@clawling/clawchat-plugin-openclaw 2026.10.9-2 → 2026.10.9-4

package/dist/src/runtime.js

@@ -1,4 +1,5 @@
 import { applyDmRecallDefault } from "./dm-recall-default.js";
+import { HOST_FLOOR, HOST_TOOL_SEARCH_DEFAULT_ON, hostAtLeast, hostToolSearchEnabled } from "./host-version.js";
 import { AckTimeoutError, AuthError, ProtocolError, StateError, TransportError, EVENT, recallTargetMessageId, } from "./protocol-types.js";
 import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
 import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
@@ -29,7 +30,9 @@ import { flushAlignedOutboundQueue, getAlignedOutboundQueueSize, sendOpenclawCla
 import { formatWsLog } from "./ws-log.js";
 import { createNotifySignalObserver, createProtocolControlHandler, createReconnectTracker } from "./ws-alignment.js";
 import { clawChatDbPathForStateDir, getClawChatStore, makeOwnerProfilePersister, } from "./storage.js";
-import { getClawChatGroupPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
+import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
+import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.js";
+import { resolveOwnerIdentity } from "./owner-identity.js";
 import { loadClawChatPromptMetadata, renderClawChatProfilePrompt, resolveSenderRelation, } from "./profile-prompt.js";
 import { buildNoteMemorySection } from "./note-injection.js";
 import { buildGroupCatchUp, CATCH_UP_FETCH_ROWS, DeliveredGroupMessages } from "./group-catch-up.js";
@@ -713,6 +716,8 @@ async function waitForActivationCredentials(params) {
     });
     return null;
 }
+let warnedBelowHostFloor = false;
+let loggedHostToolSearch = false;
 export async function startOpenclawClawlingGateway(params) {
     const { cfg, abortSignal, setStatus, getStatus, log } = params;
     let account = params.account;
@@ -720,6 +725,19 @@ export async function startOpenclawClawlingGateway(params) {
     const runtime = getOpenclawClawlingRuntime();
     const accountId = account.accountId;
     const store = resolveConnectionStore(params, runtime);
+    if (!warnedBelowHostFloor && !hostAtLeast(runtime.version, HOST_FLOOR)) {
+        warnedBelowHostFloor = true;
+        log?.warn?.(`clawchat-plugin-openclaw: host ${runtime.version ?? "unknown"} is below ${HOST_FLOOR}; turns your owner did not start keep the host tools in their schema and rely on the before_tool_call block`);
+    }
+    if (!loggedHostToolSearch &&
+        hostAtLeast(runtime.version, HOST_TOOL_SEARCH_DEFAULT_ON) &&
+        hostToolSearchEnabled(cfg)) {
+        loggedHostToolSearch = true;
+        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
+    }
+    if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
+        log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+    }
     log?.info?.(`[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`);
     // Freeze one report device_id for this process; reused for the paired report
     // so the backend links both to the same row. Imported from ./client.ts.
@@ -1488,6 +1506,7 @@ export async function startOpenclawClawlingGateway(params) {
                 return;
             void startOpenclawClawlingGateway({
                 ...params,
+                boundaryWarningIssued: true,
                 account: { ...params.account },
                 // Carry the live refresh token forward (a rotation earlier this lifecycle
                 // leaves the in-memory `cfg` stale; see refreshTokenOverride).
@@ -1535,6 +1554,7 @@ export async function startOpenclawClawlingGateway(params) {
         // agent must NOT re-read it — thread the live refresh token forward instead.
         await startOpenclawClawlingGateway({
             ...params,
+            boundaryWarningIssued: true,
             account: {
                 ...params.account,
                 configured: true,
@@ -2116,15 +2136,25 @@ export async function startOpenclawClawlingGateway(params) {
     // "invalid conversation id" and msghub never acks the send. Proactive owner
     // messages must be addressed to the direct conversation recorded at
     // activation (parity with the hermes adapter's _owner_direct_chat_id).
-    const resolveOwnerDirectConversationId = () => {
-        const ownerUserId = account.ownerUserId?.trim();
-        if (!ownerUserId)
-            return null;
-        const conversationId = store
-            ?.getActivationConversation?.({ platform: "openclaw", accountId })
-            ?.conversationId?.trim();
-        return conversationId || null;
+    // One warning per failure class for this lifecycle; never logs ids or SQL.
+    const ownerIdentityWarnings = new Set();
+    const warnOwnerIdentity = (failure) => {
+        if (ownerIdentityWarnings.has(failure))
+            return;
+        ownerIdentityWarnings.add(failure);
+        try {
+            log?.warn?.(`clawchat-plugin-openclaw: ${failure}; owner identity unavailable`);
+        }
+        catch {
+            // Logging cannot change the (fail-closed) answer.
