feat(channels): add Synology Chat native channel#23012
feat(channels): add Synology Chat native channel#23012steipete merged 2 commits intoopenclaw:mainfrom
Conversation
Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
| incomingUrl: string, | ||
| text: string, | ||
| userId?: string | number, | ||
| allowInsecureSsl = true, |
There was a problem hiding this comment.
allowInsecureSsl defaults to true here but false in accounts.ts:85. This means SSL verification is disabled by default when the parameter isn't explicitly passed, creating a security risk.
| allowInsecureSsl = true, | |
| allowInsecureSsl = false, |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/synology-chat/src/client.ts
Line: 24
Comment:
`allowInsecureSsl` defaults to `true` here but `false` in `accounts.ts:85`. This means SSL verification is disabled by default when the parameter isn't explicitly passed, creating a security risk.
```suggestion
allowInsecureSsl = false,
```
How can I resolve this? If you propose a fix, please make it concise.| incomingUrl: string, | ||
| fileUrl: string, | ||
| userId?: string | number, | ||
| allowInsecureSsl = true, |
There was a problem hiding this comment.
Same issue: allowInsecureSsl defaults to true instead of false.
| allowInsecureSsl = true, | |
| allowInsecureSsl = false, |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/synology-chat/src/client.ts
Line: 74
Comment:
Same issue: `allowInsecureSsl` defaults to `true` instead of `false`.
```suggestion
allowInsecureSsl = false,
```
How can I resolve this? If you propose a fix, please make it concise.| } | ||
| } | ||
|
|
||
| function doPost(url: string, body: string, allowInsecureSsl = true): Promise<boolean> { |
There was a problem hiding this comment.
Same issue: allowInsecureSsl defaults to true instead of false.
| function doPost(url: string, body: string, allowInsecureSsl = true): Promise<boolean> { | |
| function doPost(url: string, body: string, allowInsecureSsl = false): Promise<boolean> { |
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/synology-chat/src/client.ts
Line: 95
Comment:
Same issue: `allowInsecureSsl` defaults to `true` instead of `false`.
```suggestion
function doPost(url: string, body: string, allowInsecureSsl = false): Promise<boolean> {
```
How can I resolve this? If you propose a fix, please make it concise.| "id": "synology-chat", | ||
| "label": "Synology Chat", | ||
| "selectionLabel": "Synology Chat (Webhook)", | ||
| "docsPath": "/channels/synology-chat", |
There was a problem hiding this comment.
The docsPath references /channels/synology-chat but docs/channels/synology-chat.md doesn't exist. Per AGENTS.md:18, channel docs should be created alongside the extension.
Prompt To Fix With AI
This is a comment left during a code review.
Path: extensions/synology-chat/package.json
Line: 18
Comment:
The `docsPath` references `/channels/synology-chat` but `docs/channels/synology-chat.md` doesn't exist. Per AGENTS.md:18, channel docs should be created alongside the extension.
How can I resolve this? If you propose a fix, please make it concise.There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 75c56100d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| return setAccountEnabledInConfigSection({ | ||
| cfg, | ||
| sectionKey: `channels.${CHANNEL_ID}`, |
There was a problem hiding this comment.
Use channel key (not channels-prefixed path) for account toggles
setAccountEnabledInConfigSection reads/writes cfg.channels[sectionKey] (see src/channels/plugins/config-helpers.ts), but this call passes sectionKey: \channels.${CHANNEL_ID}`. For non-default accounts, enable/disable updates are written to cfg.channels["channels.synology-chat"]instead ofcfg.channels["synology-chat"]`, so the actual account state is not changed and a malformed config key is introduced.
Useful? React with 👍 / 👎.
| textChunkLimit: 2000, | ||
|
|
||
| sendText: async ({ to, text, accountId, account: ctxAccount }: any) => { | ||
| const account: ResolvedSynologyChatAccount = ctxAccount ?? resolveAccount({}, accountId); |
There was a problem hiding this comment.
Resolve outbound account from runtime config, not empty object
The outbound adapter is invoked with cfg and accountId (not a populated account field) by the delivery pipeline (ChannelOutboundContext + src/infra/outbound/deliver.ts). Falling back to resolveAccount({}, accountId) therefore ignores channels.synology-chat configuration and only uses env defaults, which makes normal config-based sends fail as "incoming URL not configured".
Useful? React with 👍 / 👎.
| deliver: async (payload: { text?: string; body?: string }) => { | ||
| const text = payload?.text ?? payload?.body; | ||
| if (text) { | ||
| await sendMessage( |
There was a problem hiding this comment.
Treat failed Synology reply sends as errors in dispatcher callback
sendMessage returns false on HTTP failure/timeout, but this callback ignores that boolean and always resolves. When Synology rejects a reply, the dispatcher path still appears successful, so replies can be silently dropped without triggering the surrounding error handling or retries.
Useful? React with 👍 / 👎.
