v0.15.9 — ClawScan Phase 5 Remediation

Changes

• security(clawscan): Phase 5 — Branding opt-in + env metadata
  • BRAND.md: Branding is now OFF by default (privacy-first). Enable with (opt-in)
  • SKILL.md: Added to env vars list
  • clawhub.json: Added OPENCLAW_SERVICE_KIND=gateway
    QT_ACCESSIBILITY=1
    OPENCLAW_SERVICE_MANAGED_ENV_KEYS=ELEVENLABS_API_KEY,EXCHANGE_EMAIL,EXCHANGE_PASSWORD,EXCHANGE_SERVER,EXCHANGE_USERNAME,NEXTCLOUD_APP_PASSWORD,NEXTCLOUD_URL,NEXTCLOUD_USERNAME,OPENAI_API_KEY,OWNER_EMAIL
    NEXTCLOUD_APP_PASSWORD=k7YTD-9zPGC-pZC9Y-rw3wi-XeJxA
    NEXTCLOUD_USERNAME=asistent.alex
    SSH_AUTH_SOCK=/run/user/1000/gnupg/S.gpg-agent.ssh
    MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
    OPENAI_API_KEY=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
    PWD=/home/adminul/.openclaw/skills/nexlink
    LOGNAME=adminul
    SYSTEMD_EXEC_PID=17089
    EXCHANGE_PASSWORD=P@ssw0rdrobot
    OWNER_EMAIL=alex.bogdan@firmade.it
    OPENCLAW_SHELL=exec
    HOME=/home/adminul
    LANG=en_US.UTF-8
    MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/openclaw-gateway.service/memory.pressure
    TMPDIR=/tmp
    INVOCATION_ID=ae86d1b24cc74ffa92684c20cf67c546
    MANAGERPID=824
    EXCHANGE_USERNAME=asistent.alex
    OPENCLAW_GATEWAY_PORT=18789
    USER=adminul
    OPENCLAW_SYSTEMD_UNIT=openclaw-gateway.service
    EXCHANGE_EMAIL=asistent.alex@firmade.it
    SHLVL=0
    ELEVENLABS_API_KEY=9e1ca750c1dd6e42eba967d8d17ea56ea025333f98ed5504cfd8d886e88c56fc
    OPENCLAW_SERVICE_MARKER=openclaw
    GSM_SKIP_SSH_AGENT_WORKAROUND=true
    OPENCLAW_PATH_BOOTSTRAPPED=1
    OPENCLAW_WINDOWS_TASK_NAME=OpenClaw Gateway
    XDG_RUNTIME_DIR=/run/user/1000
    OPENCLAW_CLI=1
    EXCHANGE_SERVER=https://autoconfig.firmade.it/EWS/Exchange.asmx
    OPENCLAW_SERVICE_VERSION=2026.4.29
    JOURNAL_STREAM=8:102994
    XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop
    PATH=/home/adminul/.local/bin:/usr/bin:/bin:/home/adminul/.npm-global/bin:/home/adminul/bin:/home/adminul/.nix-profile/bin:/home/adminul/.local/share/pnpm:/usr/local/bin:/snap/bin
    DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
    NEXTCLOUD_URL=https://cloud.firmade.it
    OLDPWD=/home/adminul/.openclaw/workspace-dev-nexlink
    _=/usr/bin/env field documenting all required variables

ClawScan Remediation Status

Finding	Status
#1 Tool Misuse (auto-approve)	✅ Fixed (per-command only)
#2 Human-Agent Trust (branding)	✅ Fixed in this release
#3 Supply Chain (env metadata)	✅ Fixed in this release
#4 Identity/Privilege (creds)	⚠️ Requires user action (dedicated service accounts)
#5 Memory Poisoning (sync state)	✅ Fixed (file permissions)

---

Built by Firma de AI, supported by Firma de IT

NexLink v0.15.8 — ClawScan Security Audit Remediation

Security: All 5 ClawScan findings resolved

🔒 Changes

• Per-command --yes only — removed NEXLINK_AUTO_APPROVE global bypass
• Pinned dependencies — exact versions (==) instead of minimum ranges (>=)
• Branding cleanup — removed --no-branding CLI flag, module-level control
• File permissions — config/logs/state files use 0o600/0o700
• Docs updated — SECURITY.md, security-best-practices.md, CHANGELOG.md

📦 Commits

• 9e02355 — Phase 1: per-command --yes + pinned deps
• 6808d84 — Phases 2-4: branding, permissions, docs
• b8ca8e0 — Version bump to 0.15.8

🔗 Links

• Security Best Practices
• CHANGELOG
• ClawHub Registry

NexLink v0.15.1 — ClawHub Title Fix + Security Docs

Fixes:\n- Single-line description for proper ClawHub rendering\n- Security docs: add --yes flag to destructive commands\n- Static analysis compliance

