mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-16 01:21:31 +00:00
77d9fd693f
* fix(bluebubbles): restore inbound image attachments and accept updated-message events Four interconnected fixes for BlueBubbles inbound media: 1. Strip bundled-undici dispatcher from non-SSRF fetch path so attachment downloads no longer silently fail on Node 22+ (#64105, #61861) 2. Accept updated-message webhook events that carry attachments instead of filtering them as non-reaction events (#65430) 3. Include eventType in the persistent GUID dedup key so updated-message follow-ups are not rejected as duplicates of the original new-message (#52277) 4. Retry attachment fetch from BB API (2s delay) when the initial webhook arrives with an empty attachments array — image-only messages and updated-message events only (#67437) Closes #64105, closes #61861, closes #65430. * fix(bluebubbles): resolve review findings — SSRF policy, reuse extractAttachments, add tests - F1 (BLOCKER): pass undefined instead of {} for SSRF policy when allowPrivateNetwork is false, so localhost BB servers are not blocked. - F2 (IMPORTANT): reuse exported extractAttachments() from monitor-normalize instead of duplicating field extraction logic. - F3 (IMPORTANT): simplify asRecord(asRecord(payload)?.data) to asRecord(payload.data) since payload is already Record<string, unknown>. - F4 (NIT): bind retryMessageId before the guard to eliminate non-null assertion. - F5 (IMPORTANT): add 4 tests for fetchBlueBubblesMessageAttachments covering success, non-ok HTTP, empty data, and guid-less entries. - Add CHANGELOG entry for the user-facing fix. * fix(ci): update raw-fetch allowlist line number after dispatcher strip * fix(bluebubbles): resolve PR review findings (#67510) - monitor-processing: move attachment retry into the !rawBody guard so image-only new-message events that arrive with empty attachments and empty text are recovered via a BB API refetch before being dropped. The existing retry block at the end of processMessageAfterDedupe was unreachable for this case because the !rawBody early-return fired first. (Greptile) - monitor: derive isAttachmentUpdate from the normalized message shape instead of raw payload.data.attachments so updated-message webhooks with attachments under wrapper formats (payload.message, JSON-string payloads) are correctly routed through for processing instead of silently filtered. (Codex) - types: use bundled-undici fetch when init.dispatcher is present so the SSRF guard's DNS-pinning dispatcher is preserved when this function is called as fetchImpl from guarded callers (e.g. the attachment download path via fetchRemoteMedia). Falls back to globalThis.fetch when no dispatcher is present so tests that stub globalThis.fetch keep working. (Codex) - attachments: blueBubblesPolicy returns undefined for the non-private case (matching monitor-processing's helper) so sendBlueBubblesAttachment stops routing localhost BB through the SSRF guard. (Greptile) - scripts/check-no-raw-channel-fetch: bump the types.ts allowlist line to match the restructured non-SSRF branch. * fix(bluebubbles): move attachment retry before rawBody guard, fix stale log Move the attachment retry block (2s BB API refetch for empty attachments) before the !rawBody early-return guard. Previously, image-only messages with text='' and attachments=[] would be dropped by the !rawBody check before the retry could fire, making fix #4 dead code for its primary use-case. Now the retry runs first and recomputes the placeholder from resolved attachments so rawBody becomes non-empty when media is found. Also fix stale log message that still said 'without reaction' after the filter was expanded to pass through attachment updates. * fix(bluebubbles): revert undici import, restore dispatcher-strip approach Revert the @claude bot's undici import in types.ts — it introduced a direct 'undici' dependency that is not declared in the BB extension's package.json and would break isolated plugin installs. Restore the original dispatcher-strip approach which is correct: the SSRF guard already completed validation upstream before calling this function as fetchImpl, so stripping the dispatcher does not weaken security. * fix(bluebubbles): remove dead empty-body recovery block in !rawBody guard The empty-body attachment-recovery block added in the earlier PR revision is now redundant because the main retry block was moved above the rawBody computation in |
||
|---|---|---|
| .. | ||
| test-support | ||
| account-resolve.test.ts | ||
| account-resolve.ts | ||
| accounts-normalization.ts | ||
| accounts.ts | ||
| actions-api.ts | ||
| actions-contract.ts | ||
| actions.runtime.ts | ||
| actions.test.ts | ||
| actions.ts | ||
| attachments.test.ts | ||
| attachments.ts | ||
| catchup.test.ts | ||
| catchup.ts | ||
| channel-shared.ts | ||
| channel.pairing.test.ts | ||
| channel.runtime.ts | ||
| channel.setup.ts | ||
| channel.status.test.ts | ||
| channel.ts | ||
| chat.test.ts | ||
| chat.ts | ||
| config-apply.ts | ||
| config-schema.ts | ||
| config-ui-hints.ts | ||
| conversation-bindings.test.ts | ||
| conversation-bindings.ts | ||
| conversation-id.ts | ||
| conversation-route.test.ts | ||
| conversation-route.ts | ||
| doctor-contract.ts | ||
| doctor.test.ts | ||
| doctor.ts | ||
| group-policy.ts | ||
| history.ts | ||
| inbound-dedupe.test.ts | ||
| inbound-dedupe.ts | ||
| local-file-access.ts | ||
| media-send.test.ts | ||
| media-send.ts | ||
| monitor-debounce.ts | ||
| monitor-normalize.test.ts | ||
| monitor-normalize.ts | ||
| monitor-processing-api.ts | ||
| monitor-processing.ts | ||
| monitor-reply-cache.ts | ||
| monitor-self-chat-cache.test.ts | ||
| monitor-self-chat-cache.ts | ||
| monitor-shared.ts | ||
| monitor.test.ts | ||
| monitor.ts | ||
| monitor.webhook-auth.test.ts | ||
| monitor.webhook.test-helpers.ts | ||
| multipart.ts | ||
| pairing.ts | ||
| participant-contact-names.test.ts | ||
| participant-contact-names.ts | ||
| probe.ts | ||
| reactions.test.ts | ||
| reactions.ts | ||
| request-url.ts | ||
| runtime-api.ts | ||
| runtime.ts | ||
| secret-contract.ts | ||
| secret-input.ts | ||
| send-helpers.ts | ||
| send.test.ts | ||
| send.ts | ||
| session-route.ts | ||
| setup-core.ts | ||
| setup-surface.test.ts | ||
| setup-surface.ts | ||
| status-issues.test.ts | ||
| status-issues.ts | ||
| targets.ts | ||
| test-harness.ts | ||
| test-mocks.ts | ||
| types.ts | ||
| webhook-ingress.ts | ||
| webhook-shared.ts | ||