@clawling/clawchat-plugin-openclaw 2026.10.9-2 → 2026.10.9-3

package/src/config.ts

@@ -125,6 +125,8 @@ export type OpenclawClawlingAccountConfig = {
   "note-cap-group"?: number;
   "note-cap-turn"?: number;
   "delta-budget-chars"?: number;
+  /** Host tools in turns the owner did not start: `off` | `approve` (approve currently behaves as off). */
+  "non-owner-host-tools"?: string;
   reconnect?: OpenclawClawlingReconnectConfig;
   heartbeat?: OpenclawClawlingHeartbeatConfig;
   ack?: OpenclawClawlingAckConfig;
@@ -190,6 +192,7 @@ export const openclawClawlingAccountConfigSchema = {
     "note-cap-group": { type: "integer" },
     "note-cap-turn": { type: "integer" },
     "delta-budget-chars": { type: "integer" },
+    "non-owner-host-tools": { type: "string", enum: ["off", "approve"] },
     reconnect: {
       type: "object",
       additionalProperties: false,
@@ -337,6 +340,8 @@ export type ResolvedOpenclawClawlingAccount = {
   noteCapTurn: number;
   /** `delta-budget-chars`: characters of unseen group messages an @-mention adds. */
   deltaBudgetChars: number;
+  /** `non-owner-host-tools`: parsed mode; `approve` is reserved and currently behaves like `off`. */
+  nonOwnerHostTools: "off" | "approve";
   allowFrom: string[];
   reconnect: Required<OpenclawClawlingReconnectConfig>;
   heartbeat: Required<OpenclawClawlingHeartbeatConfig>;
@@ -597,6 +602,11 @@ export const SESSION_INT_KEYS = {
   "delta-budget-chars": [8000, 2000, 32000],
 } as const satisfies Record<string, readonly [number, number, number]>;
 
+/** `approve` only when explicitly set; any other value (typo, `on`, boolean) means `off`. */
+export function parseNonOwnerHostTools(raw: unknown): "off" | "approve" {
+  return typeof raw === "string" && raw.trim().toLowerCase() === "approve" ? "approve" : "off";
+}
+
 function readSessionInt(channel: Record<string, unknown>, key: keyof typeof SESSION_INT_KEYS): number {
   const [factory, minimum, maximum] = SESSION_INT_KEYS[key];
   const raw = channel[key];
@@ -739,6 +749,7 @@ export function resolveOpenclawClawlingAccount(
     noteCapGroup: readSessionInt(channel, "note-cap-group"),
     noteCapTurn: readSessionInt(channel, "note-cap-turn"),
     deltaBudgetChars: readSessionInt(channel, "delta-budget-chars"),
+    nonOwnerHostTools: parseNonOwnerHostTools(channel["non-owner-host-tools"]),
     allowFrom: [],
     reconnect: readReconnect(channel.reconnect),
     heartbeat: readHeartbeat(channel.heartbeat),

