@clawling/clawchat-plugin-openclaw 2026.10.9-1 → 2026.10.9-3

package/src/memory-scope.ts

@@ -0,0 +1,191 @@
+// Which ClawChat notes the conversation behind a memory / metadata tool call
+// may read. A tool result stays in the calling session's history, and a group
+// is one session for everyone in it, so a note read there can surface to
+// anyone present later. Scope therefore follows the conversation (tool
+// factory ctx), never a parameter or the process environment:
+//
+//   owner DM (incl. plugin-started turns there) → every note
+//   friend DM → only users/<requesterSenderId>.md
+//   group     → groups/<this chat>.md + users/<id>.md of present members
+//   anything else (unknown session, missing store / peer, contradictions,
+//   ambiguous chat-id case, resolution errors) → nothing
+//
+// Chat ids compare case-insensitively (the host lowercases session keys);
+// the original case is recovered before any group file / SQL lookup. Member
+// user ids stay case-sensitive.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { readClawChatMemoryFile, type ClawChatMemoryTarget } from "./clawchat-memory.ts";
+import { resolveOwnerIdentity } from "./owner-identity.ts";
+import type { ClawChatStore } from "./storage.ts";
+import { classifyTurn, parseClawChatSessionKey } from "./turn-boundary.ts";
+
+export type MemoryToolContext = {
+  sessionKey?: string;
+  requesterSenderId?: string | null;
+  deliveryContext?: { to?: string };
+};
+
+export type MemoryScope = {
+  kind: "owner" | "direct" | "group" | "unknown";
+  chatId: string;
+  members: ReadonlySet<string>;
+};
+
+export type MemoryScopeStore = Partial<Pick<ClawChatStore, "lookupActivationIdentity" | "listRecentGroupMessages">>;
+
+/** Rows scanned for recent speakers when a group note has no participant list. */
+const SPEAKER_FALLBACK_ROWS = 200;
+
+const nothing = (): MemoryScope => ({ kind: "unknown", chatId: "", members: new Set() });
+
+async function groupNoteIds(root: string): Promise<string[]> {
+  try {
+    return (await fs.readdir(path.join(root, "groups")))
+      .filter((name) => name.endsWith(".md"))
+      .map((name) => name.slice(0, -3));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+    throw error;
+  }
+}
+
+function participantIds(metadata: Record<string, string>): Set<string> {
+  return new Set((metadata.participant_ids ?? "").split(",").map((id) => id.trim()).filter(Boolean));
+}
+
+function inboundSenderId(rawJson: string | null): string | null {
+  if (!rawJson) return null;
+  const sender = (JSON.parse(rawJson) as { sender?: { id?: unknown } } | null)?.sender?.id;
+  return typeof sender === "string" && sender.trim() ? sender.trim() : null;
+}
+
+export async function resolveMemoryScope(input: {
+  root: string;
+  ctx: MemoryToolContext;
+  accountId: string;
+  configOwnerUserId?: string | null;
+  store: MemoryScopeStore | null;
+  warn?: (failureClass: string) => void;
+}): Promise<MemoryScope> {
+  const { root, ctx, accountId, store, warn } = input;
+  try {
+    const parsed = parseClawChatSessionKey(ctx.sessionKey);
+    if (!parsed) return nothing();
+    if (!store) {
+      warn?.("store-unavailable");
+      return nothing();
+    }
+    const lowered = parsed.chatId; // the parser lowercases
+    let chatId = lowered;
+    let caseKnown = false;
+
+    // 1. The trusted delivery route usually carries the original-case id.
+    const destination = ctx.deliveryContext?.to?.trim()
+      .replace(/^(?:clawchat-plugin-openclaw:)?(?:group|direct):/i, "");
+    if (destination && destination.toLowerCase() === lowered) {
+      chatId = destination;
+      caseKnown = true;
+    }
+
+    // 2. A group note filename, which wins: it is the file that will be read.
+    //    Two notes differing only in case are ambiguous.
+    const fileMatches = (await groupNoteIds(root)).filter((id) => id.toLowerCase() === lowered);
+    if (fileMatches.length > 1) {
+      warn?.("ambiguous-chat-case");
+      return nothing();
+    }
+    const groupFileId = fileMatches[0];
+    if (groupFileId !== undefined) {
+      chatId = groupFileId;
+      caseKnown = true;
+    }
+    const members = groupFileId === undefined
