@clawling/clawchat-plugin-openclaw 2026.10.9-1 → 2026.10.9-3

package/dist/src/reply-dispatcher.js

@@ -268,6 +268,20 @@ function formatApprovalSummary(payload) {
 export function createOpenclawClawlingReplyDispatcher(options) {
     const { cfg, runtime, account, client, target, replyCtx, inboundMessageId, store, resolveOwnerConversationId, resolveOwnerLocale, log, } = options;
     const isGroupTarget = target.chatType === "group";
+    let warnedLocalReplyMedia = false;
+    // Non-owner turns may only send remote (http/https) media. Local sources are
+    // dropped here, before any load, because the host's local media roots include
+    // the agent workspace. Warns once per dispatcher and never names the source.
+    function filterReplyMedia(urls) {
+        if (!options.nonOwnerTurn)
+            return urls;
+        const remote = urls.filter((source) => /^https?:\/\//i.test(source.trim()));
+        if (remote.length !== urls.length && !warnedLocalReplyMedia) {
+            warnedLocalReplyMedia = true;
+            log?.warn?.("clawchat-plugin-openclaw: non-owner reply media dropped; only http(s) URLs are allowed");
+        }
+        return remote;
+    }
     const outputVisibility = effectiveOutputVisibility(account, target.chatId, target.chatType);
     const splitFullOutput = outputVisibility === "full";
     const splitNormalBlockOutput = outputVisibility === "normal";
@@ -275,12 +289,10 @@ export function createOpenclawClawlingReplyDispatcher(options) {
     // owner's usr_… id: chat_id is resolved by msghub through member-backend, and
     // a usr_… comes back "invalid conversation id" — the frame is dropped with no
     // negative ack to this client, so the owner silently never gets the approval
-    // request. Both ids are required: ownerUserId gates whether an owner exists at
-    // all, the conversation id is where a frame can actually be delivered.
+    // request. The resolver is the shared strict owner-identity lookup
+    // (src/owner-identity.ts): it yields a conversation only for an activation
+    // row with an owner, so the config `ownerUserId` mirror is not consulted.
     const ownerDirectTarget = () => {
-        const ownerUserId = account.ownerUserId?.trim();
-        if (!ownerUserId)
-            return null;
         const conversationId = resolveOwnerConversationId?.()?.trim();
         return conversationId ? { chatId: conversationId, chatType: "direct" } : null;
     };
@@ -295,7 +307,8 @@ export function createOpenclawClawlingReplyDispatcher(options) {
             userId: account.userId,
         });
     };
-    async function uploadMediaUrls(urls) {
+    async function uploadMediaUrls(inputUrls) {
+        const urls = filterReplyMedia(inputUrls);
         if (urls.length === 0)
             return [];
         const apiClient = buildApiClient();
@@ -551,10 +564,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
     const sendOwnerAttention = async (fallbackText, richFragment = null) => {
         const ownerTarget = ownerDirectTarget();
         if (!ownerTarget) {
-            const reason = account.ownerUserId?.trim()
-                ? "missing_owner_conversation"
-                : "missing_owner_user_id";
-            log?.error?.(`[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=${reason} group=${target.chatId}`);
+            log?.error?.(`[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=missing_owner_conversation group=${target.chatId}`);
             return;
         }
         await sendOpenclawClawlingText({
@@ -726,7 +736,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                 return;
             const richFragment = buildRichInteractionFragment(payload);
             const text = richFragment && account.richInteractions ? "" : resolvePayloadText(payload);
-            const urls = resolveOutboundMediaUrls(payload).filter(Boolean);
+            const urls = filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean));
             log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw deliver kind=${info?.kind ?? "unknown"} text_len=${text.length} media_urls=${urls.length} reasoning=${payload.isReasoning === true}`);
             if (isGroupTarget && richFragment) {
                 if (info?.kind === "final")
@@ -820,6 +830,9 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                     log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw final skipped: already delivered at a message boundary`);
                     return;
                 }
+                // A non-owner final whose only content was dropped local media sends nothing.
