@clawling/clawchat-plugin-openclaw 2026.10.11-3 → 2026.10.19-1

package/dist/src/host-tools-guard.js

@@ -1,9 +1,23 @@
-import { CHANNEL_ID, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.js";
-import { classifyChat, clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, normalizeToolChatId, parseClawChatSessionKey, } from "./turn-boundary.js";
+// Layer 2 of the non-owner turn boundary: a fail-closed `before_tool_call`
+// hook. Dispatch (layer 1) already narrows the offered tools for turns the
+// owner did not start; this hook blocks anything else that still reaches
+// execution. With `non-owner-host-tools: approve` and a ready approval route
+// (approval-route.ts), a group turn's other tools ask the owner instead:
+// the hook returns `requireApproval` and the host waits for the owner's
+// decision; anything but an approval blocks. Only calls whose session key
+// carries the ClawChat prefix are in scope (D8); grant-management tools
+// enforce their owner boundary on every channel. Tool arguments are never logged.
+import { HOST_FLOOR, hostAtLeast } from "./host-version.js";
+import { CHANNEL_ID, listOpenclawClawlingAccountIds, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.js";
+import { classifyChat, clawChatSessionAccountId, nonOwnerToolAllowlist, parseClawChatSessionKey, } from "./turn-boundary.js";
 import { clawChatDbPathForStateDir, getClawChatStore } from "./storage.js";
 import { resolveOwnerIdentity } from "./owner-identity.js";
 import { getRegisteredClawChatToolNames } from "./tools.js";
 import { APPROVAL_ROUTE_WARNINGS, listActiveAccountIds, resolveApprovalRoute, storedIdentityLookup, } from "./approval-route.js";
+import { bindAwaitingTurnRun, grantsForRun, readTurnGrantRun, isOwnerSideRun, isNonOwnerSideSession, hasUnattributedTurn, requestOriginForRun, bindToolRequestCall } from "./turn-grants.js";
+import { GRANT_BLOCK_MESSAGE, GRANT_INTERSECTION_BLOCK_MESSAGE, GRANT_ASK_DENIED_MESSAGE, GRANT_DENIED_MESSAGE, GRANT_ASK_UNAVAILABLE_MESSAGE, GRANT_NOT_AVAILABLE_MESSAGE, GRANT_CROSS_SESSION_MESSAGE, evaluateToolGrant, isCompiledGrants, } from "./tool-grants.js";
+import { AUTHORIZATION_TOOLS, TOOL_CAPABILITIES, canonicalToolName, hostToolTargetsCurrentSession, isCrossChatCall, resolveCrossChatGate } from "./tool-capabilities.js";
+import { recordTurnArtifactCall, registerTurnArtifacts } from "./turn-artifacts.js";
 export const BLOCK_MESSAGE = "This tool is not available here: only your owner's direct chat may use host tools on this machine. Do not try to reach them another way; answer without them, or tell the person to ask your owner.";
 /** Told to the model when the owner denies, or does not answer in time. */
 export const APPROVAL_TIMEOUT_MESSAGE = "Your owner did not approve this tool call in time, so it did not run. Do not call it again for this request; tell the group your owner did not approve it.";
@@ -19,7 +33,9 @@ const APPROVAL_DESCRIPTION_MAX = 500;
  * hook again for the inner tool a `tool_call` runs, and that inner call gets
  * every check below. They are not part of the dispatch allowlist.
  */
-export const HOST_TOOL_SEARCH_CONTROLS = Object.freeze(["tool_search", "tool_describe", "tool_call"]);
+// Current host name: tmp/openclaw/src/agents/tool-search-types.ts,
+// TOOL_CALL_RAW_TOOL_NAME (2026.10.3); retain the older tool_call name too.
