@clawling/clawchat-plugin-openclaw 2026.10.9-3 → 2026.10.11-1

package/dist/src/runtime.js

@@ -33,6 +33,7 @@ import { clawChatDbPathForStateDir, getClawChatStore, makeOwnerProfilePersister,
 import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
 import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.js";
 import { resolveOwnerIdentity } from "./owner-identity.js";
+import { createApprovalsWriteGuard, listActiveAccountIds, reconcileApprovalsPlugin, resolveApprovalRoute, storedIdentityLookup, } from "./approval-route.js";
 import { loadClawChatPromptMetadata, renderClawChatProfilePrompt, resolveSenderRelation, } from "./profile-prompt.js";
 import { buildNoteMemorySection } from "./note-injection.js";
 import { buildGroupCatchUp, CATCH_UP_FETCH_ROWS, DeliveredGroupMessages } from "./group-catch-up.js";
@@ -110,6 +111,10 @@ const OPENCLAW_CONFIRM_SLASH_COMMANDS = new Set([
     "nevermind",
 ]);
 const GROUP_OWNER_ATTENTION_TITLE = "requires owner attention";
+/** Group turns under `non-owner-host-tools: approve` (route live). */
+const GROUP_APPROVAL_GUIDANCE = "Host tools here (commands, files, browser, sub-agents, scheduling and the like) run only if your owner approves each call: " +
+    "the request goes to your owner's direct chat and the call waits up to 5 minutes. " +
+    "Do not ask anyone in this group to approve it. If it is denied or times out, do not retry; say your owner did not approve it.";
 // §C.1 — user-visible message emitted on permanent token expiry. Kept
 // byte-identical to the Hermes plugin (parity spec §C.1.4). Points the owner
 // at the reconnect prompt (a code bound to this identity) rather than at a
@@ -733,10 +738,7 @@ export async function startOpenclawClawlingGateway(params) {
         hostAtLeast(runtime.version, HOST_TOOL_SEARCH_DEFAULT_ON) &&
         hostToolSearchEnabled(cfg)) {
         loggedHostToolSearch = true;
-        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
-    }
-    if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
-        log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools without asking (approve mode: other tools in group turns still need the owner's approval each call) (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
     }
     log?.info?.(`[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`);
     // Freeze one report device_id for this process; reused for the paired report
@@ -2161,6 +2163,108 @@ export async function startOpenclawClawlingGateway(params) {
     // forwards) would be unreachable. Registered lazily — the activation
     // conversation may be recorded after the client is constructed.
     client.setOwnerDirectChatResolver(resolveOwnerDirectConversationId);
+    // `non-owner-host-tools: approve` routes group host-tool approvals to the
+    // owner's direct chat through the host's `approvals.plugin`
+    // (approval-route.ts). Checked once at start and again from a group turn
+    // that finds the route missing (the owner chat may be recorded later). One
+    // attempt per owner chat per lifecycle, so a failing write cannot loop.
+    const readLiveConfig = () => {
+        const current = runtime.config?.current;
+        return (typeof current === "function" ? current.call(runtime.config) : cfg);
+    };
+    const approvalReconcileAttempts = new Set();
+    const hasStoredIdentity = storedIdentityLookup(store);
+    const approvalsStateDir = (() => {
+        try {
+            return runtime.state?.resolveStateDir?.();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const reconcileApprovalRoute = () => {
+        const mutateConfigFile = resolveMutateConfigFile();
+        if (!mutateConfigFile) {
+            if (approvalReconcileAttempts.has("no-config-writes"))
+                return;
+            approvalReconcileAttempts.add("no-config-writes");
+            try {
+                const live = readLiveConfig();
+                if (resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools !== "approve")
+                    return;
+                const route = resolveApprovalRoute({
+                    liveConfig: live,
+                    accountId,
+                    activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+                    approve: true,
+                    ownerConversationId: resolveOwnerDirectConversationId(),
+                });
+                if (route.ready)
+                    return;
+            }
+            catch {
+                // Fall through: say why approve is not routing.