+                if (options.nonOwnerTurn && !finalText.trim() && !richFragment && finalUrls.length === 0)
+                    return;
                 const mediaFragments = await uploadMediaUrls(finalUrls);
                 const result = await sendStatic(finalText, mediaFragments, richFragment && account.richInteractions ? [richFragment] : [], { recordMessage: true });
                 if (result?.messageId)
@@ -897,7 +910,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                     if (consumeTerminalSend("reasoning"))
                         return;
                     const text = resolvePayloadText(payload);
-                    await emitFullRuntimeText("reasoning", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+                    await emitFullRuntimeText("reasoning", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
                     const trimmed = text.trim();
                     if (trimmed)
                         reasoningText = reasoningText ? `${reasoningText}\n${trimmed}` : trimmed;
@@ -926,7 +939,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
                     const text = resolvePayloadText(payload);
                     if (isDefaultToolResultText(text))
                         return;
-                    await emitFullRuntimeText("tool result", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+                    await emitFullRuntimeText("tool result", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
                 }
                 : undefined,
             onItemEvent: splitFullOutput

package/dist/src/runtime.js

@@ -1,4 +1,5 @@
 import { applyDmRecallDefault } from "./dm-recall-default.js";
+import { HOST_FLOOR, HOST_TOOL_SEARCH_DEFAULT_ON, hostAtLeast, hostToolSearchEnabled } from "./host-version.js";
 import { AckTimeoutError, AuthError, ProtocolError, StateError, TransportError, EVENT, recallTargetMessageId, } from "./protocol-types.js";
 import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
@@ -29,7 +30,9 @@ import { flushAlignedOutboundQueue, getAlignedOutboundQueueSize, sendOpenclawCla
 import { formatWsLog } from "./ws-log.js";
 import { createNotifySignalObserver, createProtocolControlHandler, createReconnectTracker } from "./ws-alignment.js";
 import { clawChatDbPathForStateDir, getClawChatStore, makeOwnerProfilePersister, } from "./storage.js";
-import { getClawChatGroupPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
+import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
+import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.js";
+import { resolveOwnerIdentity } from "./owner-identity.js";
 import { loadClawChatPromptMetadata, renderClawChatProfilePrompt, resolveSenderRelation, } from "./profile-prompt.js";
 import { buildNoteMemorySection } from "./note-injection.js";
 import { buildGroupCatchUp, CATCH_UP_FETCH_ROWS, DeliveredGroupMessages } from "./group-catch-up.js";
@@ -713,6 +716,8 @@ async function waitForActivationCredentials(params) {
     });
     return null;
 }
+let warnedBelowHostFloor = false;
+let loggedHostToolSearch = false;
 export async function startOpenclawClawlingGateway(params) {
     const { cfg, abortSignal, setStatus, getStatus, log } = params;
     let account = params.account;
@@ -720,6 +725,19 @@ export async function startOpenclawClawlingGateway(params) {
     const runtime = getOpenclawClawlingRuntime();
     const accountId = account.accountId;
     const store = resolveConnectionStore(params, runtime);
+    if (!warnedBelowHostFloor && !hostAtLeast(runtime.version, HOST_FLOOR)) {
+        warnedBelowHostFloor = true;
+        log?.warn?.(`clawchat-plugin-openclaw: host ${runtime.version ?? "unknown"} is below ${HOST_FLOOR}; turns your owner did not start keep the host tools in their schema and rely on the before_tool_call block`);
+    }
+    if (!loggedHostToolSearch &&
+        hostAtLeast(runtime.version, HOST_TOOL_SEARCH_DEFAULT_ON) &&
+        hostToolSearchEnabled(cfg)) {
+        loggedHostToolSearch = true;
+        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
+    }
+    if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
+        log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+    }
     log?.info?.(`[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`);
     // Freeze one report device_id for this process; reused for the paired report
     // so the backend links both to the same row. Imported from ./client.ts.
@@ -1488,6 +1506,7 @@ export async function startOpenclawClawlingGateway(params) {
                 return;
             void startOpenclawClawlingGateway({
                 ...params,
+                boundaryWarningIssued: true,
                 account: { ...params.account },
                 // Carry the live refresh token forward (a rotation earlier this lifecycle
                 // leaves the in-memory `cfg` stale; see refreshTokenOverride).
@@ -1535,6 +1554,7 @@ export async function startOpenclawClawlingGateway(params) {
         // agent must NOT re-read it — thread the live refresh token forward instead.
         await startOpenclawClawlingGateway({
             ...params,
+            boundaryWarningIssued: true,
             account: {
                 ...params.account,
                 configured: true,
@@ -2116,15 +2136,25 @@ export async function startOpenclawClawlingGateway(params) {
     // "invalid conversation id" and msghub never acks the send. Proactive owner
     // messages must be addressed to the direct conversation recorded at
     // activation (parity with the hermes adapter's _owner_direct_chat_id).