+export const HOST_TOOL_SEARCH_CONTROLS = Object.freeze(["tool_search", "tool_describe", "tool_call", "dispatch_action"]);
 const ACCOUNT_SCOPED_TOOLS = ["clawchat_mention_message", "clawchat_react_message"];
 const block = () => ({ block: true, blockReason: BLOCK_MESSAGE });
 const CLAWCHAT_SESSION_PREFIX = new RegExp(`^agent:[^:]+:${CHANNEL_ID}:`, "i");
@@ -44,49 +60,124 @@ export function hasLocalPathArgument(value, field = "") {
 }
 /** Pure decision for one tool call. `undefined` lets the call run. */
 export function decideHostToolCall(input) {
+    if (input.toolName === "clawchat_tool_request") {
+        const origin = input.sessionKey ? requestOriginForRun(input.sessionKey, input.runId) : undefined;
+        const parsed = parseClawChatSessionKey(input.sessionKey);
+        return input.toolGrants === "on" && origin && parsed && parsed.kind === origin.sourceChatType
+            && parsed.chatId === origin.sourceChatId.trim().toLowerCase()
+            && origin.sourceSessionKey.trim().toLowerCase() === input.sessionKey?.trim().toLowerCase()
+            && input.senderId === origin.requesterUserId
+            && input.ownerUserId && origin.requesterUserId !== input.ownerUserId
+            && input.registeredTools.has(input.toolName) ? undefined : block();
+    }
+    if (AUTHORIZATION_TOOLS.includes(input.toolName)) {
+        const parsed = parseClawChatSessionKey(input.sessionKey);
+        return parsed && clawChatSessionAccountId(input.sessionKey)
+            && classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner"
+            && input.toolGrants === "on" && Boolean(input.ownerUserId?.trim())
+            && input.senderId === input.ownerUserId ? undefined : block();
+    }
     if (!isClawChatToolCall(input))
         return undefined;
     const parsed = parseClawChatSessionKey(input.sessionKey);
     if (!parsed)
         return block();
-    if (classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner") {
+    const ownerTurn = classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner";
+    // Owner DMs without a plugin snapshot keep owner access: non-owner calls
+    // cannot start local turns in other sessions (cross-session). Under that
+    // audited premise, only the owner can initiate a snapshot-free turn here.
+    // A new host tool missing from the audit could break it; keep it current.
+    if ((ownerTurn && !isNonOwnerSideSession(input.sessionKey))
+        || (parsed.kind === "group" && isOwnerSideRun(input.sessionKey, input.runId)))
         return undefined;
+    const publicTools = nonOwnerToolAllowlist(input.publicTools);
+    // Missing plugin registration takes precedence over missing caller access.
+    if ((input.toolGrants === "on" || publicTools.includes(input.toolName))
+        && input.toolName.startsWith("clawchat_") && !input.registeredTools.has(input.toolName)) {
+        return input.toolGrants === "on"
+            ? { block: true, reasonCode: "not-available", blockReason: GRANT_NOT_AVAILABLE_MESSAGE } : block();
     }
     // Approve mode: only group turns, and only once the route to the owner's
-    // direct chat is live. Friend direct chats never ask; they block below.
-    const approve = parsed.kind === "group" && input.approvalRoute?.ready === true;
-    const allowlisted = NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName);
+    // direct chat is live. Friend direct chats ask only for an ask grant.
+    const approve = parsed.kind === "group" && input.nonOwnerHostTools !== "off"
+        && input.approvalRoute?.ready === true;
+    const run = readTurnGrantRun(input.sessionKey, input.runId);
+    if (run.kind === "unavailable")
+        return block();
+    const details = run.kind === "bound" ? run.details : { speakers: [], anyGrantedTools: new Set() };
+    const hasGrantCaller = input.toolGrants === "on" && Boolean(input.senderId)
+        && details.speakers.some(speaker => speaker.id === input.senderId);
+    // Catalog execution omits requester. A bound run must still restrict public
+    // defaults with its intersected ask/deny rules; it is not an unknown caller.
+    // Other tools retain their requirement for a matching requester identity.
+    const hasGrantContext = hasGrantCaller || (input.toolGrants === "on" && run.kind === "bound"
+        && !input.senderId?.trim() && publicTools.includes(input.toolName));
+    const grants = hasGrantContext && run.kind === "bound" ? run.grants : new Map();
+    const anyGrantedTools = hasGrantContext ? details.anyGrantedTools : new Set();
+    const context = { chatId: parsed.chatId, sessionKey: input.sessionKey, accountId: input.accountId };
+    const grant = evaluateToolGrant(grants, input.toolName, input.params, context);
+    // A host-started run without a bound speaker cannot use approve fallback,
+    // even when per-person grants are off.
