@openclaw/googlechat 2026.5.9-beta.1 → 2026.5.10-beta.1

package/dist/{actions-CSUbe7VX.js → actions-D-PNwmYx.js}

@@ -1,7 +1,7 @@
 import { i as resolveGoogleChatAccount, t as listEnabledGoogleChatAccounts } from "./accounts-BbM9zX1S.js";
-import { L as getGoogleChatRuntime } from "./runtime-api-JpbBRVpx.js";
-import { c as sendGoogleChatMessage, o as listGoogleChatReactions, r as deleteGoogleChatReaction, t as createGoogleChatReaction, u as uploadGoogleChatAttachment } from "./api-BwM7NTay.js";
-import { i as resolveGoogleChatOutboundSpace } from "./targets-14IVp2Yg.js";
+import { P as getGoogleChatRuntime } from "./runtime-api-DMEzhesS.js";
+import { c as sendGoogleChatMessage, o as listGoogleChatReactions, r as deleteGoogleChatReaction, t as createGoogleChatReaction, u as uploadGoogleChatAttachment } from "./api-AErsImS_.js";
+import { i as resolveGoogleChatOutboundSpace } from "./targets-qggOq6n-.js";
 import { extractToolSend } from "openclaw/plugin-sdk/tool-send";
 import { createActionGate, jsonResult, readNumberParam, readReactionParams, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 import { loadOutboundMediaFromUrl } from "openclaw/plugin-sdk/outbound-media";

package/dist/{api-BwM7NTay.js → api-AErsImS_.js}

@@ -1,4 +1,4 @@
-import { h as fetchWithSsrFGuard$1 } from "./runtime-api-JpbBRVpx.js";
+import { m as fetchWithSsrFGuard$1 } from "./runtime-api-DMEzhesS.js";
 import { normalizeLowercaseStringOrEmpty, resolveUserPath } from "openclaw/plugin-sdk/text-runtime";
 import crypto from "node:crypto";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";

package/dist/api.js

@@ -1,3 +1,3 @@
-import { t as googlechatPlugin } from "./channel-DHHatGQ1.js";
+import { t as googlechatPlugin } from "./channel-9lvRWX6T.js";
 import { n as googlechatSetupAdapter, t as googlechatSetupWizard } from "./setup-surface-S4ArLnR8.js";
 export { googlechatPlugin, googlechatSetupAdapter, googlechatSetupWizard };

package/dist/{channel-DHHatGQ1.js → channel-9lvRWX6T.js}

@@ -1,6 +1,6 @@
 import { a as resolveGoogleChatConfigAccessorAccount, i as resolveGoogleChatAccount, n as listGoogleChatAccountIds, r as resolveDefaultGoogleChatAccountId } from "./accounts-BbM9zX1S.js";
-import { E as resolveChannelMediaMaxBytes, a as buildChannelConfigSchema, i as PAIRING_APPROVED_MESSAGE, m as fetchRemoteMedia, o as chunkTextForOutbound, r as GoogleChatConfigSchema, t as DEFAULT_ACCOUNT_ID, v as loadOutboundMediaFromUrl, y as missingTargetError } from "./runtime-api-JpbBRVpx.js";
-import { i as resolveGoogleChatOutboundSpace, n as isGoogleChatUserTarget, r as normalizeGoogleChatTarget, t as isGoogleChatSpaceTarget } from "./targets-14IVp2Yg.js";
+import { T as resolveChannelMediaMaxBytes, _ as loadOutboundMediaFromUrl, a as buildChannelConfigSchema, i as PAIRING_APPROVED_MESSAGE, o as chunkTextForOutbound, p as fetchRemoteMedia, r as GoogleChatConfigSchema, t as DEFAULT_ACCOUNT_ID, v as missingTargetError } from "./runtime-api-DMEzhesS.js";
+import { i as resolveGoogleChatOutboundSpace, n as isGoogleChatUserTarget, r as normalizeGoogleChatTarget, t as isGoogleChatSpaceTarget } from "./targets-qggOq6n-.js";
 import { n as normalizeCompatibilityConfig, t as legacyConfigRules } from "./doctor-contract-BsERSjSe.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-DLAG2_NI.js";
 import { n as googlechatSetupAdapter, t as googlechatSetupWizard } from "./setup-surface-S4ArLnR8.js";
@@ -54,7 +54,7 @@ function resolveGoogleChatGroupRequireMention(params) {
 }
 //#endregion
 //#region extensions/googlechat/src/channel.adapters.ts
-const loadGoogleChatChannelRuntime$2 = createLazyRuntimeNamedExport(() => import("./channel.runtime-CRRchMB8.js"), "googleChatChannelRuntime");
+const loadGoogleChatChannelRuntime$2 = createLazyRuntimeNamedExport(() => import("./channel.runtime-CK4QbJkn.js"), "googleChatChannelRuntime");
 function createGoogleChatSendReceipt(params) {
 	const messageId = params.messageId?.trim();
 	return createMessageReceiptFromOutboundResults({
@@ -295,7 +295,7 @@ const collectGoogleChatMutableAllowlistWarnings = createDangerousNameMatchingMut
 });
 //#endregion
 //#region extensions/googlechat/src/gateway.ts
-const loadGoogleChatChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./channel.runtime-CRRchMB8.js"), "googleChatChannelRuntime");
+const loadGoogleChatChannelRuntime$1 = createLazyRuntimeNamedExport(() => import("./channel.runtime-CK4QbJkn.js"), "googleChatChannelRuntime");
 async function startGoogleChatGatewayAccount(ctx) {
 	const account = ctx.account;
 	const statusSink = createAccountStatusSink({
@@ -335,7 +335,7 @@ async function startGoogleChatGatewayAccount(ctx) {
 }
 //#endregion
 //#region extensions/googlechat/src/channel.ts
-const loadGoogleChatChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-CRRchMB8.js"), "googleChatChannelRuntime");
+const loadGoogleChatChannelRuntime = createLazyRuntimeNamedExport(() => import("./channel.runtime-CK4QbJkn.js"), "googleChatChannelRuntime");
 const meta = {
 	id: "googlechat",
 	label: "Google Chat",
@@ -391,7 +391,7 @@ const googlechatActions = {
 	},
 	extractToolSend: ({ args }) => extractToolSend(args, "sendMessage"),
 	handleAction: async (ctx) => {
-		const { googlechatMessageActions } = await import("./actions-CSUbe7VX.js");
+		const { googlechatMessageActions } = await import("./actions-D-PNwmYx.js");
 		if (!googlechatMessageActions.handleAction) throw new Error("Google Chat actions are not available.");
 		return await googlechatMessageActions.handleAction(ctx);
 	}

