@clawling/clawchat-plugin-openclaw 2026.10.9-4 → 2026.10.11-2

package/src/host-tools-guard.ts

@@ -1,10 +1,13 @@
 // Layer 2 of the non-owner turn boundary: a fail-closed `before_tool_call`
 // hook. Dispatch (layer 1) already narrows the offered tools for turns the
 // owner did not start; this hook blocks anything else that still reaches
-// execution. Only calls whose session key carries the ClawChat prefix are
-// in scope (D8); everything else passes untouched. Tool arguments are never
-// logged.
-import type { OpenClawPluginApi } from "openclaw/plugin-sdk";
+// execution. With `non-owner-host-tools: approve` and a ready approval route
+// (approval-route.ts), a group turn's other tools ask the owner instead:
+// the hook returns `requireApproval` and the host waits for the owner's
+// decision; anything but an approval blocks. Only calls whose session key
+// carries the ClawChat prefix are in scope (D8); everything else passes
+// untouched. Tool arguments are never logged.
+import type { OpenClawConfig, OpenClawPluginApi } from "openclaw/plugin-sdk";
 import { CHANNEL_ID, normalizeOpenclawClawlingAccountId, resolveOpenclawClawlingAccount } from "./config.ts";
 import {
   classifyChat,
@@ -16,17 +19,46 @@ import {
 import { clawChatDbPathForStateDir, getClawChatStore } from "./storage.ts";
 import { resolveOwnerIdentity } from "./owner-identity.ts";
 import { getRegisteredClawChatToolNames } from "./tools.ts";
+import {
+  APPROVAL_ROUTE_WARNINGS,
+  listActiveAccountIds,
+  resolveApprovalRoute,
+  storedIdentityLookup,
+  type ApprovalRoute,
+} from "./approval-route.ts";
 
 export const BLOCK_MESSAGE =
   "This tool is not available here: only your owner's direct chat may use host tools on this machine. Do not try to reach them another way; answer without them, or tell the person to ask your owner.";
 
-export type HostToolDecision = { block: true; blockReason: string } | undefined;
+/** Told to the model when the owner denies, or does not answer in time. */
+export const APPROVAL_TIMEOUT_MESSAGE =
+  "Your owner did not approve this tool call in time, so it did not run. Do not call it again for this request; tell the group your owner did not approve it.";
+/** Owner approval wait for one call; the host caps plugin approvals at 600 s. */
+export const APPROVAL_TIMEOUT_MS = 300_000;
+const APPROVAL_TITLE_MAX = 80;
+/** The host rejects (and so blocks) a description over 512 characters. */
+const APPROVAL_DESCRIPTION_MAX = 500;
+
+export type HostToolApproval = {
+  title: string;
+  description: string;
+  severity: "warning";
+  timeoutMs: number;
+  timeoutReason: string;
+  allowedDecisions: ["allow-once", "deny"];
+};
+export type HostToolDecision =
+  | { block: true; blockReason: string }
+  | { requireApproval: HostToolApproval }
+  | undefined;
 export type HostToolInput = {
   toolName: string;
   params: Record<string, unknown>;
   sessionKey?: string;
   ownerDirectConversationId?: string | null;
   registeredTools: ReadonlySet<string>;
+  /** Group turns only; a ready route sends non-allowlisted tools to the owner for approval. */
+  approvalRoute?: ApprovalRoute;
 };
 
