@securecoms/agent-bridge 0.26.4 → 0.26.5

package/connectors/hermes/tests/test_securecoms_authz.py

@@ -0,0 +1,235 @@
+# packages/connect-agent-bridge/connectors/hermes/tests/test_securecoms_authz.py
+#
+# Per-turn tool authorization for the Hermes connector. The daemon attaches
+# an `authorization` block to every inbound frame (BridgeAgent.authorizationFor,
+# derived from server-authenticated roster data). Its `tool_grants` list is
+# non-empty ONLY for the agent's pinned owner in their DM (or a relayed voice
+# turn spoken by that owner). Everything else - room members, other-org
+# members, agent senders, an older daemon that sends no block, a malformed
+# block - must run with NO tools. Fail closed.
+
+import securecoms_authz as authz
+
+GRANTS = [{"tool": "current_time", "mode": "read"}, {"tool": "web_search", "mode": "read"}]
+
+
+def auth(audience, *, membership="active", grants=None, version=1):
+    return {
+        "version": version,
+        "audience": audience,
+        "sender_membership": membership,
+        "tool_grants": list(GRANTS if grants is None else grants),
+    }
+
+
+def frame(authorization=..., **kw):
+    f = {"type": "message", "channel_id": "c", "sender_id": "s", "text": "t", "message_id": "m"}
+    if authorization is not ...:
+        f["authorization"] = authorization
+    f.update(kw)
+    return f
+
+
+class TestToolsAllowed:
+    def test_owner_dm_with_grants_is_allowed(self):
+        assert authz.tools_allowed(frame(auth("owner_dm"))) is True
+
+    def test_relayed_owner_voice_turn_with_grants_is_allowed(self):
+        # The daemon grants a relay turn only when the relayed speaker is the
+        # pinned owner; its audience is agent_to_agent (the relay is an agent).
+        assert authz.tools_allowed(frame(auth("agent_to_agent"))) is True
+
+    def test_room_member_without_grants_is_refused(self):
+        assert authz.tools_allowed(frame(auth("team_room", grants=[]))) is False
+
+    def test_other_org_member_without_grants_is_refused(self):
+        assert authz.tools_allowed(frame(auth("partner_room", grants=[]))) is False
+
+    def test_agent_sender_without_grants_is_refused(self):
+        assert authz.tools_allowed(frame(auth("agent_to_agent", grants=[]))) is False
+
+    def test_owner_dm_without_grants_is_refused(self):
+        # Kill switch off, an unpinned/anomalous owner, or a lying
+        # is_agent_owner flag: the audience alone never grants tools.
+        assert authz.tools_allowed(frame(auth("owner_dm", grants=[]))) is False
+
+    def test_missing_authorization_is_refused(self):
+        assert authz.tools_allowed(frame()) is False
+
+    def test_null_or_non_object_authorization_is_refused(self):
+        assert authz.tools_allowed(frame(None)) is False
+        assert authz.tools_allowed(frame("owner_dm")) is False
+        assert authz.tools_allowed(frame(["owner_dm"])) is False
+
+    def test_unknown_version_is_refused(self):
+        assert authz.tools_allowed(frame(auth("owner_dm", version=2))) is False
+        assert authz.tools_allowed(frame(auth("owner_dm", version="1"))) is False
+
+    def test_unknown_membership_is_refused(self):
+        assert authz.tools_allowed(frame(auth("owner_dm", membership="unknown"))) is False
+
+    def test_grants_that_are_not_a_list_of_tool_objects_are_refused(self):
+        assert authz.tools_allowed(frame({**auth("owner_dm"), "tool_grants": "current_time"})) is False
+        assert authz.tools_allowed(frame({**auth("owner_dm"), "tool_grants": [None]})) is False
+        assert authz.tools_allowed(frame({**auth("owner_dm"), "tool_grants": [{"mode": "read"}]})) is False
+        assert authz.tools_allowed(frame({**auth("owner_dm"), "tool_grants": [{"tool": ""}]})) is False
+
+    def test_non_dict_frame_is_refused(self):
+        assert authz.tools_allowed(None) is False
+        assert authz.tools_allowed("frame") is False
+
+
+class TestSenderRole:
+    def test_roles_follow_the_daemon_audience(self):
+        assert authz.sender_role(frame(auth("owner_dm"))) == "owner"
+        assert authz.sender_role(frame(auth("team_room", grants=[]))) == "member"
+        assert authz.sender_role(frame(auth("other_human_dm", grants=[]))) == "member"
+        assert authz.sender_role(frame(auth("partner_room", grants=[]))) == "other_org"
+        assert authz.sender_role(frame(auth("agent_to_agent", grants=[]))) == "agent"
+
+    def test_missing_or_malformed_authorization_is_unknown(self):
+        assert authz.sender_role(frame()) == "unknown"
+        assert authz.sender_role(frame(auth("unknown", membership="unknown", grants=[]))) == "unknown"
+        assert authz.sender_role(frame(auth("owner_dm", version=2))) == "unknown"
+        assert authz.sender_role(frame(auth("owner_dm", membership="unknown"))) == "unknown"
+        assert authz.sender_role(frame(auth("some_future_audience"))) == "unknown"
+
+
+class TestTurnLedger:
+    def test_unrecorded_turn_has_no_tools(self):
+        ledger = authz.TurnAuthzLedger()
+        assert ledger.tools_allowed("c", "u") is False
+
+    def test_latest_decision_for_the_chat_and_sender_wins(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("c", "owner", True)
+        assert ledger.tools_allowed("c", "owner") is True
+        ledger.record("c", "owner", False)