package/dist/channel-config-api.js

@@ -1,4 +1,4 @@
-import { a as buildChannelConfigSchema, r as GoogleChatConfigSchema } from "./runtime-api-JpbBRVpx.js";
+import { a as buildChannelConfigSchema, r as GoogleChatConfigSchema } from "./runtime-api-DMEzhesS.js";
 //#region extensions/googlechat/src/config-schema.ts
 const GoogleChatChannelConfigSchema = buildChannelConfigSchema(GoogleChatConfigSchema);
 //#endregion

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as googlechatPlugin } from "./channel-DHHatGQ1.js";
+import { t as googlechatPlugin } from "./channel-9lvRWX6T.js";
 export { googlechatPlugin };

package/dist/{channel.runtime-CRRchMB8.js → channel.runtime-CK4QbJkn.js}

@@ -1,40 +1,44 @@
-import { A as resolveInboundRouteEnvelopeBuilderWithRuntime, D as resolveDefaultGroupPolicy, F as warnMissingProviderGroupPolicyFallbackOnce, L as getGoogleChatRuntime, M as resolveWebhookPath, O as resolveDmGroupAccessWithLists, T as resolveAllowlistProviderRuntimeGroupPolicy, f as evaluateGroupRouteAccessForPolicy, g as isDangerousNameMatchingEnabled, j as resolveSenderScopedGroupPolicy, n as GROUP_POLICY_BLOCKED_LABEL, u as createChannelPairingController } from "./runtime-api-JpbBRVpx.js";
-import { c as sendGoogleChatMessage, d as verifyGoogleChatRequest, i as downloadGoogleChatMedia, l as updateGoogleChatMessage, n as deleteGoogleChatMessage, s as probeGoogleChat, u as uploadGoogleChatAttachment } from "./api-BwM7NTay.js";
-import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/text-runtime";
-import { resolveInboundMentionDecision } from "openclaw/plugin-sdk/channel-inbound";
+import { E as resolveDefaultGroupPolicy, M as warnMissingProviderGroupPolicyFallbackOnce, O as resolveInboundRouteEnvelopeBuilderWithRuntime, P as getGoogleChatRuntime, h as isDangerousNameMatchingEnabled, k as resolveWebhookPath, n as GROUP_POLICY_BLOCKED_LABEL, u as createChannelPairingController, w as resolveAllowlistProviderRuntimeGroupPolicy } from "./runtime-api-DMEzhesS.js";
+import { c as sendGoogleChatMessage, d as verifyGoogleChatRequest, i as downloadGoogleChatMedia, l as updateGoogleChatMessage, n as deleteGoogleChatMessage, s as probeGoogleChat, u as uploadGoogleChatAttachment } from "./api-AErsImS_.js";
+import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeStringEntries } from "openclaw/plugin-sdk/text-runtime";
 import { registerWebhookTargetWithPluginRoute, resolveWebhookTargetWithAuthOrReject, withResolvedWebhookRequestPipeline } from "openclaw/plugin-sdk/webhook-targets";
 import { createWebhookInFlightLimiter, readJsonWebhookBodyOrReject } from "openclaw/plugin-sdk/webhook-request-guards";
-import { expandAllowFromWithAccessGroups } from "openclaw/plugin-sdk/security-runtime";
+import { channelIngressRoutes, createChannelIngressResolver, defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { deliverTextOrMediaReply, resolveSendableOutboundReplyParts } from "openclaw/plugin-sdk/reply-payload";
-//#region extensions/googlechat/src/sender-allow.ts
-function normalizeUserId$1(raw) {
-	const trimmed = typeof raw === "string" ? raw.trim() : "";
-	if (!trimmed) return "";
-	return normalizeLowercaseStringOrEmpty(trimmed.replace(/^users\//i, ""));
-}
-function isEmailLike(value) {
-	return value.includes("@");
-}
-function isSenderAllowed(senderId, senderEmail, allowFrom, allowNameMatching = false) {
-	if (allowFrom.includes("*")) return true;
-	const normalizedSenderId = normalizeUserId$1(senderId);
-	const normalizedEmail = normalizeLowercaseStringOrEmpty(senderEmail ?? "");
-	return allowFrom.some((entry) => {
-		const normalized = normalizeLowercaseStringOrEmpty(entry);
-		if (!normalized) return false;
-		const withoutPrefix = normalized.replace(/^(googlechat|google-chat|gchat):/i, "");
-		if (withoutPrefix.startsWith("users/")) return normalizeUserId$1(withoutPrefix) === normalizedSenderId;
-		if (allowNameMatching && normalizedEmail && isEmailLike(withoutPrefix)) return withoutPrefix === normalizedEmail;
-		return withoutPrefix.replace(/^users\//i, "") === normalizedSenderId;
-	});
-}
-//#endregion