+    const effectiveApprove = approve && !hasUnattributedTurn(input.sessionKey)
+        && (input.toolGrants === "on" ? hasGrantContext : details.speakers.length > 0);
+    const multipleCallers = (details.nonOwnerSpeakerIds?.size
+        ?? details.speakers.filter(speaker => speaker.id !== input.ownerUserId).length) > 1;
+    const grantBlock = (denied = false) => ({ block: true,
+        reasonCode: multipleCallers ? "batch-intersection" : denied ? "denied" : "not-granted",
+        blockReason: multipleCallers ? GRANT_INTERSECTION_BLOCK_MESSAGE : denied ? GRANT_DENIED_MESSAGE : GRANT_BLOCK_MESSAGE,
+    });
+    // Forwarded arguments belong to the inner call, whose hook is authoritative.
+    if (grant === "deny")
+        return grantBlock(true);
+    if (HOST_TOOL_SEARCH_CONTROLS.includes(input.toolName) && (grants.size > 0 || grants.get("")))
+        return undefined;
+    const ask = grant === "ask" && input.approvalRoute?.ready === true;
+    const allowlisted = publicTools.includes(input.toolName);
     // Outer pre-check only. The inner tool call is checked again and that check
     // is authoritative: the host also accepts dotted/flattened argument keys
     // that this outer check may not recognise. Under approve, tools the owner
     // approves one by one (and the tool-search controls that reach them) show
     // the owner their arguments instead; the allowlisted tools, which run
     // without asking, keep the check.
-    if ((!approve || allowlisted) && hasLocalPathArgument(input.params))
+    const directLocalTool = grant === "direct" && [TOOL_CAPABILITIES.files, TOOL_CAPABILITIES.terminal, TOOL_CAPABILITIES.code].some(cap => cap.tools.includes(canonicalToolName(input.toolName)));
+    if (!directLocalTool && (grant === "direct" || (grant !== "ask" && (allowlisted || !effectiveApprove))) && hasLocalPathArgument(input.params))
         return block();
     if (HOST_TOOL_SEARCH_CONTROLS.includes(input.toolName))
         return undefined;
-    if (ACCOUNT_SCOPED_TOOLS.includes(input.toolName)) {
-        // D9: a non-owner turn may only act on its own chat, named explicitly.
-        // The tool resolves the same argument with the same helper, so the chat
-        // checked here is the chat the call reaches.
-        const target = normalizeToolChatId(input.params.chatId).toLowerCase();
-        if (!target || target !== parsed.chatId) {
-            return {
-                block: true,
-                blockReason: input.toolName === "clawchat_react_message"
-                    ? "Pass this chat's chatId to react here."
-                    : "Pass this chat's chatId to mention here.",
-            };
-        }
+    // Check only audited cross-session host tools before direct/ask/approve exits.
+    // Other tools' business data is opaque here; D9 remains a separate check.
+    if ((grant === "direct" || grant === "ask" || allowlisted || effectiveApprove)
+        && !hostToolTargetsCurrentSession(input.toolName, input.params, input.sessionKey)) {
+        return { block: true, reasonCode: "cross-session", blockReason: GRANT_CROSS_SESSION_MESSAGE };
     }
-    if (allowlisted) {
-        return input.toolName.startsWith("clawchat_") && !input.registeredTools.has(input.toolName)
-            ? block()
-            : undefined;
+    // D9 follows authorization. Missing/opaque targets are cross-chat, never
+    // implicitly this chat. Defaults and approve fallback cannot open that gate.
+    const crossChatGate = resolveCrossChatGate({ crossChat: isCrossChatCall(input.toolName, input.params, context) }, grant);
+    if (crossChatGate === "block")
+        return grantBlock();
+    if (hasGrantContext && isCompiledGrants(grants) && !grant)
+        return grantBlock();
+    if (allowlisted && grant !== "ask")
+        return undefined;
+    if (grant === "direct")
+        return undefined;
+    if (grant === "ask") {
+        if (!ask)
+            return { block: true, reasonCode: "ask-unavailable", blockReason: GRANT_ASK_UNAVAILABLE_MESSAGE };
+        const approval = buildHostToolApproval(input.toolName, parsed.chatId, input.params, {
+            kind: parsed.kind, ...details,
+        });
+        return approval ? { requireApproval: approval } : { block: true, blockReason: APPROVAL_UNSHOWABLE_MESSAGE };
     }
-    if (!approve)
-        return block();
+    if (input.toolGrants === "on" && !effectiveApprove) {
+        if (multipleCallers && anyGrantedTools.has(input.toolName)) {
+            return { block: true, reasonCode: "batch-intersection", blockReason: GRANT_INTERSECTION_BLOCK_MESSAGE };
+        }
+    }
+    if (isCompiledGrants(grants))
+        return grantBlock();
+    if (!effectiveApprove)
+        return input.toolGrants === "on" ? grantBlock() : block();
     const approval = buildHostToolApproval(input.toolName, parsed.chatId, input.params);
     return approval ? { requireApproval: approval } : { block: true, blockReason: APPROVAL_UNSHOWABLE_MESSAGE };
 }
@@ -109,7 +200,7 @@ export const APPROVAL_UNSHOWABLE_MESSAGE = "This call cannot be sent to your own
  * holding characters the host would escape or hide): the owner must never
  * approve a command they could not read, so such a call blocks.
