@clawling/clawchat-plugin-openclaw 2026.10.9-3 → 2026.10.11-1

package/dist/index.js

@@ -43,6 +43,16 @@ const channelEntry = defineChannelPluginEntry({
  * instead. Each load registers the commands once; a duplicate registration
  * would mark the plugin as errored on the host side.
  */
+/**
+ * The host-tools guard (`before_tool_call`) follows the same rule, for the
+ * same reason: on OpenClaw 2026.8.x the agent run uses the hook runner of the
+ * request-scoped `discovery` registry, so a guard registered only in
+ * `registerFull` never fires there (measured on 2026.8.2: the call ran with no
+ * hook invocation). Every load except `cli-metadata` gets the guard exactly
+ * once: `registerFull` covers `full` / `tool-discovery`, the wrapper covers
+ * the rest.
+ */
+const FULL_REGISTRATION_MODES = new Set(["full", "tool-discovery"]);
 export default {
     // Newer hosts expose `configSchema` as a lazy getter; the spread evaluates it
     // once here, which is fine because the schema is a static object.
@@ -51,6 +61,8 @@ export default {
         channelEntry.register(api);
         if (api.registrationMode !== "cli-metadata") {
             registerOpenclawClawlingCommands(api);
+            if (!FULL_REGISTRATION_MODES.has(String(api.registrationMode)))
+                registerHostToolsGuard(api);
         }
     },
 };

package/dist/src/approval-route.js

@@ -0,0 +1,282 @@
+// Where `non-owner-host-tools: approve` sends a group turn's host-tool request.
+//
+// The host asks for a plugin approval when `before_tool_call` returns
+// `requireApproval`; it shows that request in a chat only through the global
+// `approvals.plugin` forwarding config (OpenClaw 2026.8.1+). Without it the
+// request is posted nowhere and simply times out. Its default `session` mode
+// would answer in the chat the turn came from — the group — so the plugin
+// manages one exact block instead: `mode: "targets"`, one target (the owner's
+// direct chat on the one ClawChat account), and a `sessionFilter` that matches
+// ClawChat group sessions only.
+//
+// The plugin writes that block only when the host has none, and later rewrites
+// or removes only a block of exactly that shape. Any other `approvals.plugin`
+// is the owner's own and is never touched; approve then cannot route and group
+// calls stay blocked. A group call asks for approval only while the LIVE
+// config holds the managed block for this account and its current owner chat.
+import fs from "node:fs";
+import path from "node:path";
+import { CHANNEL_ID, listOpenclawClawlingAccountIds, resolveOpenclawClawlingAccount } from "./config.js";
+/** Substring of every ClawChat group session key (`agent:<id>:<channel>:group:<chat>`). */
+export const APPROVAL_SESSION_FILTER = `:${CHANNEL_ID}:group:`;
+function isRec(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+const norm = (value) => (typeof value === "string" ? value.trim().toLowerCase() : "");
+/** Keys holding a value; a loader may add `undefined` placeholders. */
+const definedKeys = (rec) => Object.keys(rec).filter((key) => rec[key] !== undefined).sort().join(",");
+/**
+ * Enabled ClawChat accounts in use: those whose config section carries an
+ * identity (token or user id), those with a stored activation
+ * (`hasStoredIdentity`, the SQLite row; credentials may live only there), plus
+ * `knownActive` (an account the caller knows is running). Every caller must
+ * count the same way, or two accounts' runtimes would disagree about the one
+ * global block. The root section always lists as an account, so an empty root
+ * next to named accounts does not count.
+ */
+export function listActiveAccountIds(cfg, options = {}) {
+    const { knownActive, hasStoredIdentity } = options;
+    const ids = new Set();
+    for (const id of listOpenclawClawlingAccountIds(cfg)) {
+        const account = resolveOpenclawClawlingAccount(cfg, id);
+        if (!account.enabled)
+            continue;
+        let stored = false;
+        try {
+            stored = hasStoredIdentity?.(account.accountId) === true;
+        }
+        catch {
+            // Unknown counts as in use: more accounts only ever blocks.
