@clawling/clawchat-plugin-openclaw 2026.10.9-4 → 2026.10.11-1

package/dist/src/runtime.js

@@ -33,6 +33,7 @@ import { clawChatDbPathForStateDir, getClawChatStore, makeOwnerProfilePersister,
 import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.js";
 import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.js";
 import { resolveOwnerIdentity } from "./owner-identity.js";
+import { createApprovalsWriteGuard, listActiveAccountIds, reconcileApprovalsPlugin, resolveApprovalRoute, storedIdentityLookup, } from "./approval-route.js";
 import { loadClawChatPromptMetadata, renderClawChatProfilePrompt, resolveSenderRelation, } from "./profile-prompt.js";
 import { buildNoteMemorySection } from "./note-injection.js";
 import { buildGroupCatchUp, CATCH_UP_FETCH_ROWS, DeliveredGroupMessages } from "./group-catch-up.js";
@@ -110,6 +111,10 @@ const OPENCLAW_CONFIRM_SLASH_COMMANDS = new Set([
     "nevermind",
 ]);
 const GROUP_OWNER_ATTENTION_TITLE = "requires owner attention";
+/** Group turns under `non-owner-host-tools: approve` (route live). */
+const GROUP_APPROVAL_GUIDANCE = "Host tools here (commands, files, browser, sub-agents, scheduling and the like) run only if your owner approves each call: " +
+    "the request goes to your owner's direct chat and the call waits up to 5 minutes. " +
+    "Do not ask anyone in this group to approve it. If it is denied or times out, do not retry; say your owner did not approve it.";
 // §C.1 — user-visible message emitted on permanent token expiry. Kept
 // byte-identical to the Hermes plugin (parity spec §C.1.4). Points the owner
 // at the reconnect prompt (a code bound to this identity) rather than at a
@@ -733,10 +738,7 @@ export async function startOpenclawClawlingGateway(params) {
         hostAtLeast(runtime.version, HOST_TOOL_SEARCH_DEFAULT_ON) &&
         hostToolSearchEnabled(cfg)) {
         loggedHostToolSearch = true;
-        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
-    }
-    if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
-        log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+        log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools without asking (approve mode: other tools in group turns still need the owner's approval each call) (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
     }
     log?.info?.(`[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`);
     // Freeze one report device_id for this process; reused for the paired report
@@ -2161,6 +2163,108 @@ export async function startOpenclawClawlingGateway(params) {
     // forwards) would be unreachable. Registered lazily — the activation
     // conversation may be recorded after the client is constructed.
     client.setOwnerDirectChatResolver(resolveOwnerDirectConversationId);
+    // `non-owner-host-tools: approve` routes group host-tool approvals to the
+    // owner's direct chat through the host's `approvals.plugin`
+    // (approval-route.ts). Checked once at start and again from a group turn
+    // that finds the route missing (the owner chat may be recorded later). One
+    // attempt per owner chat per lifecycle, so a failing write cannot loop.
+    const readLiveConfig = () => {
+        const current = runtime.config?.current;
+        return (typeof current === "function" ? current.call(runtime.config) : cfg);
+    };
+    const approvalReconcileAttempts = new Set();
+    const hasStoredIdentity = storedIdentityLookup(store);
+    const approvalsStateDir = (() => {
+        try {
+            return runtime.state?.resolveStateDir?.();
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const reconcileApprovalRoute = () => {
+        const mutateConfigFile = resolveMutateConfigFile();
+        if (!mutateConfigFile) {
+            if (approvalReconcileAttempts.has("no-config-writes"))
+                return;
+            approvalReconcileAttempts.add("no-config-writes");
+            try {
+                const live = readLiveConfig();
+                if (resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools !== "approve")
+                    return;
+                const route = resolveApprovalRoute({
+                    liveConfig: live,
+                    accountId,
+                    activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+                    approve: true,
+                    ownerConversationId: resolveOwnerDirectConversationId(),
+                });
+                if (route.ready)
+                    return;
+            }
+            catch {
+                // Fall through: say why approve is not routing.