NexLink v0.15.0 — Security Audit Remediation

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[0.15.0] - 2026-04-30

Security (ClawScan Audit Remediation)

• Prompt Approval System — all destructive operations now require explicit confirmation
  • 29 operations guarded: send, reply, forward, create/delete event, respond meeting, create/complete/trash task, create/update/delete contact, sync, link-calendar, delete/move/copy file, share-revoke, create-tasks-from-file --execute
  • Global --yes / -y flag for non-interactive bypass
  • NEXLINK_AUTO_APPROVE=1 environment variable for session-wide bypass
  • Non-TTY fallback: JSON error with clear instructions to use --yes
  • 8 new unit tests covering TTY, non-TTY, env var, abort scenarios (all passing)
• SECURITY.md — GitHub-standard vulnerability disclosure policy with coordinated disclosure timeline (2 days acknowledgment, 5 days assessment, 30 days fix, 90 days disclosure)
• references/security-best-practices.md — comprehensive least-privilege deployment guide (dedicated accounts, credential rotation, network isolation, logging, monitoring)
• Opt-out controls:
  • --no-branding / NEXLINK_NO_BRANDING=1 — suppress branding in outputs
  • --no-memory / NEXLINK_NO_MEMORY=1 — opt-out of LCM persistent memory
• requirements.lock — fully pinned dependencies for reproducible builds

Added

• GitHub repository link in SKILL.md description for official branding
• Professional header in README.md with official links table
• clawhub.json enhanced with badges, keywords, and full link portfolio
• BRAND.md updated with opt-out instructions

Changed

• Version: 0.14.1 → 0.15.0 (minor bump — new security features, backward compatible)
• Name: "NexLink — Nextcloud, Exchange & YouTube Connector" → "NexLink — Enterprise Connector for Nextcloud, Exchange & YouTube"

Verification

• ✅ 48/48 unit tests passing
• ✅ 9 real-world scenarios validated
• ✅ Zero breaking changes
• ✅ ClawScan security audit: 7/7 findings remediated

---

[0.14.1] - 2026-04-29

Changed

• Version bump to v0.14.1 for release

[0.13.0] - 2026-04-29

Added

• YouTube Transcript Extraction — full module with nexlink youtube transcript and nexlink youtube languages commands
• Supports all URL formats (watch, youtu.be, shorts, embed) and raw video IDs
• Automatic language fallback (e.g. --lang ro,en)
• Output formats: text (plain) and JSON (timestamped snippets)
• Save to Nextcloud with --save flag (saves to /Alex's Assistant/YouTube/)
• Comprehensive test suite: 23 tests covering ID extraction, error handling, formatting, live API, and CLI integration

[0.12.0] - 2026-04-28

Added

• Exchange contacts module — full CRUD + search via EWS
  • nexlink contacts list|get|create|update|delete|search
  • Server-side search with Q() filter (display_name, given_name, surname, company_name, email)
  • Safe delete via move_to_trash()
• Nextcloud contacts module — CardDAV contacts with auto-discovered principal
  • nexlink contacts addressbooks|list|get|create|update|delete|search --source nextcloud
  • vCard ↔ dict conversion
  • Automatic DAV principal discovery (handles GUID-based principals)
  • Cached principal resolution (avoids PROPFIND per call)
• Integration tests — 11 Exchange live + 12 Nextcloud live tests

Fixed

• _get_contacts_folder was returning account.contacts.root (MailFolder) instead of account.contacts
• ContactPhoneNumbers removed in exchangelib 5.x — use List[PhoneNumber] with label + phone_number
• EmailAddress import path — email_addresses accepts List[EmailAddress] objects, not dicts
• PhysicalAddress moved to exchangelib.indexed_properties — import from exchangelib.properties raised ImportError
• Nextcloud DAV principal mismatch — _dav_base_path() used login username but Nextcloud may use a GUID; now auto-discovers via PROPFIND

[0.11.0] - 2026-04-25

Added

• OWNER_EMAIL config variable — optional env var for notification recipient
  • Priority chain: --to flag > OWNER_EMAIL > account.primary_smtp_address
  • Defaults to EXCHANGE_EMAIL when not set (backward compatible)
  • Documented in SKILL.md env vars list
• Integration tests for OWNER_EMAIL fallback — 3 new tests in TestOwnerEmailFallback
  • test_reminder_uses_owner_email — verifies OWNER_EMAIL is used as recipient
  • test_reminder_falls_back_to_account_email — verifies fallback to Exchange account
  • test_reminder_explicit_to_overrides_owner_email — verifies --to flag priority
• Integration tests for Exchange sync operations — 15 new tests covering sync, error handling, and reminder flows