+            stored = true;
+        }
+        if (account.token || account.userId || stored || norm(id) === norm(knownActive))
+            ids.add(account.accountId);
+    }
+    if (knownActive?.trim() && ![...ids].some((id) => norm(id) === norm(knownActive)))
+        ids.add(knownActive.trim());
+    return [...ids];
+}
+/** The exact `approvals.plugin` block the plugin writes for `target`. */
+export function buildManagedApprovalsPlugin(target) {
+    return {
+        enabled: true,
+        mode: "targets",
+        sessionFilter: [APPROVAL_SESSION_FILTER],
+        targets: [{ channel: CHANNEL_ID, to: target.to, accountId: target.accountId }],
+    };
+}
+/** Classify the host's `approvals.plugin`; only the exact managed shape is ours. */
+export function readApprovalsPluginState(cfg) {
+    const approvals = isRec(cfg) ? cfg.approvals : undefined;
+    if (approvals === undefined || (isRec(approvals) && approvals.plugin === undefined)) {
+        return { kind: "absent" };
+    }
+    if (!isRec(approvals) || !isRec(approvals.plugin))
+        return { kind: "foreign" };
+    const block = approvals.plugin;
+    if (definedKeys(block) !== "enabled,mode,sessionFilter,targets")
+        return { kind: "foreign" };
+    if (block.enabled !== true || block.mode !== "targets")
+        return { kind: "foreign" };
+    const filter = block.sessionFilter;
+    if (!Array.isArray(filter) || filter.length !== 1 || filter[0] !== APPROVAL_SESSION_FILTER) {
+        return { kind: "foreign" };
+    }
+    const targets = block.targets;
+    if (!Array.isArray(targets) || targets.length !== 1 || !isRec(targets[0]))
+        return { kind: "foreign" };
+    const target = targets[0];
+    if (definedKeys(target) !== "accountId,channel,to")
+        return { kind: "foreign" };
+    if (target.channel !== CHANNEL_ID)
+        return { kind: "foreign" };
+    const to = typeof target.to === "string" ? target.to.trim() : "";
+    const accountId = typeof target.accountId === "string" ? target.accountId.trim() : "";
+    if (!to || !accountId)
+        return { kind: "foreign" };
+    return { kind: "managed", target: { to, accountId } };
+}
+/**
+ * The target the managed block should hold now, or `null` when none should
+ * exist. Approve routes only with exactly one active ClawChat account: the
+ * block is global, so a second account's owner would see the first one's
+ * requests.
+ */
+export function desiredApprovalTarget(input) {
+    if (input.approveAccountIds.length === 0)
+        return { target: null, reason: "not-approve" };
+    if (input.activeAccountIds.length !== 1)
+        return { target: null, reason: "multiple-accounts" };
+    const accountId = input.activeAccountIds[0];
+    if (!input.approveAccountIds.includes(accountId))
+        return { target: null, reason: "not-approve" };
+    const to = input.ownerConversation(accountId)?.trim();
+    if (!to)
+        return { target: null, reason: "no-owner-chat" };
+    return { target: { accountId, to } };
+}
+/** What to write so `approvals.plugin` matches `desired`, never touching a foreign block. */
+export function planApprovalsPluginWrite(current, desired) {
+    if (current.kind === "foreign")
+        return { action: "none" };
+    if (!desired)
+        return current.kind === "managed" ? { action: "remove" } : { action: "none" };
+    // Never take the block over from another account: that account's runtime
+    // would take it back (each write restarts a pre-9.2 gateway). Drop it.