-    const resolveOwnerDirectConversationId = () => {
-        const ownerUserId = account.ownerUserId?.trim();
-        if (!ownerUserId)
-            return null;
-        const conversationId = store
-            ?.getActivationConversation?.({ platform: "openclaw", accountId })
-            ?.conversationId?.trim();
-        return conversationId || null;
+    // One warning per failure class for this lifecycle; never logs ids or SQL.
+    const ownerIdentityWarnings = new Set();
+    const warnOwnerIdentity = (failure) => {
+        if (ownerIdentityWarnings.has(failure))
+            return;
+        ownerIdentityWarnings.add(failure);
+        try {
+            log?.warn?.(`clawchat-plugin-openclaw: ${failure}; owner identity unavailable`);
+        }
+        catch {
+            // Logging cannot change the (fail-closed) answer.
+        }
     };
+    const resolveOwnerDirectConversationId = () => 
+    // Shared strict resolver (src/owner-identity.ts): the SQLite activation
+    // row decides; the config `ownerUserId` mirror may be stale or absent and
+    // can neither hide nor invent the owner's direct chat. Unavailable storage
+    // or a cleared/rejected token yields no owner DM (fail closed).
+    resolveOwnerIdentity(store, accountId, account.ownerUserId, warnOwnerIdentity, params.rejectedActivationToken).conversationId;
     // R3: the owner's direct conversation is never gated by the dead-chat send
     // guard. If it were, the very message explaining why the agent went dark
     // (skill-update notices, auth/logout notices, group owner-attention
@@ -2836,8 +2866,28 @@ export async function startOpenclawClawlingGateway(params) {
         }
         turn = await withCachedGroupSenderNames(turn, memoryRoot);
         const conversationTarget = `${CHANNEL_ID}:${formatConversationSubject(turn.peer)}`;
-        const turnPrompt = await buildPromptForTurn(turn, memoryRoot);
         const senderIsOwner = turn.senderIsOwner === true || turn.senderId === account.ownerUserId;
+        // Owner turn <=> the owner's activation direct chat. Resolved per turn;
+        // any failure leaves it null, which classifies as non-owner (fail closed).
+        let ownerConversationId = null;
+        try {
+            ownerConversationId = resolveOwnerDirectConversationId();
+        }
+        catch {
+            ownerConversationId = null;
+        }
+        const turnClass = classifyChat({
+            kind: turn.peer.kind,
+            chatId: turn.peer.id,
+            ownerDirectConversationId: ownerConversationId,
+        });
+        const narrowHostTools = turnClass === "non-owner";
+        const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
+        const nonOwnerMediaGuidance = "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
+        const turnPrompt = [
+            ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            baseTurnPrompt,
+        ].filter(Boolean).join("\n\n");
         const ctxPayload = resolveChannelContextBuilder(rt)({
             channel: CHANNEL_ID,
             accountId: route.accountId ?? accountId,
@@ -2883,6 +2933,8 @@ export async function startOpenclawClawlingGateway(params) {
                 ...(isOpenClawTextSlashCommand(turn.rawBody, cfg) && senderIsOwner
                     ? { commands: { authorized: true, source: "text" } }
                     : {}),
+                // toolPolicy: host 2026.8.1+ (floor)
+                ...(narrowHostTools ? { toolPolicy: { allow: [...NON_OWNER_TOOL_ALLOWLIST] } } : {}),
             },
             ...(memoryRoot ? { extra: { memoryRoot } } : {}),
             // Deliver the rendered ClawChat per-turn prompt (owner agent_behavior,
@@ -2934,7 +2986,7 @@ export async function startOpenclawClawlingGateway(params) {
         if (stagedDirectPrompt) {
             stageClawChatPromptInjection({
                 sessionKey: resolvedSessionKey,
-                prompt: turnPrompt,
+                prompt: baseTurnPrompt,
             });
         }
         try {
@@ -2988,6 +3040,7 @@ export async function startOpenclawClawlingGateway(params) {
                 // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
                 // member-backend). Passed as a thunk so it is resolved at send time.