+            }
+            log?.warn?.(`[${accountId}] clawchat-plugin-openclaw: non-owner-host-tools approve cannot write approvals.plugin (host config writes unavailable); group host-tool calls stay blocked`);
+            return;
+        }
+        let ownerChat = null;
+        try {
+            ownerChat = resolveOwnerDirectConversationId();
+        }
+        catch {
+            ownerChat = null;
+        }
+        const attemptKey = ownerChat ?? "";
+        if (approvalReconcileAttempts.has(attemptKey))
+            return;
+        approvalReconcileAttempts.add(attemptKey);
+        void reconcileApprovalsPlugin({
+            readConfig: readLiveConfig,
+            mutateConfigFile: mutateConfigFile,
+            ownerConversation: (id) => (id === accountId ? ownerChat : null),
+            knownActive: accountId,
+            hasStoredIdentity,
+            ...(approvalsStateDir ? { writeGuard: createApprovalsWriteGuard(approvalsStateDir) } : {}),
+            log: {
+                info: (m) => log?.info?.(`[${accountId}] ${m}`),
+                warn: (m) => {
+                    const warn = log?.warn;
+                    if (warn)
+                        warn(`[${accountId}] ${m}`);
+                    else
+                        log?.info?.(`[${accountId}] WARNING ${m}`);
+                },
+                error: (m) => log?.error?.(`[${accountId}] ${m}`),
+            },
+        }).catch(() => {
+            // Logged inside; the route simply stays not ready (calls block).
+        });
+    };
+    const groupApprovalRouteReady = (ownerChat) => {
+        try {
+            const live = readLiveConfig();
+            const approve = resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools === "approve";
+            if (!approve)
+                return false;
+            const route = resolveApprovalRoute({
+                liveConfig: live,
+                accountId,
+                activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+                approve,
+                ownerConversationId: ownerChat,
+            });
+            if (!route.ready && (route.reason === "not-applied" || route.reason === "no-owner-chat")) {
+                reconcileApprovalRoute();
+            }
+            return route.ready;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!params.boundaryWarningIssued)
+        reconcileApprovalRoute();
     const sendOwnerSkillMessage = async (text) => {
         const conversationId = resolveOwnerDirectConversationId();
         if (!conversationId) {
@@ -2881,11 +2985,18 @@ export async function startOpenclawClawlingGateway(params) {
             chatId: turn.peer.id,
             ownerDirectConversationId: ownerConversationId,
         });
-        const narrowHostTools = turnClass === "non-owner";
+        // `non-owner-host-tools: approve`: a group turn keeps the host tools once
+        // the approval route to the owner's direct chat is live; the hook then
+        // asks the owner for each call. Friend direct chats always narrow.
+        const groupApproval = turnClass === "non-owner"
+            && turn.peer.kind === "group"
+            && groupApprovalRouteReady(ownerConversationId);
+        const narrowHostTools = turnClass === "non-owner" && !groupApproval;
         const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
         const nonOwnerMediaGuidance = "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
         const turnPrompt = [
-            ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            ...(turnClass === "non-owner" ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+            ...(groupApproval ? [GROUP_APPROVAL_GUIDANCE] : []),
             baseTurnPrompt,
         ].filter(Boolean).join("\n\n");
         const ctxPayload = resolveChannelContextBuilder(rt)({
@@ -3040,7 +3151,7 @@ export async function startOpenclawClawlingGateway(params) {
                 // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
                 // member-backend). Passed as a thunk so it is resolved at send time.
                 resolveOwnerConversationId: resolveOwnerDirectConversationId,
-                nonOwnerTurn: narrowHostTools,
+                nonOwnerTurn: turnClass === "non-owner",
                 log,
             });
             const agentsConfigured = Object.keys(cfg.agents ?? {});

package/dist/src/skill-update.js

@@ -66,7 +66,7 @@ export const OFFICIAL_SKILLS_BASE = "https://raw.githubusercontent.com/clawling/
  * in the install-cli repo, bump this constant, ship it. `liveware-sample.ts`
  * imports the same ref, so the `livewares` tree at that tag is pinned too.