+        }
     };
+    const resolveOwnerDirectConversationId = () => 
+    // Shared strict resolver (src/owner-identity.ts): the SQLite activation
+    // row decides; the config `ownerUserId` mirror may be stale or absent and
+    // can neither hide nor invent the owner's direct chat. Unavailable storage
+    // or a cleared/rejected token yields no owner DM (fail closed).
+    resolveOwnerIdentity(store, accountId, account.ownerUserId, warnOwnerIdentity, params.rejectedActivationToken).conversationId;
     // R3: the owner's direct conversation is never gated by the dead-chat send
     // guard. If it were, the very message explaining why the agent went dark
     // (skill-update notices, auth/logout notices, group owner-attention
@@ -2836,8 +2866,28 @@ export async function startOpenclawClawlingGateway(params) {
         }
         turn = await withCachedGroupSenderNames(turn, memoryRoot);
         const conversationTarget = `${CHANNEL_ID}:${formatConversationSubject(turn.peer)}`;
-        const turnPrompt = await buildPromptForTurn(turn, memoryRoot);
         const senderIsOwner = turn.senderIsOwner === true || turn.senderId === account.ownerUserId;
+        // Owner turn <=> the owner's activation direct chat. Resolved per turn;
+        // any failure leaves it null, which classifies as non-owner (fail closed).
+        let ownerConversationId = null;
+        try {
+            ownerConversationId = resolveOwnerDirectConversationId();
+        }
+        catch {
+            ownerConversationId = null;
+        }
+        const turnClass = classifyChat({
+            kind: turn.peer.kind,
+            chatId: turn.peer.id,
+            ownerDirectConversationId: ownerConversationId,
+        });
+        const narrowHostTools = turnClass === "non-owner";
+        const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
+        const nonOwnerMediaGuidance = "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
+        const turnPrompt = [
+            ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            baseTurnPrompt,
+        ].filter(Boolean).join("\n\n");
         const ctxPayload = resolveChannelContextBuilder(rt)({
             channel: CHANNEL_ID,
             accountId: route.accountId ?? accountId,
@@ -2883,6 +2933,8 @@ export async function startOpenclawClawlingGateway(params) {
                 ...(isOpenClawTextSlashCommand(turn.rawBody, cfg) && senderIsOwner
                     ? { commands: { authorized: true, source: "text" } }
                     : {}),
+                // toolPolicy: host 2026.8.1+ (floor)
+                ...(narrowHostTools ? { toolPolicy: { allow: [...NON_OWNER_TOOL_ALLOWLIST] } } : {}),
             },
             ...(memoryRoot ? { extra: { memoryRoot } } : {}),
             // Deliver the rendered ClawChat per-turn prompt (owner agent_behavior,
@@ -2934,7 +2986,7 @@ export async function startOpenclawClawlingGateway(params) {
         if (stagedDirectPrompt) {
             stageClawChatPromptInjection({
                 sessionKey: resolvedSessionKey,
-                prompt: turnPrompt,
+                prompt: baseTurnPrompt,
             });
         }
         try {
@@ -2988,6 +3040,7 @@ export async function startOpenclawClawlingGateway(params) {
                 // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
                 // member-backend). Passed as a thunk so it is resolved at send time.
                 resolveOwnerConversationId: resolveOwnerDirectConversationId,
+                nonOwnerTurn: narrowHostTools,
                 log,
             });
             const agentsConfigured = Object.keys(cfg.agents ?? {});
@@ -2996,7 +3049,14 @@ export async function startOpenclawClawlingGateway(params) {
                 const dispatchResult = await rt.reply.withReplyDispatcher({
                     dispatcher,
                     onSettled: () => markDispatchIdle(),
-                    run: () => runWithTerminalClawChatSendScope(terminalSendScopeId, () => rt.reply.dispatchReplyFromConfig({ ctx: ctxPayload, cfg: dispatchCfg, dispatcher, replyOptions })),
+                    run: () => runWithTerminalClawChatSendScope({ scopeId: terminalSendScopeId, sessionKey: resolvedSessionKey }, () => rt.reply.dispatchReplyFromConfig({
+                        ctx: ctxPayload,
+                        cfg: dispatchCfg,
+                        dispatcher,
+                        replyOptions: narrowHostTools
+                            ? { ...replyOptions, toolsAllow: [...NON_OWNER_TOOL_ALLOWLIST] }
+                            : replyOptions,
+                    })),
                 });
                 const counts = dispatchResult?.counts ?? {};
                 const queuedFinal = Boolean(dispatchResult?.queuedFinal);
@@ -3516,6 +3576,7 @@ export async function startOpenclawClawlingGateway(params) {
             if (activationAccount.source === "sqlite" && !abortSignal.aborted) {
                 await startOpenclawClawlingGateway({
                     ...params,
+                    boundaryWarningIssued: true,
                     account: {
                         ...params.account,
                         configured: false,

package/dist/src/storage.js

@@ -184,6 +184,30 @@ CREATE TABLE IF NOT EXISTS recalled_messages (
   recalled_at INTEGER NOT NULL,
   PRIMARY KEY (platform, account_id, message_id)
 );
+`,
+    },
+    {
+        // Explicit message-id arguments are matched case-insensitively
+        // (findSeenMessageInChat); without these the lookup scans the whole
+        // unpruned ledger synchronously.