  */
-export function buildHostToolApproval(toolName, groupChatId, params) {
+export function buildHostToolApproval(toolName, groupChatId, params, grantContext) {
     const tool = cleanText(toolName, 48);
     let args;
     try {
@@ -123,17 +214,21 @@ export function buildHostToolApproval(toolName, groupChatId, params) {
     const unattended = STARTS_UNATTENDED_WORK.test(toolName)
         ? " Approving starts work that later runs with every host tool and is not asked about again."
         : "";
-    const before = `A turn in ClawChat group ${cleanText(groupChatId, 64)} (anyone in the group may have asked) wants to run ` +
+    const conversation = grantContext?.kind === "direct" ? "friend direct chat" : "group";
+    const speakers = grantContext
+        ? ` (requested by ${cleanText(grantContext.speakers.map(s => `${s.name} (${s.id})`).join(", "), 100)})`
+        : " (anyone in the group may have asked)";
+    const before = `A turn in ClawChat ${conversation} ${cleanText(groupChatId, 64)}${speakers} wants to run ` +
         `the host tool ${tool} on this machine. Arguments: `;
     const after = `.${unattended} Allow only if you would run it yourself.`;
     if (before.length + args.length + after.length > APPROVAL_DESCRIPTION_MAX)
         return null;
     return {
-        title: cleanText(`ClawChat group wants to run ${tool}`, APPROVAL_TITLE_MAX),
+        title: cleanText(`ClawChat ${conversation} wants to run ${tool}`, APPROVAL_TITLE_MAX),
         description: `${before}${args}${after}`,
         severity: "warning",
         timeoutMs: APPROVAL_TIMEOUT_MS,
-        timeoutReason: APPROVAL_TIMEOUT_MESSAGE,
+        timeoutReason: grantContext ? GRANT_ASK_DENIED_MESSAGE : APPROVAL_TIMEOUT_MESSAGE,
         allowedDecisions: ["allow-once", "deny"],
     };
 }
@@ -171,16 +266,29 @@ export function registerHostToolsGuard(api, options = {}) {
         const current = api.runtime.config?.current;
         return (typeof current === "function" ? current.call(api.runtime.config) : api.config);
     };
-    // Only consulted for group calls. `undefined` = the account is not in
-    // approve mode; a route that is not ready blocks like `off`.
-    const groupApprovalRoute = (accountId) => {
+    // Ask grants also need the managed route for friend direct chats.
+    const approvalRoute = (accountId, hasAskSnapshot = false) => {
         try {
             const cfg = readLiveConfig();
             const active = listActiveAccountIds(cfg, { knownActive: accountId, hasStoredIdentity });
             const routeAccountId = accountId ?? (active.length === 1 ? active[0] : undefined);
-            const anyApprove = (routeAccountId ? [routeAccountId] : active).some(id => resolveOpenclawClawlingAccount(cfg, id).nonOwnerHostTools === "approve");
+            const anyApprove = (routeAccountId ? [routeAccountId] : active).some(id => {
+                const account = resolveOpenclawClawlingAccount(cfg, id);
+                if (account.nonOwnerHostTools === "approve")
+                    return true;
+                if (account.toolGrants === "on" && hasAskSnapshot)
+                    return true;
+                try {
+                    return account.toolGrants === "on" && openStore().hasActiveAskGrant(id, Date.now());
+                }
+                catch {
+                    return false;
+                }
+            });
             if (!anyApprove)
                 return undefined;
+            if (!hostAtLeast(api.runtime.version, HOST_FLOOR))
+                return { ready: false, reason: "not-applied" };
             const route = routeAccountId
                 ? resolveApprovalRoute({
                     liveConfig: cfg,
@@ -202,69 +310,151 @@ export function registerHostToolsGuard(api, options = {}) {
     api.on("before_tool_call", (event, sdkCtx) => {
         // `requester` is host 2026.8.1+ (the floor); the development SDK types predate it.