+      ? new Set<string>()
+      : participantIds((await readClawChatMemoryFile(root, { targetType: "group", targetId: groupFileId })).metadata);
+
+    if (parsed.kind === "direct") {
+      // A chat the plugin knows as a group can never be a direct chat.
+      if (members.size) {
+        warn?.("contradictory-chat-kind");
+        return nothing();
+      }
+      const ownerConversationId = resolveOwnerIdentity(store, accountId, input.configOwnerUserId, warn).conversationId;
+      if (classifyTurn({ sessionKey: ctx.sessionKey, ownerDirectConversationId: ownerConversationId }) === "owner") {
+        return { kind: "owner", chatId: ownerConversationId!, members: new Set() };
+      }
+      const peer = typeof ctx.requesterSenderId === "string" ? ctx.requesterSenderId.trim() : "";
+      if (!peer) warn?.("missing-dm-peer");
+      return { kind: "direct", chatId: parsed.chatId, members: new Set(peer ? [peer] : []) };
+    }
+
+    // 3. No cached participant list: recent inbound speakers. When neither the
+    //    route nor a filename supplied the case, the case-insensitive query is
+    //    the recovery path and its stored chat_id supplies the original case.
+    if (!members.size) {
+      if (!store.listRecentGroupMessages) {
+        warn?.("store-unavailable");
+        return nothing();
+      }
+      const rows = store.listRecentGroupMessages("openclaw", accountId, chatId, SPEAKER_FALLBACK_ROWS, {
+        ignoreCase: !caseKnown,
+      });
+      if (!caseKnown) {
+        const storedIds = new Set(rows.map((row) => row.chat_id)
+          .filter((id): id is string => typeof id === "string" && id.toLowerCase() === lowered));
+        if (storedIds.size > 1) {
+          warn?.("ambiguous-chat-case");
+          return nothing();
+        }
+        if (storedIds.size === 1) chatId = [...storedIds][0]!;
+      }
+      for (const row of rows) {
+        if (row.direction !== "inbound") continue;
+        try {
+          const sender = inboundSenderId(row.raw_json);
+          if (sender) members.add(sender);
+        } catch {
+          warn?.("malformed-group-row");
+        }
+      }
+    }
+    return { kind: "group", chatId, members };
+  } catch {
+    warn?.("scope-resolution");
+    return nothing();
+  }
+}
+
+export function canReadMemory(scope: MemoryScope, target: ClawChatMemoryTarget): boolean {
+  if (scope.kind === "owner") return true;
+  if (scope.kind === "unknown" || target.targetType === "owner") return false;
+  if (target.targetType === "user") return scope.members.has(target.targetId);
+  return scope.kind === "group" && target.targetType === "group" && target.targetId === scope.chatId;
+}
+
+export function memoryScopeRefusal(scope: MemoryScope, target: ClawChatMemoryTarget): {
+  error: "not_readable_here";
+  code: "memory_scope";
+  message: string;
+} {
+  const message = target.targetType === "owner"
+    ? "owner.md can only be read in your owner's direct chat. Tool results stay in this conversation's history. Do not try to get the owner's notes another way."
+    : scope.kind === "direct"
+      ? "In this direct chat you can only read the note about the person you are talking to."
+      : scope.kind === "group"
+        ? "In a group you can only read this group's note and its members' notes."
+        : "This conversation could not be identified; no ClawChat notes are readable here.";
+  return { error: "not_readable_here", code: "memory_scope", message };
+}
+
+/** What a restricted search left out, for the model (never counts). */
+export function memoryScopeNote(scope: MemoryScope): string | undefined {
+  if (scope.kind === "direct") {
+    return "In this direct chat only the note about the person you are talking to is searched; owner.md, other people's notes and group notes are left out.";
+  }
+  if (scope.kind === "group") {
+    return "In a group only this group's note and its members' notes are searched; owner.md, other groups' notes and notes about non-members are left out.";
+  }
+  if (scope.kind === "unknown") return "This conversation could not be identified; no ClawChat notes were searched.";
+  return undefined;
+}