+            }
+            log?.warn?.(`[${accountId}] clawchat-plugin-openclaw: non-owner-host-tools approve cannot write approvals.plugin (host config writes unavailable); group host-tool calls stay blocked`);
+            return;
+        }
+        let ownerChat = null;
+        try {
+            ownerChat = resolveOwnerDirectConversationId();
+        }
+        catch {
+            ownerChat = null;
+        }
+        const attemptKey = ownerChat ?? "";
+        if (approvalReconcileAttempts.has(attemptKey))
+            return;
+        approvalReconcileAttempts.add(attemptKey);
+        void reconcileApprovalsPlugin({
+            readConfig: readLiveConfig,
+            mutateConfigFile: mutateConfigFile,
+            ownerConversation: (id) => (id === accountId ? ownerChat : null),
+            knownActive: accountId,
+            hasStoredIdentity,
+            ...(approvalsStateDir ? { writeGuard: createApprovalsWriteGuard(approvalsStateDir) } : {}),
+            log: {
+                info: (m) => log?.info?.(`[${accountId}] ${m}`),
+                warn: (m) => {
+                    const warn = log?.warn;
+                    if (warn)
+                        warn(`[${accountId}] ${m}`);
+                    else
+                        log?.info?.(`[${accountId}] WARNING ${m}`);
+                },
+                error: (m) => log?.error?.(`[${accountId}] ${m}`),
+            },
+        }).catch(() => {
+            // Logged inside; the route simply stays not ready (calls block).
+        });
+    };
+    const groupApprovalRouteReady = (ownerChat) => {
+        try {
+            const live = readLiveConfig();
+            const approve = resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools === "approve";
+            if (!approve)
+                return false;
+            const route = resolveApprovalRoute({
+                liveConfig: live,
+                accountId,
+                activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+                approve,
+                ownerConversationId: ownerChat,
+            });
+            if (!route.ready && (route.reason === "not-applied" || route.reason === "no-owner-chat")) {
+                reconcileApprovalRoute();
+            }
+            return route.ready;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!params.boundaryWarningIssued)
+        reconcileApprovalRoute();
     const sendOwnerSkillMessage = async (text) => {
         const conversationId = resolveOwnerDirectConversationId();
         if (!conversationId) {
@@ -2881,11 +2985,18 @@ export async function startOpenclawClawlingGateway(params) {
             chatId: turn.peer.id,
             ownerDirectConversationId: ownerConversationId,
         });
-        const narrowHostTools = turnClass === "non-owner";
+        // `non-owner-host-tools: approve`: a group turn keeps the host tools once
+        // the approval route to the owner's direct chat is live; the hook then
+        // asks the owner for each call. Friend direct chats always narrow.
+        const groupApproval = turnClass === "non-owner"
+            && turn.peer.kind === "group"
+            && groupApprovalRouteReady(ownerConversationId);
+        const narrowHostTools = turnClass === "non-owner" && !groupApproval;
         const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
         const nonOwnerMediaGuidance = "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
         const turnPrompt = [
-            ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            ...(turnClass === "non-owner" ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            ...(groupApproval ? [GROUP_APPROVAL_GUIDANCE] : []),
             baseTurnPrompt,
         ].filter(Boolean).join("\n\n");
         const ctxPayload = resolveChannelContextBuilder(rt)({
@@ -3040,7 +3151,7 @@ export async function startOpenclawClawlingGateway(params) {
                 // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
                 // member-backend). Passed as a thunk so it is resolved at send time.