 /**
@@ -70,10 +102,17 @@ export function decideHostToolCall(input: HostToolInput): HostToolDecision {
   if (classifyChat({ ...parsed, ownerDirectConversationId: input.ownerDirectConversationId }) === "owner") {
     return undefined;
   }
+  // Approve mode: only group turns, and only once the route to the owner's
+  // direct chat is live. Friend direct chats never ask; they block below.
+  const approve = parsed.kind === "group" && input.approvalRoute?.ready === true;
+  const allowlisted = NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName);
   // Outer pre-check only. The inner tool call is checked again and that check
   // is authoritative: the host also accepts dotted/flattened argument keys
-  // that this outer check may not recognise.
-  if (hasLocalPathArgument(input.params)) return block();
+  // that this outer check may not recognise. Under approve, tools the owner
+  // approves one by one (and the tool-search controls that reach them) show
+  // the owner their arguments instead; the allowlisted tools, which run
+  // without asking, keep the check.
+  if ((!approve || allowlisted) && hasLocalPathArgument(input.params)) return block();
   if (HOST_TOOL_SEARCH_CONTROLS.includes(input.toolName)) return undefined;
   if (ACCOUNT_SCOPED_TOOLS.includes(input.toolName)) {
     // D9: a non-owner turn may only act on its own chat, named explicitly.
@@ -89,19 +128,81 @@ export function decideHostToolCall(input: HostToolInput): HostToolDecision {
       };
     }
   }
-  if (NON_OWNER_TOOL_ALLOWLIST.includes(input.toolName)) {
+  if (allowlisted) {
     return input.toolName.startsWith("clawchat_") && !input.registeredTools.has(input.toolName)
       ? block()
       : undefined;
   }
-  return block(); // `off` and the reserved `approve` both block in this release.
+  if (!approve) return block();
+  const approval = buildHostToolApproval(input.toolName, parsed.chatId, input.params);
+  return approval ? { requireApproval: approval } : { block: true, blockReason: APPROVAL_UNSHOWABLE_MESSAGE };
+}
+
+// Drop what the host would escape (controls, zero-width, bidi) from the names
+// shown on the card, and collapse whitespace. Arguments are never cleaned:
+// they are shown exactly, or the call is not offered for approval.
+const UNSAFE_TEXT = /[\u0000-\u001f\u007f-\u009f\u00ad\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/g;
+function cleanText(text: string, max: number): string {
+  const flat = text.replace(UNSAFE_TEXT, " ").replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+}
+
+/** Tools whose approval starts work that later runs on its own (own session key, no further asking). */
+const STARTS_UNATTENDED_WORK = /spawn|subagent|sessions_send|cron|automation|schedul/i;
+
+/** Told to the model when a call's arguments cannot be shown to the owner exactly. */
+export const APPROVAL_UNSHOWABLE_MESSAGE =
+  "This call cannot be sent to your owner for approval: its arguments are too long or contain hidden characters, and your owner must see exactly what would run. Do not retry it as is; use a much shorter call, or tell the person to ask your owner directly.";
+
+/**
+ * The approval card for one group host-tool call; it goes only to the owner's
+ * direct chat. `null` when the arguments cannot be shown in full and exactly
+ * (too long for the host's 512-character description, unserializable, or
+ * holding characters the host would escape or hide): the owner must never
+ * approve a command they could not read, so such a call blocks.
+ */
+export function buildHostToolApproval(
+  toolName: string,
+  groupChatId: string,
+  params: Record<string, unknown>,
+): HostToolApproval | null {
+  const tool = cleanText(toolName, 48);
+  let args: string;
+  try {
+    args = JSON.stringify(params) ?? "{}";
+  } catch {
+    return null;
+  }
+  if (new RegExp(UNSAFE_TEXT.source).test(args)) return null;
+  const unattended = STARTS_UNATTENDED_WORK.test(toolName)
+    ? " Approving starts work that later runs with every host tool and is not asked about again."
+    : "";
+  const before =
+    `A turn in ClawChat group ${cleanText(groupChatId, 64)} (anyone in the group may have asked) wants to run ` +
+    `the host tool ${tool} on this machine. Arguments: `;
+  const after = `.${unattended} Allow only if you would run it yourself.`;
+  if (before.length + args.length + after.length > APPROVAL_DESCRIPTION_MAX) return null;
+  return {
+    title: cleanText(`ClawChat group wants to run ${tool}`, APPROVAL_TITLE_MAX),
+    description: `${before}${args}${after}`,
+    severity: "warning",
+    timeoutMs: APPROVAL_TIMEOUT_MS,
+    timeoutReason: APPROVAL_TIMEOUT_MESSAGE,
+    allowedDecisions: ["allow-once", "deny"],
+  };
 }
 
 type RequesterContext = { channel?: string; accountId?: string };
 