                 resolveOwnerConversationId: resolveOwnerDirectConversationId,
+                nonOwnerTurn: narrowHostTools,
                 log,
             });
             const agentsConfigured = Object.keys(cfg.agents ?? {});
@@ -2996,7 +3049,14 @@ export async function startOpenclawClawlingGateway(params) {
                 const dispatchResult = await rt.reply.withReplyDispatcher({
                     dispatcher,
                     onSettled: () => markDispatchIdle(),
-                    run: () => runWithTerminalClawChatSendScope(terminalSendScopeId, () => rt.reply.dispatchReplyFromConfig({ ctx: ctxPayload, cfg: dispatchCfg, dispatcher, replyOptions })),
+                    run: () => runWithTerminalClawChatSendScope(terminalSendScopeId, () => rt.reply.dispatchReplyFromConfig({
+                        ctx: ctxPayload,
+                        cfg: dispatchCfg,
+                        dispatcher,
+                        replyOptions: narrowHostTools
+                            ? { ...replyOptions, toolsAllow: [...NON_OWNER_TOOL_ALLOWLIST] }
+                            : replyOptions,
+                    })),
                 });
                 const counts = dispatchResult?.counts ?? {};
                 const queuedFinal = Boolean(dispatchResult?.queuedFinal);
@@ -3516,6 +3576,7 @@ export async function startOpenclawClawlingGateway(params) {
             if (activationAccount.source === "sqlite" && !abortSignal.aborted) {
                 await startOpenclawClawlingGateway({
                     ...params,
+                    boundaryWarningIssued: true,
                     account: {
                         ...params.account,
                         configured: false,

package/dist/src/storage.js

@@ -362,6 +362,40 @@ export class ClawChatStore {
             };
         }) ?? null;
     }
+    /**
+     * Strict owner-identity read for the non-owner turn boundary. Unlike the
+     * other getters (which collapse failure into null), this keeps "storage
+     * unavailable", "no activation row" and "row" apart — including incomplete
+     * rows — because only a proven-absent row may fall back to the config mirror
+     * (see `resolveOwnerIdentity`). Nothing is logged here: the caller warns
+     * once per failure class, and no SQL or credentials reach the log.
+     */
+    lookupActivationIdentity(input) {
+        if (!this.ensureInitialized())
+            return { status: "unavailable" };
+        try {
+            const row = this.requireDb()
+                .prepare("SELECT owner_user_id, conversation_id, access_token FROM activations WHERE platform = ? AND account_id = ?")
+                .get(input.platform, input.accountId);
+            if (!row)
+                return { status: "absent" };
+            const value = (key) => {
+                const raw = row[key];
+                return typeof raw === "string" ? raw.trim() || null : null;
+            };
+            return {
+                status: "row",
+                row: {
+                    ownerUserId: value("owner_user_id"),
+                    conversationId: value("conversation_id"),
+                    accessToken: value("access_token"),
+                },
+            };
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+    }
     claimPendingActivationBootstrap(input) {
         return this.write(() => {
             const now = Date.now();
@@ -710,13 +744,18 @@ export class ClawChatStore {
      * as `'thinking'` are excluded so the @-mention prior-context block never
      * surfaces the agent's intermediate output as conversation history.
      * Uses `idx_clawchat_messages_chat_created` for performance.
+     * `ignoreCase` matches `chat_id` case-insensitively (rows keep their stored
+     * case) so memory scope can recover a group id's original case from a
+     * lowercased session key; it cannot use that index, so callers that already
+     * know the exact id leave it off.
      * Returns an empty array if the store is unavailable.