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…dit, exec sandbox, channel fallback, session path, test perf Key upstream changes: - fix(telegram): classify undici fetch errors as recoverable for retry (openclaw#16699) - fix(telegram): prevent update offset skipping queued updates (openclaw#23284) - fix: stop hardcoded channel fallback and auto-pick sole configured channel (openclaw#23357) - fix(session): resolve agent session path with configured sessions dir - fix: harden exec sandbox fallback semantics (openclaw#23398) - fix: land security audit severity + temp-path guard fixes (openclaw#23428) - Security: expand audit checks for mDNS and real-IP fallback - feat(feishu): persistent message deduplication - feat(channels): add Synology Chat native channel (openclaw#23012) - feat: add Korean language support for memory search - refactor(bluebubbles): centralize private-api status handling - refactor(session): centralize transcript path option resolution - 137 perf/refactor commits (test reclassification, e2e speedups) - chore: remove verified dead code paths Conflicts resolved (38 files): - 4 modify/delete: accepted upstream deletions of dead code - 34 content: import ordering/additions merged with deduplication
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> (cherry picked from commit 03586e3)
(cherry picked from commit 780bbbd) # Conflicts: # src/agents/google-gemini-switch.live.test.ts
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> (cherry picked from commit 03586e3)
(cherry picked from commit 780bbbd) # Conflicts: # src/agents/google-gemini-switch.live.test.ts
* feat(channels): add Synology Chat native channel Webhook-based integration with Synology NAS Chat (DSM 7+). Supports outgoing webhooks, incoming messages, multi-account, DM policies, rate limiting, and input sanitization. - HMAC-based constant-time token validation - Configurable SSL verification (allowInsecureSsl) for self-signed NAS certs - 54 unit tests across 5 test suites - Follows the same ChannelPlugin pattern as LINE/Discord/Telegram * feat(synology-chat): add pairing, warnings, messaging, agent hints - Enable media capability (file_url already supported by client) - Add pairing.notifyApproval to message approved users - Add security.collectWarnings for missing token/URL, insecure SSL, open DM policy - Add messaging.normalizeTarget and targetResolver for user ID resolution - Add directory stubs (self, listPeers, listGroups) - Add agentPrompt.messageToolHints with Synology Chat formatting guide - 63 tests (up from 54), all passing ---------
Summary
synology-chatchannel plugin inextensions/synology-chat/(15 source files, ~1700 lines)Change Type
Scope
Architecture
Follows the exact same
ChannelPluginpattern as LINE/Discord/Telegram extensions:index.ts— Plugin entry point, registers channel viaapi.registerChannel()src/channel.ts— ChannelPlugin implementation (meta, config, security, outbound, gateway)src/webhook-handler.ts— Incoming webhook HTTP handler (form-urlencoded payloads)src/client.ts— Outbound HTTP client for Synology Chat incoming webhook APIsrc/security.ts— Token validation (HMAC-based constant-time), rate limiting, input sanitizationsrc/accounts.ts— Multi-account config resolution with env var fallbackssrc/types.ts— TypeScript interfacessrc/runtime.ts— Plugin runtime accessorUser-visible / Behavior Changes
channels.synology-chatin openclaw.jsonSYNOLOGY_CHAT_TOKEN,SYNOLOGY_CHAT_INCOMING_URL)Security Impact
process.envat runtimecrypto.createHmac+crypto.timingSafeEqual)allowInsecureSsl, defaultfalse) for self-signed NAS certsTest Coverage
54 unit tests across 5 test suites:
security.test.ts(17 tests) — token validation, user allowlist, input sanitization, rate limiteraccounts.test.ts(11 tests) — config resolution, env var fallback, multi-account mergewebhook-handler.test.ts(9 tests) — HTTP methods, auth, rate limiting, trigger words, async deliveryclient.test.ts(5 tests) — send/retry, file URL, userId handlingchannel.test.ts(12 tests) — plugin structure, outbound, gateway lifecycleRepro + Verification
SYNOLOGY_CHAT_TOKENandSYNOLOGY_CHAT_INCOMING_URLin environment"channels": { "synology-chat": { "enabled": true } }Human Verification
Compatibility / Migration
channels.synology-chatconfig sectionFailure Recovery
"channels": { "synology-chat": { "enabled": false } }extensions/synology-chat/directory🤖 Generated with Claude Code
Greptile Summary
Adds a new Synology Chat channel plugin following the established channel plugin pattern. The implementation includes webhook-based messaging, security features (token validation, rate limiting, input sanitization), and comprehensive test coverage (54 tests).
Major additions:
extensions/synology-chat/with ~1700 lines across 15 filesIssues found:
allowInsecureSsldefaults totrueinclient.tsfunction parameters butfalsein account resolution, causing SSL verification to be disabled by default when the parameter isn't explicitly passeddocs/channels/synology-chat.md) referenced in package.json.github/labeler.ymlentry (required per AGENTS.md:18)Confidence Score: 3/5
allowInsecureSslparameter defaulting totruein three locations creates a security vulnerability where SSL verification could be disabled unintentionally. Additionally, missing documentation and labeler configuration need to be addressed per repository guidelines.extensions/synology-chat/src/client.ts- the SSL verification defaults must be correctedLast reviewed commit: 75c5610
(2/5) Greptile learns from your feedback when you react with thumbs up/down!