package/src/host-tools-guard.ts

@@ -0,0 +1,186 @@
+// Layer 2 of the non-owner turn boundary: a fail-closed `before_tool_call`
+// hook. Dispatch (layer 1) already narrows the offered tools for turns the
+// owner did not start; this hook blocks anything else that still reaches
+// execution. Only calls whose session key carries the ClawChat prefix are
+// in scope (D8); everything else passes untouched. Tool arguments are never
+// logged.
+import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
+import { CHANNEL_ID, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.ts";
+import {
+  classifyChat,
+  clawChatSessionAccountId,
+  NON_OWNER_TOOL_ALLOWLIST,
+  parseClawChatSessionKey,
+} from "./turn-boundary.ts";
+import { clawChatDbPathForStateDir, getClawChatStore } from "./storage.ts";
+import { resolveOwnerIdentity } from "./owner-identity.ts";
+import { getRegisteredClawChatToolNames } from "./tools.ts";
+
+export const BLOCK_MESSAGE =
+  "This tool is not available here: only your owner's direct chat may use host tools on this machine. Do not try to reach them another way; answer without them, or tell the person to ask your owner.";
+
+export type HostToolDecision = { block: true; blockReason: string } | undefined;
+export type HostToolInput = {
+  toolName: string;
+  params: Record<string, unknown>;
+  sessionKey?: string;
+  ownerDirectConversationId?: string | null;
+  registeredTools: ReadonlySet<string>;
+};
+
+/**
+ * Host tool-search controls (OpenClaw 2026.9.6+). The host adds them to every
+ * run on its own and builds their catalog from the run's allowed tools, so in
+ * a non-owner turn they reach only the allowlisted tools; the host fires this
+ * hook again for the inner tool a `tool_call` runs, and that inner call gets
+ * every check below. They are not part of the dispatch allowlist.
+ */
+export const HOST_TOOL_SEARCH_CONTROLS: readonly string[] = Object.freeze(["tool_search", "tool_describe", "tool_call"]);
+const ACCOUNT_SCOPED_TOOLS: readonly string[] = ["clawchat_mention_message", "clawchat_react_message"];
+
+const block = (): HostToolDecision => ({ block: true, blockReason: BLOCK_MESSAGE });
+const CLAWCHAT_SESSION_PREFIX = new RegExp(`^agent:[^:]+:${CHANNEL_ID}:`, "i");
+const PATH_FIELD = /^(?:filePath|media|iconPath|path|attachments)$/i;
+
+/** D8: only the ClawChat session-key prefix ties a call to ClawChat; requester channel alone never does. */
+export function isClawChatToolCall(input: Pick<HostToolInput, "sessionKey">): boolean {
+  return CLAWCHAT_SESSION_PREFIX.test(input.sessionKey?.trim() ?? "");
+}
+
+/** True when any argument looks like a local file path; only http(s) URLs are allowed. */
+export function hasLocalPathArgument(value: unknown, field = ""): boolean {
+  if (typeof value === "string") {
+    const text = value.trim();
+    if (/^https?:\/\//i.test(text)) return false;
+    if (/^(?:\/|[a-z]:[\\/]|\\\\|file:|~|\.\.?[\\/])/i.test(text)) return true;
+    return PATH_FIELD.test(field) && text.length > 0;
+  }
+  if (Array.isArray(value)) return value.some(item => hasLocalPathArgument(item, field));
+  return Boolean(value && typeof value === "object" && Object.entries(value).some(
+    ([key, item]) => hasLocalPathArgument(item, PATH_FIELD.test(field) ? field : key),
+  ));
+}
+
+/** Pure decision for one tool call. `undefined` lets the call run. */
+export function decideHostToolCall(input: HostToolInput): HostToolDecision {
+  if (!isClawChatToolCall(input)) return undefined;
+  const parsed = parseClawChatSessionKey(input.sessionKey);
+  if (!parsed) return block();
+  if (classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner") {
+    return undefined;
+  }
+  // Outer pre-check only. The inner tool call is checked again and that check
+  // is authoritative: the host also accepts dotted/flattened argument keys
+  // that this outer check may not recognise.
+  if (hasLocalPathArgument(input.params)) return block();
+  if (HOST_TOOL_SEARCH_CONTROLS.includes(input.toolName)) return undefined;
+  if (ACCOUNT_SCOPED_TOOLS.includes(input.toolName)) {
+    // D9: a non-owner turn may only act on its own chat, named explicitly.
+    const target = input.params.chatId;
+    if (typeof target !== "string" || !target.trim() || target.trim().toLowerCase() !== parsed.chatId) {
