Enforce Mautic API transport safety

Author: romgenie

.github/workflows/clawhub-publish.yml

@@ -41,7 +41,7 @@ jobs:
       id-token: write
     uses: openclaw/clawhub/.github/workflows/package-publish.yml@v0.18.0
     with:
-      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz
+      source: ./clawpack/completetech-openclaw-mautic-plugin-0.1.12.tgz
       dry_run: false
       source_repo: CompleteTech-LLC-AI-Research/openclaw-mautic-plugin
       source_commit: ${{ github.sha }}

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.12 - 2026-05-26
+
+- Enforced transport safety for authenticated Mautic API requests: routable plain-HTTP `baseUrl` values now fail before credentials are sent.
+
 ## 0.1.11 - 2026-05-26
 
 - Added explicit Basic auth transport warnings for plain HTTP Mautic API connections.

README.md

@@ -76,7 +76,7 @@ OAuth2 is preferred for external production integrations where available. The lo
 
 `mautic_request`, `mautic_entity`, `mautic_webhook_triggers`, and `mautic_status` send Mautic API credentials with each request. If `baseUrl` uses plain HTTP, those credentials can be intercepted anywhere between OpenClaw and Mautic.
 
-Use `https://` for production, hosted, routed, or cross-host Mautic deployments. Use plain `http://` only for a trusted loopback address or private container network such as `http://mautic_web`. The `mautic_status` tool reports a transport warning when the configured `baseUrl` is not HTTPS.
+Use `https://` for production, hosted, routed, or cross-host Mautic deployments. Use plain `http://` only for a trusted loopback address or private container network such as `http://mautic_web`. The `mautic_status` tool reports a transport warning when the configured `baseUrl` is not HTTPS, and authenticated API tools refuse to send credentials to a routable plain-HTTP host.
 
 ## Plugin Settings
 

SECURITY.md

@@ -42,7 +42,7 @@ Mitigations:
 
 The Mautic API tools use the configured `baseUrl` and send Basic auth credentials in the HTTP `Authorization` header. Plain HTTP is intended only for trusted local Docker networks, loopback automation, or another private network segment where OpenClaw and Mautic are isolated from untrusted traffic.
 
-For production, hosted, routed, or cross-host deployments, set `baseUrl` to an HTTPS endpoint. Do not send production Mautic credentials through plain HTTP over a public, shared, wireless, or otherwise untrusted network.
+For production, hosted, routed, or cross-host deployments, set `baseUrl` to an HTTPS endpoint. Authenticated API tools refuse to send credentials to a routable plain-HTTP host, but operators should still avoid plain HTTP except on trusted loopback or private container networks.
 
 ## Console Bridge
 

clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz

@@ -48,7 +48,7 @@ Result:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.11"
+  "version": "0.1.12"
 }
 ```
 
@@ -67,7 +67,7 @@ Result: passed. ClawHub detected:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.11"
+  "version": "0.1.12"
 }
 ```
 

clawpack/completetech-openclaw-mautic-plugin-0.1.12.tgz

@@ -6,7 +6,7 @@ Historical/alternate handoff only. The repository is currently public, so this p
 
 - Package name: `@completetech/openclaw-mautic-plugin`
 - Plugin id: `mautic-control`
-- Version: `0.1.11`
+- Version: `0.1.12`
 - Source repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Current source visibility: public
 - Branch: `main`

docs/CLAWHUB_READINESS.md

@@ -8,7 +8,7 @@ This package is configured for GitHub Actions OIDC trusted publishing.
 - Repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Workflow file: `clawhub-publish.yml`
 - Artifact format: ClawPack `npm-pack` `.tgz`
-- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.11.tgz`
+- Workflow artifact: `./clawpack/completetech-openclaw-mautic-plugin-0.1.12.tgz`
 
 ## Workflow
 

docs/PRIVATE_SOURCE_REVIEW_REQUEST.md

@@ -200,6 +200,14 @@ export function transportSecurityWarning(baseUrl) {
   };
 }
 
+export function assertSafeMauticTransport(config) {
+  const warning = config.transportSecurityWarning ?? transportSecurityWarning(config.baseUrl);
+  if (warning?.level === "critical" || warning?.level === "error") {
+    throw new Error(`${warning.message} Refusing to send Mautic API credentials.`);
+  }
+  return warning ?? null;
+}
+
 export function getRuntimeConfig(api) {
   const pluginConfig = api?.pluginConfig && typeof api.pluginConfig === "object" ? api.pluginConfig : {};
   const workspaceRoot = nonEmptyString(pluginConfig.workspaceRoot)
@@ -279,6 +287,8 @@ export async function fetchWithTimeout(url, init, timeoutSeconds) {
 }
 
 export async function mauticFetch(config, requestPath, options = {}) {
+  assertSafeMauticTransport(config);
+  const url = buildUrl(config.baseUrl, requestPath, options.query);
   const headers = {
     Accept: "application/json",
     Authorization: authHeader(config),
@@ -289,7 +299,6 @@ export async function mauticFetch(config, requestPath, options = {}) {
     headers["Content-Type"] = "application/json";
     init.body = JSON.stringify(options.body);
   }
-  const url = buildUrl(config.baseUrl, requestPath, options.query);
   const response = await fetchWithTimeout(url, init, config.requestTimeoutSeconds);
   const text = await response.text();
   let body = text;