 export function registerHostToolsGuard(
   api: OpenClawPluginApi,
-  options: { ownerConversation?: (accountId: string) => string | null } = {},
+  options: {
+    ownerConversation?: (accountId: string) => string | null;
+    /** The config the gateway runs with now; defaults to the runtime's live config. */
+    liveConfig?: () => unknown;
+    /** Whether an account has a stored activation; defaults to the plugin store. */
+    hasStoredIdentity?: (accountId: string) => boolean;
+  } = {},
 ): void {
   const warned = new Set<string>();
   const warn = (failure: string) => {
@@ -113,15 +214,52 @@ export function registerHostToolsGuard(
       // Logging cannot unlock a call.
     }
   };
-  const lookupOwnerConversation = (accountId: string): string | null => {
-    if (options.ownerConversation) return options.ownerConversation(accountId);
-    const account = resolveOpenclawClawlingAccount(api.config, accountId);
+  const openStore = () => {
     const stateDir = api.runtime.state?.resolveStateDir?.();
-    const store = getClawChatStore({
+    return getClawChatStore({
       ...(stateDir ? { dbPath: clawChatDbPathForStateDir(stateDir) } : {}),
       log: { error: message => api.logger.error?.(message) },
     });
-    return resolveOwnerIdentity(store, accountId, account.ownerUserId).conversationId;
+  };
+  const lookupOwnerConversation = (accountId: string): string | null => {
+    if (options.ownerConversation) return options.ownerConversation(accountId);
+    const account = resolveOpenclawClawlingAccount(api.config, accountId);
+    return resolveOwnerIdentity(openStore(), accountId, account.ownerUserId).conversationId;
+  };
+  const hasStoredIdentity = options.hasStoredIdentity
+    ?? ((accountId: string) => storedIdentityLookup(openStore())(accountId));
+
+  const readLiveConfig = (): OpenClawConfig => {
+    if (options.liveConfig) return options.liveConfig() as OpenClawConfig;
+    const current = (api.runtime.config as { current?: () => unknown } | undefined)?.current;
+    return (typeof current === "function" ? current.call(api.runtime.config) : api.config) as OpenClawConfig;
+  };
+  // Only consulted for group calls. `undefined` = the account is not in
+  // approve mode; a route that is not ready blocks like `off`.
+  const groupApprovalRoute = (accountId: string | undefined): ApprovalRoute | undefined => {
+    try {
+      const cfg = readLiveConfig();
+      const active = listActiveAccountIds(cfg, { knownActive: accountId, hasStoredIdentity });
+      const routeAccountId = accountId ?? (active.length === 1 ? active[0] : undefined);
+      const anyApprove = (routeAccountId ? [routeAccountId] : active).some(
+        id => resolveOpenclawClawlingAccount(cfg, id).nonOwnerHostTools === "approve",
+      );
+      if (!anyApprove) return undefined;
+      const route = routeAccountId
+        ? resolveApprovalRoute({
+          liveConfig: cfg,
+          accountId: routeAccountId,
+          activeAccountIds: active,
+          approve: true,
+          ownerConversationId: lookupOwnerConversation(routeAccountId),
+        })
+        : { ready: false as const, reason: "multiple-accounts" as const };
+      if (!route.ready) warn(`approve unavailable (${route.reason}): ${APPROVAL_ROUTE_WARNINGS[route.reason]}`);
+      return route;
+    } catch {
+      warn("approve unavailable (route lookup failed)");
+      return { ready: false, reason: "not-applied" };
+    }
   };
 
   api.on("before_tool_call", (event, sdkCtx) => {
@@ -165,6 +303,7 @@ export function registerHostToolsGuard(
           sessionKey,
           ownerDirectConversationId: null,
           registeredTools: getRegisteredClawChatToolNames(),
+          approvalRoute: groupApprovalRoute(undefined),
         });
       }
       let ownerDirectConversationId: string | null = null;
@@ -180,6 +319,7 @@ export function registerHostToolsGuard(
         sessionKey,
         ownerDirectConversationId,
         registeredTools: getRegisteredClawChatToolNames(),
+        ...(parsed.kind === "group" ? { approvalRoute: groupApprovalRoute(accountId) } : {}),
       });
     } catch {
       warn("handler-exception");

