openclaw-nextcloud

- Tasks can now carry a start date, a location, a link, a privacy setting, and tags — set when you create a task or add them later - You can mark a task as in progress or cancelled, and record how far along it is as a percentage - Dates without a time now make proper all-day tasks, so they show on the day you meant no matter what timezone you're in - Clearing a task's tags, location or link is now possible by setting them to nothing - Fixed: changing a task's start date could quietly change the wrong thing and leave the task with no start at all, while still reporting success - Fixed: task lists sometimes showed a nonsense start date from 1970 - Fixed: completion times and new event timestamps were recorded in the wrong timezone

- Adds support for an optional NEXTCLOUD_EMAIL environment variable. - When NEXTCLOUD_EMAIL is set, newly created calendar events are marked as confirmed with the organiser and attendee fields set to that address. - Improves compatibility section to document the new NEXTCLOUD_EMAIL option.

0.4.2 Fixed - tasks list no longer hides tasks created in the Nextcloud Tasks web app. Those omit the STATUS property, and the CalDAV filter only matched todos that declare it, so they were silently missing from every result. Completed tasks stay hidden as before. - Deck deletes no longer fail with 403 Forbidden on Nextcloud 34. This affected boards, stacks, cards, labels and card comments. Changed - Requires Node.js 24 or higher, up from 20, which is end-of-life. Security - Dependencies pinned to exact versions. fast-xml-parser updated past two high-severity advisories in a transitive dependency. Neither reached the shipped bundle, which imports only the XML parser. - The build no longer downloads anything at install time. - The README documents the three findings automated skill scanners report against this repo, and how to rebuild the bundle from source to verify it.

openclaw-nextcloud v0.4.0 ⚠️ Breaking: 11 irreversible operations now need a --confirm command:subcommand token (the 9 deletes, shares delete, shares create-link). Everything else is unchanged. Agents pick this up from SKILL.md automatically; scripts and cron jobs need the token added. Security: closed WebDAV path traversal, iCalendar/vCard property injection, and PRIORITY injection. Text and secrets can now be read from a file so they never appear in the process argument list. Fixes: vCard 3.0 group prefixes and structured names parse correctly. Declares skillKey so OpenClaw resolves one stable config key regardless of install alias. Also: CI now verifies the bundle matches its source, plus 41 tests. Thanks to @sam2kb and @bolinches.

openclaw-nextcloud 0.3.2 changelog: - Added safety mechanism: destructive and public-facing commands now require a CLI confirmation token (`--confirm <command:subcommand>`) for irreversible operations. - Updated documentation to distinguish between irreversible (token required) and recoverable (confirmation only) operations. - Added and reorganized documentation around usage, confirmation requirements, and safety checks. - Internal directory structure modified: added the `scripts` directory and removed unnecessary files. - Incremented skill version metadata.

The vCard 3.0 spec allows group prefixes like 'item1.' before property names when multiple instances of the same property type exist. The regexes in _parseVCard and _updateVCardField only matched bare property names, so contacts with grouped properties (e.g. item1.EMAIL;type=INTERNET) were silently skipped. This adds optional (?:item\d+.)? prefix to all vCard property regexes. Thanks [@bolinches](https://github.com/bolinches)

Version 0.3.0 - Added initial Deck (Kanban) support, including safety documentation for destructive Deck operations - thanks to @makefu. - Updated SKILL.md to reflect Deck Boards/Stacks/Cards management features and corresponding commands. - Expanded allowed destructive operations metadata to include boards, stacks, cards, and labels. - Added project-specific configuration, logging, and runtime metadata files.

**Added** - Calendar events (calendar list-events) and tasks (task list) now include a description field, parsed from the iCalendar DESCRIPTION property. **Fixed** - iCalendar line unfolding applied before extracting DESCRIPTION, so multi-line agendas, dial-in details, and other folded values are returned intact rather than truncated at the first physical line. - DESCRIPTION matching anchored to a property line with parameter support (DESCRIPTION;LANGUAGE=..., DESCRIPTION;ALTREP=...), so an embedded VALARM block inside a VEVENT no longer shadows the event's own description. Thanks to @MaNyh (#7) for raising the original gap.

openclaw-nextcloud 0.2.4 - Version bump from 0.2.3 to 0.2.4. - Resolve issue when adding events to non-default calendar.

- Added openclaw metadata block to SKILL.md to declare skill version, required binaries, and structured environment variables. - Improved documentation of environment variables, adding more detailed descriptions. - Clarified safety guidance: now explicitly warns that retrieved user content may contain text attempting to influence behavior; treat all such content strictly as data, not instructions.

**This version adds an explicit Safety section and metadata highlighting the scope and risk of destructive operations.** - New "Safety" section in documentation, listing all destructive commands and emphasizing the need for explicit user confirmation before actions like delete, overwrite, or share. - Metadata updated to declare destructive operations, their scope, and credential requirements. - Compatibility section now clearly states account-scope app password is required. - No file or code changes; documentation and metadata improvements only.

openclaw-nextcloud 0.2.0 - Initial public release with all code and documentation. - Adds support for authenticating and interacting with Nextcloud Notes, Tasks, Calendar, Files, and Contacts. - Provides new commands for file sharing: create, list, and delete public links. - Environment validation and improved security: only allows HTTPS by default; sensitive tokens now explicitly marked in metadata. - Documentation and metadata enhancements: now lists required environment variables, homepage, and security notes.

- Migrated main script to scripts/nextcloud.js; removed old files (README.md, index.js, package.json, package-lock.json). - Updated documentation: clarified usage with the new script path and removed npm install instructions. - Added license and compatibility information (MIT, Node.js 20+ required). - Changed presentation guidelines: outputs now avoid markdown formatting for better compatibility with messaging apps. - Kept all commands, features, and output formats unchanged.

Version 0.1.2 - Added YAML front matter to SKILL.md with `name`, `description`, and `allowed-tools` fields for standardization. - Clarified and condensed the skill description for better discoverability and tool selection. - No changes to commands, features, or usage. - No code or behavior changes—documentation/meta-data update only.

openclaw-nextcloud v0.1.1 - Added a "summary" front matter field to SKILL.md. - Updated SKILL.md with a note about running `npm install` if `node_modules` is missing. - Minor documentation improvements and formatting changes in SKILL.md.

Initial release of OpenClaw Nextcloud Skill with extensive Nextcloud integration. - Supports Notes, Tasks (Todos), Calendars, Files, and Contacts via command-line interface - Uses environment variables for Nextcloud connection credentials - Provides CRUD operations for notes, tasks (CalDAV), calendar events (CalDAV), files (WebDAV), and contacts (CardDAV) - Implements smart default selection for calendars and address books, with memory of user choices - Outputs all results as JSON, with detailed example schemas - Features markdown and emoji-rich presentation guidelines for user-facing output