 //#region extensions/googlechat/src/monitor-access.ts
 function normalizeUserId(raw) {
 	const trimmed = normalizeOptionalString(raw) ?? "";
 	if (!trimmed) return "";
 	return normalizeLowercaseStringOrEmpty(trimmed.replace(/^users\//i, ""));
 }
+const GOOGLECHAT_EMAIL_KIND = "plugin:googlechat-email";
+function normalizeEntryValue(raw) {
+	return normalizeLowercaseStringOrEmpty(raw ?? "");
+}
+function normalizeGoogleChatStableEntry(entry) {
+	const withoutProvider = normalizeEntryValue(entry).replace(/^(googlechat|google-chat|gchat):/i, "");
+	if (!withoutProvider) return null;
+	return withoutProvider.startsWith("users/") ? normalizeUserId(withoutProvider) : withoutProvider;
+}
+function normalizeGoogleChatEmailEntry(entry) {
+	if (normalizeEntryValue(entry).replace(/^(googlechat|google-chat|gchat):/i, "").startsWith("users/")) return null;
+	const stable = normalizeGoogleChatStableEntry(entry);
+	return stable?.includes("@") ? stable : null;
+}
+const googleChatIngressIdentity = defineStableChannelIngressIdentity({
+	key: "sender-id",
+	normalizeEntry: normalizeGoogleChatStableEntry,
+	normalizeSubject: normalizeUserId,
+	aliases: [{
+		key: "email",
+		kind: GOOGLECHAT_EMAIL_KIND,
+		normalizeEntry: normalizeGoogleChatEmailEntry,
+		normalizeSubject: normalizeEntryValue,
+		dangerous: true
+	}],
+	isWildcardEntry: (entry) => normalizeEntryValue(entry) === "*",
+	resolveEntryId: ({ entryIndex, fieldKey }) => fieldKey === "stableId" ? `entry-${entryIndex + 1}:user` : `entry-${entryIndex + 1}:${fieldKey}`
+});
 function resolveGroupConfig(params) {
 	const { groupId, groupName, groups } = params;
 	const entries = groups ?? {};
@@ -121,120 +125,116 @@ async function applyGoogleChatInboundAccessPolicy(params) {
 	});
 	const groupEntry = groupConfigResolved.entry;
 	const groupUsers = groupEntry?.users ?? account.config.groupAllowFrom ?? [];
-	const isGoogleChatSenderAllowed = (_senderId, allowFrom) => isSenderAllowed(senderId, senderEmail, allowFrom, allowNameMatching);
-	const expandedGroupUsers = await expandAllowFromWithAccessGroups({
-		cfg: config,
-		allowFrom: groupUsers,
-		channel: "googlechat",
+	let effectiveWasMentioned;
+	const dmPolicy = account.config.dm?.policy ?? "pairing";
+	const rawConfigAllowFrom = normalizeStringEntries(account.config.dm?.allowFrom);
+	const shouldComputeAuth = core.channel.commands.shouldComputeCommandAuthorized(rawBody, config);
+	const groupActivation = (() => {
+		if (!isGroup) return;
+		const requireMention = groupEntry?.requireMention ?? account.config.requireMention ?? true;
+		const mentionInfo = extractMentionInfo(message.annotations ?? [], account.config.botUser);
+		return {
+			requireMention,
+			allowTextCommands: core.channel.commands.shouldHandleTextCommands({
+				cfg: config,
+				surface: "googlechat"
+			}),
+			hasControlCommand: core.channel.text.hasControlCommand(rawBody, config),
+			wasMentioned: mentionInfo.wasMentioned,
+			hasAnyMention: mentionInfo.hasAnyMention
+		};
+	})();
+	const command = {
+		hasControlCommand: groupActivation?.hasControlCommand ?? shouldComputeAuth,
+		groupOwnerAllowFrom: "none"
+	};
+	const groupAllowFrom = normalizeStringEntries(groupUsers);
+	const senderGroupPolicy = groupConfigResolved.allowlistConfigured && groupAllowFrom.length === 0 ? groupPolicy : groupPolicy === "disabled" ? "disabled" : groupAllowFrom.length > 0 ? "allowlist" : "open";
+	const route = channelIngressRoutes(isGroup && groupPolicy !== "disabled" && groupEntry?.enabled === false && {
+		id: "googlechat:space",
+		enabled: false,
+		matched: true,
+		matchId: "googlechat-space",
+		blockReason: "route_disabled"
+	}, isGroup && groupPolicy === "allowlist" && groupEntry?.enabled !== false && !groupConfigResolved.allowlistConfigured && {
+		id: "googlechat:space",
+		allowed: false,
+		blockReason: "empty_allowlist"
+	}, isGroup && groupPolicy === "allowlist" && groupEntry?.enabled !== false && groupConfigResolved.allowlistConfigured && {
+		id: "googlechat:space",
+		senderPolicy: "deny-when-empty",