  */
-export const DEFAULT_SKILLS_REF = "skills-v1.17.0";
+export const DEFAULT_SKILLS_REF = "skills-v1.17.1";
 /** Refuse to treat an absurdly large response as a skill file (defence in depth). */
 export const MAX_SKILL_BYTES = 256 * 1024;
 /** This adapter's host target inside `skills/manifest.json`. */

package/dist/src/tools.js

@@ -13,7 +13,7 @@ import { isValidChatId } from "./ws-client.js";
 import { getOpenclawClawlingClient, } from "./runtime.js";
 import { markTerminalClawChatSend, getCurrentTerminalSendScope } from "./terminal-send.js";
 import { editClawChatMemoryBody, readClawChatMemoryFile, resolveClawChatMemoryPath, searchClawChatMemory, writeClawChatMemoryBody, } from "./clawchat-memory.js";
-import { canReadMemory, memoryScopeNote, memoryScopeRefusal, resolveMemoryScope, } from "./memory-scope.js";
+import { canReadMemory, canWriteMemory, memoryScopeNote, memoryScopeRefusal, ownerNoteWriteRefusal, resolveMemoryScope, } from "./memory-scope.js";
 import { clawChatSessionAccountId, NON_OWNER_TOOL_ALLOWLIST, normalizeToolChatId } from "./turn-boundary.js";
 import { pullGroupMetadata, pullOwnerMetadata, pullUserMetadata, pushMetadata, updateMetadata, } from "./clawchat-metadata.js";
 import { ClawchatGetAccountProfileSchema, ClawchatGetConversationSchema, ClawchatGetDirectConversationSchema, ClawchatGetMomentSchema, ClawchatGetUserProfileSchema, ClawchatLeaveGroupSchema, ClawchatAddGroupMemberSchema, ClawchatAcceptFriendRequestSchema, ClawchatMemoryEditSchema, ClawchatMemoryReadSchema, ClawchatMemorySearchSchema, ClawchatMemoryWriteSchema, ClawchatMetadataSyncSchema, ClawchatMetadataUpdateSchema, ClawchatCreateMomentCommentSchema, ClawchatCreateMomentSchema, ClawchatDeleteMomentCommentSchema, ClawchatDeleteMomentSchema, ClawchatListAccountFriendsSchema, ClawchatListFriendRequestsSchema, ClawchatListMomentsSchema, ClawchatMentionMessageSchema, ClawchatReactMessageSchema, ClawchatReplyMomentCommentSchema, ClawchatRejectFriendRequestSchema, ClawchatRemoveFriendSchema, ClawchatSearchUsersSchema, ClawchatSendFriendRequestSchema, ClawchatToggleMomentReactionSchema, ClawchatUpdateAccountProfileSchema, ClawchatUploadAvatarImageSchema, ClawchatRegisterAppSchema, ClawchatListAppsSchema, ClawchatUnregisterAppSchema, ClawchatLivewareLoginSchema, ClawchatOrchListAgentsSchema, ClawchatOrchGetAgentSchema, ClawchatOrchSetAgentBehaviorSchema, ClawchatOrchListGroupsSchema, ClawchatOrchGetGroupSchema, ClawchatOrchSetGroupPromptSchema, ClawchatOrchCreateGroupSchema, ClawchatOrchGroupMemberSchema, ClawchatOrchSetGroupAgentSettingsSchema, ClawchatOrchCreateConnectCodeSchema, ClawchatOrchGetConnectCodeSchema, } from "./tools-schema.js";
@@ -135,7 +135,7 @@ const MEMORY_READ_MAX_LIMIT = 100_000;
 function toolDescription(...parts) {
     return `${parts.join("")} ${DIRECT_TOOL_GUARD}`;
 }
-const MEMORY_SCOPE_DESCRIPTION = "In a non-owner direct chat only that person's note is readable; in a group only that group's note and its members' notes are readable. owner.md is readable only in the owner's direct chat. Replace, edit and metadata operations require a readable target; append may add facts to any target without revealing existing content.";
+const MEMORY_SCOPE_DESCRIPTION = "In a non-owner direct chat only that person's note is readable; in a group only that group's note and its members' notes are readable. owner.md is readable only in the owner's direct chat. Replace, edit and metadata operations require a readable target; append may add facts to any other target without revealing existing content. owner.md can only be written (append included) in the owner's direct chat; elsewhere, record facts about the owner in the speaker's own users/<id>.md or this group's note.";
 function memoryToolDescription(...parts) {
     return `${parts.join("")} ${MEMORY_SCOPE_DESCRIPTION}`;
 }
@@ -757,9 +757,12 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                     const target = targetFromParams(p);
                     const scope = await memoryScopeFor(ctx, root);
                     readable = canReadMemory(scope, target);
-                    // Replacing wipes what is there; append may go to any note.