                 resolveOwnerConversationId: resolveOwnerDirectConversationId,
-                nonOwnerTurn: narrowHostTools,
+                nonOwnerTurn: turnClass === "non-owner",
                 log,
             });
             const agentsConfigured = Object.keys(cfg.agents ?? {});
@@ -3049,7 +3160,7 @@ export async function startOpenclawClawlingGateway(params) {
                 const dispatchResult = await rt.reply.withReplyDispatcher({
                     dispatcher,
                     onSettled: () => markDispatchIdle(),
-                    run: () => runWithTerminalClawChatSendScope(terminalSendScopeId, () => rt.reply.dispatchReplyFromConfig({
+                    run: () => runWithTerminalClawChatSendScope({ scopeId: terminalSendScopeId, sessionKey: resolvedSessionKey }, () => rt.reply.dispatchReplyFromConfig({
                         ctx: ctxPayload,
                         cfg: dispatchCfg,
                         dispatcher,

package/dist/src/skill-update.js

@@ -66,7 +66,7 @@ export const OFFICIAL_SKILLS_BASE = "https://raw.githubusercontent.com/clawling/
  * in the install-cli repo, bump this constant, ship it. `liveware-sample.ts`
  * imports the same ref, so the `livewares` tree at that tag is pinned too.
  */
-export const DEFAULT_SKILLS_REF = "skills-v1.17.0";
+export const DEFAULT_SKILLS_REF = "skills-v1.17.1";
 /** Refuse to treat an absurdly large response as a skill file (defence in depth). */
 export const MAX_SKILL_BYTES = 256 * 1024;
 /** This adapter's host target inside `skills/manifest.json`. */

package/dist/src/storage.js

@@ -184,6 +184,30 @@ CREATE TABLE IF NOT EXISTS recalled_messages (
   recalled_at INTEGER NOT NULL,
   PRIMARY KEY (platform, account_id, message_id)
 );
+`,
+    },
+    {
+        // Explicit message-id arguments are matched case-insensitively
+        // (findSeenMessageInChat); without these the lookup scans the whole
+        // unpruned ledger synchronously.
+        version: 11,
+        name: "message_id_nocase_indexes",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_message_id_nocase
+  ON clawchat_messages(message_id COLLATE NOCASE);
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_protocol_message_id_nocase
+  ON clawchat_messages(protocol_message_id COLLATE NOCASE);
+`,
+    },
+    {
+        // A tool chat id from the model is mapped to the case already stored for
+        // that chat (findStoredChatId) before a row is written, so one chat never
+        // ends up under two cases.
+        version: 12,
+        name: "chat_id_nocase_index",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_chat_id_nocase
+  ON clawchat_messages(chat_id COLLATE NOCASE);
 `,
     },
 ];
@@ -503,6 +527,55 @@ export class ClawChatStore {
                 .run(input.eventType, input.traceId ?? null, input.chatId ?? null, input.text ?? null, toJson(input.raw), input.accountId, input.kind, input.direction, input.messageId);
         });
     }
+    /**
+     * The stored chat id and message id of this account's ledger row that has
+     * `messageId` in `chatId`, both compared case-insensitively. The message id
+     * matches the client id (`message_id`) or the acked protocol id
+     * (`protocol_message_id`); the one that matched is returned, in its stored
+     * case, so callers put the real id on the wire. Answers `false` when no row
+     * matches and `null` when the store is unavailable, so callers can tell
+     * "not seen" from "cannot say". Seeks via the NOCASE message-id indexes
+     * (migration 11); platform, account and chat are post-filters.
+     */
+    findSeenMessageInChat(input) {
+        if (!input.chatId || !input.messageId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_SEEN_MESSAGE_SQL)
+                .get(input.messageId, input.platform, input.accountId, input.chatId, input.messageId, input.platform, input.accountId, input.chatId);
+            if (typeof row?.chat_id !== "string" || typeof row.matched_id !== "string")
+                return false;
+            return { chatId: row.chat_id, messageId: row.matched_id };
+        });
+    }
+    /**
+     * The chat id as this account's ledger already stores it for `chatId`
+     * (compared case-insensitively), preferring an inbound row, whose case is
+     * the server's. `false` when the ledger has no row for that chat, `null`
+     * when the store is unavailable. Seeks via the NOCASE chat-id index
+     * (migration 12); platform, account and direction are post-filters.