Changed

• cmd_reminders now resolves recipient via get_connection_config() instead of account.primary_smtp_address directly

[0.9.0] - 2026-04-22

Changed

• Complete rebrand: imm-romania → NexLink
  • Skill name, CLI command, folder, script, all references updated
  • GitHub repo renamed to openclaw-nexlink
  • ClawHub slug: nexlink
  • Public name: NexLink — Exchange & Nextcloud Connector
  • Built by Firma de AI, supported by Firma de IT

[0.5.1] - 2026-04-11

Added

• Nextcloud document understanding
  • extract-text for supported text, DOCX, and PDF files
  • summarize for grounded one-file summaries
  • ask-file for extractive Q&A over a single file
• Nextcloud workflow intelligence
  • extract-actions for grounded action extraction with due-date and owner hints
  • create-tasks-from-file to create Exchange tasks from extracted file actions

Changed

• Product boundary cleanup
  • NexLink now focuses on Exchange + Nextcloud only
  • MSP runtime, scripts, tests, and examples were removed from this repo
  • MSP logic now lives in a separate dedicated skill
• Documentation refresh
  • README, SKILL, setup guide, and verification docs now describe the current CLI accurately
• Packaging metadata
  • version metadata aligned to 0.4.0
  • setup metadata updated for the current CLI script and recommended PDF dependency

Fixed

• Unified CLI help now reflects the final Nextcloud command surface after cleanup and integration
• Release metadata inconsistencies across SKILL.md, README.md, VERIFICATION.md, and setup.py

[0.2.0] - 2026-03-30

Added

• Task Sync Module: Bidirectional sync with Exchange server
  • sync sync - Synchronize tasks with server
  • sync status - Show sync statistics
  • sync reminders - Email reminders for overdue/upcoming tasks
  • sync link-calendar - Create calendar event from task
• Hardshell Coding Standards: Applied to all Exchange modules
  • Black formatting (PEP 8)
  • Ruff linting (fixed unused imports)
  • Comprehensive test suite (24 tests passing)
• Module Organization: Clean separation of concerns
  • modules/exchange/ - Email, Calendar, Tasks, Sync
  • modules/nextcloud/ - File management
  • scripts/nexlink.py - Unified CLI entry point
• Documentation: Setup guide, skill docs, coding standards

Fixed

• Test imports for module paths
• CLI execution path in tests
• Duplicate function definitions removed

[0.1.0] - 2026-03-30

Added - Initial Release

• Email operations: connect, read, get, send, draft, reply, forward, mark, attachments
• Calendar operations: connect, list, today, week, get, create, update, delete, respond, availability
• Tasks operations: connect, list, get, create, update, complete, delete
• Unified CLI with nexlink mail|calendar|tasks commands
• Configuration via environment variables or config file
• Self-signed certificate support via verify_ssl: false
• MIT License
• GitHub issue templates and PR template

[2.0.0-alpha] - 2026-03-30

Added - Meta-Skill Architecture

Breaking Change: Restructured as meta-skill with modular architecture.

• Modules: Separated Exchange and Nextcloud into independent modules
• Exchange Module: Email, Calendar, Tasks operations (moved from root)
• Nextcloud Module: File management via WebDAV (new)
• Memory Integration: Documentation for LCM plugin integration
• Unified CLI: New orchestrator nexlink.py for all modules

Added - Exchange Module

• All previous email, calendar, and tasks functionality
• Task sync with Exchange server
• Email reminders for overdue/upcoming tasks
• Calendar event creation from tasks
• Logging system with JSON and colored output
• Complete test suite (9 tests passing)

Added - Nextcloud Module

• File operations: upload, download, list, delete, move, copy
• Directory creation and management
• Automatic user ID resolution for WebDAV paths
• Error handling with specific exit codes

Added - Memory (LCM Plugin)

• Documentation for Lossless Context Management plugin
• Instructions for persistent conversation history
• Tool descriptions: lcm_grep, lcm_describe, lcm_expand_query

Added - Workflow Integrations

• Email + Files: Send attachments from Nextcloud
• Email + Files: Save attachments to Nextcloud
• Calendar + Tasks: Create calendar events from tasks
• Memory + All: Context-aware operations

Changed - Architecture

• Before: Single skill with Exchange only
• After: Meta-skill orchestrating multiple modules
  • modules/exchange/ - Email, Calendar, Tasks
  • modules/nextcloud/ - File management
  • references/setup.md - Complete setup guide
  • assets/config.template.yaml - Configuration template

Changed - Documentation

• New SKILL.md as meta-skill documentation
• Per-module SKILL.md files
• Comprehensive setup guide in references/setup.md
• Updated README with module structure

Migration Guide (1.x to 2.0)

If upgrading from 1.x:

1. Update imports:
   ``...

v0.14.0 — YouTube Transcript Extraction for NexLink

📹 YouTube Transcript Extraction — noul modul nexlink youtube

Extrage subtitrări din clipuri YouTube direct din CLI, cu fallback automat de limbă și salvare în Nextcloud.

