@clawling/clawchat-plugin-openclaw 2026.10.9-3 → 2026.10.9-4

package/dist/src/host-tools-guard.js

@@ -1,5 +1,5 @@
 import { CHANNEL_ID, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.js";
-import { classifyChat, clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, parseClawChatSessionKey, } from "./turn-boundary.js";
+import { classifyChat, clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, normalizeToolChatId, parseClawChatSessionKey, } from "./turn-boundary.js";
 import { clawChatDbPathForStateDir, getClawChatStore } from "./storage.js";
 import { resolveOwnerIdentity } from "./owner-identity.js";
 import { getRegisteredClawChatToolNames } from "./tools.js";
@@ -53,8 +53,10 @@ export function decideHostToolCall(input) {
         return undefined;
     if (ACCOUNT_SCOPED_TOOLS.includes(input.toolName)) {
         // D9: a non-owner turn may only act on its own chat, named explicitly.
-        const target = input.params.chatId;
-        if (typeof target !== "string" || !target.trim() || target.trim().toLowerCase() !== parsed.chatId) {
+        // The tool resolves the same argument with the same helper, so the chat
+        // checked here is the chat the call reaches.
+        const target = normalizeToolChatId(input.params.chatId).toLowerCase();
+        if (!target || target !== parsed.chatId) {
             return {
                 block: true,
                 blockReason: input.toolName === "clawchat_react_message"

package/dist/src/outbound.js

@@ -583,15 +583,16 @@ export async function sendOpenclawClawlingMedia(params) {
  * Emit a Protocol-v2 `message.reaction`. Fire-and-forget: reactions are NOT
  * ack-aligned (the server mints the slot-key message_id, so the ack-by-trace_id
  * path used for message.send/reply does not apply). Matches the mobile client.
+ * Local refusals are returned, not thrown; a transport failure still throws.
  */
 export function sendOpenclawClawlingReaction(params) {
     if (!isValidChatId(params.chatId)) {
         params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=invalid_chat_id`);
-        return;
+        return { sent: false, reason: "invalid_chat_id" };
     }
     if (isOutboundBlocked(params.client, params.chatId)) {
         params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=chat_rejected_by_server`);
-        return;
+        return { sent: false, reason: "chat_rejected_by_server" };
     }
     const payload = {
         target_message_id: params.targetMessageId,
@@ -608,6 +609,7 @@ export function sendOpenclawClawlingReaction(params) {
     };
     params.client.sendWire(JSON.stringify(env));
     params.log?.info?.(`clawchat reaction sent chat_id=${params.chatId} target=${params.targetMessageId} emoji=${params.emoji} removed=${params.removed}`);
+    return { sent: true };
 }
 // Crockford base32 alphabet (ULID spec).
 const ULID_ENCODING = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
@@ -629,6 +631,30 @@ function ulid(now = Date.now()) {
     }
     return out.join("");
 }
+// Every message id shape a ClawChat message can carry. The server preserves a
+// client-supplied id verbatim and never parses it, so this is deliberately a
+// plausibility check, not the mint contract:
+//   - `msg-<ULID>`: clients (this plugin, mobile, hermes) and the server's own
+//     fallback mint; `msg_…` / short `msg-…` forms are kept for older ids;
+//   - `sys-<ULID>` / `sys-<request_id>`: server system injections;
+//   - a bare ULID: the server's user-message publisher;
+//   - `clawchat-plugin-openclaw-…`: this plugin's synthetic turn ids.
+// UUIDs are not accepted: no ClawChat message id the model sees has that
+// shape, while host transcript ids (e.g. from `sessions_search`) do.
+const PREFIXED_MESSAGE_ID = /^(?:msg[-_]|sys-|clawchat-plugin-openclaw-)\S+$/i;
+const BARE_ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
+/**
+ * Whether `id` can be a real ClawChat message id. Rejects what a model makes
+ * up when it has no id (a label like `B`, `msg`, prose); the server only checks
+ * that a reaction target is non-empty, so such a value would "succeed" on no
+ * message. Callers trim first. Tools use this only as the fallback when the
+ * plugin store cannot answer whether it has seen the id in the chat.
+ */
+export function isPlausibleMessageId(id) {
+    if (typeof id !== "string")
+        return false;
+    return PREFIXED_MESSAGE_ID.test(id) || BARE_ULID.test(id);
+}
 /** Client-minted message id: `msg-` + ULID (protocol §7.6 format contract). */
 export function mintMessageId() {
     return `msg-${ulid()}`;