package/src/memory-scope.ts

@@ -10,6 +10,11 @@
 //   anything else (unknown session, missing store / peer, contradictions,
 //   ambiguous chat-id case, resolution errors) → nothing
 //
+// Writes: replace / edit need a readable note; append may go to any note
+// except owner.md, which only the owner DM writes. owner.md is injected into
+// the owner DM, where the agent has every tool, so text appended from a
+// friend or group turn would read there as the owner's own note.
+//
 // Chat ids compare case-insensitively (the host lowercases session keys);
 // the original case is recovered before any group file / SQL lookup. Member
 // user ids stay case-sensitive.
@@ -163,6 +168,27 @@ export function canReadMemory(scope: MemoryScope, target: ClawChatMemoryTarget):
   return scope.kind === "group" && target.targetType === "group" && target.targetId === scope.chatId;
 }
 
+/** Whether a write (`append` when `append` is true) may touch the target. */
+export function canWriteMemory(scope: MemoryScope, target: ClawChatMemoryTarget, append: boolean): boolean {
+  if (target.targetType === "owner") return scope.kind === "owner";
+  return append || canReadMemory(scope, target);
+}
+
+/** Refusal for an owner.md write outside the owner DM, with where to write instead. */
+export function ownerNoteWriteRefusal(scope: MemoryScope): {
+  error: "not_writable_here";
+  code: "memory_scope";
+  message: string;
+} {
+  const base = "owner.md can only be changed in your owner's direct chat.";
+  const message = scope.kind === "direct"
+    ? `${base} Record this in the note about the person you are talking to (their users/<id>.md) instead.`
+    : scope.kind === "group"
+      ? `${base} Record this in the speaker's own note (users/<id>.md) or this group's note instead; if the owner wants it in owner.md, they can tell you in their direct chat.`
+      : base;
+  return { error: "not_writable_here", code: "memory_scope", message };
+}
+
 export function memoryScopeRefusal(scope: MemoryScope, target: ClawChatMemoryTarget): {
   error: "not_readable_here";
   code: "memory_scope";

package/src/outbound.ts

@@ -979,8 +979,22 @@ function markChannelOutboundAcknowledged(params: {
   }
 }
 
+/**
+ * Host approval prompts (exec and plugin approvals forwarded by
+ * `approvals.exec` / `approvals.plugin`) never go into a ClawChat group: anyone
+ * there could read the request, and only the owner may answer it. The host
+ * calls this before each forwarded prompt; throwing fails that one delivery.
+ */
+export function refuseGroupApprovalPrompt(params: { target: { to: string }; hint?: { kind?: string } }): void {
+  if (params.hint?.kind !== "approval-pending") return;
+  if (parseOpenclawRecipient(params.target.to).chatType === "group") {
+    throw new Error("clawchat-plugin-openclaw: approval prompts are not sent to ClawChat groups");
+  }
+}
+
 export const openclawClawlingOutbound: ChannelOutboundAdapter = {
   deliveryMode: "direct",
+  beforeDeliverPayload: (params) => refuseGroupApprovalPrompt(params),
   chunker: (text, limit) => chunkMarkdownText(text, limit),
   chunkerMode: "markdown",
   textChunkLimit: 4000,