      */
-    listRecentGroupMessages(platform, accountId, chatId, limit) {
+    listRecentGroupMessages(platform, accountId, chatId, limit, options = {}) {
+        const chatMatch = options.ignoreCase ? "chat_id = ? COLLATE NOCASE" : "chat_id = ?";
         return this.read(() => {
             const rows = this.requireDb()
                 .prepare(`SELECT * FROM clawchat_messages
-            WHERE platform = ? AND account_id = ? AND chat_id = ? AND kind = 'message'
+            WHERE platform = ? AND account_id = ? AND ${chatMatch} AND kind = 'message'
             ORDER BY created_at DESC, rowid DESC LIMIT ?`)
                 .all(platform, accountId, chatId, limit);
             return rows.reverse(); // oldest-first for prompt order

package/dist/src/tools.js

@@ -12,6 +12,8 @@ import { sendOpenclawClawlingMentionMessage, sendOpenclawClawlingReaction } from
 import { getOpenclawClawlingClient, } from "./runtime.js";
 import { markTerminalClawChatSend, getCurrentTerminalSendScope } from "./terminal-send.js";
 import { editClawChatMemoryBody, readClawChatMemoryFile, resolveClawChatMemoryPath, searchClawChatMemory, writeClawChatMemoryBody, } from "./clawchat-memory.js";
+import { canReadMemory, memoryScopeNote, memoryScopeRefusal, resolveMemoryScope, } from "./memory-scope.js";
+import { clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.js";
 import { pullGroupMetadata, pullOwnerMetadata, pullUserMetadata, pushMetadata, updateMetadata, } from "./clawchat-metadata.js";
 import { ClawchatGetAccountProfileSchema, ClawchatGetConversationSchema, ClawchatGetDirectConversationSchema, ClawchatGetMomentSchema, ClawchatGetUserProfileSchema, ClawchatLeaveGroupSchema, ClawchatAddGroupMemberSchema, ClawchatAcceptFriendRequestSchema, ClawchatMemoryEditSchema, ClawchatMemoryReadSchema, ClawchatMemorySearchSchema, ClawchatMemoryWriteSchema, ClawchatMetadataSyncSchema, ClawchatMetadataUpdateSchema, ClawchatCreateMomentCommentSchema, ClawchatCreateMomentSchema, ClawchatDeleteMomentCommentSchema, ClawchatDeleteMomentSchema, ClawchatListAccountFriendsSchema, ClawchatListFriendRequestsSchema, ClawchatListMomentsSchema, ClawchatMentionMessageSchema, ClawchatReactMessageSchema, ClawchatReplyMomentCommentSchema, ClawchatRejectFriendRequestSchema, ClawchatRemoveFriendSchema, ClawchatSearchUsersSchema, ClawchatSendFriendRequestSchema, ClawchatToggleMomentReactionSchema, ClawchatUpdateAccountProfileSchema, ClawchatUploadAvatarImageSchema, ClawchatRegisterAppSchema, ClawchatListAppsSchema, ClawchatUnregisterAppSchema, ClawchatLivewareLoginSchema, ClawchatOrchListAgentsSchema, ClawchatOrchGetAgentSchema, ClawchatOrchSetAgentBehaviorSchema, ClawchatOrchListGroupsSchema, ClawchatOrchGetGroupSchema, ClawchatOrchSetGroupPromptSchema, ClawchatOrchCreateGroupSchema, ClawchatOrchGroupMemberSchema, ClawchatOrchSetGroupAgentSettingsSchema, ClawchatOrchCreateConnectCodeSchema, ClawchatOrchGetConnectCodeSchema, } from "./tools-schema.js";
 const MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
@@ -123,8 +125,9 @@ const MEMORY_READ_MAX_LIMIT = 100_000;
 function toolDescription(...parts) {
     return `${parts.join("")} ${DIRECT_TOOL_GUARD}`;
 }
+const MEMORY_SCOPE_DESCRIPTION = "In a non-owner direct chat only that person's note is readable; in a group only that group's note and its members' notes are readable. owner.md is readable only in the owner's direct chat. Replace, edit and metadata operations require a readable target; append may add facts to any target without revealing existing content.";
 function memoryToolDescription(...parts) {
-    return parts.join("");
+    return `${parts.join("")} ${MEMORY_SCOPE_DESCRIPTION}`;
 }
 function inferMimeFromPath(filePath) {
     const ext = path.extname(filePath).toLowerCase();
@@ -241,6 +244,31 @@ export function resolveOpenclawClawlingToolAccountId(ctx) {
     }
     return null;
 }
+// Names this plugin registered through its wrapper below. The host-tool guard
+// lets an allowlisted `clawchat_*` name through only when it is in this set,
+// so another plugin's tool under a lookalike name is not trusted by prefix.
+const registeredClawChatToolNames = new Set();
+/** Snapshot of the tool names this plugin registered; callers cannot mutate the record. */
+export function getRegisteredClawChatToolNames() {
+    return new Set(registeredClawChatToolNames);
+}
+// Host tool search (OpenClaw 2026.9.6+) hides every tool not marked
+// `catalogMode: "direct-only"` behind tool_search/tool_call, whose hook ctx has
+// no requester. The allowlisted tools stay directly callable so non-owner
+// turns keep the full hook ctx; older hosts ignore the field.