+     */
+    findStoredChatId(input) {
+        if (!input.chatId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_STORED_CHAT_ID_SQL)
+                .get(input.chatId, input.platform, input.accountId, input.chatId, input.platform, input.accountId);
+            return typeof row?.chat_id === "string" ? row.chat_id : false;
+        });
+    }
+    /** True when `message_id` was recalled for this (platform, account). */
+    isMessageRecalled(input) {
+        if (!input.messageId)
+            return false;
+        const row = this.requireDb()
+            .prepare(`SELECT 1 FROM recalled_messages
+          WHERE platform = ? AND account_id = ? AND message_id = ?`)
+            .get(input.platform, input.accountId, input.messageId);
+        return row !== undefined;
+    }
     /**
      * Erase every ledger row for one `message_id` — the local half of a
      * server-authorised recall (`message.recall`, docs/client-integration.md §9.8).
@@ -521,19 +594,8 @@ export class ClawChatStore {
      * the row may never have been stored (a message that arrived before this
      * account was paired, or one dropped by the inbound filter). `null` means the
      * store is unavailable.
-     */
-    /** True when `message_id` was recalled for this (platform, account). */
-    isMessageRecalled(input) {
-        if (!input.messageId)
-            return false;
-        const row = this.requireDb()
-            .prepare(`SELECT 1 FROM recalled_messages
-          WHERE platform = ? AND account_id = ? AND message_id = ?`)
-            .get(input.platform, input.accountId, input.messageId);
-        return row !== undefined;
-    }
-    /**
-     * Record the permanent recall tombstone and purge any row already stored,
+     *
+     * Records the permanent recall tombstone and purges any row already stored,
      * atomically. Returns the number of ledger rows deleted (0 when the recall
      * arrived before the message did — the tombstone still stands and the later
      * ingest is refused by {@link claimMessageOnce}).
@@ -860,6 +922,43 @@ export class ClawChatStore {
         this.log?.error?.(`${prefix}: ${safeErrorMessage(err)}`);
     }
 }
+/**
+ * Lookup behind {@link ClawChatStore.findStoredChatId}: an inbound row first,
+ * then any row. Both halves seek `idx_clawchat_messages_chat_id_nocase`.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_STORED_CHAT_ID_SQL = `SELECT chat_id FROM (
+  SELECT chat_id, 0 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ? AND direction = 'inbound'
+      LIMIT 1
+  )
+  UNION ALL
+  SELECT chat_id, 1 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ?
+      LIMIT 1
+  )
+) ORDER BY rank LIMIT 1`;
+/**
+ * Lookup behind {@link ClawChatStore.findSeenMessageInChat}. Two index seeks
+ * (`message_id` / `protocol_message_id`, both COLLATE NOCASE, migration 11);
+ * platform, account and chat are post-filters. A `message_id` match wins.
+ * `INDEXED BY` pins the seek: without table statistics the planner would
+ * otherwise pick the chat-id index (migration 12) and walk the whole chat.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_SEEN_MESSAGE_SQL = `SELECT chat_id, matched_id FROM (
+  SELECT chat_id, message_id AS matched_id, 0 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_message_id_nocase
+    WHERE message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+  UNION ALL
+  SELECT chat_id, protocol_message_id AS matched_id, 1 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_protocol_message_id_nocase
+    WHERE protocol_message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+) ORDER BY rank LIMIT 1`;
 let singleton = null;
 export function createClawChatStore(options = {}) {
     return new ClawChatStore(options);

package/dist/src/terminal-send.js

@@ -1,12 +1,67 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 const DEFAULT_TTL_MS = 60_000;
 const terminalSends = new Map();
-const terminalSendScope = new AsyncLocalStorage();
+const turnScopeStorage = new AsyncLocalStorage();
+const openScopesBySession = new Map();
+function normalizeSessionKey(sessionKey) {
+    const normalized = sessionKey?.trim().toLowerCase();
+    return normalized ? normalized : null;
+}
 function key(accountId, chatId, scopeId) {
     return `${accountId}\0${chatId}\0${scopeId}`;
 }
-export function runWithTerminalClawChatSendScope(scopeId, fn) {
-    return terminalSendScope.run(scopeId, fn);
+function isPromiseLike(value) {
+    return typeof value?.then === "function";
+}
+/**
+ * Run one dispatched turn. `sessionKey` is the session the host runs the turn
+ * in; consumers only see this turn when their trusted session key matches.
