Initial commit: OpenClaw Mattermost Extension

2026-04-10 21:57:29 -07:00
commit 2072259fb6
126 changed files with 26403 additions and 0 deletions
@@ -0,0 +1,71 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security
+
+## [1.0.0] - 2026-04-10
+
+### Added
+
+- **PAT (Personal Access Token) Support**: Dual token authentication with bot token for reads and PAT for writes
+- **Message Editing**: Edit bot messages with permission controls via `editMessage()` action
+- **Message Deletion**: Delete bot messages with safety checks via `deleteMessage()` action
+- **File Download**: Secure file download with MIME type validation, executable blocking, and size limits
+- **Interactive Directives**: Support for `[[mattermost_buttons: ...]]` and `[[mattermost_select: ...]]` syntax
+- **Security Audit**: Automated security configuration scanning with `collectMattermostSecurityAuditFindings()`
+- **Structured Error Handling**: Comprehensive error classes with context, retry logic, and user-friendly messages
+- **Automatic Retry Logic**: Exponential backoff with jitter for transient failures
+- **Rate Limit Handling**: Full support for Mattermost rate limiting with `Retry-After` header parsing
+- **SSRF Protection**: Guarded outbound requests with `fetchWithSsrFGuard`
+- **Multi-Account Support**: Configure multiple Mattermost accounts with `accounts` and `defaultAccount`
+- **Advanced Slash Commands**: Native and skill-based commands with callback configuration
+- **DM Channel Retry**: Configurable retry logic for DM channel creation
+- **Error Boundary**: Global error handling with `globalErrorBoundary`
+- **Group-Specific Settings**: Per-channel configuration via `groups` object
+
+### Security
+
+- HTTPS enforcement warnings for insecure configurations
+- IP allowlisting for interaction callbacks
+- Private network access controls
+- Hardcoded token detection in security audit
+- Mutable allowlist entry detection
+- Executable file blocking in downloads
+- Input validation for all user-provided parameters
+
+### Changed
+
+- Improved error messages with context and remediation hints
+- Enhanced configuration validation with Zod schemas
+- Better separation of concerns in client architecture
+- More comprehensive logging without exposing secrets
+
+## [0.1.0] - 2026-04-10
+
+### Added
+
+- Initial release of open-source
+- TypeScript support
+- Basic filtering functionality for OpenCode
+- Mattermost integration support
+- Development tooling (Vitest, TypeScript)
+
+[Unreleased]: https://github.com/lumbridgecorp/openclaw-extentions-mattermost/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/lumbridgecorp/openclaw-extentions-mattermost/releases/tag/v1.0.0
+[0.1.0]: https://github.com/lumbridgecorp/openclaw-extentions-mattermost/releases/tag/v0.1.0