+    if (current.kind === "managed" && norm(current.target.accountId) !== norm(desired.accountId)) {
+        return { action: "remove" };
+    }
+    if (current.kind === "managed" &&
+        norm(current.target.to) === norm(desired.to) &&
+        norm(current.target.accountId) === norm(desired.accountId)) {
+        return { action: "none" };
+    }
+    return { action: "set", target: desired };
+}
+/** Apply `plan` to a config draft in place. */
+export function applyApprovalsPluginWrite(draft, plan) {
+    if (plan.action === "none")
+        return;
+    const approvals = isRec(draft.approvals) ? { ...draft.approvals } : {};
+    if (plan.action === "set") {
+        approvals.plugin = buildManagedApprovalsPlugin(plan.target);
+        draft.approvals = approvals;
+        return;
+    }
+    delete approvals.plugin;
+    if (Object.keys(approvals).length === 0)
+        delete draft.approvals;
+    else
+        draft.approvals = approvals;
+}
+/**
+ * Whether a group call on `accountId` can be sent for approval now: the live
+ * config must already hold the managed block for exactly this account and its
+ * current owner chat. Everything else blocks.
+ */
+export function resolveApprovalRoute(input) {
+    if (!input.approve)
+        return { ready: false, reason: "not-approve" };
+    if (input.activeAccountIds.length !== 1 || norm(input.activeAccountIds[0]) !== norm(input.accountId)) {
+        return { ready: false, reason: "multiple-accounts" };
+    }
+    const owner = input.ownerConversationId?.trim();
+    if (!owner)
+        return { ready: false, reason: "no-owner-chat" };
+    const state = readApprovalsPluginState(input.liveConfig);
+    if (state.kind === "foreign")
+        return { ready: false, reason: "foreign-config" };
+    if (state.kind !== "managed" ||
+        norm(state.target.accountId) !== norm(input.accountId) ||
+        norm(state.target.to) !== norm(owner)) {
+        return { ready: false, reason: "not-applied" };
+    }
+    return { ready: true, target: state.target };
+}
+export const APPROVAL_ROUTE_WARNINGS = {
+    "not-approve": "",
+    "multiple-accounts": "non-owner-host-tools approve needs exactly one ClawChat account on this gateway; group host-tool calls stay blocked",
+    "no-owner-chat": "non-owner-host-tools approve has no owner direct chat yet (activate first); group host-tool calls stay blocked",
+    "foreign-config": "non-owner-host-tools approve cannot route: approvals.plugin is already set in the OpenClaw config and the plugin will not change it; group host-tool calls stay blocked",
+    "not-applied": "non-owner-host-tools approve is waiting for the gateway to load approvals.plugin; group host-tool calls stay blocked until it does",
+};
+/**
+ * Bring `approvals.plugin` in line with the accounts' `non-owner-host-tools`:
+ * write the managed block when approve can route, remove a managed block that
+ * no longer applies, and never touch the owner's own block. The write lets the
+ * host decide how to load it (`afterWrite: auto`): OpenClaw 2026.9.2+ applies
+ * `approvals.plugin` without a restart, earlier hosts restart the gateway once.
+ */
+export async function reconcileApprovalsPlugin(params) {
+    const cfg = params.readConfig();
+    const active = listActiveAccountIds(cfg, {
+        knownActive: params.knownActive,
+        hasStoredIdentity: params.hasStoredIdentity,
+    });
+    const approveIds = active.filter((id) => resolveOpenclawClawlingAccount(cfg, id).nonOwnerHostTools === "approve");
+    const desired = desiredApprovalTarget({
+        activeAccountIds: active,
+        approveAccountIds: approveIds,
+        ownerConversation: params.ownerConversation,
+    });
+    const current = readApprovalsPluginState(cfg);
+    if (approveIds.length > 0) {
+        const reason = current.kind === "foreign" ? "foreign-config" : desired.reason;
+        if (reason && reason !== "not-approve")
+            params.log?.warn?.(`clawchat-plugin-openclaw: ${APPROVAL_ROUTE_WARNINGS[reason]}`);
+    }
+    const planned = planApprovalsPluginWrite(current, desired.target);
+    if (planned.action === "none")
+        return "none";
+    const guardKey = planned.action === "set"
+        ? `set:${norm(planned.target.accountId)}:${norm(planned.target.to)}`
+        : "remove";
+    try {
+        if (params.writeGuard?.seen(guardKey)) {
+            params.log?.warn?.("clawchat-plugin-openclaw: approvals.plugin was already updated recently but the gateway does not show it; not writing again (group host-tool calls stay blocked)");
+            return "none";
+        }
+        params.writeGuard?.record(guardKey);
+    }
+    catch {
+        // A broken guard must not stop the write; the per-lifecycle guard still applies.