-                    if (p.mode !== "append" && !readable)
-                        return jsonResponse(memoryScopeRefusal(scope, target));
+                    // Replacing wipes what is there; append may go to any note but owner.md.
+                    if (!canWriteMemory(scope, target, p.mode === "append")) {
+                        return jsonResponse(target.targetType === "owner"
+                            ? ownerNoteWriteRefusal(scope)
+                            : memoryScopeRefusal(scope, target));
+                    }
                     await writeClawChatMemoryBody(root, target, p.mode, p.content);
                     return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId, mode: p.mode });
                 }
@@ -794,8 +797,11 @@ export function registerOpenclawClawlingTools(api, options = {}) {
                         return memoryToolError(new Error(targetError));
                     const target = targetFromParams(p);
                     const scope = await memoryScopeFor(ctx, root);
-                    if (!canReadMemory(scope, target))
-                        return jsonResponse(memoryScopeRefusal(scope, target));
+                    if (!canWriteMemory(scope, target, false)) {
+                        return jsonResponse(target.targetType === "owner"
+                            ? ownerNoteWriteRefusal(scope)
+                            : memoryScopeRefusal(scope, target));
+                    }
                     await editClawChatMemoryBody(root, target, p.oldText, p.newText);
                     return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId });
                 }

package/index.ts

@@ -49,6 +49,17 @@ const channelEntry = defineChannelPluginEntry({
  * instead. Each load registers the commands once; a duplicate registration
  * would mark the plugin as errored on the host side.
  */
+/**
+ * The host-tools guard (`before_tool_call`) follows the same rule, for the
+ * same reason: on OpenClaw 2026.8.x the agent run uses the hook runner of the
+ * request-scoped `discovery` registry, so a guard registered only in
+ * `registerFull` never fires there (measured on 2026.8.2: the call ran with no
+ * hook invocation). Every load except `cli-metadata` gets the guard exactly
+ * once: `registerFull` covers `full` / `tool-discovery`, the wrapper covers
+ * the rest.
+ */
+const FULL_REGISTRATION_MODES = new Set(["full", "tool-discovery"]);
+
 export default {
   // Newer hosts expose `configSchema` as a lazy getter; the spread evaluates it
   // once here, which is fine because the schema is a static object.
@@ -57,6 +68,7 @@ export default {
     channelEntry.register(api);
     if (api.registrationMode !== "cli-metadata") {
       registerOpenclawClawlingCommands(api);
+      if (!FULL_REGISTRATION_MODES.has(String(api.registrationMode))) registerHostToolsGuard(api);
     }
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawling/clawchat-plugin-openclaw",
-  "version": "2026.10.9-4",
+  "version": "2026.10.11-1",
   "description": "OpenClaw ClawChat channel plugin",
   "license": "MIT",
   "author": "CLAWLING PTE. LTD.",

package/skills/manifest.json

@@ -41,10 +41,10 @@
     },
     "hermes": {
       "clawchat-core": {
-        "version": "1.17.0",
+        "version": "1.17.1",
         "path": "hermes/clawchat-core/SKILL.md",
-        "sha256": "b3038b3a540645a19224ce198fdf77f1fbb109b843a3a80fe803a955d027d689",
-        "bytes": 27668
+        "sha256": "2c235cdca892c3553ce883494e0af71b1bb91c04e7f63bc544788f90951a3484",
+        "bytes": 28209
       },
       "clawchat-liveware": {
         "version": "1.3.0",

package/src/approval-route.ts

@@ -0,0 +1,346 @@
+// Where `non-owner-host-tools: approve` sends a group turn's host-tool request.
+//
+// The host asks for a plugin approval when `before_tool_call` returns
+// `requireApproval`; it shows that request in a chat only through the global
+// `approvals.plugin` forwarding config (OpenClaw 2026.8.1+). Without it the
+// request is posted nowhere and simply times out. Its default `session` mode
+// would answer in the chat the turn came from — the group — so the plugin
+// manages one exact block instead: `mode: "targets"`, one target (the owner's
+// direct chat on the one ClawChat account), and a `sessionFilter` that matches
+// ClawChat group sessions only.