package/dist/src/runtime.js

@@ -3049,7 +3049,7 @@ export async function startOpenclawClawlingGateway(params) {
                 const dispatchResult = await rt.reply.withReplyDispatcher({
                     dispatcher,
                     onSettled: () => markDispatchIdle(),
-                    run: () => runWithTerminalClawChatSendScope(terminalSendScopeId, () => rt.reply.dispatchReplyFromConfig({
+                    run: () => runWithTerminalClawChatSendScope({ scopeId: terminalSendScopeId, sessionKey: resolvedSessionKey }, () => rt.reply.dispatchReplyFromConfig({
                         ctx: ctxPayload,
                         cfg: dispatchCfg,
                         dispatcher,

package/dist/src/storage.js

@@ -184,6 +184,30 @@ CREATE TABLE IF NOT EXISTS recalled_messages (
   recalled_at INTEGER NOT NULL,
   PRIMARY KEY (platform, account_id, message_id)
 );
+`,
+    },
+    {
+        // Explicit message-id arguments are matched case-insensitively
+        // (findSeenMessageInChat); without these the lookup scans the whole
+        // unpruned ledger synchronously.
+        version: 11,
+        name: "message_id_nocase_indexes",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_message_id_nocase
+  ON clawchat_messages(message_id COLLATE NOCASE);
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_protocol_message_id_nocase
+  ON clawchat_messages(protocol_message_id COLLATE NOCASE);
+`,
+    },
+    {
+        // A tool chat id from the model is mapped to the case already stored for
+        // that chat (findStoredChatId) before a row is written, so one chat never
+        // ends up under two cases.
+        version: 12,
+        name: "chat_id_nocase_index",
+        sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_chat_id_nocase
+  ON clawchat_messages(chat_id COLLATE NOCASE);
 `,
     },
 ];
@@ -503,6 +527,55 @@ export class ClawChatStore {
                 .run(input.eventType, input.traceId ?? null, input.chatId ?? null, input.text ?? null, toJson(input.raw), input.accountId, input.kind, input.direction, input.messageId);
         });
     }
+    /**
+     * The stored chat id and message id of this account's ledger row that has
+     * `messageId` in `chatId`, both compared case-insensitively. The message id
+     * matches the client id (`message_id`) or the acked protocol id
+     * (`protocol_message_id`); the one that matched is returned, in its stored
+     * case, so callers put the real id on the wire. Answers `false` when no row
+     * matches and `null` when the store is unavailable, so callers can tell
+     * "not seen" from "cannot say". Seeks via the NOCASE message-id indexes
+     * (migration 11); platform, account and chat are post-filters.
+     */
+    findSeenMessageInChat(input) {
+        if (!input.chatId || !input.messageId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_SEEN_MESSAGE_SQL)
+                .get(input.messageId, input.platform, input.accountId, input.chatId, input.messageId, input.platform, input.accountId, input.chatId);
+            if (typeof row?.chat_id !== "string" || typeof row.matched_id !== "string")
+                return false;
+            return { chatId: row.chat_id, messageId: row.matched_id };
+        });
+    }
+    /**
+     * The chat id as this account's ledger already stores it for `chatId`
+     * (compared case-insensitively), preferring an inbound row, whose case is
+     * the server's. `false` when the ledger has no row for that chat, `null`
+     * when the store is unavailable. Seeks via the NOCASE chat-id index
+     * (migration 12); platform, account and direction are post-filters.
+     */
+    findStoredChatId(input) {
+        if (!input.chatId)
+            return false;
