mirror of https://github.com/openclaw/openclaw.git synced 2026-02-09 05:19:32 +08:00

Files

Tyler Yust 1007d71f0c fix: comprehensive BlueBubbles and channel cleanup (#11093 )

* feat(bluebubbles): auto-strip markdown from outbound messages (#7402)

* fix(security): add timeout to webhook body reading (#6762)

Adds 30-second timeout to readBody() in voice-call, bluebubbles, and nostr
webhook handlers. Prevents Slow-Loris DoS (CWE-400, CVSS 7.5).
Merged with existing maxBytes protection in voice-call.

* fix(security): unify Error objects and lint fixes in webhook timeouts (#6762)

* fix: prevent plugins from auto-enabling without user consent (#3961)

Changes default plugin enabled state from true to false in enablePluginEntry().
Preserves existing enabled:true values. Fixes #3932.

* fix: apply hierarchical mediaMaxMb config to all channels (#8749)

Generalizes resolveAttachmentMaxBytes() to use account → channel → global
config resolution for all channels, not just BlueBubbles. Fixes #7847.

* fix(bluebubbles): sanitize attachment filenames against header injection (#10333)

Strip ", \r, \n, and \\ from filenames after path.basename() to prevent
multipart Content-Disposition header injection (CWE-93, CVSS 5.4).
Also adds sanitization to setGroupIconBlueBubbles which had zero filename
sanitization.

* fix(lint): exclude extensions/ from Oxlint preflight check (#9313)

Extensions use PluginRuntime|null patterns that trigger
no-redundant-type-constituents because PluginRuntime resolves to any.
Excluding extensions/ from Oxlint unblocks user upgrades.
Re-applies the approach from closed PR #10087.

* fix(bluebubbles): add tempGuid to createNewChatWithMessage payload (#7745)

Non-Private-API mode (AppleScript) requires tempGuid in send payloads.
The main sendMessageBlueBubbles already had it, but createNewChatWithMessage
was missing it, causing 400 errors for new chat creation without Private API.

* fix: send stop-typing signal when run ends with NO_REPLY (#8785)

Adds onCleanup callback to the typing controller that fires when the
controller is cleaned up while typing was active (e.g., after NO_REPLY).
Channels using createTypingCallbacks automatically get stop-typing on
cleanup. This prevents the typing indicator from lingering in group chats
when the agent decides not to reply.

* fix(telegram): deduplicate skill commands in multi-agent setup (#5717)

Two fixes:
1. Skip duplicate workspace dirs when listing skill commands across agents.
   Multiple agents sharing the same workspace would produce duplicate commands
   with _2, _3 suffixes.
2. Clear stale commands via deleteMyCommands before registering new ones.
   Commands from deleted skills now get cleaned up on restart.

* fix: add size limits to unbounded in-memory caches (#4948)

Adds max-size caps with oldest-entry eviction to prevent OOM in
long-running deployments:
- BlueBubbles serverInfoCache: 64 entries (already has TTL)
- Google Chat authCache: 32 entries
- Matrix directRoomCache: 1024 entries
- Discord presenceCache: 5000 entries per account

* fix: address review concerns (#11093)

- Chain deleteMyCommands → setMyCommands to prevent race condition (#5717)
- Rename enablePluginEntry to registerPluginEntry (now sets enabled: false)
- Add Slow-Loris timeout test for readJsonBody (#6023)

2026-02-07 05:00:55 -08:00

src

fix: comprehensive BlueBubbles and channel cleanup (#11093 )

2026-02-07 05:00:55 -08:00

index.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

openclaw.plugin.json

chore: Run pnpm format:fix.

2026-01-31 21:13:13 +09:00

package.json

chore(release): 2026.2.6-3

2026-02-07 00:44:32 -08:00

README.md

iMessage: promote BlueBubbles and refresh docs/skills (#8415 )

2026-02-03 18:06:54 -08:00

README.md

BlueBubbles extension (developer reference)

This directory contains the BlueBubbles external channel plugin for OpenClaw.

If you’re looking for how to use BlueBubbles as an agent/tool user, see:

skills/bluebubbles/SKILL.md

Layout

Extension package: extensions/bluebubbles/ (entry: index.ts).
Channel implementation: extensions/bluebubbles/src/channel.ts.
Webhook handling: extensions/bluebubbles/src/monitor.ts (register via api.registerHttpHandler).
REST helpers: extensions/bluebubbles/src/send.ts + extensions/bluebubbles/src/probe.ts.
Runtime bridge: extensions/bluebubbles/src/runtime.ts (set via api.runtime).
Catalog entry for onboarding: src/channels/plugins/catalog.ts.

Internal helpers (use these, not raw API calls)

probeBlueBubbles in extensions/bluebubbles/src/probe.ts for health checks.
sendMessageBlueBubbles in extensions/bluebubbles/src/send.ts for text delivery.
resolveChatGuidForTarget in extensions/bluebubbles/src/send.ts for chat lookup.
sendBlueBubblesReaction in extensions/bluebubbles/src/reactions.ts for tapbacks.
sendBlueBubblesTyping + markBlueBubblesChatRead in extensions/bluebubbles/src/chat.ts.
downloadBlueBubblesAttachment in extensions/bluebubbles/src/attachments.ts for inbound media.
buildBlueBubblesApiUrl + blueBubblesFetchWithTimeout in extensions/bluebubbles/src/types.ts for shared REST plumbing.

Webhooks

BlueBubbles posts JSON to the gateway HTTP server.
Normalize sender/chat IDs defensively (payloads vary by version).
Skip messages marked as from self.
Route into core reply pipeline via the plugin runtime (api.runtime) and openclaw/plugin-sdk helpers.
For attachments/stickers, use <media:...> placeholders when text is empty and attach media paths via MediaUrl(s) in the inbound context.

Config (core)

channels.bluebubbles.serverUrl (base URL), channels.bluebubbles.password, channels.bluebubbles.webhookPath.
Action gating: channels.bluebubbles.actions.reactions (default true).

Message tool notes

Reactions: the react action requires a target (phone number or chat identifier) in addition to messageId. Example: action=react target=+15551234567 messageId=ABC123 emoji=❤️

README.md Unescape Escape

BlueBubbles extension (developer reference)

Layout

Internal helpers (use these, not raw API calls)

Webhooks

Config (core)

Message tool notes

README.md