+      return {
+        block: true,
+        blockReason: input.toolName === "clawchat_react_message"
+          ? "Pass this chat's chatId to react here."
+          : "Pass this chat's chatId to mention here.",
+      };
+    }
+  }
+  if (NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName)) {
+    return input.toolName.startsWith("clawchat_") && !input.registeredTools.has(input.toolName)
+      ? block()
+      : undefined;
+  }
+  return block(); // `off` and the reserved `approve` both block in this release.
+}
+
+type RequesterContext = { channel?: string; accountId?: string };
+
+export function registerHostToolsGuard(
+  api: OpenClawPluginApi,
+  options: { ownerConversation?: (accountId: string) => string | null } = {},
+): void {
+  const warned = new Set<string>();
+  const warn = (failure: string) => {
+    if (warned.has(failure)) return;
+    warned.add(failure);
+    try {
+      api.logger.warn(`clawchat-plugin-openclaw: host-tool guard ${failure}; enforcing non-owner policy`);
+    } catch {
+      // Logging cannot unlock a call.
+    }
+  };
+  const lookupOwnerConversation = (accountId: string): string | null => {
+    if (options.ownerConversation) return options.ownerConversation(accountId);
+    const account = resolveOpenclawClawlingAccount(api.config, accountId);
+    const stateDir = api.runtime.state?.resolveStateDir?.();
+    const store = getClawChatStore({
+      ...(stateDir ? { dbPath: clawChatDbPathForStateDir(stateDir) } : {}),
+      log: { error: message => api.logger.error?.(message) },
+    });
+    return resolveOwnerIdentity(store, accountId, account.ownerUserId).conversationId;
+  };
+
+  api.on("before_tool_call", (event, sdkCtx) => {
+    // `requester` is host 2026.8.1+ (the floor); the development SDK types predate it.
+    const ctx = sdkCtx as (typeof sdkCtx & { requester?: RequesterContext }) | undefined;
+    try {
+      if (!ctx) {
+        warn("missing-context");
+        return block();
+      }
+      const sessionKey = ctx.sessionKey;
+      if (!isClawChatToolCall({ sessionKey })) return undefined;
+      const requester = ctx.requester;
+      const parsed = parseClawChatSessionKey(sessionKey);
+      if (!parsed || (requester?.channel && requester.channel !== CHANNEL_ID)) {
+        warn("unknown-session");
+        return block();
+      }
+      // Direct keys carry their account; group keys do not. A group turn is
+      // non-owner whoever speaks, so a group call without the requester
+      // account (host tool-search controls and the inner calls they run get
+      // a run-level ctx without one) still gets the non-owner policy; only
+      // the tools that act as an account need it. Conflicting ids block.
+      const keyAccountId = clawChatSessionAccountId(sessionKey);
+      const requesterAccountId = requester?.accountId?.trim()
+        ? normalizeOpenclawClawlingAccountId(requester.accountId)
+        : undefined;
+      const accountId = requesterAccountId ?? keyAccountId;
+      if (keyAccountId && keyAccountId !== accountId) {
+        warn("account-identity");
+        return block();
+      }
+      if (!accountId) {
+        if (parsed.kind !== "group" || ACCOUNT_SCOPED_TOOLS.includes(event.toolName)) {
+          warn("account-identity");
+          return block();
+        }
+        return decideHostToolCall({
+          toolName: event.toolName,
+          params: event.params ?? {},
+          sessionKey,
+          ownerDirectConversationId: null,
+          registeredTools: getRegisteredClawChatToolNames(),
+        });
+      }
+      let ownerDirectConversationId: string | null = null;
+      try {
+        ownerDirectConversationId = lookupOwnerConversation(accountId);
+      } catch {
+        // Treated as missing below; the allowlist still applies.
+      }
+      if (!ownerDirectConversationId?.trim()) warn("missing-owner-conversation");
+      return decideHostToolCall({
+        toolName: event.toolName,
+        params: event.params ?? {},
+        sessionKey,
+        ownerDirectConversationId,
+        registeredTools: getRegisteredClawChatToolNames(),
+      });
+    } catch {
+      warn("handler-exception");
+      return block();
+    }
+  });
+}