+        return this.read(() => {
+            const row = this.requireDb()
+                .prepare(FIND_STORED_CHAT_ID_SQL)
+                .get(input.chatId, input.platform, input.accountId, input.chatId, input.platform, input.accountId);
+            return typeof row?.chat_id === "string" ? row.chat_id : false;
+        });
+    }
+    /** True when `message_id` was recalled for this (platform, account). */
+    isMessageRecalled(input) {
+        if (!input.messageId)
+            return false;
+        const row = this.requireDb()
+            .prepare(`SELECT 1 FROM recalled_messages
+          WHERE platform = ? AND account_id = ? AND message_id = ?`)
+            .get(input.platform, input.accountId, input.messageId);
+        return row !== undefined;
+    }
     /**
      * Erase every ledger row for one `message_id` — the local half of a
      * server-authorised recall (`message.recall`, docs/client-integration.md §9.8).
@@ -521,19 +594,8 @@ export class ClawChatStore {
      * the row may never have been stored (a message that arrived before this
      * account was paired, or one dropped by the inbound filter). `null` means the
      * store is unavailable.
-     */
-    /** True when `message_id` was recalled for this (platform, account). */
-    isMessageRecalled(input) {
-        if (!input.messageId)
-            return false;
-        const row = this.requireDb()
-            .prepare(`SELECT 1 FROM recalled_messages
-          WHERE platform = ? AND account_id = ? AND message_id = ?`)
-            .get(input.platform, input.accountId, input.messageId);
-        return row !== undefined;
-    }
-    /**
-     * Record the permanent recall tombstone and purge any row already stored,
+     *
+     * Records the permanent recall tombstone and purges any row already stored,
      * atomically. Returns the number of ledger rows deleted (0 when the recall
      * arrived before the message did — the tombstone still stands and the later
      * ingest is refused by {@link claimMessageOnce}).
@@ -860,6 +922,43 @@ export class ClawChatStore {
         this.log?.error?.(`${prefix}: ${safeErrorMessage(err)}`);
     }
 }
+/**
+ * Lookup behind {@link ClawChatStore.findStoredChatId}: an inbound row first,
+ * then any row. Both halves seek `idx_clawchat_messages_chat_id_nocase`.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_STORED_CHAT_ID_SQL = `SELECT chat_id FROM (
+  SELECT chat_id, 0 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ? AND direction = 'inbound'
+      LIMIT 1
+  )
+  UNION ALL
+  SELECT chat_id, 1 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ?
+      LIMIT 1
+  )
+) ORDER BY rank LIMIT 1`;
+/**
+ * Lookup behind {@link ClawChatStore.findSeenMessageInChat}. Two index seeks
+ * (`message_id` / `protocol_message_id`, both COLLATE NOCASE, migration 11);
+ * platform, account and chat are post-filters. A `message_id` match wins.
+ * `INDEXED BY` pins the seek: without table statistics the planner would
+ * otherwise pick the chat-id index (migration 12) and walk the whole chat.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_SEEN_MESSAGE_SQL = `SELECT chat_id, matched_id FROM (
+  SELECT chat_id, message_id AS matched_id, 0 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_message_id_nocase
+    WHERE message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+  UNION ALL
+  SELECT chat_id, protocol_message_id AS matched_id, 1 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_protocol_message_id_nocase
+    WHERE protocol_message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+) ORDER BY rank LIMIT 1`;
 let singleton = null;
 export function createClawChatStore(options = {}) {
     return new ClawChatStore(options);