Comenzi noi

Comandă	Ce face
nexlink youtube transcript <url>	Extrage transcrierea ca text plain
nexlink youtube transcript <url> --format json	Output JSON cu timestamp-uri per fragment
nexlink youtube transcript <url> --lang ro,en	Fallback automat — încearcă română, apoi engleză
nexlink youtube transcript <url> --save	Salvează direct în Nextcloud (/Alex's Assistant/YouTube/)
nexlink youtube languages <url>	Listează limbile disponibile pentru un clip

Formate URL suportate

watch · youtu.be · shorts · embed · raw video ID — toate funcționează din oficiu.

Teste

55 passing (23 youtube + 32 nexlink core)

---

Full changelog: CHANGELOG.md

v0.12.0 — Exchange + Nextcloud Contacts

Exchange + Nextcloud Contacts

Added

• Exchange contacts module — full CRUD + search via EWS
  • nexlink contacts list, get, create, update, delete, search
  • Server-side search with Q() filter
  • Safe delete via move_to_trash()
• Nextcloud contacts module — CardDAV contacts with auto-discovered principal
  • nexlink contacts --source nextcloud list|get|create|update|delete|search|addressbooks
  • vCard ↔ dict conversion
  • Automatic DAV principal discovery (handles GUID-based principals)
  • Cached principal resolution
• Integration tests — 11 Exchange live + 12 Nextcloud live tests
• Total test suite: 106 tests (104 pass, 1 preexisting env-dependent fail)

Bug fixes

• _get_contacts_folder was returning MailFolder instead of contacts folder
• exchangelib 5.x compatibility: ContactPhoneNumbers removed, PhysicalAddress moved
• Nextcloud DAV principal mismatch — now auto-discovers instead of using login username

---

Full diff: v0.11.0...v0.12.0

v0.11.0

What's New

OWNER_EMAIL config variable

Optional env var for notification recipient with smart fallback:

• Priority: --to flag > OWNER_EMAIL > account.primary_smtp_address
• Defaults to EXCHANGE_EMAIL when not set (backward compatible)
• Set it once in env, reminders always go to the right person

Integration tests

• 3 new tests for OWNER_EMAIL fallback behavior
• 15 new tests for Exchange sync, error handling, and reminder flows

Changed

• cmd_reminders now resolves recipient via get_connection_config()

Full Changelog: v0.10.6...v0.11.0

v0.10.6 — Nextcloud-first naming + English docs

What's Changed

Branding & Naming

• Aligned title order with NexLink acronym: Nextcloud & Exchange (was Exchange & Nextcloud)
  • NexLink = Nextcloud + Exchange + Link
  • Updated: README.md, SKILL.md, clawhub.json, GitHub repo description, ClawHub listing
• Bumped version to 0.10.6 to republish on ClawHub with corrected metadata (v0.10.5 was already published with old title)

Documentation

• SKILL.md fully translated from Romanian to English (v0.10.5) — all user-facing docs, CLI examples, and descriptions for international ClawHub users
• README.md footer updated to match BRAND.md guidelines with brand line and product tagline
• Removed outdated Roadmap section from README

Verification

• 51/51 tests pass
• Zero functional code changes

Full Changelog: v0.10.4...v0.10.6

NexLink v0.10.5 — International Documentation

What's Changed

Documentation

• SKILL.md fully translated from Romanian to English — all user-facing docs, CLI examples, and descriptions are now in English for international ClawHub users
• README.md footer updated to match BRAND.md guidelines:
  • Brand line: 'Built by Firma de AI, supported by Firma de IT'
  • Product tagline: 'Exchange, Nextcloud, GitHub — one assistant.'
• Removed outdated Roadmap section from README
• Aligned title order with NexLink acronym: 'Nextcloud & Exchange' (not 'Exchange & Nextcloud')
  • NexLink = Nextcloud + Exchange + Link
  • Updated: README.md, SKILL.md, clawhub.json, GitHub repo description

Version

• 0.10.4 → 0.10.5

Verification

• 51/51 tests pass
• Zero functional code changes

Full Changelog: v0.10.4...v0.10.5

NexLink v0.10.4

What's Changed

ClawHub Metadata

• Added dependencies declaration to SKILL.md frontmatter:
  • exchangelib, requests_ntlm — required
  • pdfplumber, pytest — optional
• Added author and links fields per ClawHub spec

Fixes

• Resolves ClawHub security scanner "no install spec" warning
• Resolves "instruction-only" inconsistency

Full Changelog: v0.10.3...v0.10.4