         const ctx = sdkCtx;
-        try {
-            if (!ctx) {
-                warn("missing-context");
-                return block();
-            }
-            const sessionKey = ctx.sessionKey;
-            if (!isClawChatToolCall({ sessionKey }))
-                return undefined;
-            const requester = ctx.requester;
-            const parsed = parseClawChatSessionKey(sessionKey);
-            if (!parsed || (requester?.channel && requester.channel !== CHANNEL_ID)) {
-                warn("unknown-session");
-                return block();
-            }
-            // Direct keys carry their account; group keys do not. A group turn is
-            // non-owner whoever speaks, so a group call without the requester
-            // account (host tool-search controls and the inner calls they run get
-            // a run-level ctx without one) still gets the non-owner policy; only
-            // the tools that act as an account need it. Conflicting ids block.
-            const keyAccountId = clawChatSessionAccountId(sessionKey);
-            const requesterAccountId = requester?.accountId?.trim()
-                ? normalizeOpenclawClawlingAccountId(requester.accountId)
-                : undefined;
-            const accountId = requesterAccountId ?? keyAccountId;
-            if (keyAccountId && keyAccountId !== accountId) {
-                warn("account-identity");
-                return block();
-            }
-            if (!accountId) {
-                if (parsed.kind !== "group" || ACCOUNT_SCOPED_TOOLS.includes(event.toolName)) {
+        const decision = (() => {
+            try {
+                if (!ctx) {
+                    warn("missing-context");
+                    return block();
+                }
+                const sessionKey = ctx.sessionKey;
+                const runId = ctx.runId ?? event.runId;
+                if (sessionKey && isClawChatToolCall({ sessionKey }) && ctx.requester?.senderId?.trim()
+                    && (!ctx.requester.channel || ctx.requester.channel === CHANNEL_ID)) {
+                    bindAwaitingTurnRun(sessionKey, runId, ctx.requester.senderId);
+                }
+                if (event.toolName === "clawchat_tool_request") {
+                    const origin = sessionKey ? requestOriginForRun(sessionKey, runId) : undefined;
+                    if (!origin || !sessionKey || !ctx.requester?.senderId
+                        || (ctx.requester.channel && ctx.requester.channel !== CHANNEL_ID)
+                        || (ctx.requester.accountId && normalizeOpenclawClawlingAccountId(ctx.requester.accountId) !== origin.accountId)
+                        || (clawChatSessionAccountId(sessionKey) && clawChatSessionAccountId(sessionKey) !== origin.accountId))
+                        return block();
+                    const account = resolveOpenclawClawlingAccount(readLiveConfig(), origin.accountId);
+                    const ownerUserId = options.ownerUserId ? options.ownerUserId(origin.accountId)
+                        : resolveOwnerIdentity(openStore(), origin.accountId, account.ownerUserId).ownerUserId;
+                    const decision = decideHostToolCall({ toolName: event.toolName, params: event.params ?? {}, sessionKey, runId,
+                        senderId: ctx.requester.senderId, ownerUserId: ownerUserId ?? undefined, toolGrants: account.toolGrants,
+                        registeredTools: getRegisteredClawChatToolNames() });
+                    const callId = ctx.toolCallId
+                        ?? event.toolCallId;
+                    return decision ?? (bindToolRequestCall(sessionKey, runId, callId) ? undefined : block());
+                }
+                if (AUTHORIZATION_TOOLS.includes(event.toolName)
+                    && (!clawChatSessionAccountId(sessionKey) || !ctx.requester?.senderId))
+                    return block();
+                if (!isClawChatToolCall({ sessionKey }))
+                    return undefined;
+                const requester = ctx.requester;
+                const parsed = parseClawChatSessionKey(sessionKey);
+                if (!parsed || (requester?.channel && requester.channel !== CHANNEL_ID)) {
+                    warn("unknown-session");
+                    return block();
+                }
+                // Direct keys carry their account; group keys do not. A group turn is
+                // classified as non-owner at the session level; owner-only runs carry
+                // a separate snapshot. A group call without the requester
+                // account (host tool-search controls and the inner calls they run get
+                // a run-level ctx without one) still gets the non-owner policy; only
+                // the tools that act as an account need it. Conflicting ids block.
