mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 14:30:42 +00:00

Files

Cole Tebou 60406d0e60 feat(bluebubbles): promote attachment download errors to runtime.error and redact secrets in logs

Carries forward two BlueBubbles observability/security fixes from #73241
so this PR is a strict superset of the competing implementation.

- Promote attachment download failures from logVerbose to runtime.error
  alongside a verbose copy. Previously, BB attachment download failures
  (pinned-dispatcher compat bugs, BB server 500s, transient network
  errors) were invisible at default log level — agents only saw the
  `<media:image> (1 image)` placeholder text with nothing in the log
  pointing at the actual failure.
- Extend sanitizeForLog to redact `?password=…` / `?token=…` /
  `?api_key=…` / `?secret=…` query params and `Authorization: Bearer …`
  headers before they reach the log sink. BB uses query-string auth by
  default, so error chains carrying captured request URLs were
  vulnerable to leaking the API password into log aggregators
  (CWE-532).
- Move the changelog entry to the bottom of `## Unreleased` →
  `### Changes`. Insertions at the top of that section are the most
  common cause of CHANGELOG conflicts on long-lived PRs; bottom
  position keeps the diff context stable.

Both behavioral changes originated in @zqchris's PR #73241; attribution
preserved in the CHANGELOG entry.

2026-05-01 04:51:29 +00:00

src

feat(bluebubbles): promote attachment download errors to runtime.error and redact secrets in logs

2026-05-01 04:51:29 +00:00

api.ts

refactor: pin remaining extension api surfaces

2026-04-27 21:02:53 +01:00

channel-config-api.ts

refactor: move channel config metadata into plugin-owned manifests

2026-03-27 01:59:30 +00:00

channel-plugin-api.ts

perf(channels): narrow slow bundled channel entry imports

2026-04-20 22:34:11 +01:00

contract-api.ts

Tests: narrow session binding contract setup

2026-04-17 03:36:13 -04:00

doctor-contract-api.ts

fix(plugins): prune inactive bundled runtime deps

2026-04-28 10:34:24 +01:00

index.ts

perf(channels): narrow slow bundled channel entry imports

2026-04-20 22:34:11 +01:00

openclaw.plugin.json

perf: mark channel plugins startup lazy

2026-04-28 04:33:47 +01:00

package.json

chore: bump version to 2026.4.25

2026-04-25 10:31:52 +01:00

README.md

refactor(plugins): decouple bundled plugin runtime loading

2026-03-29 09:10:38 +01:00

runtime-api.ts

refactor: clean bundled channel bootstrap boundaries

2026-04-05 18:18:59 +01:00

secret-contract-api.ts

fix: repair bundled channel secret sidecars

2026-04-08 04:56:58 +01:00

setup-entry.ts

fix: repair bundled channel secret sidecars

2026-04-08 04:56:58 +01:00

tsconfig.json

chore(plugins): bulk add package boundary tsconfig rollout

2026-04-07 08:48:23 +01:00

README.md

BlueBubbles extension (developer reference)

This package contains the BlueBubbles external channel plugin for OpenClaw.

If you’re looking for how to use BlueBubbles as an agent/tool user, see:

skills/bluebubbles/SKILL.md

Layout

Package entry: index.ts.
Channel implementation: src/channel.ts.
Webhook handling: src/monitor.ts (register per-account route via registerPluginHttpRoute).
REST helpers: src/send.ts + src/probe.ts.
Runtime bridge: src/runtime.ts (set via api.runtime).
Catalog entry for setup selection: src/channels/plugins/catalog.ts.

Internal helpers (use these, not raw API calls)

probeBlueBubbles in src/probe.ts for health checks.
sendMessageBlueBubbles in src/send.ts for text delivery.
resolveChatGuidForTarget in src/send.ts for chat lookup.
sendBlueBubblesReaction in src/reactions.ts for tapbacks.
sendBlueBubblesTyping + markBlueBubblesChatRead in src/chat.ts.
downloadBlueBubblesAttachment in src/attachments.ts for inbound media.
buildBlueBubblesApiUrl + blueBubblesFetchWithTimeout in src/types.ts for shared REST plumbing.

Webhooks

BlueBubbles posts JSON to the gateway HTTP server.
Normalize sender/chat IDs defensively (payloads vary by version).
Skip messages marked as from self.
Route into core reply pipeline via the plugin runtime (api.runtime) and openclaw/plugin-sdk helpers.
For attachments/stickers, use <media:...> placeholders when text is empty and attach media paths via MediaUrl(s) in the inbound context.

Config (core)

channels.bluebubbles.serverUrl (base URL), channels.bluebubbles.password, channels.bluebubbles.webhookPath.
Action gating: channels.bluebubbles.actions.reactions (default true).

Message tool notes

Reactions: the react action requires a target (phone number or chat identifier) in addition to messageId. Example: action=react target=+15551234567 messageId=ABC123 emoji=❤️

README.md Unescape Escape

BlueBubbles extension (developer reference)

Layout

Internal helpers (use these, not raw API calls)

Webhooks

Config (core)

Message tool notes

README.md