package/src/owner-identity.ts

@@ -0,0 +1,49 @@
+// The one definition of "who is the owner, and which chat is the owner's DM"
+// shared by dispatch, the host-tool guard and memory scope. The SQLite
+// activation row decides; the config `ownerUserId` mirror is only a fallback
+// once a working store has proved there is no activation row at all. An
+// unavailable store, a failed read, a cleared/rejected token or an incomplete
+// row never falls back to the mirror — the caller sees no owner (fail closed).
+
+export type ActivationIdentityLookup =
+  | { status: "unavailable" }
+  | { status: "absent" }
+  | {
+      status: "row";
+      row: { ownerUserId: string | null; conversationId: string | null; accessToken: string | null };
+    };
+
+/** Structural so focused fixtures can omit unrelated store methods. */
+export type OwnerIdentityStore = {
+  lookupActivationIdentity?(input: { platform: string; accountId: string }): ActivationIdentityLookup;
+};
+
+export type OwnerIdentity = { ownerUserId: string | null; conversationId: string | null };
+
+export function resolveOwnerIdentity(
+  store: OwnerIdentityStore | null | undefined,
+  accountId: string,
+  configOwnerUserId?: string | null,
+  warn?: (failure: string) => void,
+  rejectedActivationToken?: string,
+): OwnerIdentity {
+  const denied: OwnerIdentity = { ownerUserId: null, conversationId: null };
+  try {
+    const lookup = store?.lookupActivationIdentity?.({ platform: "openclaw", accountId });
+    if (!lookup || lookup.status === "unavailable") {
+      warn?.("owner-identity");
+      return denied;
+    }
+    if (lookup.status === "absent") {
+      return { ownerUserId: configOwnerUserId?.trim() || null, conversationId: null };
+    }
+    const { row } = lookup;
+    // Mirror the runtime overlay: never trust the activation rejected during this lifecycle.
+    if (!row.accessToken || row.accessToken === rejectedActivationToken) return denied;
+    const ownerUserId = row.ownerUserId?.trim() || null;
+    return { ownerUserId, conversationId: ownerUserId ? row.conversationId?.trim() || null : null };
+  } catch {
+    warn?.("owner-identity");
+    return denied;
+  }
+}

package/src/reply-dispatcher.ts

@@ -88,7 +88,13 @@ export interface ReplyDispatcherOptions {
    * framework error final; null/absent means English.
    */
   resolveOwnerLocale?: () => string | null;
-  log?: { info?: (m: string) => void; error?: (m: string) => void };
+  /**
+   * True when the turn was not started by the owner (any group turn, any
+   * non-owner direct chat). Reply media is then limited to http(s) URLs; local
+   * paths are never loaded. Legacy standalone callers default to owner behavior.
+   */
+  nonOwnerTurn?: boolean;
+  log?: { info?: (m: string) => void; warn?: (m: string) => void; error?: (m: string) => void };
 }
 