+                const keyAccountId = clawChatSessionAccountId(sessionKey);
+                const requesterAccountId = requester?.accountId?.trim()
+                    ? normalizeOpenclawClawlingAccountId(requester.accountId)
+                    : undefined;
+                const accountId = requesterAccountId ?? keyAccountId;
+                if (keyAccountId && keyAccountId !== accountId) {
                     warn("account-identity");
                     return block();
                 }
+                if (!accountId && parsed.kind === "group" && isOwnerSideRun(sessionKey, runId)) {
+                    return decideHostToolCall({ toolName: event.toolName, params: event.params ?? {}, sessionKey, runId,
+                        registeredTools: getRegisteredClawChatToolNames() });
+                }
+                if (!accountId) {
+                    if (parsed.kind !== "group" || ACCOUNT_SCOPED_TOOLS.includes(event.toolName)) {
+                        warn("account-identity");
+                        return block();
+                    }
+                    const cfg = readLiveConfig();
+                    const run = readTurnGrantRun(sessionKey, runId);
+                    if (run.kind === "unavailable")
+                        return block();
+                    const snapshotAccountId = run.kind === "bound" ? run.details.accountId : undefined;
+                    let account = null;
+                    try {
+                        if (snapshotAccountId) {
+                            // Unknown IDs otherwise inherit root settings. A removed account
+                            // must not acquire another account's public policy that way.
+                            if (listOpenclawClawlingAccountIds(cfg).includes(snapshotAccountId)) {
+                                account = resolveOpenclawClawlingAccount(cfg, snapshotAccountId);
+                            }
+                        }
+                        else {
+                            const active = listActiveAccountIds(cfg, { hasStoredIdentity });
+                            if (active.length === 1)
+                                account = resolveOpenclawClawlingAccount(cfg, active[0]);
+                        }
+                    }
+                    catch { /* Missing/unreadable dispatch accounts keep the conservative fallback. */ }
+                    nonOwnerToolAllowlist(account?.publicTools, api.logger);
+                    return decideHostToolCall({
+                        toolName: event.toolName,
+                        params: event.params ?? {},
+                        sessionKey,
+                        runId,
+                        ownerDirectConversationId: null,
+                        registeredTools: getRegisteredClawChatToolNames(),
+                        senderId: requester?.senderId,
+                        approvalRoute: approvalRoute(account?.accountId, [...grantsForRun(sessionKey, runId).values()].includes("ask")),
+                        accountId: account?.accountId,
+                        publicTools: account?.publicTools,
+                        // A bound run can have grants disabled. Use its recorded mode;
+                        // older/ambiguous snapshots keep the conservative grants-on path.
+                        toolGrants: account?.toolGrants ?? (run.kind === "bound" ? run.details.toolGrants ?? "on" : "off"),
+                        nonOwnerHostTools: account?.nonOwnerHostTools ?? "off",
+                    });
+                }
+                let ownerDirectConversationId = null;
+                try {
+                    ownerDirectConversationId = lookupOwnerConversation(accountId);
+                }
+                catch {
+                    // Treated as missing below; the allowlist still applies.
+                }
+                if (!ownerDirectConversationId?.trim())
+                    warn("missing-owner-conversation");
+                const account = resolveOpenclawClawlingAccount(readLiveConfig(), accountId);
+                nonOwnerToolAllowlist(account.publicTools, api.logger);
+                let ownerUserId = null;
+                if (AUTHORIZATION_TOOLS.includes(event.toolName)) {
+                    try {
+                        ownerUserId = options.ownerUserId ? options.ownerUserId(accountId)
+                            : resolveOwnerIdentity(openStore(), accountId, account.ownerUserId).ownerUserId;
+                    }
+                    catch { /* A missing owner identity cannot authorize grant tools. */ }
+                }
                 return decideHostToolCall({
                     toolName: event.toolName,
                     params: event.params ?? {},
                     sessionKey,
-                    ownerDirectConversationId: null,
+                    runId,
+                    ownerDirectConversationId,
                     registeredTools: getRegisteredClawChatToolNames(),
-                    approvalRoute: groupApprovalRoute(undefined),
+                    accountId,
+                    publicTools: account.publicTools,
+                    toolGrants: account.toolGrants,
+                    nonOwnerHostTools: account.nonOwnerHostTools,
+                    ownerUserId: ownerUserId ?? undefined,
+                    senderId: requester?.senderId,
+                    approvalRoute: approvalRoute(accountId, [...grantsForRun(sessionKey, runId).values()].includes("ask")),
                 });
             }
-            let ownerDirectConversationId = null;
-            try {
-                ownerDirectConversationId = lookupOwnerConversation(accountId);
-            }
             catch {
-                // Treated as missing below; the allowlist still applies.