+//
+// The plugin writes that block only when the host has none, and later rewrites
+// or removes only a block of exactly that shape. Any other `approvals.plugin`
+// is the owner's own and is never touched; approve then cannot route and group
+// calls stay blocked. A group call asks for approval only while the LIVE
+// config holds the managed block for this account and its current owner chat.
+import fs from "node:fs";
+import path from "node:path";
+import type { OpenClawConfig } from "openclaw/plugin-sdk";
+import { CHANNEL_ID, listOpenclawClawlingAccountIds, resolveOpenclawClawlingAccount } from "./config.ts";
+
+type Rec = Record<string, unknown>;
+
+/** Substring of every ClawChat group session key (`agent:<id>:<channel>:group:<chat>`). */
+export const APPROVAL_SESSION_FILTER = `:${CHANNEL_ID}:group:`;
+
+export type ApprovalTarget = { accountId: string; to: string };
+
+export type ApprovalsPluginState =
+  | { kind: "absent" }
+  | { kind: "managed"; target: ApprovalTarget }
+  | { kind: "foreign" };
+
+export type ApprovalRouteBlockReason =
+  | "not-approve"
+  | "multiple-accounts"
+  | "no-owner-chat"
+  | "foreign-config"
+  | "not-applied";
+
+export type ApprovalRoute =
+  | { ready: true; target: ApprovalTarget }
+  | { ready: false; reason: ApprovalRouteBlockReason };
+
+function isRec(value: unknown): value is Rec {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+const norm = (value: unknown) => (typeof value === "string" ? value.trim().toLowerCase() : "");
+/** Keys holding a value; a loader may add `undefined` placeholders. */
+const definedKeys = (rec: Rec) => Object.keys(rec).filter((key) => rec[key] !== undefined).sort().join(",");
+
+/**
+ * Enabled ClawChat accounts in use: those whose config section carries an
+ * identity (token or user id), those with a stored activation
+ * (`hasStoredIdentity`, the SQLite row; credentials may live only there), plus
+ * `knownActive` (an account the caller knows is running). Every caller must
+ * count the same way, or two accounts' runtimes would disagree about the one
+ * global block. The root section always lists as an account, so an empty root
+ * next to named accounts does not count.
+ */
+export function listActiveAccountIds(
+  cfg: OpenClawConfig,
+  options: { knownActive?: string; hasStoredIdentity?: (accountId: string) => boolean } = {},
+): string[] {
+  const { knownActive, hasStoredIdentity } = options;
+  const ids = new Set<string>();
+  for (const id of listOpenclawClawlingAccountIds(cfg)) {
+    const account = resolveOpenclawClawlingAccount(cfg, id);
+    if (!account.enabled) continue;
+    let stored = false;
+    try {
+      stored = hasStoredIdentity?.(account.accountId) === true;
+    } catch {
+      // Unknown counts as in use: more accounts only ever blocks.
+      stored = true;
+    }
+    if (account.token || account.userId || stored || norm(id) === norm(knownActive)) ids.add(account.accountId);
+  }
+  if (knownActive?.trim() && ![...ids].some((id) => norm(id) === norm(knownActive))) ids.add(knownActive.trim());
+  return [...ids];
+}
+
+/** The exact `approvals.plugin` block the plugin writes for `target`. */
+export function buildManagedApprovalsPlugin(target: ApprovalTarget): Rec {
+  return {
+    enabled: true,
+    mode: "targets",
+    sessionFilter: [APPROVAL_SESSION_FILTER],
+    targets: [{ channel: CHANNEL_ID, to: target.to, accountId: target.accountId }],
+  };
+}
+
+/** Classify the host's `approvals.plugin`; only the exact managed shape is ours. */
+export function readApprovalsPluginState(cfg: unknown): ApprovalsPluginState {
+  const approvals = isRec(cfg) ? cfg.approvals : undefined;
+  if (approvals === undefined || (isRec(approvals) && approvals.plugin === undefined)) {
+    return { kind: "absent" };
+  }
+  if (!isRec(approvals) || !isRec(approvals.plugin)) return { kind: "foreign" };
+  const block = approvals.plugin;
+  if (definedKeys(block) !== "enabled,mode,sessionFilter,targets") return { kind: "foreign" };
+  if (block.enabled !== true || block.mode !== "targets") return { kind: "foreign" };
+  const filter = block.sessionFilter;
+  if (!Array.isArray(filter) || filter.length !== 1 || filter[0] !== APPROVAL_SESSION_FILTER) {
+    return { kind: "foreign" };
+  }
+  const targets = block.targets;
+  if (!Array.isArray(targets) || targets.length !== 1 || !isRec(targets[0])) return { kind: "foreign" };
+  const target = targets[0];
+  if (definedKeys(target) !== "accountId,channel,to") return { kind: "foreign" };
+  if (target.channel !== CHANNEL_ID) return { kind: "foreign" };
+  const to = typeof target.to === "string" ? target.to.trim() : "";
+  const accountId = typeof target.accountId === "string" ? target.accountId.trim() : "";
+  if (!to || !accountId) return { kind: "foreign" };
+  return { kind: "managed", target: { to, accountId } };
+}
+
+/**
+ * The target the managed block should hold now, or `null` when none should
+ * exist. Approve routes only with exactly one active ClawChat account: the
+ * block is global, so a second account's owner would see the first one's
+ * requests.