+    }
+    let action = "none";
+    try {
+        await params.mutateConfigFile({
+            afterWrite: { mode: "auto" },
+            mutate(draft) {
+                // Re-plan against the file as it is now, not the snapshot read above.
+                const plan = planApprovalsPluginWrite(readApprovalsPluginState(draft), desired.target);
+                action = plan.action;
+                applyApprovalsPluginWrite(draft, plan);
+            },
+        });
+    }
+    catch (err) {
+        params.log?.error?.(`clawchat-plugin-openclaw: approvals.plugin update failed; group host-tool calls stay blocked (${err instanceof Error ? err.message : String(err)})`);
+        return "failed";
+    }
+    if (action === "set") {
+        params.log?.info?.("clawchat-plugin-openclaw: non-owner-host-tools approve: wrote approvals.plugin so group host-tool approvals go only to the owner's ClawChat direct chat");
+    }
+    else if (action === "remove") {
+        params.log?.info?.("clawchat-plugin-openclaw: removed the plugin-managed approvals.plugin (approve is no longer in use)");
+    }
+    return action;
+}
+export const APPROVALS_WRITE_MARKER_FILENAME = "clawchat-approvals-plugin-write.json";
+const WRITE_GUARD_WINDOW_MS = 10 * 60_000;
+/**
+ * File-backed `writeGuard` in the plugin's state dir: the same write is made
+ * at most once per 10 minutes, across gateway restarts.
+ */
+export function createApprovalsWriteGuard(stateDir, now = Date.now) {
+    const file = path.join(stateDir, APPROVALS_WRITE_MARKER_FILENAME);
+    const read = () => {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+            return isRec(parsed) ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    return {
+        seen: (key) => {
+            const last = read();
+            return last.key === key && typeof last.at === "number" && now() - last.at < WRITE_GUARD_WINDOW_MS;
+        },
+        record: (key) => {
+            fs.mkdirSync(stateDir, { recursive: true });
+            fs.writeFileSync(file, JSON.stringify({ key, at: now() }));
+        },
+    };
+}
+/** `hasStoredIdentity` from the plugin store; an unavailable store counts every account. */
+export function storedIdentityLookup(store) {
+    return (accountId) => {
+        const lookup = store?.lookupActivationIdentity?.({ platform: "openclaw", accountId });
+        return !lookup || lookup.status !== "absent";
+    };
+}

package/dist/src/host-tools-guard.js

@@ -1,9 +1,17 @@
 import { CHANNEL_ID, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.js";
-import { classifyChat, clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, parseClawChatSessionKey, } from "./turn-boundary.js";
+import { classifyChat, clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, normalizeToolChatId, parseClawChatSessionKey, } from "./turn-boundary.js";
 import { clawChatDbPathForStateDir, getClawChatStore } from "./storage.js";
 import { resolveOwnerIdentity } from "./owner-identity.js";
 import { getRegisteredClawChatToolNames } from "./tools.js";
+import { APPROVAL_ROUTE_WARNINGS, listActiveAccountIds, resolveApprovalRoute, storedIdentityLookup, } from "./approval-route.js";
 export const BLOCK_MESSAGE = "This tool is not available here: only your owner's direct chat may use host tools on this machine. Do not try to reach them another way; answer without them, or tell the person to ask your owner.";
+/** Told to the model when the owner denies, or does not answer in time. */
+export const APPROVAL_TIMEOUT_MESSAGE = "Your owner did not approve this tool call in time, so it did not run. Do not call it again for this request; tell the group your owner did not approve it.";
+/** Owner approval wait for one call; the host caps plugin approvals at 600 s. */
+export const APPROVAL_TIMEOUT_MS = 300_000;
+const APPROVAL_TITLE_MAX = 80;
+/** The host rejects (and so blocks) a description over 512 characters. */
+const APPROVAL_DESCRIPTION_MAX = 500;
 /**
  * Host tool-search controls (OpenClaw 2026.9.6+). The host adds them to every
  * run on its own and builds their catalog from the run's allowed tools, so in
@@ -44,17 +52,26 @@ export function decideHostToolCall(input) {
     if (classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner") {
         return undefined;
     }
+    // Approve mode: only group turns, and only once the route to the owner's
+    // direct chat is live. Friend direct chats never ask; they block below.