package/src/host-version.ts

@@ -0,0 +1,35 @@
+export const HOST_FLOOR = "2026.8.1";
+
+function parse(v: string): [number, number, number] | null {
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null;
+}
+
+/** Prerelease suffixes count as their base version (10.1-beta.2 ≥ 8.1). Unparseable ⇒ false. */
+export function hostAtLeast(version: string | undefined, min: string): boolean {
+  const a = version ? parse(version) : null;
+  const b = parse(min);
+  if (!a || !b) return false;
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+
+/** First host release where tool search is on unless `tools.toolSearch` turns it off. */
+export const HOST_TOOL_SEARCH_DEFAULT_ON = "2026.9.6";
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  typeof v === "object" && v !== null && !Array.isArray(v);
+
+/**
+ * Whether the host's `tools.toolSearch` setting leaves tool search on, read the
+ * way the host reads it (2026.9.6+): unset or `true` ⇒ on; `false` ⇒ off; an
+ * object ⇒ its `enabled` flag, else on only when it sets other options.
+ */
+export function hostToolSearchEnabled(config: unknown): boolean {
+  const tools = isRecord(config) ? config.tools : undefined;
+  const raw = isRecord(tools) ? tools.toolSearch : undefined;
+  if (raw === undefined || raw === true) return true;
+  if (!isRecord(raw)) return false;
+  if (typeof raw.enabled === "boolean") return raw.enabled;
+  return Object.keys(raw).some(key => key !== "enabled");
+}