+ */
+export function desiredApprovalTarget(input: {
+  activeAccountIds: readonly string[];
+  approveAccountIds: readonly string[];
+  ownerConversation: (accountId: string) => string | null;
+}): { target: ApprovalTarget | null; reason?: ApprovalRouteBlockReason } {
+  if (input.approveAccountIds.length === 0) return { target: null, reason: "not-approve" };
+  if (input.activeAccountIds.length !== 1) return { target: null, reason: "multiple-accounts" };
+  const accountId = input.activeAccountIds[0]!;
+  if (!input.approveAccountIds.includes(accountId)) return { target: null, reason: "not-approve" };
+  const to = input.ownerConversation(accountId)?.trim();
+  if (!to) return { target: null, reason: "no-owner-chat" };
+  return { target: { accountId, to } };
+}
+
+export type ApprovalsPluginWrite =
+  | { action: "none" }
+  | { action: "set"; target: ApprovalTarget }
+  | { action: "remove" };
+
+/** What to write so `approvals.plugin` matches `desired`, never touching a foreign block. */
+export function planApprovalsPluginWrite(
+  current: ApprovalsPluginState,
+  desired: ApprovalTarget | null,
+): ApprovalsPluginWrite {
+  if (current.kind === "foreign") return { action: "none" };
+  if (!desired) return current.kind === "managed" ? { action: "remove" } : { action: "none" };
+  // Never take the block over from another account: that account's runtime
+  // would take it back (each write restarts a pre-9.2 gateway). Drop it.
+  if (current.kind === "managed" && norm(current.target.accountId) !== norm(desired.accountId)) {
+    return { action: "remove" };
+  }
+  if (
+    current.kind === "managed" &&
+    norm(current.target.to) === norm(desired.to) &&
+    norm(current.target.accountId) === norm(desired.accountId)
+  ) {
+    return { action: "none" };
+  }
+  return { action: "set", target: desired };
+}
+
+/** Apply `plan` to a config draft in place. */
+export function applyApprovalsPluginWrite(draft: Rec, plan: ApprovalsPluginWrite): void {
+  if (plan.action === "none") return;
+  const approvals = isRec(draft.approvals) ? { ...draft.approvals } : {};
+  if (plan.action === "set") {
+    approvals.plugin = buildManagedApprovalsPlugin(plan.target);
+    draft.approvals = approvals;
+    return;
+  }
+  delete approvals.plugin;
+  if (Object.keys(approvals).length === 0) delete draft.approvals;
+  else draft.approvals = approvals;
+}
+
+/**
+ * Whether a group call on `accountId` can be sent for approval now: the live
+ * config must already hold the managed block for exactly this account and its
+ * current owner chat. Everything else blocks.