 type TypedReplyDispatcherResult = ReturnType<
@@ -435,6 +441,19 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
     log,
   } = options;
   const isGroupTarget = target.chatType === "group";
+  let warnedLocalReplyMedia = false;
+  // Non-owner turns may only send remote (http/https) media. Local sources are
+  // dropped here, before any load, because the host's local media roots include
+  // the agent workspace. Warns once per dispatcher and never names the source.
+  function filterReplyMedia(urls: string[]): string[] {
+    if (!options.nonOwnerTurn) return urls;
+    const remote = urls.filter((source) => /^https?:\/\//i.test(source.trim()));
+    if (remote.length !== urls.length && !warnedLocalReplyMedia) {
+      warnedLocalReplyMedia = true;
+      log?.warn?.("clawchat-plugin-openclaw: non-owner reply media dropped; only http(s) URLs are allowed");
+    }
+    return remote;
+  }
   const outputVisibility = effectiveOutputVisibility(account, target.chatId, target.chatType);
   const splitFullOutput = outputVisibility === "full";
   const splitNormalBlockOutput = outputVisibility === "normal";
@@ -442,11 +461,10 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   // owner's usr_… id: chat_id is resolved by msghub through member-backend, and
   // a usr_… comes back "invalid conversation id" — the frame is dropped with no
   // negative ack to this client, so the owner silently never gets the approval
-  // request. Both ids are required: ownerUserId gates whether an owner exists at
-  // all, the conversation id is where a frame can actually be delivered.
+  // request. The resolver is the shared strict owner-identity lookup
+  // (src/owner-identity.ts): it yields a conversation only for an activation
+  // row with an owner, so the config `ownerUserId` mirror is not consulted.
   const ownerDirectTarget = (): { chatId: string; chatType: "direct" } | null => {
-    const ownerUserId = account.ownerUserId?.trim();
-    if (!ownerUserId) return null;
     const conversationId = resolveOwnerConversationId?.()?.trim();
     return conversationId ? { chatId: conversationId, chatType: "direct" as const } : null;
   };
@@ -462,7 +480,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
     });
   };
 
-  async function uploadMediaUrls(urls: string[]): Promise<ClawlingMediaFragment[]> {
+  async function uploadMediaUrls(inputUrls: string[]): Promise<ClawlingMediaFragment[]> {
+    const urls = filterReplyMedia(inputUrls);
     if (urls.length === 0) return [];
     const apiClient = buildApiClient();
     if (!apiClient) {
@@ -720,11 +739,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   ): Promise<void> => {
     const ownerTarget = ownerDirectTarget();
     if (!ownerTarget) {
-      const reason = account.ownerUserId?.trim()
-        ? "missing_owner_conversation"
-        : "missing_owner_user_id";
       log?.error?.(
-        `[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=${reason} group=${target.chatId}`,
+        `[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=missing_owner_conversation group=${target.chatId}`,
       );
       return;
     }
@@ -917,7 +933,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
       if (consumeTerminalSend(info?.kind ?? "unknown")) return;
       const richFragment = buildRichInteractionFragment(payload);
       const text = richFragment && account.richInteractions ? "" : resolvePayloadText(payload);
-      const urls = resolveOutboundMediaUrls(payload).filter(Boolean);
+      const urls = filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean));
       log?.info?.(
         `[${account.accountId}] clawchat-plugin-openclaw deliver kind=${info?.kind ?? "unknown"} text_len=${text.length} media_urls=${urls.length} reasoning=${payload.isReasoning === true}`,
       );
@@ -1021,6 +1037,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
           log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw final skipped: already delivered at a message boundary`);
           return;
         }
+        // A non-owner final whose only content was dropped local media sends nothing.
+        if (options.nonOwnerTurn && !finalText.trim() && !richFragment && finalUrls.length === 0) return;
         const mediaFragments = await uploadMediaUrls(finalUrls);
         const result = await sendStatic(
           finalText,
@@ -1097,7 +1115,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
         ? async (payload: ReplyPayload) => {
             if (consumeTerminalSend("reasoning")) return;
             const text = resolvePayloadText(payload);
-            await emitFullRuntimeText("reasoning", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+            await emitFullRuntimeText("reasoning", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
             const trimmed = text.trim();
             if (trimmed) reasoningText = reasoningText ? `${reasoningText}\n${trimmed}` : trimmed;
           }
@@ -1120,7 +1138,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
             if (consumeTerminalSend("tool-result")) return;
             const text = resolvePayloadText(payload);
             if (isDefaultToolResultText(text)) return;
-            await emitFullRuntimeText("tool result", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+            await emitFullRuntimeText("tool result", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
           }
         : undefined,
       onItemEvent: splitFullOutput