+                warn("handler-exception");
+                return block();
             }
-            if (!ownerDirectConversationId?.trim())
-                warn("missing-owner-conversation");
-            return decideHostToolCall({
-                toolName: event.toolName,
-                params: event.params ?? {},
-                sessionKey,
-                ownerDirectConversationId,
-                registeredTools: getRegisteredClawChatToolNames(),
-                ...(parsed.kind === "group" ? { approvalRoute: groupApprovalRoute(accountId) } : {}),
-            });
-        }
-        catch {
-            warn("handler-exception");
-            return block();
-        }
+        })();
+        recordTurnArtifactCall(event, ctx, decision === undefined || "requireApproval" in decision);
+        return decision;
     });
+    api.on("after_tool_call", (event, ctx) => registerTurnArtifacts(event, ctx));
 }

package/dist/src/inbound.js

@@ -67,6 +67,8 @@ function extractMentionUsers(fragments) {
         .filter((mention) => mention !== null);
 }
 function normalizeMentionUsers(mentions) {
+    if (!Array.isArray(mentions))
+        return [];
     return mentions
         .map((mention) => {
         if (typeof mention === "string" && mention.length > 0)
@@ -181,7 +183,7 @@ export async function dispatchOpenclawClawlingInbound(params) {
         return;
     }
     const fragmentMentionUsers = extractMentionUsers(message.body.fragments);
-    const contextMentionUsers = normalizeMentionUsers(message.context.mentions);
+    const contextMentionUsers = normalizeMentionUsers(message.context?.mentions);
     const mentionedUsers = mergeMentionUsers(fragmentMentionUsers, contextMentionUsers);
     const mentionIds = mentionedUserIds(mentionedUsers);
     const rawBody = fragmentsToText(message.body.fragments, {
@@ -225,13 +227,14 @@ export async function dispatchOpenclawClawlingInbound(params) {
     // when a backend reply_mode="all" row overrides the static config.
     // Direct chats are unaffected (detectMention returns true for direct).
     log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw inbound event=${envelope.event} msg=${payload.message_id} from=${sender.id} text_len=${rawBody.length} mentioned=${wasMentioned}`);
-    const replyCtx = message.context.reply
+    const reply = message.context?.reply;
+    const replyCtx = reply
         ? {
-            replyToMessageId: message.context.reply.reply_to_msg_id,
+            replyToMessageId: reply.reply_to_msg_id,
             replyPreviewChatId: chatId,
-            replyPreviewSenderId: message.context.reply.reply_preview.id ?? "",
-            replyPreviewNickName: message.context.reply.reply_preview.nick_name ?? "",
-            replyPreviewText: fragmentsToText(message.context.reply.reply_preview.fragments),
+            replyPreviewSenderId: reply.reply_preview?.id ?? "",
+            replyPreviewNickName: reply.reply_preview?.nick_name ?? "",
+            replyPreviewText: fragmentsToText((Array.isArray(reply.reply_preview?.fragments) ? reply.reply_preview.fragments : [])),
         }
         : undefined;
     await params.ingest({

package/dist/src/memory-scope.js

@@ -5,15 +5,17 @@
 // factory ctx), never a parameter or the process environment:
 //
 //   owner DM (incl. plugin-started turns there) → every note
-//   friend DM → only users/<requesterSenderId>.md
-//   group     → groups/<this chat>.md + users/<id>.md of present members
+//   friend DM → owner.md + users/<requesterSenderId>.md
+//   group     → owner.md + groups/<this chat>.md + users/<id>.md of present members
 //   anything else (unknown session, missing store / peer, contradictions,
 //   ambiguous chat-id case, resolution errors) → nothing
 //
-// Writes: replace / edit need a readable note; append may go to any note
-// except owner.md, which only the owner DM writes. owner.md is injected into
-// the owner DM, where the agent has every tool, so text appended from a
-// friend or group turn would read there as the owner's own note.
+// owner.md body is also readable in a friend DM and a group: it is injected
+// into every turn, and what to say from it is left to the agent (platform
+// prompt). Its metadata block (behavior, profile) stays owner-DM-only for
+// the metadata tools.