+        version: 11,
+        name: "message_id_nocase_indexes",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_message_id_nocase
+  ON clawchat_messages(message_id COLLATE NOCASE);
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_protocol_message_id_nocase
+  ON clawchat_messages(protocol_message_id COLLATE NOCASE);
+`,
+    },
+    {
+        // A tool chat id from the model is mapped to the case already stored for
+        // that chat (findStoredChatId) before a row is written, so one chat never
+        // ends up under two cases.
+        version: 12,
+        name: "chat_id_nocase_index",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_chat_id_nocase
+  ON clawchat_messages(chat_id COLLATE NOCASE);
 `,
     },
 ];
@@ -362,6 +386,40 @@ export class ClawChatStore {
             };
         }) ?? null;
     }
+    /**
+     * Strict owner-identity read for the non-owner turn boundary. Unlike the
+     * other getters (which collapse failure into null), this keeps "storage
+     * unavailable", "no activation row" and "row" apart — including incomplete
+     * rows — because only a proven-absent row may fall back to the config mirror
+     * (see `resolveOwnerIdentity`). Nothing is logged here: the caller warns
+     * once per failure class, and no SQL or credentials reach the log.
+     */
+    lookupActivationIdentity(input) {
+        if (!this.ensureInitialized())
+            return { status: "unavailable" };
+        try {
+            const row = this.requireDb()
+                .prepare("SELECT owner_user_id, conversation_id, access_token FROM activations WHERE platform = ? AND account_id = ?")
+                .get(input.platform, input.accountId);
+            if (!row)
+                return { status: "absent" };
+            const value = (key) => {
+                const raw = row[key];
+                return typeof raw === "string" ? raw.trim() || null : null;
+            };
+            return {
+                status: "row",
+                row: {
+                    ownerUserId: value("owner_user_id"),
+                    conversationId: value("conversation_id"),
+                    accessToken: value("access_token"),
+                },
+            };
+        }
+        catch {
+            return { status: "unavailable" };
+        }
+    }
     claimPendingActivationBootstrap(input) {
         return this.write(() => {
             const now = Date.now();
@@ -469,6 +527,55 @@ export class ClawChatStore {
                 .run(input.eventType, input.traceId ?? null, input.chatId ?? null, input.text ?? null, toJson(input.raw), input.accountId, input.kind, input.direction, input.messageId);
         });
     }
+    /**
+     * The stored chat id and message id of this account's ledger row that has
+     * `messageId` in `chatId`, both compared case-insensitively. The message id
+     * matches the client id (`message_id`) or the acked protocol id
+     * (`protocol_message_id`); the one that matched is returned, in its stored
+     * case, so callers put the real id on the wire. Answers `false` when no row
+     * matches and `null` when the store is unavailable, so callers can tell
+     * "not seen" from "cannot say". Seeks via the NOCASE message-id indexes
+     * (migration 11); platform, account and chat are post-filters.
+     */
+    findSeenMessageInChat(input) {
+        if (!input.chatId || !input.messageId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_SEEN_MESSAGE_SQL)
+                .get(input.messageId, input.platform, input.accountId, input.chatId, input.messageId, input.platform, input.accountId, input.chatId);
+            if (typeof row?.chat_id !== "string" || typeof row.matched_id !== "string")
+                return false;
+            return { chatId: row.chat_id, messageId: row.matched_id };
+        });
+    }
+    /**
+     * The chat id as this account's ledger already stores it for `chatId`
+     * (compared case-insensitively), preferring an inbound row, whose case is
+     * the server's. `false` when the ledger has no row for that chat, `null`
+     * when the store is unavailable. Seeks via the NOCASE chat-id index
+     * (migration 12); platform, account and direction are post-filters.
