openclaw-quiubo 2.6.25 → 2.6.27

package/README.md

@@ -323,6 +323,23 @@ src/
 | OpenClaw | `sendOpenclawResponse()` |
 | Webhooks | `configureWebhook()` |
 
+## Known Security Scanner Warnings
+
+When installing, OpenClaw's plugin scanner may flag two patterns. Both are false positives:
+
+- **"Shell command execution detected (child_process)"** — From `pusher-js`'s bundled XMLHttpRequest polyfill. This sync code path is never executed by the plugin.
+- **"Environment variable access combined with network send"** — The plugin reads `process.env.HOME` to locate `~/.openclaw/cron/` for persisting cursors and keys. No credentials flow through environment variables.
+
+To suppress the auto-load warning, add the plugin to your allowlist in `~/.openclaw/openclaw.json`:
+
+```json
+{
+  "plugins": {
+    "allow": ["openclaw-quiubo"]
+  }
+}
+```
+
 ## License
 
 MIT

package/dist/index.js

@@ -12882,7 +12882,8 @@ var RealtimeGateway = class {
             senderIdentityId: data.senderId,
             senderUsername: data.senderUsername,
             plaintext: data.plaintext,
-            createdAt: data.createdAt
+            createdAt: data.createdAt,
+            ...data.attachments?.length ? { attachments: data.attachments } : {}
           })).catch((err) => {
             log.error?.(`Failed to route Pusher message ${data.messageId}: ${err}`);
           });
@@ -12912,7 +12913,8 @@ var RealtimeGateway = class {
                   senderIdentityId: data.senderId,
                   senderUsername: data.senderUsername,
                   plaintext,
-                  createdAt: data.createdAt
+                  createdAt: data.createdAt,
+                  ...data.attachments?.length ? { attachments: data.attachments } : {}
                 }));
               } catch (decErr) {
                 log.error?.(`[e2ee:pusher] Decryption failed for message ${data.messageId} in group ${data.groupId}: ${decErr}`);
@@ -12968,7 +12970,8 @@ var RealtimeGateway = class {
         groupId,
         senderIdentityId: msg.senderIdentityId,
         plaintext: msg.plaintext,
-        createdAt: msg.createdAt
+        createdAt: msg.createdAt,
+        ...msg.attachments?.length ? { attachments: msg.attachments } : {}
       });
     } catch (error) {
       this.log.error?.(`Failed to fetch message ${messageId}:`, error);
@@ -13156,7 +13159,8 @@ var RealtimeGateway = class {
             groupId,
             senderIdentityId: msg.senderIdentityId,
             plaintext,
-            createdAt: msg.createdAt
+            createdAt: msg.createdAt,
+            ...msg.attachments?.length ? { attachments: msg.attachments } : {}
           });
         } catch (error) {
           this.log.error?.(`Failed to handle message ${msg.id}:`, error);