+    const approve = parsed.kind === "group" && input.approvalRoute?.ready === true;
+    const allowlisted = NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName);
     // Outer pre-check only. The inner tool call is checked again and that check
     // is authoritative: the host also accepts dotted/flattened argument keys
-    // that this outer check may not recognise.
-    if (hasLocalPathArgument(input.params))
+    // that this outer check may not recognise. Under approve, tools the owner
+    // approves one by one (and the tool-search controls that reach them) show
+    // the owner their arguments instead; the allowlisted tools, which run
+    // without asking, keep the check.
+    if ((!approve || allowlisted) && hasLocalPathArgument(input.params))
         return block();
     if (HOST_TOOL_SEARCH_CONTROLS.includes(input.toolName))
         return undefined;
     if (ACCOUNT_SCOPED_TOOLS.includes(input.toolName)) {
         // D9: a non-owner turn may only act on its own chat, named explicitly.
-        const target = input.params.chatId;
-        if (typeof target !== "string" || !target.trim() || target.trim().toLowerCase() !== parsed.chatId) {
+        // The tool resolves the same argument with the same helper, so the chat
+        // checked here is the chat the call reaches.
+        const target = normalizeToolChatId(input.params.chatId).toLowerCase();
+        if (!target || target !== parsed.chatId) {
             return {
                 block: true,
                 blockReason: input.toolName === "clawchat_react_message"
@@ -63,12 +80,62 @@ export function decideHostToolCall(input) {
             };
         }
     }
-    if (NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName)) {
+    if (allowlisted) {
         return input.toolName.startsWith("clawchat_") && !input.registeredTools.has(input.toolName)
             ? block()
             : undefined;
     }
-    return block(); // `off` and the reserved `approve` both block in this release.
+    if (!approve)
+        return block();
+    const approval = buildHostToolApproval(input.toolName, parsed.chatId, input.params);
+    return approval ? { requireApproval: approval } : { block: true, blockReason: APPROVAL_UNSHOWABLE_MESSAGE };
+}
+// Drop what the host would escape (controls, zero-width, bidi) from the names
+// shown on the card, and collapse whitespace. Arguments are never cleaned:
+// they are shown exactly, or the call is not offered for approval.
+const UNSAFE_TEXT = /[\u0000-\u001f\u007f-\u009f\u00ad\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/g;
+function cleanText(text, max) {
+    const flat = text.replace(UNSAFE_TEXT, " ").replace(/\s+/g, " ").trim();
+    return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+/** Tools whose approval starts work that later runs on its own (own session key, no further asking). */
+const STARTS_UNATTENDED_WORK = /spawn|subagent|sessions_send|cron|automation|schedul/i;
+/** Told to the model when a call's arguments cannot be shown to the owner exactly. */
+export const APPROVAL_UNSHOWABLE_MESSAGE = "This call cannot be sent to your owner for approval: its arguments are too long or contain hidden characters, and your owner must see exactly what would run. Do not retry it as is; use a much shorter call, or tell the person to ask your owner directly.";
+/**
+ * The approval card for one group host-tool call; it goes only to the owner's
+ * direct chat. `null` when the arguments cannot be shown in full and exactly
+ * (too long for the host's 512-character description, unserializable, or
+ * holding characters the host would escape or hide): the owner must never
+ * approve a command they could not read, so such a call blocks.