+function markDirectOnly(tool) {
+    return Object.assign(tool, { catalogMode: "direct-only" });
+}
+function directOnlyTool(tool) {
+    if (typeof tool !== "function")
+        return markDirectOnly(tool);
+    return (ctx) => {
+        const resolved = tool(ctx);
+        if (Array.isArray(resolved))
+            return resolved.map(markDirectOnly);
+        return resolved ? markDirectOnly(resolved) : resolved;
+    };
+}
 export function registerOpenclawClawlingTools(api, options = {}) {
     if (!api.config) {
         api.logger.debug?.("clawchat-plugin-openclaw: api.config missing; skipping tool registration");
@@ -250,9 +278,14 @@ export function registerOpenclawClawlingTools(api, options = {}) {
     // the end is derived from what was actually registered, not hand-maintained.
     const registeredToolNames = [];
     const registerTool = (tool, opts) => {
-        if (opts?.name)
+        const directOnly = Boolean(opts?.name && NON_OWNER_TOOL_ALLOWLIST.includes(opts.name));
+        api.registerTool(directOnly ? directOnlyTool(tool) : tool, opts);
+        // Recorded only after registerTool returned without throwing (the SDK
+        // returns void, so host-side duplicate rejection is not observable here).
+        if (opts?.name) {
             registeredToolNames.push(opts.name);
-        api.registerTool(tool, opts);
+            registeredClawChatToolNames.add(opts.name);
+        }
     };
     // Re-resolve at call time so config reloads pick up new tokens / baseUrl.
     function resolveCurrent(accountId) {
@@ -452,6 +485,49 @@ export function registerOpenclawClawlingTools(api, options = {}) {
     function isUnsafeMemoryPathError(message) {
         return /Unsafe clawchat memory|Resolved clawchat memory path is outside root/i.test(message);
     }
+    // One warning per failure class per registration; never tool arguments.
+    const scopeWarnings = new Set();
+    function warnScopeOnce(failure) {
+        if (scopeWarnings.has(failure))
+            return;
+        scopeWarnings.add(failure);
+        try {
+            api.logger.warn(`clawchat-plugin-openclaw: memory scope ${failure}; no additional notes readable`);
+        }
+        catch {
+            // Logging must not widen or break the (restrictive) scope.
+        }
+    }
+    /**
+     * Scope of the conversation behind this call, resolved fresh on every call
+     * (activation and group membership can change between calls). The account
+     * comes from the direct session key and/or the trusted tool context; a
+     * missing or contradictory account reads nothing.
+     */
+    async function memoryScopeFor(ctx, root) {
+        const sessionAccount = clawChatSessionAccountId(ctx.sessionKey) ?? null;
+        const contextAccount = resolveOpenclawClawlingToolAccountId(ctx);
+        if (sessionAccount && contextAccount && sessionAccount !== contextAccount) {
+            warnScopeOnce("account-mismatch");
+            return { kind: "unknown", chatId: "", members: new Set() };
+        }
+        const accountId = sessionAccount ?? contextAccount;
+        if (!accountId)
+            return { kind: "unknown", chatId: "", members: new Set() };
+        const delivery = ctx.deliveryContext;
+        return resolveMemoryScope({
+            root,
+            ctx: {
+                sessionKey: ctx.sessionKey,
+                requesterSenderId: ctx.requesterSenderId,
+                deliveryContext: delivery?.channel === CHANNEL_ID ? { to: delivery.to } : undefined,
+            },
+            accountId,
+            configOwnerUserId: resolveCurrent(accountId).ownerUserId,
+            store: resolveStore(),
+            warn: warnScopeOnce,
+        });
+    }
     function memoryToolError(err) {
         if (err instanceof ClawlingApiError)
             return apiError(err);
@@ -478,11 +554,14 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                 }
                 try {
                     const p = params;
-                    return jsonResponse(await searchClawChatMemory(root, {
+                    const scope = await memoryScopeFor(ctx, root);
+                    const result = await searchClawChatMemory(root, {
                         query: p.query,
                         targetTypes: p.targetTypes,
                         maxResults: p.maxResults,
-                    }));
+                    }, { readable: (target) => canReadMemory(scope, target) });
+                    const scopeNote = memoryScopeNote(scope);
+                    return jsonResponse({ ...result, ...(scopeNote ? { scopeNote } : {}) });
                 }
                 catch (err) {
                     return memoryToolError(err);
@@ -507,8 +586,12 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                     const targetError = validateTarget(root, p);
                     if (targetError)
                         return memoryToolError(new Error(targetError));
+                    const target = targetFromParams(p);
+                    const scope = await memoryScopeFor(ctx, root);
+                    if (!canReadMemory(scope, target))
+                        return jsonResponse(memoryScopeRefusal(scope, target));
                     const { offset, limit } = normalizeReadBounds(p);
-                    const file = await readClawChatMemoryFile(root, targetFromParams(p));
+                    const file = await readClawChatMemoryFile(root, target);
                     if (!file.exists) {
                         return jsonResponse({
                             exists: false,
@@ -553,15 +636,26 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                 if (!root) {
                     return validationError("clawchat-plugin-openclaw: OpenClaw workspaceDir is required");
                 }
+                const p = params;
+                let readable = false;
                 try {
-                    const p = params;
                     const targetError = validateTarget(root, p);
                     if (targetError)
                         return memoryToolError(new Error(targetError));
-                    await writeClawChatMemoryBody(root, targetFromParams(p), p.mode, p.content);
+                    const target = targetFromParams(p);
+                    const scope = await memoryScopeFor(ctx, root);
+                    readable = canReadMemory(scope, target);
+                    // Replacing wipes what is there; append may go to any note.