+     */
+    findStoredChatId(input) {
+        if (!input.chatId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_STORED_CHAT_ID_SQL)
+                .get(input.chatId, input.platform, input.accountId, input.chatId, input.platform, input.accountId);
+            return typeof row?.chat_id === "string" ? row.chat_id : false;
+        });
+    }
+    /** True when `message_id` was recalled for this (platform, account). */
+    isMessageRecalled(input) {
+        if (!input.messageId)
+            return false;
+        const row = this.requireDb()
+            .prepare(`SELECT 1 FROM recalled_messages
+          WHERE platform = ? AND account_id = ? AND message_id = ?`)
+            .get(input.platform, input.accountId, input.messageId);
+        return row !== undefined;
+    }
     /**
      * Erase every ledger row for one `message_id` — the local half of a
      * server-authorised recall (`message.recall`, docs/client-integration.md §9.8).
@@ -487,19 +594,8 @@ export class ClawChatStore {
      * the row may never have been stored (a message that arrived before this
      * account was paired, or one dropped by the inbound filter). `null` means the
      * store is unavailable.
-     */
-    /** True when `message_id` was recalled for this (platform, account). */
-    isMessageRecalled(input) {
-        if (!input.messageId)
-            return false;
-        const row = this.requireDb()
-            .prepare(`SELECT 1 FROM recalled_messages
-          WHERE platform = ? AND account_id = ? AND message_id = ?`)
-            .get(input.platform, input.accountId, input.messageId);
-        return row !== undefined;
-    }
-    /**
-     * Record the permanent recall tombstone and purge any row already stored,
+     *
+     * Records the permanent recall tombstone and purges any row already stored,
      * atomically. Returns the number of ledger rows deleted (0 when the recall
      * arrived before the message did — the tombstone still stands and the later
      * ingest is refused by {@link claimMessageOnce}).
@@ -710,13 +806,18 @@ export class ClawChatStore {
      * as `'thinking'` are excluded so the @-mention prior-context block never
      * surfaces the agent's intermediate output as conversation history.
      * Uses `idx_clawchat_messages_chat_created` for performance.
+     * `ignoreCase` matches `chat_id` case-insensitively (rows keep their stored
+     * case) so memory scope can recover a group id's original case from a
+     * lowercased session key; it cannot use that index, so callers that already
+     * know the exact id leave it off.
      * Returns an empty array if the store is unavailable.
      */
-    listRecentGroupMessages(platform, accountId, chatId, limit) {
+    listRecentGroupMessages(platform, accountId, chatId, limit, options = {}) {
+        const chatMatch = options.ignoreCase ? "chat_id = ? COLLATE NOCASE" : "chat_id = ?";
         return this.read(() => {
             const rows = this.requireDb()
                 .prepare(`SELECT * FROM clawchat_messages
-            WHERE platform = ? AND account_id = ? AND chat_id = ? AND kind = 'message'
+            WHERE platform = ? AND account_id = ? AND ${chatMatch} AND kind = 'message'
             ORDER BY created_at DESC, rowid DESC LIMIT ?`)
                 .all(platform, accountId, chatId, limit);
             return rows.reverse(); // oldest-first for prompt order
@@ -821,6 +922,43 @@ export class ClawChatStore {
         this.log?.error?.(`${prefix}: ${safeErrorMessage(err)}`);
     }
 }
+/**
+ * Lookup behind {@link ClawChatStore.findStoredChatId}: an inbound row first,
+ * then any row. Both halves seek `idx_clawchat_messages_chat_id_nocase`.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_STORED_CHAT_ID_SQL = `SELECT chat_id FROM (
+  SELECT chat_id, 0 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ? AND direction = 'inbound'
+      LIMIT 1
+  )
+  UNION ALL
+  SELECT chat_id, 1 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ?
+      LIMIT 1
+  )
+) ORDER BY rank LIMIT 1`;
+/**
+ * Lookup behind {@link ClawChatStore.findSeenMessageInChat}. Two index seeks
+ * (`message_id` / `protocol_message_id`, both COLLATE NOCASE, migration 11);
+ * platform, account and chat are post-filters. A `message_id` match wins.