package/src/runtime.ts

@@ -1,4 +1,5 @@
 import { applyDmRecallDefault } from "./dm-recall-default.ts";
+import { HOST_FLOOR, HOST_TOOL_SEARCH_DEFAULT_ON, hostAtLeast, hostToolSearchEnabled } from "./host-version.ts";
 import {
   AckTimeoutError,
   AuthError,
@@ -86,7 +87,9 @@ import {
   type ClawChatStore,
   type MessageRow,
 } from "./storage.ts";
-import { getClawChatGroupPrompt, getClawChatUserPrompt } from "./plugin-prompts.ts";
+import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.ts";
+import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.ts";
+import { resolveOwnerIdentity } from "./owner-identity.ts";
 import {
   loadClawChatPromptMetadata,
   type ClawChatGroupParticipantPrompt,
@@ -111,7 +114,8 @@ import { PermissionCache } from "./permissions.ts";
 import { buildAwarenessNoteEnvelope, buildMomentCommentNoteEnvelope } from "./awareness-note-turn.ts";
 import { handlePermissionResult } from "./permission-result.ts";
 
-type Log = { debug?: (m: string) => void; info?: (m: string) => void; error?: (m: string) => void };
+type Log = { debug?: (m: string) => void; info?: (m: string) => void;
+  warn?: (m: string) => void; error?: (m: string) => void };
 type ChannelContextBuilder = (params: Record<string, unknown>) => unknown;
 type CompatibleChannelRuntime = PluginRuntime["channel"] & {
   inbound?: { buildContext?: ChannelContextBuilder };
@@ -140,6 +144,7 @@ type RuntimeConnectionStore = Pick<
       | "releaseActivationBootstrapClaim"
       | "markActivationBootstrapSent"
       | "getActivationConversation"
+      | "lookupActivationIdentity"
       | "getLastResolvedDeviceId"
       | "listRecentGroupMessages"
       | "recallMessage"
@@ -585,6 +590,8 @@ export interface StartGatewayParams {
   setStatus: (next: ChannelAccountSnapshot) => void;
   getStatus: () => ChannelAccountSnapshot;
   log?: Log;
+  /** Internal — set on recursive re-entry so the approve-unsupported warning is issued once per lifecycle. */
+  boundaryWarningIssued?: boolean;
   /** Test hook only. */
   store?: RuntimeConnectionStore | null;
   /** Test hook only. */
@@ -1057,6 +1064,9 @@ async function waitForActivationCredentials(params: {
   return null;
 }
 
