: false,
+                initialSyncTimeoutMs: 1,
+                tiers: {},
+                relaySets: {},
+              },
+            }
+          : {}),
+      },
+      abortSignal: abortController.signal,
+    }),
+  );
+  await vi.waitFor(() => expect(getActiveNostrBuses().has(accountId)).toBe(true));
+  const onMessage = mocks.startNostrBus.mock.calls.at(-1)?.[0]?.onMessage;
+  if (!onMessage) throw new Error("expected onMessage handler");
+
+  return {
+    accountId,
+    abortController,
+    startPromise,
+    bus,
+    onMessage,
+    finalizeInboundContext,
+    dispatchReplyWithBufferedBlockDispatcher,
+    readAllowFromStore,
+    upsertPairingRequest,
+    recordInboundSession,
+  };
+}
+
+async function stopHarness(harness: Awaited<ReturnType<typeof startDmHarness>>) {
+  harness.abortController.abort();
+  await harness.startPromise;
+}
+
+describe("nostr inbound DM access enforcement", () => {
+  afterEach(() => {
+    mocks.startNostrBus.mockReset();
+    mocks.createNip51FleetService.mockReset();
+    mocks.readNostrProfileState.mockClear();
+    mocks.writeNostrProfileState.mockClear();
+  });
+
+  it("dispatches fleet members with tier-specific structured access context", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "disabled",
+      allowFrom: [OPERATOR],
+      fleetTiers: ["worker", "cascadia"],
+    });
+    const reply = vi.fn();
+
+    await harness.onMessage(SENDER, "fleet hello", reply, { protocol: "nip17" });
+
+    expect(harness.finalizeInboundContext).toHaveBeenCalledWith(expect.objectContaining({
+      Body: "fleet hello",
+      BodyForAgent: "fleet hello",
+      CommandAuthorized: false,
+      NostrAccessTier: "fleet",
+      NostrAccessSource: "nip51",
+      ConversationLabel: `${SENDER.slice(0, 16)} (fleet: cascadia, worker)`,
+      UntrustedStructuredContext: [expect.objectContaining({
+        label: "Nostr access",
+        payload: expect.objectContaining({
+          senderPubkey: SENDER,
+          tier: "fleet",
+          source: "nip51",
+          privileges: "fleet",
+          fleetTiers: ["cascadia", "worker"],
+        }),
+      })],
+    }));
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).toHaveBeenCalledTimes(1);
+    expect(harness.readAllowFromStore).not.toHaveBeenCalled();
+    await stopHarness(harness);
+  });
+
+  it("reports actual mute state when a concrete operator overrides mute", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "disabled",
+      allowFrom: [SENDER],
+      muted: true,
+    });
+
+    await harness.onMessage(SENDER, "operator hello", vi.fn(), { protocol: "nip17" });
+
+    expect(harness.finalizeInboundContext).toHaveBeenCalledWith(expect.objectContaining({
+      CommandAuthorized: true,
+      NostrAccessTier: "operator",
+      UntrustedStructuredContext: [expect.objectContaining({
+        payload: expect.objectContaining({
+          senderPubkey: SENDER,
+          tier: "operator",
+          privileges: "full",
+          muted: true,
+        }),
+      })],
+    }));
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).toHaveBeenCalledTimes(1);
+    await stopHarness(harness);
+  });
+
+  it("dispatches an approved pairing peer without operator privileges", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "pairing",
+      allowFrom: [OPERATOR],
+      pairedPubkeys: [SENDER],
+    });
+
+    await harness.onMessage(SENDER, "paired hello", vi.fn(), { protocol: "nip04" });
+
+    expect(harness.finalizeInboundContext).toHaveBeenCalledWith(expect.objectContaining({
+      Body: "paired hello",
+      BodyForAgent: "paired hello",
+      CommandAuthorized: false,
+      NostrAccessTier: "paired",
+      NostrAccessSource: "pairing-store",
+      ConversationLabel: `${SENDER.slice(0, 16)} (paired)`,
+    }));
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).toHaveBeenCalledTimes(1);
+    expect(harness.upsertPairingRequest).not.toHaveBeenCalled();
+    await stopHarness(harness);
+  });
+
+  it("uses the canonical pairing flow and does not dispatch an unknown sender", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "pairing",
+      allowFrom: [OPERATOR],
+      pairingCreated: true,
+    });
+    const reply = vi.fn(async () => {});
+
+    await expect(
+      harness.onMessage(SENDER, "unknown hello", reply, { protocol: "nip17" }),
+    ).resolves.toBeUndefined();
+
+    expect(harness.upsertPairingRequest).toHaveBeenCalledWith({
+      channel: "nostr",
+      accountId: "default",
+      id: SENDER,
+      meta: undefined,
+    });
+    expect(reply).toHaveBeenCalledTimes(1);
+    expect(reply.mock.calls[0]?.[0]).toContain("PAIR1234");
+    expect(harness.recordInboundSession).not.toHaveBeenCalled();
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).not.toHaveBeenCalled();
+    await stopHarness(harness);
+  });
+
+  it("does not repeat a pairing reply for an existing request", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "pairing",
+      allowFrom: [OPERATOR],
+      pairingCreated: false,
+    });
+    const reply = vi.fn();
+
+    await harness.onMessage(SENDER, "again", reply, { protocol: "nip17" });
+
+    expect(harness.upsertPairingRequest).toHaveBeenCalledTimes(1);
+    expect(reply).not.toHaveBeenCalled();
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).not.toHaveBeenCalled();
+    await stopHarness(harness);
+  });
+
+  it.each(["allowlist", "disabled"] as const)(
+    "silently handles unknown senders under %s without dispatch",
+    async (dmPolicy) => {
+      const harness = await startDmHarness({ dmPolicy, allowFrom: [OPERATOR] });
+      const reply = vi.fn();
+
+      await expect(
+        harness.onMessage(SENDER, "blocked", reply, { protocol: "nip17" }),
+      ).resolves.toBeUndefined();
+
+      expect(harness.readAllowFromStore).not.toHaveBeenCalled();
+      expect(harness.upsertPairingRequest).not.toHaveBeenCalled();
+      expect(reply).not.toHaveBeenCalled();
+      expect(harness.recordInboundSession).not.toHaveBeenCalled();
+      expect(harness.dispatchReplyWithBufferedBlockDispatcher).not.toHaveBeenCalled();
+      await stopHarness(harness);
+    },
+  );
+
+  it("handles pairing-store failures without dispatch or replay-triggering rejection", async () => {
+    const harness = await startDmHarness({
+      dmPolicy: "pairing",
+      allowFrom: [OPERATOR],
+      pairingUpsertError: new Error("store unavailable"),
+    });
+
+    await expect(
+      harness.onMessage(SENDER, "pair me", vi.fn(), { protocol: "nip17" }),
+    ).resolves.toBeUndefined();
+    expect(harness.dispatchReplyWithBufferedBlockDispatcher).not.toHaveBeenCalled();
+    await stopHarness(harness);
+  });
+
+  it("notifies approval through the requested account rather than the default account", async () => {
+    const harness = await startDmHarness({
+      accountId: "work",
+      dmPolicy: "allowlist",
+      allowFrom: [OPERATOR],
+    });
+
+    await nostrPlugin.pairing!.notifyApproval!({
+      cfg: { channels: { nostr: {} } },
+      id: SENDER,
+      accountId: "work",
+    });
+
+    expect(harness.bus.sendDm).toHaveBeenCalledWith(
+      SENDER,
+      "Your pairing request has been approved!",
+    );
+    await stopHarness(harness);
+  });
+});