+//
+// Writes: replace / edit need a readable note; append may go to any note.
 //
 // Chat ids compare case-insensitively (the host lowercases session keys);
 // the original case is recovered before any group file / SQL lookup. Member
@@ -138,6 +140,7 @@ export async function resolveMemoryScope(input) {
         return nothing();
     }
 }
+/** Whether the metadata tools may read or change the target (owner.md: owner DM only). */
 export function canReadMemory(scope, target) {
     if (scope.kind === "owner")
         return true;
@@ -147,41 +150,41 @@ export function canReadMemory(scope, target) {
         return scope.members.has(target.targetId);
     return scope.kind === "group" && target.targetType === "group" && target.targetId === scope.chatId;
 }
-/** Whether a write (`append` when `append` is true) may touch the target. */
-export function canWriteMemory(scope, target, append) {
+/** Whether a note body may be read, searched, replaced or edited. */
+export function canReadNote(scope, target) {
+    // A direct chat with no trusted peer reads nothing, owner.md included.
     if (target.targetType === "owner")
-        return scope.kind === "owner";
-    return append || canReadMemory(scope, target);
+        return scope.kind !== "unknown" && (scope.kind !== "direct" || scope.members.size > 0);
+    return canReadMemory(scope, target);
 }
-/** Refusal for an owner.md write outside the owner DM, with where to write instead. */
-export function ownerNoteWriteRefusal(scope) {
-    const base = "owner.md can only be changed in your owner's direct chat.";
-    const message = scope.kind === "direct"
-        ? `${base} Record this in the note about the person you are talking to (their users/<id>.md) instead.`
-        : scope.kind === "group"
-            ? `${base} Record this in the speaker's own note (users/<id>.md) or this group's note instead; if the owner wants it in owner.md, they can tell you in their direct chat.`
-            : base;
-    return { error: "not_writable_here", code: "memory_scope", message };
+/** Whether a write (`append` when `append` is true) may touch the target. */
+export function canWriteMemory(scope, target, append) {
+    return append || canReadNote(scope, target);
 }
 export function memoryScopeRefusal(scope, target) {
-    const message = target.targetType === "owner"
-        ? "owner.md can only be read in your owner's direct chat. Tool results stay in this conversation's history. Do not try to get the owner's notes another way."
-        : scope.kind === "direct"
-            ? "In this direct chat you can only read the note about the person you are talking to."
-            : scope.kind === "group"
-                ? "In a group you can only read this group's note and its members' notes."
-                : "This conversation could not be identified; no ClawChat notes are readable here.";
+    // For a known peer, owner-body reads are allowed; only metadata can reach
+    // the owner-target refusal below. A missing peer blocks every note body.
+    const message = scope.kind === "direct" && scope.members.size === 0
+        ? "The other person's identity could not be confirmed; no ClawChat notes are readable in this direct chat."
+        : target.targetType === "owner" && scope.kind !== "unknown"
+            ? "owner.md metadata can only be read or changed in your owner's direct chat."
+            : scope.kind === "direct"
+                ? "In this direct chat you can only read the note about the person you are talking to."
+                : scope.kind === "group"
+                    ? "In a group you can only read this group's note and its members' notes."
+                    : "This conversation could not be identified; no ClawChat notes are readable here.";
     return { error: "not_readable_here", code: "memory_scope", message };
 }
 /** What a restricted search left out, for the model (never counts). */
 export function memoryScopeNote(scope) {
+    if (scope.kind === "unknown" || (scope.kind === "direct" && scope.members.size === 0)) {
+        return "This conversation could not be identified; no ClawChat notes were searched.";
+    }
     if (scope.kind === "direct") {
-        return "In this direct chat only the note about the person you are talking to is searched; owner.md, other people's notes and group notes are left out.";
+        return "In this direct chat only owner.md and the note about the person you are talking to are searched; other people's notes and group notes are left out.";
     }
     if (scope.kind === "group") {
-        return "In a group only this group's note and its members' notes are searched; owner.md, other groups' notes and notes about non-members are left out.";
+        return "In a group only owner.md, that group's note and its members' notes are searched; other groups' notes and notes about non-members are left out.";
     }
-    if (scope.kind === "unknown")
-        return "This conversation could not be identified; no ClawChat notes were searched.";
     return undefined;
 }