+		...groupEntry ? { senderAllowFromSource: "effective-group" } : {},
+		allowed: Boolean(groupEntry),
+		matchId: "googlechat-space",
+		blockReason: groupEntry ? "sender_empty_allowlist" : "route_not_allowlisted"
+	});
+	const resolvedAccess = await createChannelIngressResolver({
+		channelId: "googlechat",
 		accountId: account.accountId,
-		senderId,
-		isSenderAllowed: isGoogleChatSenderAllowed
+		identity: googleChatIngressIdentity,
+		cfg: config,
+		readStoreAllowFrom: pairing.readAllowFromStore
+	}).message({
+		subject: {
+			stableId: senderId,
+			aliases: { email: senderEmail }
+		},
+		conversation: {
+			kind: isGroup ? "group" : "direct",
+			id: spaceId
+		},
+		route,
+		allowFrom: rawConfigAllowFrom,
+		groupAllowFrom,
+		dmPolicy,
+		groupPolicy: senderGroupPolicy,
+		policy: {
+			groupAllowFromFallbackToAllowFrom: false,
+			mutableIdentifierMatching: allowNameMatching ? "enabled" : "disabled",
+			...groupActivation ? { activation: {
+				requireMention: groupActivation.requireMention,
+				allowTextCommands: groupActivation.allowTextCommands
+			} } : {}
+		},
+		...groupActivation == null ? {} : { mentionFacts: {
+			canDetectMention: true,
+			wasMentioned: groupActivation.wasMentioned,
+			hasAnyMention: groupActivation.hasAnyMention,
+			implicitMentionKinds: []
+		} },
+		command
 	});
-	let effectiveWasMentioned;
+	const senderAccess = resolvedAccess.senderAccess;
+	const commandAuthorized = resolvedAccess.commandAccess.requested ? resolvedAccess.commandAccess.authorized : void 0;
 	if (isGroup) {
 		if (groupConfigResolved.deprecatedNameMatch) {
 			logVerbose(`drop group message (deprecated mutable group key matched, space=${spaceId})`);
 			return { ok: false };
 		}
-		const groupAllowlistConfigured = groupConfigResolved.allowlistConfigured;
-		const routeAccess = evaluateGroupRouteAccessForPolicy({
-			groupPolicy,
-			routeAllowlistConfigured: groupAllowlistConfigured,
-			routeMatched: Boolean(groupEntry),
-			routeEnabled: groupEntry?.enabled !== false
-		});
-		if (!routeAccess.allowed) {
-			if (routeAccess.reason === "disabled") logVerbose(`drop group message (groupPolicy=disabled, space=${spaceId})`);
-			else if (routeAccess.reason === "empty_allowlist") logVerbose(`drop group message (groupPolicy=allowlist, no allowlist, space=${spaceId})`);
-			else if (routeAccess.reason === "route_not_allowlisted") logVerbose(`drop group message (not allowlisted, space=${spaceId})`);
-			else if (routeAccess.reason === "route_disabled") logVerbose(`drop group message (space disabled, space=${spaceId})`);
+		const routeBlockReason = resolvedAccess.routeAccess.reason;
+		if (routeBlockReason && routeBlockReason !== "sender_empty_allowlist") {
+			if (routeBlockReason === "empty_allowlist") logVerbose(`drop group message (groupPolicy=allowlist, no allowlist, space=${spaceId})`);
+			else if (routeBlockReason === "route_not_allowlisted") logVerbose(`drop group message (not allowlisted, space=${spaceId})`);
+			else if (routeBlockReason === "route_disabled") logVerbose(`drop group message (space disabled, space=${spaceId})`);
 			return { ok: false };
 		}
-		if (expandedGroupUsers.length > 0) {
-			warnDeprecatedUsersEmailEntries(logVerbose, expandedGroupUsers);
-			if (!isSenderAllowed(senderId, senderEmail, expandedGroupUsers, allowNameMatching)) {
-				logVerbose(`drop group message (sender not allowed, ${senderId})`);
-				return { ok: false };
-			}
+		if (senderAccess.effectiveGroupAllowFrom.length > 0 && senderAccess.decision !== "allow") {
+			warnDeprecatedUsersEmailEntries(logVerbose, senderAccess.effectiveGroupAllowFrom);
+			logVerbose(`drop group message (sender not allowed, ${senderId})`);
+			return { ok: false };
 		}
 	}
-	const dmPolicy = account.config.dm?.policy ?? "pairing";
-	const rawConfigAllowFrom = (account.config.dm?.allowFrom ?? []).map((v) => String(v));
-	const normalizedGroupUsers = expandedGroupUsers;
-	const senderGroupPolicy = groupConfigResolved.allowlistConfigured && normalizedGroupUsers.length === 0 ? groupPolicy : resolveSenderScopedGroupPolicy({
-		groupPolicy,