package/dist/src/terminal-send.js

@@ -1,12 +1,67 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 const DEFAULT_TTL_MS = 60_000;
 const terminalSends = new Map();
-const terminalSendScope = new AsyncLocalStorage();
+const turnScopeStorage = new AsyncLocalStorage();
+const openScopesBySession = new Map();
+function normalizeSessionKey(sessionKey) {
+    const normalized = sessionKey?.trim().toLowerCase();
+    return normalized ? normalized : null;
+}
 function key(accountId, chatId, scopeId) {
     return `${accountId}\0${chatId}\0${scopeId}`;
 }
-export function runWithTerminalClawChatSendScope(scopeId, fn) {
-    return terminalSendScope.run(scopeId, fn);
+function isPromiseLike(value) {
+    return typeof value?.then === "function";
+}
+/**
+ * Run one dispatched turn. `sessionKey` is the session the host runs the turn
+ * in; consumers only see this turn when their trusted session key matches.
+ * The scope closes when `fn` returns or its promise settles.
+ */
+export function runWithTerminalClawChatSendScope(init, fn) {
+    const scope = {
+        scopeId: init.scopeId,
+        sessionKey: normalizeSessionKey(init.sessionKey),
+        open: true,
+        superseded: false,
+    };
+    const sessionKey = scope.sessionKey;
+    if (sessionKey) {
+        const open = openScopesBySession.get(sessionKey) ?? new Set();
+        for (const earlier of open)
+            earlier.superseded = true;
+        open.add(scope);
+        openScopesBySession.set(sessionKey, open);
+    }
+    const close = () => {
+        scope.open = false;
+        if (!sessionKey)
+            return;
+        const open = openScopesBySession.get(sessionKey);
+        open?.delete(scope);
+        if (open?.size === 0)
+            openScopesBySession.delete(sessionKey);
+    };
+    let result;
+    try {
+        result = turnScopeStorage.run(scope, fn);
+    }
+    catch (err) {
+        close();
+        throw err;
+    }
+    if (isPromiseLike(result)) {
+        return Promise.resolve(result).finally(close);
+    }
+    close();
+    return result;
+}
+/** The caller's own open turn, or null when it cannot be tied to the caller's session. */
+function resolveCallerScope(sessionKey) {
+    const scope = turnScopeStorage.getStore();
+    if (!scope?.open || !scope.sessionKey)
+        return null;
+    return scope.sessionKey === normalizeSessionKey(sessionKey) ? scope : null;
 }
 /**
  * Drop every marker whose TTL has lapsed. A marker is only otherwise deleted
@@ -22,7 +77,7 @@ function sweepExpiredTerminalSends(nowMs) {
     }
 }
 export function markTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId ?? resolveCallerScope(params.sessionKey)?.scopeId;
     if (!scopeId)
         return;
     const nowMs = params.nowMs ?? Date.now();
@@ -34,7 +89,7 @@ export function markTerminalClawChatSend(params) {
     });
 }
 export function consumeTerminalClawChatSend(params) {
-    const scopeId = params.scopeId ?? terminalSendScope.getStore();
+    const scopeId = params.scopeId;
     if (!scopeId)
         return null;
     const recordKey = key(params.accountId, params.chatId, scopeId);
@@ -48,17 +103,19 @@ export function consumeTerminalClawChatSend(params) {
 }
 export function clearTerminalClawChatSendsForTest() {
     terminalSends.clear();
+    openScopesBySession.clear();
 }
 /**
- * Read the current turn's ambient send scope (accountId\0chatId\0messageId).
- * Returns null when not inside a dispatch scope, or when the scope id is not
- * the tripartite form (e.g. a test-only opaque scope id).
+ * The calling turn's default reaction target (accountId\0chatId\0messageId).
+ * Returns null unless the tool call's trusted `sessionKey` matches the open
+ * turn in its async context and no later turn of that session has started
+ * since; also null for a non-tripartite scope id (e.g. a test-only one).
  */
-export function getCurrentTerminalSendScope() {
-    const store = terminalSendScope.getStore();
-    if (!store)
+export function getCurrentTerminalSendScope(params) {
+    const scope = resolveCallerScope(params.sessionKey);
+    if (!scope || scope.superseded)
         return null;
-    const parts = store.split("\0");
+    const parts = scope.scopeId.split("\0");
     if (parts.length !== 3)
         return null;
     const [accountId, chatId, messageId] = parts;