+ */
+export function buildHostToolApproval(toolName, groupChatId, params) {
+    const tool = cleanText(toolName, 48);
+    let args;
+    try {
+        args = JSON.stringify(params) ?? "{}";
+    }
+    catch {
+        return null;
+    }
+    if (new RegExp(UNSAFE_TEXT.source).test(args))
+        return null;
+    const unattended = STARTS_UNATTENDED_WORK.test(toolName)
+        ? " Approving starts work that later runs with every host tool and is not asked about again."
+        : "";
+    const before = `A turn in ClawChat group ${cleanText(groupChatId, 64)} (anyone in the group may have asked) wants to run ` +
+        `the host tool ${tool} on this machine. Arguments: `;
+    const after = `.${unattended} Allow only if you would run it yourself.`;
+    if (before.length + args.length + after.length > APPROVAL_DESCRIPTION_MAX)
+        return null;
+    return {
+        title: cleanText(`ClawChat group wants to run ${tool}`, APPROVAL_TITLE_MAX),
+        description: `${before}${args}${after}`,
+        severity: "warning",
+        timeoutMs: APPROVAL_TIMEOUT_MS,
+        timeoutReason: APPROVAL_TIMEOUT_MESSAGE,
+        allowedDecisions: ["allow-once", "deny"],
+    };
 }
 export function registerHostToolsGuard(api, options = {}) {
     const warned = new Set();
@@ -83,16 +150,54 @@ export function registerHostToolsGuard(api, options = {}) {
             // Logging cannot unlock a call.
         }
     };
-    const lookupOwnerConversation = (accountId) => {
-        if (options.ownerConversation)
-            return options.ownerConversation(accountId);
-        const account = resolveOpenclawClawlingAccount(api.config, accountId);
+    const openStore = () => {
         const stateDir = api.runtime.state?.resolveStateDir?.();
-        const store = getClawChatStore({
+        return getClawChatStore({
             ...(stateDir ? { dbPath: clawChatDbPathForStateDir(stateDir) } : {}),
             log: { error: message => api.logger.error?.(message) },
         });
-        return resolveOwnerIdentity(store, accountId, account.ownerUserId).conversationId;
+    };
+    const lookupOwnerConversation = (accountId) => {
+        if (options.ownerConversation)
+            return options.ownerConversation(accountId);
+        const account = resolveOpenclawClawlingAccount(api.config, accountId);
+        return resolveOwnerIdentity(openStore(), accountId, account.ownerUserId).conversationId;
+    };
+    const hasStoredIdentity = options.hasStoredIdentity
+        ?? ((accountId) => storedIdentityLookup(openStore())(accountId));
+    const readLiveConfig = () => {
+        if (options.liveConfig)
+            return options.liveConfig();
+        const current = api.runtime.config?.current;
+        return (typeof current === "function" ? current.call(api.runtime.config) : api.config);
+    };
+    // Only consulted for group calls. `undefined` = the account is not in
+    // approve mode; a route that is not ready blocks like `off`.