+                    if (p.mode !== "append" && !readable)
+                        return jsonResponse(memoryScopeRefusal(scope, target));
+                    await writeClawChatMemoryBody(root, target, p.mode, p.content);
                     return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId, mode: p.mode });
                 }
                 catch (err) {
+                    // An unreadable note's failure text could reveal its state.
+                    if (p.mode === "append" && !readable) {
+                        return jsonResponse({ error: "memory_write_failed", message: "The memory append could not be completed." });
+                    }
                     return memoryToolError(err);
                 }
             },
@@ -586,7 +680,11 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                     const targetError = validateTarget(root, p);
                     if (targetError)
                         return memoryToolError(new Error(targetError));
-                    await editClawChatMemoryBody(root, targetFromParams(p), p.oldText, p.newText);
+                    const target = targetFromParams(p);
+                    const scope = await memoryScopeFor(ctx, root);
+                    if (!canReadMemory(scope, target))
+                        return jsonResponse(memoryScopeRefusal(scope, target));
+                    await editClawChatMemoryBody(root, target, p.oldText, p.newText);
                     return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId });
                 }
                 catch (err) {
@@ -612,14 +710,18 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                     if (!root) {
                         return validationError("clawchat-plugin-openclaw: OpenClaw workspaceDir is required");
                     }
-                    const built = buildClient(accountId);
-                    if (!built.ok)
-                        return built.error;
                     try {
                         const p = params;
                         const targetError = validateTarget(root, p);
                         if (targetError)
                             return memoryToolError(new Error(targetError));
+                        const target = targetFromParams(p);
+                        const scope = await memoryScopeFor(ctx, root);
+                        if (!canReadMemory(scope, target))
+                            return jsonResponse(memoryScopeRefusal(scope, target));
+                        const built = buildClient(accountId);
+                        if (!built.ok)
+                            return built.error;
                         const account = resolveCurrent(accountId);
                         if (p.direction === "push") {
                             if (!Array.isArray(p.fields) || p.fields.length === 0) {
@@ -683,9 +785,6 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                     if (!root) {
                         return validationError("clawchat-plugin-openclaw: OpenClaw workspaceDir is required");
                     }
-                    const built = buildClient(accountId);
-                    if (!built.ok)
-                        return built.error;
                     try {
                         const p = params;
                         const targetError = validateTarget(root, p);
@@ -694,6 +793,13 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                         const patchError = validateMetadataUpdatePatch(p);
                         if (patchError)
                             return validationError(patchError);
+                        const target = targetFromParams(p);
+                        const scope = await memoryScopeFor(ctx, root);
+                        if (!canReadMemory(scope, target))
+                            return jsonResponse(memoryScopeRefusal(scope, target));
+                        const built = buildClient(accountId);
+                        if (!built.ok)
+                            return built.error;
                         const account = resolveCurrent(accountId);
                         if (p.targetType === "owner" && !account.agentId) {
                             return configError("clawchat-plugin-openclaw: agentId is required");
@@ -1076,7 +1182,7 @@ export function registerOpenclawClawlingTools(api, options = {}) {
             label: "React to ClawChat Message",
             description: toolDescription("React to a ClawChat message with a single quick emoji (the bubble long-press reaction), instead of sending a text message. " +
                 "TRIGGER - invoke when a short acknowledgement or emotional beat (agreement, thanks, laughter, celebration, sympathy) reads more naturally as an emoji on the message than as a sentence, e.g. a simple 👍 to \"done\" or ❤️ to good news. " +
-                "Omit targetMessageId and chatId to react to the message that triggered the current turn; pass targetMessageId to react to an earlier message. " +
+                "In the owner's direct chat, omit targetMessageId and chatId to react to the message that triggered the current turn; pass targetMessageId to react to an earlier message. In group chats and other direct chats, always pass this chat's chatId. " +
                 "Set remove:true to take back your reaction. " +
                 "Prefer the quick set 👍 ❤️ 😂 😮 😢 🙏 🎉 👏 🔥 😍 🤔. " +
                 "When a reaction is all you want to send, do not also send a normal text reply."),

package/dist/src/turn-boundary.js

@@ -0,0 +1,51 @@
+// Who started this turn? The owner's turns are exactly the ones in the owner's
+// activation direct chat (whoever the sender is — plugin-started turns there
+// count). Every group turn and every other direct chat is someone else's.