package/src/memory-scope.ts

@@ -0,0 +1,191 @@
+// Which ClawChat notes the conversation behind a memory / metadata tool call
+// may read. A tool result stays in the calling session's history, and a group
+// is one session for everyone in it, so a note read there can surface to
+// anyone present later. Scope therefore follows the conversation (tool
+// factory ctx), never a parameter or the process environment:
+//
+//   owner DM (incl. plugin-started turns there) → every note
+//   friend DM → only users/<requesterSenderId>.md
+//   group     → groups/<this chat>.md + users/<id>.md of present members
+//   anything else (unknown session, missing store / peer, contradictions,
+//   ambiguous chat-id case, resolution errors) → nothing
+//
+// Chat ids compare case-insensitively (the host lowercases session keys);
+// the original case is recovered before any group file / SQL lookup. Member
+// user ids stay case-sensitive.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { readClawChatMemoryFile, type ClawChatMemoryTarget } from "./clawchat-memory.ts";
+import { resolveOwnerIdentity } from "./owner-identity.ts";
+import type { ClawChatStore } from "./storage.ts";
+import { classifyTurn, parseClawChatSessionKey } from "./turn-boundary.ts";
+
+export type MemoryToolContext = {
+  sessionKey?: string;
+  requesterSenderId?: string | null;
+  deliveryContext?: { to?: string };
+};
+
+export type MemoryScope = {
+  kind: "owner" | "direct" | "group" | "unknown";
+  chatId: string;
+  members: ReadonlySet<string>;
+};
+
+export type MemoryScopeStore = Partial<Pick<ClawChatStore, "lookupActivationIdentity" | "listRecentGroupMessages">>;
+
+/** Rows scanned for recent speakers when a group note has no participant list. */
+const SPEAKER_FALLBACK_ROWS = 200;
+
+const nothing = (): MemoryScope => ({ kind: "unknown", chatId: "", members: new Set() });
+
+async function groupNoteIds(root: string): Promise<string[]> {
+  try {
+    return (await fs.readdir(path.join(root, "groups")))
+      .filter((name) => name.endsWith(".md"))
+      .map((name) => name.slice(0, -3));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+    throw error;
+  }
+}
+
+function participantIds(metadata: Record<string, string>): Set<string> {
+  return new Set((metadata.participant_ids ?? "").split(",").map((id) => id.trim()).filter(Boolean));
+}
+
+function inboundSenderId(rawJson: string | null): string | null {
+  if (!rawJson) return null;
+  const sender = (JSON.parse(rawJson) as { sender?: { id?: unknown } } | null)?.sender?.id;
+  return typeof sender === "string" && sender.trim() ? sender.trim() : null;
+}
+
+export async function resolveMemoryScope(input: {
+  root: string;
+  ctx: MemoryToolContext;
+  accountId: string;
+  configOwnerUserId?: string | null;
+  store: MemoryScopeStore | null;
+  warn?: (failureClass: string) => void;
+}): Promise<MemoryScope> {
+  const { root, ctx, accountId, store, warn } = input;
+  try {
+    const parsed = parseClawChatSessionKey(ctx.sessionKey);
+    if (!parsed) return nothing();
+    if (!store) {
+      warn?.("store-unavailable");
+      return nothing();
+    }
+    const lowered = parsed.chatId; // the parser lowercases
+    let chatId = lowered;
+    let caseKnown = false;
+
+    // 1. The trusted delivery route usually carries the original-case id.
+    const destination = ctx.deliveryContext?.to?.trim()
+      .replace(/^(?:clawchat-plugin-openclaw:)?(?:group|direct):/i, "");
+    if (destination && destination.toLowerCase() === lowered) {
+      chatId = destination;
+      caseKnown = true;
+    }
+
+    // 2. A group note filename, which wins: it is the file that will be read.
+    //    Two notes differing only in case are ambiguous.
+    const fileMatches = (await groupNoteIds(root)).filter((id) => id.toLowerCase() === lowered);
+    if (fileMatches.length > 1) {
+      warn?.("ambiguous-chat-case");
+      return nothing();
+    }
+    const groupFileId = fileMatches[0];
+    if (groupFileId !== undefined) {
+      chatId = groupFileId;
+      caseKnown = true;
+    }
+    const members = groupFileId === undefined
+      ? new Set<string>()
+      : participantIds((await readClawChatMemoryFile(root, { targetType: "group", targetId: groupFileId })).metadata);
+
+    if (parsed.kind === "direct") {
+      // A chat the plugin knows as a group can never be a direct chat.
+      if (members.size) {
+        warn?.("contradictory-chat-kind");
+        return nothing();
+      }
+      const ownerConversationId = resolveOwnerIdentity(store, accountId, input.configOwnerUserId, warn).conversationId;
+      if (classifyTurn({ sessionKey: ctx.sessionKey, ownerDirectConversationId: ownerConversationId }) === "owner") {
+        return { kind: "owner", chatId: ownerConversationId!, members: new Set() };
+      }
+      const peer = typeof ctx.requesterSenderId === "string" ? ctx.requesterSenderId.trim() : "";
+      if (!peer) warn?.("missing-dm-peer");
+      return { kind: "direct", chatId: parsed.chatId, members: new Set(peer ? [peer] : []) };
+    }
+
+    // 3. No cached participant list: recent inbound speakers. When neither the
+    //    route nor a filename supplied the case, the case-insensitive query is
+    //    the recovery path and its stored chat_id supplies the original case.
+    if (!members.size) {
+      if (!store.listRecentGroupMessages) {
+        warn?.("store-unavailable");
+        return nothing();
+      }
+      const rows = store.listRecentGroupMessages("openclaw", accountId, chatId, SPEAKER_FALLBACK_ROWS, {
+        ignoreCase: !caseKnown,
+      });
+      if (!caseKnown) {
+        const storedIds = new Set(rows.map((row) => row.chat_id)
+          .filter((id): id is string => typeof id === "string" && id.toLowerCase() === lowered));
+        if (storedIds.size > 1) {
+          warn?.("ambiguous-chat-case");
+          return nothing();
+        }
+        if (storedIds.size === 1) chatId = [...storedIds][0]!;
+      }
+      for (const row of rows) {
+        if (row.direction !== "inbound") continue;
+        try {
+          const sender = inboundSenderId(row.raw_json);
+          if (sender) members.add(sender);
+        } catch {
+          warn?.("malformed-group-row");
+        }
+      }
+    }
+    return { kind: "group", chatId, members };
+  } catch {
+    warn?.("scope-resolution");
+    return nothing();
+  }
+}
+
+export function canReadMemory(scope: MemoryScope, target: ClawChatMemoryTarget): boolean {
+  if (scope.kind === "owner") return true;
+  if (scope.kind === "unknown" || target.targetType === "owner") return false;
+  if (target.targetType === "user") return scope.members.has(target.targetId);
+  return scope.kind === "group" && target.targetType === "group" && target.targetId === scope.chatId;
+}
+
+export function memoryScopeRefusal(scope: MemoryScope, target: ClawChatMemoryTarget): {
+  error: "not_readable_here";
+  code: "memory_scope";
+  message: string;
+} {
+  const message = target.targetType === "owner"
+    ? "owner.md can only be read in your owner's direct chat. Tool results stay in this conversation's history. Do not try to get the owner's notes another way."
+    : scope.kind === "direct"
+      ? "In this direct chat you can only read the note about the person you are talking to."
+      : scope.kind === "group"
+        ? "In a group you can only read this group's note and its members' notes."
+        : "This conversation could not be identified; no ClawChat notes are readable here.";
+  return { error: "not_readable_here", code: "memory_scope", message };
+}
+
+/** What a restricted search left out, for the model (never counts). */
+export function memoryScopeNote(scope: MemoryScope): string | undefined {
+  if (scope.kind === "direct") {
+    return "In this direct chat only the note about the person you are talking to is searched; owner.md, other people's notes and group notes are left out.";
+  }
+  if (scope.kind === "group") {
+    return "In a group only this group's note and its members' notes are searched; owner.md, other groups' notes and notes about non-members are left out.";
+  }
+  if (scope.kind === "unknown") return "This conversation could not be identified; no ClawChat notes were searched.";
+  return undefined;
+}

