ClawHub
Code Pluginsource linkedVerified

Openclaw Bluebubbles 2026.5.7.Tgzv2026.5.7

OpenClaw BlueBubbles channel plugin

@openclaw/bluebubbles·runtime bluebubbles·by @openclaw
openclaw plugins install clawhub:@openclaw/bluebubbles
Latest release: v2026.5.7Download zip

Compatibility

Built With Open Claw Version
2026.5.7
Min Gateway Version
>=2026.4.10
Plugin Api Range
>=2026.5.7
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The package purpose, manifest, README, and code align around a BlueBubbles channel plugin. It can send, edit, unsend, react, attach media, and manage group chats, which is high-impact but expected for an iMessage bridge.
ℹ
Instruction Scope
Capabilities are visible in the schema and runtime code, including webhooks, catchup replay, sender policies, local media roots, and optional Contacts enrichment. The top-level README is brief, so users should review configuration defaults.
✓
Install Mechanism
The npm package contains bundled plugin files and no install-time lifecycle scripts or hidden installer behavior.
ℹ
Credentials
The plugin requires a BlueBubbles server URL and password and may contact private-network hosts when configured. This is proportionate for a local BlueBubbles integration and is guarded by explicit configuration.
ℹ
Persistence & Privilege
It registers authenticated webhook routes and writes bounded dedupe/catchup cursor state under the OpenClaw state directory. This persistence supports message delivery and replay rather than unrelated background behavior.
Scan Findings in Context
[suspicious.dangerous_exec] expected: The cited scanner evidence was a regex .exec call, not shell execution. The artifact does import execFile, but it is used to call sqlite3 with fixed arguments for optional macOS Contacts name enrichment, which is purpose-aligned and not arbitrary command execution.
[suspicious.exposed_secret_literal] expected: The cited password occurrences are schema and runtime handling for the configured BlueBubbles password; no hardcoded secret or credential leak was found.
Assessment
Install this only if you want OpenClaw to access and act through your BlueBubbles/iMessage account. Store the BlueBubbles password as a secret, restrict allowed senders and group policies, disable message or group actions you do not need, and review catchup, private-network, local media, and Contacts enrichment settings before enabling it.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Source
github.com/openclaw/openclaw
Commit
eeef4864494f
Tag
refs/heads/release/2026.5.7
Provenance
No
Scan status
clean

Tags

beta
2026.5.6-beta.1
latest
2026.5.7

BlueBubbles extension (developer reference)

This package contains the BlueBubbles external channel plugin for OpenClaw.

If you’re looking for how to use BlueBubbles as an agent/tool user, see:

  • skills/bluebubbles/SKILL.md

Layout

  • Package entry: index.ts.
  • Channel implementation: src/channel.ts.
  • Webhook handling: src/monitor.ts (register per-account route via registerPluginHttpRoute).
  • REST helpers: src/send.ts + src/probe.ts.
  • Runtime bridge: src/runtime.ts (set via api.runtime).
  • Catalog entry for setup selection: src/channels/plugins/catalog.ts.

Internal helpers (use these, not raw API calls)

  • probeBlueBubbles in src/probe.ts for health checks.
  • sendMessageBlueBubbles in src/send.ts for text delivery.
  • resolveChatGuidForTarget in src/send.ts for chat lookup.
  • sendBlueBubblesReaction in src/reactions.ts for tapbacks.
  • sendBlueBubblesTyping + markBlueBubblesChatRead in src/chat.ts.
  • downloadBlueBubblesAttachment in src/attachments.ts for inbound media.
  • buildBlueBubblesApiUrl + blueBubblesFetchWithTimeout in src/types.ts for shared REST plumbing.

Webhooks

  • BlueBubbles posts JSON to the gateway HTTP server.
  • Normalize sender/chat IDs defensively (payloads vary by version).
  • Skip messages marked as from self.
  • Route into core reply pipeline via the plugin runtime (api.runtime) and openclaw/plugin-sdk helpers.
  • For attachments/stickers, use <media:...> placeholders when text is empty and attach media paths via MediaUrl(s) in the inbound context.

Config (core)

  • channels.bluebubbles.serverUrl (base URL), channels.bluebubbles.password, channels.bluebubbles.webhookPath.
  • Action gating: channels.bluebubbles.actions.reactions (default true).

Message tool notes

  • Reactions: the react action requires a target (phone number or chat identifier) in addition to messageId. Example: action=react target=+15551234567 messageId=ABC123 emoji=❤️