+    const groupApprovalRoute = (accountId) => {
+        try {
+            const cfg = readLiveConfig();
+            const active = listActiveAccountIds(cfg, { knownActive: accountId, hasStoredIdentity });
+            const routeAccountId = accountId ?? (active.length === 1 ? active[0] : undefined);
+            const anyApprove = (routeAccountId ? [routeAccountId] : active).some(id => resolveOpenclawClawlingAccount(cfg, id).nonOwnerHostTools === "approve");
+            if (!anyApprove)
+                return undefined;
+            const route = routeAccountId
+                ? resolveApprovalRoute({
+                    liveConfig: cfg,
+                    accountId: routeAccountId,
+                    activeAccountIds: active,
+                    approve: true,
+                    ownerConversationId: lookupOwnerConversation(routeAccountId),
+                })
+                : { ready: false, reason: "multiple-accounts" };
+            if (!route.ready)
+                warn(`approve unavailable (${route.reason}): ${APPROVAL_ROUTE_WARNINGS[route.reason]}`);
+            return route;
+        }
+        catch {
+            warn("approve unavailable (route lookup failed)");
+            return { ready: false, reason: "not-applied" };
+        }
     };
     api.on("before_tool_call", (event, sdkCtx) => {
         // `requester` is host 2026.8.1+ (the floor); the development SDK types predate it.
@@ -136,6 +241,7 @@ export function registerHostToolsGuard(api, options = {}) {
                     sessionKey,
                     ownerDirectConversationId: null,
                     registeredTools: getRegisteredClawChatToolNames(),
+                    approvalRoute: groupApprovalRoute(undefined),
                 });
             }
             let ownerDirectConversationId = null;
@@ -153,6 +259,7 @@ export function registerHostToolsGuard(api, options = {}) {
                 sessionKey,
                 ownerDirectConversationId,
                 registeredTools: getRegisteredClawChatToolNames(),
+                ...(parsed.kind === "group" ? { approvalRoute: groupApprovalRoute(accountId) } : {}),
             });
         }
         catch {

package/dist/src/memory-scope.js

@@ -10,6 +10,11 @@
 //   anything else (unknown session, missing store / peer, contradictions,
 //   ambiguous chat-id case, resolution errors) → nothing
 //
+// Writes: replace / edit need a readable note; append may go to any note
+// except owner.md, which only the owner DM writes. owner.md is injected into
+// the owner DM, where the agent has every tool, so text appended from a
+// friend or group turn would read there as the owner's own note.
+//
 // Chat ids compare case-insensitively (the host lowercases session keys);
 // the original case is recovered before any group file / SQL lookup. Member
 // user ids stay case-sensitive.
@@ -142,6 +147,22 @@ export function canReadMemory(scope, target) {
         return scope.members.has(target.targetId);
     return scope.kind === "group" && target.targetType === "group" && target.targetId === scope.chatId;
 }
+/** Whether a write (`append` when `append` is true) may touch the target. */
+export function canWriteMemory(scope, target, append) {
+    if (target.targetType === "owner")
+        return scope.kind === "owner";
+    return append || canReadMemory(scope, target);
+}
+/** Refusal for an owner.md write outside the owner DM, with where to write instead. */
+export function ownerNoteWriteRefusal(scope) {
+    const base = "owner.md can only be changed in your owner's direct chat.";
+    const message = scope.kind === "direct"
+        ? `${base} Record this in the note about the person you are talking to (their users/<id>.md) instead.`
+        : scope.kind === "group"
+            ? `${base} Record this in the speaker's own note (users/<id>.md) or this group's note instead; if the owner wants it in owner.md, they can tell you in their direct chat.`
+            : base;
+    return { error: "not_writable_here", code: "memory_scope", message };
+}
 export function memoryScopeRefusal(scope, target) {
     const message = target.targetType === "owner"
         ? "owner.md can only be read in your owner's direct chat. Tool results stay in this conversation's history. Do not try to get the owner's notes another way."

package/dist/src/outbound.js

@@ -583,15 +583,16 @@ export async function sendOpenclawClawlingMedia(params) {
  * Emit a Protocol-v2 `message.reaction`. Fire-and-forget: reactions are NOT
  * ack-aligned (the server mints the slot-key message_id, so the ack-by-trace_id
  * path used for message.send/reply does not apply). Matches the mobile client.