+ * The scope closes when `fn` returns or its promise settles.
+ */
+export function runWithTerminalClawChatSendScope(init, fn) {
+    const scope = {
+        scopeId: init.scopeId,
+        sessionKey: normalizeSessionKey(init.sessionKey),
+        open: true,
+        superseded: false,
+    };
+    const sessionKey = scope.sessionKey;
+    if (sessionKey) {
+        const open = openScopesBySession.get(sessionKey) ?? new Set();
+        for (const earlier of open)
+            earlier.superseded = true;
+        open.add(scope);
+        openScopesBySession.set(sessionKey, open);
+    }
+    const close = () => {
+        scope.open = false;
+        if (!sessionKey)
+            return;
+        const open = openScopesBySession.get(sessionKey);
+        open?.delete(scope);
+        if (open?.size === 0)
+            openScopesBySession.delete(sessionKey);
+    };
+    let result;
+    try {
+        result = turnScopeStorage.run(scope, fn);
+    }
+    catch (err) {
+        close();
+        throw err;
+    }
+    if (isPromiseLike(result)) {
+        return Promise.resolve(result).finally(close);
+    }
+    close();
+    return result;
+}
+/** The caller's own open turn, or null when it cannot be tied to the caller's session. */
+function resolveCallerScope(sessionKey) {
+    const scope = turnScopeStorage.getStore();
+    if (!scope?.open || !scope.sessionKey)
+        return null;
+    return scope.sessionKey === normalizeSessionKey(sessionKey) ? scope : null;
 }
 /**
  * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
@@ -22,7 +77,7 @@ function sweepExpiredTerminalSends(nowMs) {
     }
 }
 export function markTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId ?? resolveCallerScope(params.sessionKey)?.scopeId;
     if (!scopeId)
         return;
     const nowMs = params.nowMs ?? Date.now();
@@ -34,7 +89,7 @@ export function markTerminalClawChatSend(params) {
     });
 }
 export function consumeTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId;
     if (!scopeId)
         return null;
     const recordKey = key(params.accountId, params.chatId, scopeId);
@@ -48,17 +103,19 @@ export function consumeTerminalClawChatSend(params) {
 }
 export function clearTerminalClawChatSendsForTest() {
     terminalSends.clear();
+    openScopesBySession.clear();
 }
 /**
- * Read the current turn's ambient send scope (accountId\0chatId\0messageId).
- * Returns null when not inside a dispatch scope, or when the scope id is not
- * the tripartite form (e.g. a test-only opaque scope id).
+ * The calling turn's default reaction target (accountId\0chatId\0messageId).
+ * Returns null unless the tool call's trusted `sessionKey` matches the open
+ * turn in its async context and no later turn of that session has started
+ * since; also null for a non-tripartite scope id (e.g. a test-only one).
  */
-export function getCurrentTerminalSendScope() {
-    const store = terminalSendScope.getStore();
-    if (!store)
+export function getCurrentTerminalSendScope(params) {
+    const scope = resolveCallerScope(params.sessionKey);
+    if (!scope || scope.superseded)
         return null;
-    const parts = store.split("\0");
+    const parts = scope.scopeId.split("\0");
     if (parts.length !== 3)
         return null;
     const [accountId, chatId, messageId] = parts;