package/src/runtime.ts

@@ -12,7 +12,7 @@ import {
   type Transport,
 } from "./protocol-types.ts";
 import type { ChannelAccountSnapshot } from "openclaw/plugin-sdk/channel-contract";
-import { waitUntilAbort } from "openclaw/plugin-sdk/channel-lifecycle";
+import { waitUntilAbort } from "openclaw/plugin-sdk/channel-outbound";
 import { hasControlCommand } from "openclaw/plugin-sdk/command-detection";
 import type { OpenClawConfig, PluginRuntime } from "openclaw/plugin-sdk/core";
 import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
@@ -90,6 +90,13 @@ import {
 import { getClawChatGroupPrompt, getClawChatPlatformPrompt, getClawChatUserPrompt } from "./plugin-prompts.ts";
 import { classifyChat, NON_OWNER_TOOL_ALLOWLIST } from "./turn-boundary.ts";
 import { resolveOwnerIdentity } from "./owner-identity.ts";
+import {
+  createApprovalsWriteGuard,
+  listActiveAccountIds,
+  reconcileApprovalsPlugin,
+  resolveApprovalRoute,
+  storedIdentityLookup,
+} from "./approval-route.ts";
 import {
   loadClawChatPromptMetadata,
   type ClawChatGroupParticipantPrompt,
@@ -221,6 +228,11 @@ const OPENCLAW_CONFIRM_SLASH_COMMANDS = new Set([
   "nevermind",
 ]);
 const GROUP_OWNER_ATTENTION_TITLE = "requires owner attention";
+/** Group turns under `non-owner-host-tools: approve` (route live). */
+const GROUP_APPROVAL_GUIDANCE =
+  "Host tools here (commands, files, browser, sub-agents, scheduling and the like) run only if your owner approves each call: " +
+  "the request goes to your owner's direct chat and the call waits up to 5 minutes. " +
+  "Do not ask anyone in this group to approve it. If it is denied or times out, do not retry; say your owner did not approve it.";
 // §C.1 — user-visible message emitted on permanent token expiry. Kept
 // byte-identical to the Hermes plugin (parity spec §C.1.4). Points the owner
 // at the reconnect prompt (a code bound to this identity) rather than at a
@@ -590,7 +602,7 @@ export interface StartGatewayParams {
   setStatus: (next: ChannelAccountSnapshot) => void;
   getStatus: () => ChannelAccountSnapshot;
   log?: Log;
-  /** Internal — set on recursive re-entry so the approve-unsupported warning is issued once per lifecycle. */
+  /** Internal — set on recursive re-entry so the approve-route check at start runs once per lifecycle. */
   boundaryWarningIssued?: boolean;
   /** Test hook only. */
   store?: RuntimeConnectionStore | null;
@@ -1084,10 +1096,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
     hostToolSearchEnabled(cfg)
   ) {
     loggedHostToolSearch = true;
-    log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
-  }
-  if (!params.boundaryWarningIssued && account.nonOwnerHostTools === "approve") {
-    log?.warn?.("clawchat-plugin-openclaw: non-owner-host-tools approve is not supported yet; using off");
+    log?.info?.("clawchat-plugin-openclaw: host tool search is on; turns your owner did not start can still use only the allowlisted tools without asking (approve mode: other tools in group turns still need the owner's approval each call) (set tools.toolSearch.enabled=false to turn tool search off; this affects every turn)");
   }
   log?.info?.(
     `[${accountId}] clawchat-plugin-openclaw runtime start entered configured=${account.configured} enabled=${account.enabled} hasToken=${Boolean(account.token)} hasUserId=${Boolean(account.userId)} hasOwnerUserId=${Boolean(account.ownerUserId)} websocketUrl=${account.websocketUrl || "(empty)"}`,
@@ -2603,6 +2612,98 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
   // forwards) would be unreachable. Registered lazily — the activation
   // conversation may be recorded after the client is constructed.
   client.setOwnerDirectChatResolver(resolveOwnerDirectConversationId);
+  // `non-owner-host-tools: approve` routes group host-tool approvals to the
+  // owner's direct chat through the host's `approvals.plugin`
+  // (approval-route.ts). Checked once at start and again from a group turn
+  // that finds the route missing (the owner chat may be recorded later). One
+  // attempt per owner chat per lifecycle, so a failing write cannot loop.
+  const readLiveConfig = (): OpenClawConfig => {
+    const current = (runtime.config as { current?: () => unknown } | undefined)?.current;
+    return (typeof current === "function" ? current.call(runtime.config) : cfg) as OpenClawConfig;
+  };
+  const approvalReconcileAttempts = new Set<string>();
+  const hasStoredIdentity = storedIdentityLookup(store);
+  const approvalsStateDir = (() => {
+    try {
+      return runtime.state?.resolveStateDir?.();
+    } catch {
+      return undefined;
+    }
+  })();
+  const reconcileApprovalRoute = (): void => {
+    const mutateConfigFile = resolveMutateConfigFile();
+    if (!mutateConfigFile) {