+ * `INDEXED BY` pins the seek: without table statistics the planner would
+ * otherwise pick the chat-id index (migration 12) and walk the whole chat.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_SEEN_MESSAGE_SQL = `SELECT chat_id, matched_id FROM (
+  SELECT chat_id, message_id AS matched_id, 0 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_message_id_nocase
+    WHERE message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+  UNION ALL
+  SELECT chat_id, protocol_message_id AS matched_id, 1 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_protocol_message_id_nocase
+    WHERE protocol_message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+) ORDER BY rank LIMIT 1`;
 let singleton = null;
 export function createClawChatStore(options = {}) {
     return new ClawChatStore(options);

package/dist/src/terminal-send.js

@@ -1,12 +1,67 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 const DEFAULT_TTL_MS = 60_000;
 const terminalSends = new Map();
-const terminalSendScope = new AsyncLocalStorage();
+const turnScopeStorage = new AsyncLocalStorage();
+const openScopesBySession = new Map();
+function normalizeSessionKey(sessionKey) {
+    const normalized = sessionKey?.trim().toLowerCase();
+    return normalized ? normalized : null;
+}
 function key(accountId, chatId, scopeId) {
     return `${accountId}\0${chatId}\0${scopeId}`;
 }
-export function runWithTerminalClawChatSendScope(scopeId, fn) {
-    return terminalSendScope.run(scopeId, fn);
+function isPromiseLike(value) {
+    return typeof value?.then === "function";
+}
+/**
+ * Run one dispatched turn. `sessionKey` is the session the host runs the turn
+ * in; consumers only see this turn when their trusted session key matches.
+ * The scope closes when `fn` returns or its promise settles.
+ */
+export function runWithTerminalClawChatSendScope(init, fn) {
+    const scope = {
+        scopeId: init.scopeId,
+        sessionKey: normalizeSessionKey(init.sessionKey),
+        open: true,
+        superseded: false,
+    };
+    const sessionKey = scope.sessionKey;
+    if (sessionKey) {
+        const open = openScopesBySession.get(sessionKey) ?? new Set();
+        for (const earlier of open)
+            earlier.superseded = true;
+        open.add(scope);
+        openScopesBySession.set(sessionKey, open);
+    }
+    const close = () => {
+        scope.open = false;
+        if (!sessionKey)
+            return;
+        const open = openScopesBySession.get(sessionKey);
+        open?.delete(scope);
+        if (open?.size === 0)
+            openScopesBySession.delete(sessionKey);
+    };
+    let result;
+    try {
+        result = turnScopeStorage.run(scope, fn);
+    }
+    catch (err) {
+        close();
+        throw err;
+    }
+    if (isPromiseLike(result)) {
+        return Promise.resolve(result).finally(close);
+    }
+    close();
+    return result;
+}
+/** The caller's own open turn, or null when it cannot be tied to the caller's session. */
+function resolveCallerScope(sessionKey) {
+    const scope = turnScopeStorage.getStore();
+    if (!scope?.open || !scope.sessionKey)
+        return null;
+    return scope.sessionKey === normalizeSessionKey(sessionKey) ? scope : null;
 }
 /**
  * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
@@ -22,7 +77,7 @@ function sweepExpiredTerminalSends(nowMs) {
     }
 }
 export function markTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId ?? resolveCallerScope(params.sessionKey)?.scopeId;
     if (!scopeId)
         return;
     const nowMs = params.nowMs ?? Date.now();
@@ -34,7 +89,7 @@ export function markTerminalClawChatSend(params) {
     });
 }
 export function consumeTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId;
     if (!scopeId)
         return null;
     const recordKey = key(params.accountId, params.chatId, scopeId);
@@ -48,17 +103,19 @@ export function consumeTerminalClawChatSend(params) {
 }
 export function clearTerminalClawChatSendsForTest() {
     terminalSends.clear();
+    openScopesBySession.clear();
 }
 /**
- * Read the current turn's ambient send scope (accountId\0chatId\0messageId).
- * Returns null when not inside a dispatch scope, or when the scope id is not
- * the tripartite form (e.g. a test-only opaque scope id).
+ * The calling turn's default reaction target (accountId\0chatId\0messageId).
+ * Returns null unless the tool call's trusted `sessionKey` matches the open
+ * turn in its async context and no later turn of that session has started
+ * since; also null for a non-tripartite scope id (e.g. a test-only one).
  */
-export function getCurrentTerminalSendScope() {
-    const store = terminalSendScope.getStore();
-    if (!store)
+export function getCurrentTerminalSendScope(params) {
+    const scope = resolveCallerScope(params.sessionKey);
+    if (!scope || scope.superseded)
         return null;
-    const parts = store.split("\0");
+    const parts = scope.scopeId.split("\0");
     if (parts.length !== 3)
         return null;
     const [accountId, chatId, messageId] = parts;