+ * Local refusals are returned, not thrown; a transport failure still throws.
  */
 export function sendOpenclawClawlingReaction(params) {
     if (!isValidChatId(params.chatId)) {
         params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=invalid_chat_id`);
-        return;
+        return { sent: false, reason: "invalid_chat_id" };
     }
     if (isOutboundBlocked(params.client, params.chatId)) {
         params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=chat_rejected_by_server`);
-        return;
+        return { sent: false, reason: "chat_rejected_by_server" };
     }
     const payload = {
         target_message_id: params.targetMessageId,
@@ -608,6 +609,7 @@ export function sendOpenclawClawlingReaction(params) {
     };
     params.client.sendWire(JSON.stringify(env));
     params.log?.info?.(`clawchat reaction sent chat_id=${params.chatId} target=${params.targetMessageId} emoji=${params.emoji} removed=${params.removed}`);
+    return { sent: true };
 }
 // Crockford base32 alphabet (ULID spec).
 const ULID_ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -629,6 +631,30 @@ function ulid(now = Date.now()) {
     }
     return out.join("");
 }
+// Every message id shape a ClawChat message can carry. The server preserves a
+// client-supplied id verbatim and never parses it, so this is deliberately a
+// plausibility check, not the mint contract:
+//   - `msg-<ULID>`: clients (this plugin, mobile, hermes) and the server's own
+//     fallback mint; `msg_…` / short `msg-…` forms are kept for older ids;
+//   - `sys-<ULID>` / `sys-<request_id>`: server system injections;
+//   - a bare ULID: the server's user-message publisher;
+//   - `clawchat-plugin-openclaw-…`: this plugin's synthetic turn ids.
+// UUIDs are not accepted: no ClawChat message id the model sees has that
+// shape, while host transcript ids (e.g. from `sessions_search`) do.
+const PREFIXED_MESSAGE_ID = /^(?:msg[-_]|sys-|clawchat-plugin-openclaw-)\S+$/i;
+const BARE_ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+/**
+ * Whether `id` can be a real ClawChat message id. Rejects what a model makes
+ * up when it has no id (a label like `B`, `msg`, prose); the server only checks
+ * that a reaction target is non-empty, so such a value would "succeed" on no
+ * message. Callers trim first. Tools use this only as the fallback when the
+ * plugin store cannot answer whether it has seen the id in the chat.
+ */
+export function isPlausibleMessageId(id) {
+    if (typeof id !== "string")
+        return false;
+    return PREFIXED_MESSAGE_ID.test(id) || BARE_ULID.test(id);
+}
 /** Client-minted message id: `msg-` + ULID (protocol §7.6 format contract). */
 export function mintMessageId() {
     return `msg-${ulid()}`;
@@ -687,8 +713,22 @@ function markChannelOutboundAcknowledged(params) {
         // Best-effort diagnostics only; ack has already succeeded.
     }
 }
+/**
+ * Host approval prompts (exec and plugin approvals forwarded by
+ * `approvals.exec` / `approvals.plugin`) never go into a ClawChat group: anyone
+ * there could read the request, and only the owner may answer it. The host
+ * calls this before each forwarded prompt; throwing fails that one delivery.
+ */
+export function refuseGroupApprovalPrompt(params) {
+    if (params.hint?.kind !== "approval-pending")
+        return;
+    if (parseOpenclawRecipient(params.target.to).chatType === "group") {
+        throw new Error("clawchat-plugin-openclaw: approval prompts are not sent to ClawChat groups");
+    }
+}
 export const openclawClawlingOutbound = {
     deliveryMode: "direct",
+    beforeDeliverPayload: (params) => refuseGroupApprovalPrompt(params),
     chunker: (text, limit) => chunkMarkdownText(text, limit),
     chunkerMode: "markdown",
     textChunkLimit: 4000,