+      if (approvalReconcileAttempts.has("no-config-writes")) return;
+      approvalReconcileAttempts.add("no-config-writes");
+      try {
+        const live = readLiveConfig();
+        if (resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools !== "approve") return;
+        const route = resolveApprovalRoute({
+          liveConfig: live,
+          accountId,
+          activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+          approve: true,
+          ownerConversationId: resolveOwnerDirectConversationId(),
+        });
+        if (route.ready) return;
+      } catch {
+        // Fall through: say why approve is not routing.
+      }
+      log?.warn?.(
+        `[${accountId}] clawchat-plugin-openclaw: non-owner-host-tools approve cannot write approvals.plugin (host config writes unavailable); group host-tool calls stay blocked`,
+      );
+      return;
+    }
+    let ownerChat: string | null = null;
+    try {
+      ownerChat = resolveOwnerDirectConversationId();
+    } catch {
+      ownerChat = null;
+    }
+    const attemptKey = ownerChat ?? "";
+    if (approvalReconcileAttempts.has(attemptKey)) return;
+    approvalReconcileAttempts.add(attemptKey);
+    void reconcileApprovalsPlugin({
+      readConfig: readLiveConfig,
+      mutateConfigFile: mutateConfigFile as never,
+      ownerConversation: (id) => (id === accountId ? ownerChat : null),
+      knownActive: accountId,
+      hasStoredIdentity,
+      ...(approvalsStateDir ? { writeGuard: createApprovalsWriteGuard(approvalsStateDir) } : {}),
+      log: {
+        info: (m) => log?.info?.(`[${accountId}] ${m}`),
+        warn: (m) => {
+          const warn = (log as { warn?: (msg: string) => void } | undefined)?.warn;
+          if (warn) warn(`[${accountId}] ${m}`);
+          else log?.info?.(`[${accountId}] WARNING ${m}`);
+        },
+        error: (m) => log?.error?.(`[${accountId}] ${m}`),
+      },
+    }).catch(() => {
+      // Logged inside; the route simply stays not ready (calls block).
+    });
+  };
+  const groupApprovalRouteReady = (ownerChat: string | null): boolean => {
+    try {
+      const live = readLiveConfig();
+      const approve = resolveOpenclawClawlingAccount(live, accountId).nonOwnerHostTools === "approve";
+      if (!approve) return false;
+      const route = resolveApprovalRoute({
+        liveConfig: live,
+        accountId,
+        activeAccountIds: listActiveAccountIds(live, { knownActive: accountId, hasStoredIdentity }),
+        approve,
+        ownerConversationId: ownerChat,
+      });
+      if (!route.ready && (route.reason === "not-applied" || route.reason === "no-owner-chat")) {
+        reconcileApprovalRoute();
+      }
+      return route.ready;
+    } catch {
+      return false;
+    }
+  };
+  if (!params.boundaryWarningIssued) reconcileApprovalRoute();
   const sendOwnerSkillMessage = async (text: string): Promise<void> => {
     const conversationId = resolveOwnerDirectConversationId();
     if (!conversationId) {
@@ -3389,12 +3490,19 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
       chatId: turn.peer.id,
       ownerDirectConversationId: ownerConversationId,
     });
-    const narrowHostTools = turnClass === "non-owner";
+    // `non-owner-host-tools: approve`: a group turn keeps the host tools once
+    // the approval route to the owner's direct chat is live; the hook then
+    // asks the owner for each call. Friend direct chats always narrow.
+    const groupApproval = turnClass === "non-owner"
+      && turn.peer.kind === "group"
+      && groupApprovalRouteReady(ownerConversationId);
+    const narrowHostTools = turnClass === "non-owner" && !groupApproval;
     const baseTurnPrompt = await buildPromptForTurn(turn, memoryRoot);
     const nonOwnerMediaGuidance =
       "To send an image or file here, include it in your final reply as an http(s) URL; local files cannot be sent from this chat.";
     const turnPrompt = [
-      ...(narrowHostTools ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+      ...(turnClass === "non-owner" ? [getClawChatPlatformPrompt(), nonOwnerMediaGuidance] : []),
+      ...(groupApproval ? [GROUP_APPROVAL_GUIDANCE] : []),
       baseTurnPrompt,
     ].filter(Boolean).join("\n\n");
     const ctxPayload = resolveChannelContextBuilder(rt)({
@@ -3560,7 +3668,7 @@ export async function startOpenclawClawlingGateway(params: StartGatewayParams):
           // conversation, not `ownerUserId` (a usr_… chat_id is rejected by
           // member-backend). Passed as a thunk so it is resolved at send time.
           resolveOwnerConversationId: resolveOwnerDirectConversationId,
-          nonOwnerTurn: narrowHostTools,
+          nonOwnerTurn: turnClass === "non-owner",
           log,
         });
 