-		groupAllowFrom: normalizedGroupUsers
-	});
-	const shouldComputeAuth = core.channel.commands.shouldComputeCommandAuthorized(rawBody, config);
-	const storeAllowFrom = !isGroup && dmPolicy !== "allowlist" && dmPolicy !== "open" ? await pairing.readAllowFromStore().catch(() => []) : [];
-	const [configAllowFrom, effectiveStoreAllowFrom] = await Promise.all([expandAllowFromWithAccessGroups({
-		cfg: config,
-		allowFrom: rawConfigAllowFrom,
-		channel: "googlechat",
-		accountId: account.accountId,
-		senderId,
-		isSenderAllowed: isGoogleChatSenderAllowed
-	}), expandAllowFromWithAccessGroups({
-		cfg: config,
-		allowFrom: storeAllowFrom,
-		channel: "googlechat",
-		accountId: account.accountId,
-		senderId,
-		isSenderAllowed: isGoogleChatSenderAllowed
-	})]);
-	const access = resolveDmGroupAccessWithLists({
-		isGroup,
-		dmPolicy,
-		groupPolicy: senderGroupPolicy,
-		allowFrom: configAllowFrom,
-		groupAllowFrom: normalizedGroupUsers,
-		storeAllowFrom: effectiveStoreAllowFrom,
-		groupAllowFromFallbackToAllowFrom: false,
-		isSenderAllowed: (allowFrom) => isSenderAllowed(senderId, senderEmail, allowFrom, allowNameMatching)
-	});
-	const effectiveAllowFrom = access.effectiveAllowFrom;
-	const effectiveGroupAllowFrom = access.effectiveGroupAllowFrom;
+	const effectiveAllowFrom = senderAccess.effectiveAllowFrom;
 	warnDeprecatedUsersEmailEntries(logVerbose, effectiveAllowFrom);
-	const commandAllowFrom = isGroup ? effectiveGroupAllowFrom : effectiveAllowFrom;
-	const useAccessGroups = config.commands?.useAccessGroups !== false;
-	const senderAllowedForCommands = isSenderAllowed(senderId, senderEmail, commandAllowFrom, allowNameMatching);
-	const commandAuthorized = shouldComputeAuth ? core.channel.commands.resolveCommandAuthorizedFromAuthorizers({
-		useAccessGroups,
-		authorizers: [{
-			configured: commandAllowFrom.length > 0,
-			allowed: senderAllowedForCommands
-		}]
-	}) : void 0;
-	if (isGroup) {
-		const requireMention = groupEntry?.requireMention ?? account.config.requireMention ?? true;
-		const mentionInfo = extractMentionInfo(message.annotations ?? [], account.config.botUser);
-		const allowTextCommands = core.channel.commands.shouldHandleTextCommands({
-			cfg: config,
-			surface: "googlechat"
-		});
-		const mentionDecision = resolveInboundMentionDecision({
-			facts: {
-				canDetectMention: true,
-				wasMentioned: mentionInfo.wasMentioned,
-				hasAnyMention: mentionInfo.hasAnyMention,
-				implicitMentionKinds: []
-			},
-			policy: {
-				isGroup: true,
-				requireMention,
-				allowTextCommands,
-				hasControlCommand: core.channel.text.hasControlCommand(rawBody, config),
-				commandAuthorized: commandAuthorized === true
-			}
-		});
-		effectiveWasMentioned = mentionDecision.effectiveWasMentioned;
-		if (mentionDecision.shouldSkip) {
+	if (isGroup && resolvedAccess.activationAccess.ran) {
+		effectiveWasMentioned = resolvedAccess.activationAccess.effectiveWasMentioned;
+		if (resolvedAccess.activationAccess.shouldSkip) {
 			logVerbose(`drop group message (mention required, space=${spaceId})`);
 			return { ok: false };
 		}
 	}
-	if (isGroup && access.decision !== "allow") {
-		logVerbose(`drop group message (sender policy blocked, reason=${access.reason}, space=${spaceId})`);
+	if (isGroup && senderAccess.decision !== "allow") {
+		logVerbose(`drop group message (sender policy blocked, reason=${resolvedAccess.ingress.reasonCode === "route_sender_empty" ? "groupPolicy=allowlist (empty allowlist)" : senderAccess.reasonCode}, space=${spaceId})`);
 		return { ok: false };
 	}
 	if (!isGroup) {
@@ -242,8 +242,8 @@ async function applyGoogleChatInboundAccessPolicy(params) {
 			logVerbose(`Blocked Google Chat DM from ${senderId} (dmPolicy=disabled)`);
 			return { ok: false };
 		}
-		if (access.decision !== "allow") {
-			if (access.decision === "pairing") await pairing.issueChallenge({
+		if (senderAccess.decision !== "allow") {
+			if (senderAccess.decision === "pairing") await pairing.issueChallenge({
 				senderId,
 				senderIdLine: `Your Google Chat user id: ${senderId}`,
 				meta: {

