openclaw-quiubo 2.6.24 → 2.6.27

package/README.md

@@ -323,6 +323,23 @@ src/
 | OpenClaw | `sendOpenclawResponse()` |
 | Webhooks | `configureWebhook()` |
 
+## Known Security Scanner Warnings
+
+When installing, OpenClaw's plugin scanner may flag two patterns. Both are false positives:
+
+- **"Shell command execution detected (child_process)"** — From `pusher-js`'s bundled XMLHttpRequest polyfill. This sync code path is never executed by the plugin.
+- **"Environment variable access combined with network send"** — The plugin reads `process.env.HOME` to locate `~/.openclaw/cron/` for persisting cursors and keys. No credentials flow through environment variables.
+
+To suppress the auto-load warning, add the plugin to your allowlist in `~/.openclaw/openclaw.json`:
+
+```json
+{
+  "plugins": {
+    "allow": ["openclaw-quiubo"]
+  }
+}
+```
+
 ## License
 
 MIT

package/dist/index.js

@@ -12882,7 +12882,8 @@ var RealtimeGateway = class {
             senderIdentityId: data.senderId,
             senderUsername: data.senderUsername,
             plaintext: data.plaintext,
-            createdAt: data.createdAt
+            createdAt: data.createdAt,
+            ...data.attachments?.length ? { attachments: data.attachments } : {}
           })).catch((err) => {
             log.error?.(`Failed to route Pusher message ${data.messageId}: ${err}`);
           });
@@ -12912,7 +12913,8 @@ var RealtimeGateway = class {
                   senderIdentityId: data.senderId,
                   senderUsername: data.senderUsername,
                   plaintext,
-                  createdAt: data.createdAt
+                  createdAt: data.createdAt,
+                  ...data.attachments?.length ? { attachments: data.attachments } : {}
                 }));
               } catch (decErr) {
                 log.error?.(`[e2ee:pusher] Decryption failed for message ${data.messageId} in group ${data.groupId}: ${decErr}`);
@@ -12968,7 +12970,8 @@ var RealtimeGateway = class {
         groupId,
         senderIdentityId: msg.senderIdentityId,
         plaintext: msg.plaintext,
-        createdAt: msg.createdAt
+        createdAt: msg.createdAt,
+        ...msg.attachments?.length ? { attachments: msg.attachments } : {}
       });
     } catch (error) {
       this.log.error?.(`Failed to fetch message ${messageId}:`, error);
@@ -13156,7 +13159,8 @@ var RealtimeGateway = class {
             groupId,
             senderIdentityId: msg.senderIdentityId,
             plaintext,
-            createdAt: msg.createdAt
+            createdAt: msg.createdAt,
+            ...msg.attachments?.length ? { attachments: msg.attachments } : {}
           });
         } catch (error) {
           this.log.error?.(`Failed to handle message ${msg.id}:`, error);
@@ -13348,7 +13352,7 @@ var quiuboPlugin = {
   },
   capabilities: {
     chatTypes: ["group"],
-    supportsMedia: false,
+    supportsMedia: true,
     supportsReactions: false,
     supportsThreads: false
   },
@@ -14225,8 +14229,14 @@ async function routeInboundMessage(opts) {
   const senderId = msg.senderIdentityId;
   const groupId = msg.groupId;
   let text = msg.plaintext ?? "";
+  const imageAttachments = (msg.attachments ?? []).filter(
+    (att) => att.storageUrl && att.mimeType?.startsWith("image/")
+  );
+  const mediaUrls = imageAttachments.map((att) => att.storageUrl);
+  const mediaTypes = imageAttachments.map((att) => att.mimeType);
   if (msg.attachments?.length) {
     for (const att of msg.attachments) {
+      if (att.storageUrl && att.mimeType?.startsWith("image/")) continue;
       const sizeKb = att.sizeBytes ? `${(att.sizeBytes / 1024).toFixed(1)} KB` : "";
       text += `
 
@@ -14263,7 +14273,11 @@ async function routeInboundMessage(opts) {
     Provider: CHANNEL_ID,
     Surface: CHANNEL_ID,
     MessageSid: `quiubo-${msg.messageId}`,
-    Timestamp: msg.createdAt ? new Date(msg.createdAt).getTime() : Date.now()
+    Timestamp: msg.createdAt ? new Date(msg.createdAt).getTime() : Date.now(),
+    ...mediaUrls.length > 0 && {
+      MediaUrls: mediaUrls,
+      MediaTypes: mediaTypes
+    }
   });
   try {
     await runtime2.channel.reply.dispatchReplyWithBufferedBlockDispatcher({