package/src/skill-update.ts

@@ -71,7 +71,7 @@ export const OFFICIAL_SKILLS_BASE =
  * in the install-cli repo, bump this constant, ship it. `liveware-sample.ts`
  * imports the same ref, so the `livewares` tree at that tag is pinned too.
  */
-export const DEFAULT_SKILLS_REF = "skills-v1.17.0";
+export const DEFAULT_SKILLS_REF = "skills-v1.17.1";
 
 /** Refuse to treat an absurdly large response as a skill file (defence in depth). */
 export const MAX_SKILL_BYTES = 256 * 1024;

package/src/tools.ts

@@ -40,8 +40,10 @@ import {
 } from "./clawchat-memory.ts";
 import {
   canReadMemory,
+  canWriteMemory,
   memoryScopeNote,
   memoryScopeRefusal,
+  ownerNoteWriteRefusal,
   resolveMemoryScope,
   type MemoryScope,
 } from "./memory-scope.ts";
@@ -290,7 +292,7 @@ function toolDescription(...parts: string[]): string {
 }
 
 const MEMORY_SCOPE_DESCRIPTION =
-  "In a non-owner direct chat only that person's note is readable; in a group only that group's note and its members' notes are readable. owner.md is readable only in the owner's direct chat. Replace, edit and metadata operations require a readable target; append may add facts to any target without revealing existing content.";
+  "In a non-owner direct chat only that person's note is readable; in a group only that group's note and its members' notes are readable. owner.md is readable only in the owner's direct chat. Replace, edit and metadata operations require a readable target; append may add facts to any other target without revealing existing content. owner.md can only be written (append included) in the owner's direct chat; elsewhere, record facts about the owner in the speaker's own users/<id>.md or this group's note.";
 
 function memoryToolDescription(...parts: string[]): string {
   return `${parts.join("")} ${MEMORY_SCOPE_DESCRIPTION}`;
@@ -982,8 +984,12 @@ export function registerOpenclawClawlingTools(
             const target = targetFromParams(p);
             const scope = await memoryScopeFor(ctx, root);
             readable = canReadMemory(scope, target);
-            // Replacing wipes what is there; append may go to any note.
-            if (p.mode !== "append" && !readable) return jsonResponse(memoryScopeRefusal(scope, target));
+            // Replacing wipes what is there; append may go to any note but owner.md.
+            if (!canWriteMemory(scope, target, p.mode === "append")) {
+              return jsonResponse(target.targetType === "owner"
+                ? ownerNoteWriteRefusal(scope)
+                : memoryScopeRefusal(scope, target));
+            }
             await writeClawChatMemoryBody(root, target, p.mode, p.content);
             return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId, mode: p.mode });
           } catch (err) {
@@ -1022,7 +1028,11 @@ export function registerOpenclawClawlingTools(
             if (targetError) return memoryToolError(new Error(targetError));
             const target = targetFromParams(p);
             const scope = await memoryScopeFor(ctx, root);
-            if (!canReadMemory(scope, target)) return jsonResponse(memoryScopeRefusal(scope, target));
+            if (!canWriteMemory(scope, target, false)) {
+              return jsonResponse(target.targetType === "owner"
+                ? ownerNoteWriteRefusal(scope)
+                : memoryScopeRefusal(scope, target));
+            }
             await editClawChatMemoryBody(root, target, p.oldText, p.newText);
             return jsonResponse({ ok: true, targetType: p.targetType, targetId: p.targetId });
           } catch (err) {