package/dist/{runtime-api-JpbBRVpx.js → runtime-api-DMEzhesS.js}

@@ -7,7 +7,6 @@ import { missingTargetError } from "openclaw/plugin-sdk/channel-feedback";
 import { createAccountStatusSink as createAccountStatusSink$1, runPassiveAccountLifecycle as runPassiveAccountLifecycle$1 } from "openclaw/plugin-sdk/channel-lifecycle";
 import { createChannelPairingController } from "openclaw/plugin-sdk/channel-pairing";
 import { createChannelMessageReplyPipeline } from "openclaw/plugin-sdk/channel-message";
-import { evaluateGroupRouteAccessForPolicy, resolveDmGroupAccessWithLists, resolveSenderScopedGroupPolicy } from "openclaw/plugin-sdk/channel-policy";
 import { PAIRING_APPROVED_MESSAGE } from "openclaw/plugin-sdk/channel-status";
 import { chunkTextForOutbound } from "openclaw/plugin-sdk/text-chunking";
 import { GoogleChatConfigSchema } from "openclaw/plugin-sdk/bundled-channel-config-schema";
@@ -15,7 +14,7 @@ import { GROUP_POLICY_BLOCKED_LABEL, resolveAllowlistProviderRuntimeGroupPolicy,
 import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
 import { fetchRemoteMedia, resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/media-runtime";
 import { loadOutboundMediaFromUrl as loadOutboundMediaFromUrl$1 } from "openclaw/plugin-sdk/outbound-media";
-import { resolveInboundMentionDecision as resolveInboundMentionDecision$1 } from "openclaw/plugin-sdk/channel-inbound";
+import { resolveInboundMentionDecision } from "openclaw/plugin-sdk/channel-inbound";
 import { resolveInboundRouteEnvelopeBuilderWithRuntime } from "openclaw/plugin-sdk/inbound-envelope";
 import { resolveWebhookPath } from "openclaw/plugin-sdk/webhook-path";
 import { registerWebhookTargetWithPluginRoute as registerWebhookTargetWithPluginRoute$1, resolveWebhookTargetWithAuthOrReject as resolveWebhookTargetWithAuthOrReject$1, withResolvedWebhookRequestPipeline as withResolvedWebhookRequestPipeline$1 } from "openclaw/plugin-sdk/webhook-targets";
@@ -27,4 +26,4 @@ const { setRuntime: setGoogleChatRuntime, getRuntime: getGoogleChatRuntime } = c
 	errorMessage: "Google Chat runtime not initialized"
 });
 //#endregion
-export { resolveInboundRouteEnvelopeBuilderWithRuntime as A, readStringParam$1 as C, resolveDefaultGroupPolicy as D, resolveChannelMediaMaxBytes as E, warnMissingProviderGroupPolicyFallbackOnce as F, withResolvedWebhookRequestPipeline$1 as I, getGoogleChatRuntime as L, resolveWebhookPath as M, resolveWebhookTargetWithAuthOrReject$1 as N, resolveDmGroupAccessWithLists as O, runPassiveAccountLifecycle$1 as P, setGoogleChatRuntime as R, readReactionParams$1 as S, resolveAllowlistProviderRuntimeGroupPolicy as T, jsonResult$1 as _, buildChannelConfigSchema as a, readJsonWebhookBodyOrReject$1 as b, createActionGate$1 as c, createWebhookInFlightLimiter$1 as d, evaluateGroupRouteAccessForPolicy as f, isDangerousNameMatchingEnabled as g, fetchWithSsrFGuard$1 as h, PAIRING_APPROVED_MESSAGE as i, resolveSenderScopedGroupPolicy as j, resolveInboundMentionDecision$1 as k, createChannelMessageReplyPipeline as l, fetchRemoteMedia as m, GROUP_POLICY_BLOCKED_LABEL as n, chunkTextForOutbound as o, extractToolSend$1 as p, GoogleChatConfigSchema as r, createAccountStatusSink$1 as s, DEFAULT_ACCOUNT_ID as t, createChannelPairingController as u, loadOutboundMediaFromUrl$1 as v, registerWebhookTargetWithPluginRoute$1 as w, readNumberParam$1 as x, missingTargetError as y };
+export { resolveWebhookTargetWithAuthOrReject$1 as A, registerWebhookTargetWithPluginRoute$1 as C, resolveInboundMentionDecision as D, resolveDefaultGroupPolicy as E, setGoogleChatRuntime as F, warnMissingProviderGroupPolicyFallbackOnce as M, withResolvedWebhookRequestPipeline$1 as N, resolveInboundRouteEnvelopeBuilderWithRuntime as O, getGoogleChatRuntime as P, readStringParam$1 as S, resolveChannelMediaMaxBytes as T, loadOutboundMediaFromUrl$1 as _, buildChannelConfigSchema as a, readNumberParam$1 as b, createActionGate$1 as c, createWebhookInFlightLimiter$1 as d, extractToolSend$1 as f, jsonResult$1 as g, isDangerousNameMatchingEnabled as h, PAIRING_APPROVED_MESSAGE as i, runPassiveAccountLifecycle$1 as j, resolveWebhookPath as k, createChannelMessageReplyPipeline as l, fetchWithSsrFGuard$1 as m, GROUP_POLICY_BLOCKED_LABEL as n, chunkTextForOutbound as o, fetchRemoteMedia as p, GoogleChatConfigSchema as r, createAccountStatusSink$1 as s, DEFAULT_ACCOUNT_ID as t, createChannelPairingController as u, missingTargetError as v, resolveAllowlistProviderRuntimeGroupPolicy as w, readReactionParams$1 as x, readJsonWebhookBodyOrReject$1 as y };