+let warnedBelowHostFloor = false;
+let loggedHostToolSearch = false;
+
 export async function startOpenclawClawlingGateway(params: StartGatewayParams): Promise<void> {
   const { cfg, abortSignal, setStatus, getStatus, log } = params;
   let account = params.account;
@@ -1064,6 +1074,21 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   const runtime = getOpenclawClawlingRuntime();
   const accountId = account.accountId;
   const store = resolveConnectionStore(params, runtime);
+  if (!warnedBelowHostFloor && !hostAtLeast(runtime.version, HOST_FLOOR)) {
+    warnedBelowHostFloor = true;
+    log?.warn?.(`clawchat-plugin-openclaw: host ${runtime.version ?? "unknown"} is below ${HOST_FLOOR}; turns your owner did not start keep the host tools in their schema and rely on the before_tool_call block`);
+  }
+  if (
+    !loggedHostToolSearch &&
+    hostAtLeast(runtime.version, HOST_TOOL_SEARCH_DEFAULT_ON) &&
+    hostToolSearchEnabled(cfg)
+  ) {
+    loggedHostToolSearch = true;
+    log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
+  }
+  if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
+    log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+  }
   log?.info?.(
     `[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`,
   );
@@ -1897,6 +1922,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
       if (abortSignal.aborted) return;
       void startOpenclawClawlingGateway({
         ...params,
+        boundaryWarningIssued: true,
         account: { ...params.account },
         // Carry the live refresh token forward (a rotation earlier this lifecycle
         // leaves the in-memory `cfg` stale; see refreshTokenOverride).
@@ -1944,6 +1970,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     // agent must NOT re-read it — thread the live refresh token forward instead.
     await startOpenclawClawlingGateway({
       ...params,
+      boundaryWarningIssued: true,
       account: {
         ...params.account,
         configured: true,
@@ -2552,14 +2579,24 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   // "invalid conversation id" and msghub never acks the send. Proactive owner
   // messages must be addressed to the direct conversation recorded at
   // activation (parity with the hermes adapter's _owner_direct_chat_id).
-  const resolveOwnerDirectConversationId = (): string | null => {
-    const ownerUserId = account.ownerUserId?.trim();
-    if (!ownerUserId) return null;
-    const conversationId = store
-      ?.getActivationConversation?.({ platform: "openclaw", accountId })
-      ?.conversationId?.trim();
-    return conversationId || null;
+  // One warning per failure class for this lifecycle; never logs ids or SQL.
+  const ownerIdentityWarnings = new Set<string>();
+  const warnOwnerIdentity = (failure: string) => {
+    if (ownerIdentityWarnings.has(failure)) return;
+    ownerIdentityWarnings.add(failure);
+    try {
+      log?.warn?.(`clawchat-plugin-openclaw: ${failure}; owner identity unavailable`);
+    } catch {
+      // Logging cannot change the (fail-closed) answer.
+    }
   };
+  const resolveOwnerDirectConversationId = (): string | null =>
+    // Shared strict resolver (src/owner-identity.ts): the SQLite activation
+    // row decides; the config `ownerUserId` mirror may be stale or absent and
+    // can neither hide nor invent the owner's direct chat. Unavailable storage
+    // or a cleared/rejected token yields no owner DM (fail closed).
+    resolveOwnerIdentity(store, accountId, account.ownerUserId, warnOwnerIdentity,
+      params.rejectedActivationToken).conversationId;
   // R3: the owner's direct conversation is never gated by the dead-chat send
   // guard. If it were, the very message explaining why the agent went dark
   // (skill-update notices, auth/logout notices, group owner-attention
@@ -3338,8 +3375,28 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     }
     turn = await withCachedGroupSenderNames(turn, memoryRoot);
     const conversationTarget = `${CHANNEL_ID}:${formatConversationSubject(turn.peer)}`;
-    const turnPrompt = await buildPromptForTurn(turn, memoryRoot);
     const senderIsOwner = turn.senderIsOwner === true || turn.senderId === account.ownerUserId;
+    // Owner turn <=> the owner's activation direct chat. Resolved per turn;
+    // any failure leaves it null, which classifies as non-owner (fail closed).
+    let ownerConversationId: string | null = null;
+    try {
+      ownerConversationId = resolveOwnerDirectConversationId();
+    } catch {
+      ownerConversationId = null;
+    }
+    const turnClass = classifyChat({
+      kind: turn.peer.kind,
+      chatId: turn.peer.id,
+      ownerDirectConversationId: ownerConversationId,
+    });
+    const narrowHostTools = turnClass === "non-owner";
+    const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
+    const nonOwnerMediaGuidance =
+      "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
+    const turnPrompt = [
+      ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+      baseTurnPrompt,
+    ].filter(Boolean).join("\n\n");
     const ctxPayload = resolveChannelContextBuilder(rt)({
       channel: CHANNEL_ID,
       accountId: route.accountId ?? accountId,
@@ -3385,6 +3442,8 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
         ...(isOpenClawTextSlashCommand(turn.rawBody, cfg) && senderIsOwner
           ? { commands: { authorized: true, source: "text" } }
           : {}),
+        // toolPolicy: host 2026.8.1+ (floor)
+        ...(narrowHostTools ? { toolPolicy: { allow: [...NON_OWNER_TOOL_ALLOWLIST] } } : {}),
       },
       ...(memoryRoot ? { extra: { memoryRoot } } : {}),
       // Deliver the rendered ClawChat per-turn prompt (owner agent_behavior,
@@ -3440,7 +3499,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     if (stagedDirectPrompt) {
       stageClawChatPromptInjection({
         sessionKey: resolvedSessionKey,
-        prompt: turnPrompt,
+        prompt: baseTurnPrompt,
       });
     }
 
@@ -3501,6 +3560,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
           // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
           // member-backend). Passed as a thunk so it is resolved at send time.
           resolveOwnerConversationId: resolveOwnerDirectConversationId,
+          nonOwnerTurn: narrowHostTools,
           log,
         });
 