package/src/owner-identity.ts

@@ -0,0 +1,49 @@
+// The one definition of "who is the owner, and which chat is the owner's DM"
+// shared by dispatch, the host-tool guard and memory scope. The SQLite
+// activation row decides; the config `ownerUserId` mirror is only a fallback
+// once a working store has proved there is no activation row at all. An
+// unavailable store, a failed read, a cleared/rejected token or an incomplete
+// row never falls back to the mirror — the caller sees no owner (fail closed).
+
+export type ActivationIdentityLookup =
+  | { status: "unavailable" }
+  | { status: "absent" }
+  | {
+      status: "row";
+      row: { ownerUserId: string | null; conversationId: string | null; accessToken: string | null };
+    };
+
+/** Structural so focused fixtures can omit unrelated store methods. */
+export type OwnerIdentityStore = {
+  lookupActivationIdentity?(input: { platform: string; accountId: string }): ActivationIdentityLookup;
+};
+
+export type OwnerIdentity = { ownerUserId: string | null; conversationId: string | null };
+
+export function resolveOwnerIdentity(
+  store: OwnerIdentityStore | null | undefined,
+  accountId: string,
+  configOwnerUserId?: string | null,
+  warn?: (failure: string) => void,
+  rejectedActivationToken?: string,
+): OwnerIdentity {
+  const denied: OwnerIdentity = { ownerUserId: null, conversationId: null };
+  try {
+    const lookup = store?.lookupActivationIdentity?.({ platform: "openclaw", accountId });
+    if (!lookup || lookup.status === "unavailable") {
+      warn?.("owner-identity");
+      return denied;
+    }
+    if (lookup.status === "absent") {
+      return { ownerUserId: configOwnerUserId?.trim() || null, conversationId: null };
+    }
+    const { row } = lookup;
+    // Mirror the runtime overlay: never trust the activation rejected during this lifecycle.
+    if (!row.accessToken || row.accessToken === rejectedActivationToken) return denied;
+    const ownerUserId = row.ownerUserId?.trim() || null;
+    return { ownerUserId, conversationId: ownerUserId ? row.conversationId?.trim() || null : null };
+  } catch {
+    warn?.("owner-identity");
+    return denied;
+  }
+}

package/src/reply-dispatcher.ts

@@ -88,7 +88,13 @@ export interface ReplyDispatcherOptions {
    * framework error final; null/absent means English.
    */
   resolveOwnerLocale?: () => string | null;
-  log?: { info?: (m: string) => void; error?: (m: string) => void };
+  /**
+   * True when the turn was not started by the owner (any group turn, any
+   * non-owner direct chat). Reply media is then limited to http(s) URLs; local
+   * paths are never loaded. Legacy standalone callers default to owner behavior.
+   */
+  nonOwnerTurn?: boolean;
+  log?: { info?: (m: string) => void; warn?: (m: string) => void; error?: (m: string) => void };
 }
 