package/dist/runtime-api.js

@@ -1,2 +1,2 @@
-import { A as resolveInboundRouteEnvelopeBuilderWithRuntime, C as readStringParam, D as resolveDefaultGroupPolicy, E as resolveChannelMediaMaxBytes, F as warnMissingProviderGroupPolicyFallbackOnce, I as withResolvedWebhookRequestPipeline, M as resolveWebhookPath, N as resolveWebhookTargetWithAuthOrReject, O as resolveDmGroupAccessWithLists, P as runPassiveAccountLifecycle, R as setGoogleChatRuntime, S as readReactionParams, T as resolveAllowlistProviderRuntimeGroupPolicy, _ as jsonResult, a as buildChannelConfigSchema, b as readJsonWebhookBodyOrReject, c as createActionGate, d as createWebhookInFlightLimiter, f as evaluateGroupRouteAccessForPolicy, g as isDangerousNameMatchingEnabled, h as fetchWithSsrFGuard, i as PAIRING_APPROVED_MESSAGE, j as resolveSenderScopedGroupPolicy, k as resolveInboundMentionDecision, l as createChannelMessageReplyPipeline, m as fetchRemoteMedia, n as GROUP_POLICY_BLOCKED_LABEL, o as chunkTextForOutbound, p as extractToolSend, r as GoogleChatConfigSchema, s as createAccountStatusSink, t as DEFAULT_ACCOUNT_ID, u as createChannelPairingController, v as loadOutboundMediaFromUrl, w as registerWebhookTargetWithPluginRoute, x as readNumberParam, y as missingTargetError } from "./runtime-api-JpbBRVpx.js";
-export { DEFAULT_ACCOUNT_ID, GROUP_POLICY_BLOCKED_LABEL, GoogleChatConfigSchema, PAIRING_APPROVED_MESSAGE, buildChannelConfigSchema, chunkTextForOutbound, createAccountStatusSink, createActionGate, createChannelMessageReplyPipeline, createChannelPairingController, createWebhookInFlightLimiter, evaluateGroupRouteAccessForPolicy, extractToolSend, fetchRemoteMedia, fetchWithSsrFGuard, isDangerousNameMatchingEnabled, jsonResult, loadOutboundMediaFromUrl, missingTargetError, readJsonWebhookBodyOrReject, readNumberParam, readReactionParams, readStringParam, registerWebhookTargetWithPluginRoute, resolveAllowlistProviderRuntimeGroupPolicy, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveDmGroupAccessWithLists, resolveInboundMentionDecision, resolveInboundRouteEnvelopeBuilderWithRuntime, resolveSenderScopedGroupPolicy, resolveWebhookPath, resolveWebhookTargetWithAuthOrReject, runPassiveAccountLifecycle, setGoogleChatRuntime, warnMissingProviderGroupPolicyFallbackOnce, withResolvedWebhookRequestPipeline };
+import { A as resolveWebhookTargetWithAuthOrReject, C as registerWebhookTargetWithPluginRoute, D as resolveInboundMentionDecision, E as resolveDefaultGroupPolicy, F as setGoogleChatRuntime, M as warnMissingProviderGroupPolicyFallbackOnce, N as withResolvedWebhookRequestPipeline, O as resolveInboundRouteEnvelopeBuilderWithRuntime, S as readStringParam, T as resolveChannelMediaMaxBytes, _ as loadOutboundMediaFromUrl, a as buildChannelConfigSchema, b as readNumberParam, c as createActionGate, d as createWebhookInFlightLimiter, f as extractToolSend, g as jsonResult, h as isDangerousNameMatchingEnabled, i as