@@ -3515,7 +3575,14 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
           onSettled: () => markDispatchIdle(),
           run: () =>
             runWithTerminalClawChatSendScope(terminalSendScopeId, () =>
-              rt.reply.dispatchReplyFromConfig({ ctx: ctxPayload, cfg: dispatchCfg, dispatcher, replyOptions }),
+              rt.reply.dispatchReplyFromConfig({
+                ctx: ctxPayload,
+                cfg: dispatchCfg,
+                dispatcher,
+                replyOptions: narrowHostTools
+                  ? { ...replyOptions, toolsAllow: [...NON_OWNER_TOOL_ALLOWLIST] }
+                  : replyOptions,
+              }),
             ),
         });
         const counts = (dispatchResult as { counts?: Record<string, number> } | undefined)?.counts ?? {};
@@ -4101,6 +4168,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
       if (activationAccount.source === "sqlite" && !abortSignal.aborted) {
         await startOpenclawClawlingGateway({
           ...params,
+          boundaryWarningIssued: true,
           account: {
             ...params.account,
             configured: false,

package/src/storage.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { resolveStateDirFromEnv } from "./state-paths.ts";
+import type { ActivationIdentityLookup } from "./owner-identity.ts";
 
 type Log = { error?: (message: string) => void };
 
@@ -643,6 +644,40 @@ export class ClawChatStore {
     }) ?? null;
   }
 
+  /**
+   * Strict owner-identity read for the non-owner turn boundary. Unlike the
+   * other getters (which collapse failure into null), this keeps "storage
+   * unavailable", "no activation row" and "row" apart — including incomplete
+   * rows — because only a proven-absent row may fall back to the config mirror
+   * (see `resolveOwnerIdentity`). Nothing is logged here: the caller warns
+   * once per failure class, and no SQL or credentials reach the log.
+   */
+  lookupActivationIdentity(input: ConversationAccountInput): ActivationIdentityLookup {
+    if (!this.ensureInitialized()) return { status: "unavailable" };
+    try {
+      const row = this.requireDb()
+        .prepare(
+          "SELECT owner_user_id, conversation_id, access_token FROM activations WHERE platform = ? AND account_id = ?",
+        )
+        .get(input.platform, input.accountId) as Record<string, unknown> | undefined;
+      if (!row) return { status: "absent" };
+      const value = (key: string) => {
+        const raw = row[key];
+        return typeof raw === "string" ? raw.trim() || null : null;
+      };
+      return {
+        status: "row",
+        row: {
+          ownerUserId: value("owner_user_id"),
+          conversationId: value("conversation_id"),
+          accessToken: value("access_token"),
+        },
+      };
+    } catch {
+      return { status: "unavailable" };
+    }
+  }
+
   claimPendingActivationBootstrap(
     input: ActivationBootstrapInput,
   ): ActivationBootstrapConversation | null {
@@ -1184,6 +1219,10 @@ export class ClawChatStore {
    * as `'thinking'` are excluded so the @-mention prior-context block never
    * surfaces the agent's intermediate output as conversation history.
    * Uses `idx_clawchat_messages_chat_created` for performance.
+   * `ignoreCase` matches `chat_id` case-insensitively (rows keep their stored
+   * case) so memory scope can recover a group id's original case from a
+   * lowercased session key; it cannot use that index, so callers that already
+   * know the exact id leave it off.
    * Returns an empty array if the store is unavailable.
    */
   listRecentGroupMessages(
@@ -1191,12 +1230,14 @@ export class ClawChatStore {
     accountId: string,
     chatId: string,
     limit: number,
+    options: { ignoreCase?: boolean } = {},
   ): MessageRow[] {
+    const chatMatch = options.ignoreCase ? "chat_id = ? COLLATE NOCASE" : "chat_id = ?";
     return this.read(() => {
       const rows = this.requireDb()
         .prepare(
           `SELECT * FROM clawchat_messages
-            WHERE platform = ? AND account_id = ? AND chat_id = ? AND kind = 'message'
+            WHERE platform = ? AND account_id = ? AND ${chatMatch} AND kind = 'message'
             ORDER BY created_at DESC, rowid DESC LIMIT ?`,
         )
         .all(platform, accountId, chatId, limit) as MessageRow[];