+ */
+export function resolveApprovalRoute(input: {
+  liveConfig: unknown;
+  accountId: string;
+  activeAccountIds: readonly string[];
+  approve: boolean;
+  ownerConversationId: string | null;
+}): ApprovalRoute {
+  if (!input.approve) return { ready: false, reason: "not-approve" };
+  if (input.activeAccountIds.length !== 1 || norm(input.activeAccountIds[0]) !== norm(input.accountId)) {
+    return { ready: false, reason: "multiple-accounts" };
+  }
+  const owner = input.ownerConversationId?.trim();
+  if (!owner) return { ready: false, reason: "no-owner-chat" };
+  const state = readApprovalsPluginState(input.liveConfig);
+  if (state.kind === "foreign") return { ready: false, reason: "foreign-config" };
+  if (
+    state.kind !== "managed" ||
+    norm(state.target.accountId) !== norm(input.accountId) ||
+    norm(state.target.to) !== norm(owner)
+  ) {
+    return { ready: false, reason: "not-applied" };
+  }
+  return { ready: true, target: state.target };
+}
+
+export const APPROVAL_ROUTE_WARNINGS: Record<ApprovalRouteBlockReason, string> = {
+  "not-approve": "",
+  "multiple-accounts":
+    "non-owner-host-tools approve needs exactly one ClawChat account on this gateway; group host-tool calls stay blocked",
+  "no-owner-chat":
+    "non-owner-host-tools approve has no owner direct chat yet (activate first); group host-tool calls stay blocked",
+  "foreign-config":
+    "non-owner-host-tools approve cannot route: approvals.plugin is already set in the OpenClaw config and the plugin will not change it; group host-tool calls stay blocked",
+  "not-applied":
+    "non-owner-host-tools approve is waiting for the gateway to load approvals.plugin; group host-tool calls stay blocked until it does",
+};
+
+type ReconcileLog = { info?: (msg: string) => void; warn?: (msg: string) => void; error?: (msg: string) => void };
+type MutateConfigFile = (params: {
+  afterWrite: { mode: "auto" };
+  mutate: (draft: OpenClawConfig) => void;
+}) => Promise<unknown>;
+
+/**
+ * Bring `approvals.plugin` in line with the accounts' `non-owner-host-tools`:
+ * write the managed block when approve can route, remove a managed block that
+ * no longer applies, and never touch the owner's own block. The write lets the
+ * host decide how to load it (`afterWrite: auto`): OpenClaw 2026.9.2+ applies
+ * `approvals.plugin` without a restart, earlier hosts restart the gateway once.
+ */
+export async function reconcileApprovalsPlugin(params: {
+  readConfig: () => OpenClawConfig;
+  mutateConfigFile: MutateConfigFile;
+  ownerConversation: (accountId: string) => string | null;
+  /** The account whose runtime is calling; it counts as in use. */
+  knownActive?: string;
+  hasStoredIdentity?: (accountId: string) => boolean;
+  /**
+   * Durable guard against write loops: `seen(key)` is true when the same write
+   * was already made recently (a pre-9.2 gateway restarts after each write, so
+   * an in-memory guard would not survive). `record(key)` remembers one.
+   */
+  writeGuard?: { seen: (key: string) => boolean; record: (key: string) => void };
+  log?: ReconcileLog;
+}): Promise<ApprovalsPluginWrite["action"] | "failed"> {
+  const cfg = params.readConfig();
+  const active = listActiveAccountIds(cfg, {
+    knownActive: params.knownActive,
+    hasStoredIdentity: params.hasStoredIdentity,
+  });
+  const approveIds = active.filter((id) => resolveOpenclawClawlingAccount(cfg, id).nonOwnerHostTools === "approve");
+  const desired = desiredApprovalTarget({
+    activeAccountIds: active,
+    approveAccountIds: approveIds,
+    ownerConversation: params.ownerConversation,
+  });
+  const current = readApprovalsPluginState(cfg);
+  if (approveIds.length > 0) {
+    const reason = current.kind === "foreign" ? "foreign-config" : desired.reason;
+    if (reason && reason !== "not-approve") params.log?.warn?.(`clawchat-plugin-openclaw: ${APPROVAL_ROUTE_WARNINGS[reason]}`);
+  }
+  const planned = planApprovalsPluginWrite(current, desired.target);
+  if (planned.action === "none") return "none";
+  const guardKey = planned.action === "set"
+    ? `set:${norm(planned.target.accountId)}:${norm(planned.target.to)}`
+    : "remove";
+  try {
+    if (params.writeGuard?.seen(guardKey)) {
+      params.log?.warn?.(
+        "clawchat-plugin-openclaw: approvals.plugin was already updated recently but the gateway does not show it; not writing again (group host-tool calls stay blocked)",
+      );
+      return "none";
+    }
+    params.writeGuard?.record(guardKey);
+  } catch {
+    // A broken guard must not stop the write; the per-lifecycle guard still applies.