PAIRING_APPROVED_MESSAGE, j as runPassiveAccountLifecycle, k as resolveWebhookPath, l as createChannelMessageReplyPipeline, m as fetchWithSsrFGuard, n as GROUP_POLICY_BLOCKED_LABEL, o as chunkTextForOutbound, p as fetchRemoteMedia, r as GoogleChatConfigSchema, s as createAccountStatusSink, t as DEFAULT_ACCOUNT_ID, u as createChannelPairingController, v as missingTargetError, w as resolveAllowlistProviderRuntimeGroupPolicy, x as readReactionParams, y as readJsonWebhookBodyOrReject } from "./runtime-api-DMEzhesS.js";
+export { DEFAULT_ACCOUNT_ID, GROUP_POLICY_BLOCKED_LABEL, GoogleChatConfigSchema, PAIRING_APPROVED_MESSAGE, buildChannelConfigSchema, chunkTextForOutbound, createAccountStatusSink, createActionGate, createChannelMessageReplyPipeline, createChannelPairingController, createWebhookInFlightLimiter, extractToolSend, fetchRemoteMedia, fetchWithSsrFGuard, isDangerousNameMatchingEnabled, jsonResult, loadOutboundMediaFromUrl, missingTargetError, readJsonWebhookBodyOrReject, readNumberParam, readReactionParams, readStringParam, registerWebhookTargetWithPluginRoute, resolveAllowlistProviderRuntimeGroupPolicy, resolveChannelMediaMaxBytes, resolveDefaultGroupPolicy, resolveInboundMentionDecision, resolveInboundRouteEnvelopeBuilderWithRuntime, resolveWebhookPath, resolveWebhookTargetWithAuthOrReject, runPassiveAccountLifecycle, setGoogleChatRuntime, warnMissingProviderGroupPolicyFallbackOnce, withResolvedWebhookRequestPipeline };

package/dist/{targets-14IVp2Yg.js → targets-qggOq6n-.js}

@@ -1,4 +1,4 @@
-import { a as findGoogleChatDirectMessage } from "./api-BwM7NTay.js";
+import { a as findGoogleChatDirectMessage } from "./api-AErsImS_.js";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/text-runtime";
 //#region extensions/googlechat/src/targets.ts
 function normalizeGoogleChatTarget(raw) {

package/dist/test-api.js

@@ -1,3 +1,3 @@
-import { R as setGoogleChatRuntime } from "./runtime-api-JpbBRVpx.js";
-import { t as googlechatPlugin } from "./channel-DHHatGQ1.js";
+import { F as setGoogleChatRuntime } from "./runtime-api-DMEzhesS.js";
+import { t as googlechatPlugin } from "./channel-9lvRWX6T.js";
 export { googlechatPlugin, setGoogleChatRuntime };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/googlechat",
-  "version": "2026.5.9-beta.1",
+  "version": "2026.5.10-beta.1",
   "description": "OpenClaw Google Chat channel plugin",
   "repository": {
     "type": "git",
@@ -16,7 +16,7 @@
     "openclaw": "workspace:*"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.5.9-beta.1"
+    "openclaw": ">=2026.5.10-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -74,10 +74,10 @@
       "minHostVersion": ">=2026.4.10"
     },
     "compat": {
-      "pluginApi": ">=2026.5.9-beta.1"
+      "pluginApi": ">=2026.5.10-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.5.9-beta.1"
+      "openclawVersion": "2026.5.10-beta.1"
     },
     "release": {
       "publishToClawHub": true,