 type TypedReplyDispatcherResult = ReturnType<
@@ -435,6 +441,19 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
     log,
   } = options;
   const isGroupTarget = target.chatType === "group";
+  let warnedLocalReplyMedia = false;
+  // Non-owner turns may only send remote (http/https) media. Local sources are
+  // dropped here, before any load, because the host's local media roots include
+  // the agent workspace. Warns once per dispatcher and never names the source.
+  function filterReplyMedia(urls: string[]): string[] {
+    if (!options.nonOwnerTurn) return urls;
+    const remote = urls.filter((source) => /^https?:\/\//i.test(source.trim()));
+    if (remote.length !== urls.length && !warnedLocalReplyMedia) {
+      warnedLocalReplyMedia = true;
+      log?.warn?.("clawchat-plugin-openclaw: non-owner reply media dropped; only http(s) URLs are allowed");
+    }
+    return remote;
+  }
   const outputVisibility = effectiveOutputVisibility(account, target.chatId, target.chatType);
   const splitFullOutput = outputVisibility === "full";
   const splitNormalBlockOutput = outputVisibility === "normal";
@@ -442,11 +461,10 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   // owner's usr_… id: chat_id is resolved by msghub through member-backend, and
   // a usr_… comes back "invalid conversation id" — the frame is dropped with no
   // negative ack to this client, so the owner silently never gets the approval
-  // request. Both ids are required: ownerUserId gates whether an owner exists at
-  // all, the conversation id is where a frame can actually be delivered.
+  // request. The resolver is the shared strict owner-identity lookup
+  // (src/owner-identity.ts): it yields a conversation only for an activation
+  // row with an owner, so the config `ownerUserId` mirror is not consulted.
   const ownerDirectTarget = (): { chatId: string; chatType: "direct" } | null => {
-    const ownerUserId = account.ownerUserId?.trim();
-    if (!ownerUserId) return null;
     const conversationId = resolveOwnerConversationId?.()?.trim();
     return conversationId ? { chatId: conversationId, chatType: "direct" as const } : null;
   };
@@ -462,7 +480,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
     });
   };
 
-  async function uploadMediaUrls(urls: string[]): Promise<ClawlingMediaFragment[]> {
+  async function uploadMediaUrls(inputUrls: string[]): Promise<ClawlingMediaFragment[]> {
+    const urls = filterReplyMedia(inputUrls);
     if (urls.length === 0) return [];
     const apiClient = buildApiClient();
     if (!apiClient) {
@@ -720,11 +739,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
   ): Promise<void> => {
     const ownerTarget = ownerDirectTarget();
     if (!ownerTarget) {
-      const reason = account.ownerUserId?.trim()
-        ? "missing_owner_conversation"
-        : "missing_owner_user_id";
       log?.error?.(
-        `[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=${reason} group=${target.chatId}`,
+        `[${account.accountId}] clawchat-plugin-openclaw group owner attention suppressed reason=missing_owner_conversation group=${target.chatId}`,
       );
       return;
     }
@@ -917,7 +933,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
       if (consumeTerminalSend(info?.kind ?? "unknown")) return;
       const richFragment = buildRichInteractionFragment(payload);
       const text = richFragment && account.richInteractions ? "" : resolvePayloadText(payload);
-      const urls = resolveOutboundMediaUrls(payload).filter(Boolean);
+      const urls = filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean));
       log?.info?.(
         `[${account.accountId}] clawchat-plugin-openclaw deliver kind=${info?.kind ?? "unknown"} text_len=${text.length} media_urls=${urls.length} reasoning=${payload.isReasoning === true}`,
       );
@@ -1021,6 +1037,8 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
           log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw final skipped: already delivered at a message boundary`);
           return;
         }
+        // A non-owner final whose only content was dropped local media sends nothing.
+        if (options.nonOwnerTurn && !finalText.trim() && !richFragment && finalUrls.length === 0) return;
         const mediaFragments = await uploadMediaUrls(finalUrls);
         const result = await sendStatic(
           finalText,
@@ -1097,7 +1115,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
         ? async (payload: ReplyPayload) => {
             if (consumeTerminalSend("reasoning")) return;
             const text = resolvePayloadText(payload);
-            await emitFullRuntimeText("reasoning", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+            await emitFullRuntimeText("reasoning", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
             const trimmed = text.trim();
             if (trimmed) reasoningText = reasoningText ? `${reasoningText}\n${trimmed}` : trimmed;
           }
@@ -1120,7 +1138,7 @@ export function createOpenclawClawlingReplyDispatcher(options: ReplyDispatcherOp
             if (consumeTerminalSend("tool-result")) return;
             const text = resolvePayloadText(payload);
             if (isDefaultToolResultText(text)) return;
-            await emitFullRuntimeText("tool result", text, resolveOutboundMediaUrls(payload).filter(Boolean));
+            await emitFullRuntimeText("tool result", text, filterReplyMedia(resolveOutboundMediaUrls(payload).filter(Boolean)));
           }
         : undefined,
       onItemEvent: splitFullOutput