+  }
+  let action = "none" as ApprovalsPluginWrite["action"];
+  try {
+    await params.mutateConfigFile({
+      afterWrite: { mode: "auto" },
+      mutate(draft) {
+        // Re-plan against the file as it is now, not the snapshot read above.
+        const plan = planApprovalsPluginWrite(readApprovalsPluginState(draft), desired.target);
+        action = plan.action;
+        applyApprovalsPluginWrite(draft as unknown as Rec, plan);
+      },
+    });
+  } catch (err) {
+    params.log?.error?.(
+      `clawchat-plugin-openclaw: approvals.plugin update failed; group host-tool calls stay blocked (${err instanceof Error ? err.message : String(err)})`,
+    );
+    return "failed";
+  }
+  if (action === "set") {
+    params.log?.info?.(
+      "clawchat-plugin-openclaw: non-owner-host-tools approve: wrote approvals.plugin so group host-tool approvals go only to the owner's ClawChat direct chat",
+    );
+  } else if (action === "remove") {
+    params.log?.info?.("clawchat-plugin-openclaw: removed the plugin-managed approvals.plugin (approve is no longer in use)");
+  }
+  return action;
+}
+
+export const APPROVALS_WRITE_MARKER_FILENAME = "clawchat-approvals-plugin-write.json";
+const WRITE_GUARD_WINDOW_MS = 10 * 60_000;
+
+/**
+ * File-backed `writeGuard` in the plugin's state dir: the same write is made
+ * at most once per 10 minutes, across gateway restarts.
+ */
+export function createApprovalsWriteGuard(stateDir: string, now: () => number = Date.now) {
+  const file = path.join(stateDir, APPROVALS_WRITE_MARKER_FILENAME);
+  const read = (): { key?: unknown; at?: unknown } => {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, "utf8")) as unknown;
+      return isRec(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  };
+  return {
+    seen: (key: string) => {
+      const last = read();
+      return last.key === key && typeof last.at === "number" && now() - last.at < WRITE_GUARD_WINDOW_MS;
+    },
+    record: (key: string) => {
+      fs.mkdirSync(stateDir, { recursive: true });
+      fs.writeFileSync(file, JSON.stringify({ key, at: now() }));
+    },
+  };
+}
+
+/** `hasStoredIdentity` from the plugin store; an unavailable store counts every account. */
+export function storedIdentityLookup(
+  store: { lookupActivationIdentity?: (input: { platform: string; accountId: string }) => { status: string } } | null | undefined,
+): (accountId: string) => boolean {
+  return (accountId) => {
+    const lookup = store?.lookupActivationIdentity?.({ platform: "openclaw", accountId });
+    return !lookup || lookup.status !== "absent";
+  };
+}

package/src/config.ts

@@ -125,7 +125,7 @@ export type OpenclawClawlingAccountConfig = {
   "note-cap-group"?: number;
   "note-cap-turn"?: number;
   "delta-budget-chars"?: number;
-  /** Host tools in turns the owner did not start: `off` | `approve` (approve currently behaves as off). */
+  /** Host tools in turns the owner did not start: `off` | `approve` (group calls ask the owner; see approval-route.ts). */
   "non-owner-host-tools"?: string;
   reconnect?: OpenclawClawlingReconnectConfig;
   heartbeat?: OpenclawClawlingHeartbeatConfig;
@@ -340,7 +340,7 @@ export type ResolvedOpenclawClawlingAccount = {
   noteCapTurn: number;
   /** `delta-budget-chars`: characters of unseen group messages an @-mention adds. */
   deltaBudgetChars: number;
-  /** `non-owner-host-tools`: parsed mode; `approve` is reserved and currently behaves like `off`. */
+  /** `non-owner-host-tools`: parsed mode; `approve` sends group host-tool calls to the owner for approval. */
   nonOwnerHostTools: "off" | "approve";
   allowFrom: string[];
   reconnect: Required<OpenclawClawlingReconnectConfig>;