+// Anything we cannot place is treated as someone else's (fail closed).
+import { CHANNEL_ID, normalizeOpenclawClawlingAccountId } from "./config.js";
+/** Tools a turn the owner did not start may still see and call. */
+export const NON_OWNER_TOOL_ALLOWLIST = Object.freeze([
+    "clawchat_memory_search", "clawchat_memory_read", "clawchat_memory_write", "clawchat_memory_edit",
+    "clawchat_mention_message", "clawchat_react_message", "clawchat_get_user_profile", "clawchat_metadata_sync",
+    "web_search",
+]);
+const norm = (v) => (typeof v === "string" ? v.trim().toLowerCase() : "");
+/**
+ * Host session keys (dmScope per-account-channel-peer):
+ *   agent:<agent>:<channel>:<account>:direct:<chat>
+ *   agent:<agent>:<channel>:group:<chat>
+ */
+export function parseClawChatSessionKey(sessionKey) {
+    const parts = norm(sessionKey).split(":");
+    if (parts.length < 5 || parts[0] !== "agent" || parts[2] !== CHANNEL_ID)
+        return null;
+    if (parts[3] === "group" && parts.length === 5 && parts[4])
+        return { kind: "group", chatId: parts[4] };
+    if (parts[4] === "direct" && parts.length === 6 && parts[5])
+        return { kind: "direct", chatId: parts[5] };
+    return null;
+}
+/**
+ * Account id carried by a ClawChat direct session key, normalized exactly once
+ * with the plugin's account-id normalizer. Group keys carry no account
+ * segment, and a blank segment is missing (never silently "default").
+ */
+export function clawChatSessionAccountId(sessionKey) {
+    if (parseClawChatSessionKey(sessionKey)?.kind !== "direct")
+        return undefined;
+    const segment = (sessionKey ?? "").trim().split(":")[3]?.trim();
+    return segment ? normalizeOpenclawClawlingAccountId(segment) : undefined;
+}
+export function classifyChat(input) {
+    const owner = norm(input.ownerDirectConversationId);
+    const chat = norm(input.chatId);
+    if (input.kind !== "direct" || !owner || !chat)
+        return "non-owner";
+    return chat === owner ? "owner" : "non-owner";
+}
+export function classifyTurn(input) {
+    const parsed = parseClawChatSessionKey(input.sessionKey);
+    if (!parsed)
+        return "non-owner";
+    return classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId });
+}

package/index.ts

@@ -3,6 +3,7 @@ import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
 import { openclawClawlingPlugin } from "./src/channel.ts";
 import { registerOpenclawClawlingCommands } from "./src/commands.ts";
 import { openclawClawlingConfigSchema } from "./src/config.ts";
+import { registerHostToolsGuard } from "./src/host-tools-guard.ts";
 import {
   registerClawChatPromptInjection,
   type ClawChatPromptInjectionApi,
@@ -20,6 +21,9 @@ const channelEntry = defineChannelPluginEntry({
   registerFull(api) {
     registerClawChatPromptInjection(api as unknown as ClawChatPromptInjectionApi);
     registerOpenclawClawlingTools(api);
+    // Fail-closed host-tool guard for turns the owner did not start. After the
+    // tools so their names are recorded; not gated by conversation access.
+    registerHostToolsGuard(api);
     // NOTE: the legacy-rename config migration is intentionally NOT registered
     // here. The host's setup-migration runner only loads a plugin's SETUP source
     // (`openclaw.setupEntry`/`runtimeSetupEntry` → setup-entry.ts) and calls its