+        assert ledger.tools_allowed("c", "owner") is False
+
+    def test_a_grant_never_leaks_to_another_sender_or_chat(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "owner", True)
+        assert ledger.tools_allowed("dm", "intruder") is False
+        assert ledger.tools_allowed("room", "owner") is False
+
+    def test_known_chats_survive_decision_eviction(self):
+        ledger = authz.TurnAuthzLedger(max_entries=1)
+        ledger.record("c1", "u", False)
+        ledger.record("c2", "u", False)
+        assert ledger.knows_chat("c1") is True
+        assert ledger.knows_chat("c3") is False
+        assert ledger.knows_chat("") is False
+
+    def test_empty_keys_are_never_allowed(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("", "", True)
+        assert ledger.tools_allowed("", "") is False
+        assert ledger.tools_allowed(None, None) is False
+
+    def test_ledger_is_bounded_and_evicts_to_no_tools(self):
+        ledger = authz.TurnAuthzLedger(max_entries=2)
+        ledger.record("c1", "u", True)
+        ledger.record("c2", "u", True)
+        ledger.record("c3", "u", True)
+        assert ledger.tools_allowed("c1", "u") is False
+        assert ledger.tools_allowed("c3", "u") is True
+
+
+class TestPreToolCallDecision:
+    def _env(self, **values):
+        return lambda name, default="": values.get(name, default)
+
+    def test_owner_turn_on_securecoms_is_not_blocked(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "owner", True)
+        env = self._env(HERMES_SESSION_PLATFORM="securecoms", HERMES_SESSION_CHAT_ID="dm", HERMES_SESSION_USER_ID="owner")
+        assert authz.pre_tool_call_decision(env, ledger) is None
+
+    def test_non_owner_turn_on_securecoms_is_blocked(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("room", "member", False)
+        env = self._env(HERMES_SESSION_PLATFORM="securecoms", HERMES_SESSION_CHAT_ID="room", HERMES_SESSION_USER_ID="member")
+        decision = authz.pre_tool_call_decision(env, ledger)
+        assert decision == {"action": "block", "message": authz.TOOL_VETO_MESSAGE}
+
+    def test_unrecorded_securecoms_turn_is_blocked(self):
+        env = self._env(HERMES_SESSION_PLATFORM="securecoms", HERMES_SESSION_CHAT_ID="dm", HERMES_SESSION_USER_ID="owner")
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger())["action"] == "block"
+
+    def test_securecoms_turn_without_chat_or_user_is_blocked(self):
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("dm", "owner", True)
+        env = self._env(HERMES_SESSION_PLATFORM="securecoms", HERMES_SESSION_CHAT_ID="dm")
+        assert authz.pre_tool_call_decision(env, ledger)["action"] == "block"
+
+    def test_a_known_securecoms_chat_is_gated_even_if_the_platform_label_differs(self):
+        # Defence in depth: should Hermes ever label the platform differently,
+        # a chat id this connector recorded is still a SecureComs turn.
+        ledger = authz.TurnAuthzLedger()
+        ledger.record("room-uuid", "member", False)
+        env = self._env(HERMES_SESSION_PLATFORM="SecureComs", HERMES_SESSION_CHAT_ID="room-uuid", HERMES_SESSION_USER_ID="member")
+        assert authz.pre_tool_call_decision(env, ledger)["action"] == "block"
+
+    def test_an_evicted_room_chat_with_a_mislabelled_platform_still_blocks(self):
+        # The decision ledger is bounded; the set of SecureComs chat ids is not.
+        ledger = authz.TurnAuthzLedger(max_entries=2)
+        ledger.record("room-uuid", "member", False)
+        ledger.record("c2", "u", True)
+        ledger.record("c3", "u", True)
+        env = self._env(HERMES_SESSION_PLATFORM="", HERMES_SESSION_CHAT_ID="room-uuid", HERMES_SESSION_USER_ID="member")
+        assert authz.pre_tool_call_decision(env, ledger)["action"] == "block"
+
+    def test_other_platforms_are_left_alone(self):
+        env = self._env(HERMES_SESSION_PLATFORM="telegram", HERMES_SESSION_CHAT_ID="x", HERMES_SESSION_USER_ID="y")
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger()) is None
+
+    def test_an_empty_turn_identity_in_an_engaged_gateway_blocks(self):
+        # H1: a tool call that lost its task-local session reads "" for the
+        # platform, chat and user. It cannot be attributed, so it is refused.
+        decision = authz.pre_tool_call_decision(self._env(), authz.TurnAuthzLedger(), lambda: True)
+        assert decision == {"action": "block", "message": authz.TOOL_VETO_MESSAGE}
+
+    def test_the_session_engaged_reader_defaults_to_engaged(self):
+        assert authz.pre_tool_call_decision(self._env(), authz.TurnAuthzLedger())["action"] == "block"
+
+    def test_an_empty_turn_identity_outside_a_gateway_is_left_alone(self):
+        # A Hermes process that never bound a gateway session (the CLI) has no
+        # SecureComs turns at all.
+        assert authz.pre_tool_call_decision(self._env(), authz.TurnAuthzLedger(), lambda: False) is None
+
+    def test_a_positively_identified_cron_turn_is_left_alone(self):
+        # N2: cron is identified ONLY by the task-local ContextVar reader the
+        # adapter passes in (is_cron), never by the environment.
+        decide = authz.pre_tool_call_decision
+        assert decide(self._env(), authz.TurnAuthzLedger(), lambda: True, lambda: True) is None
+        assert decide(self._env(), authz.TurnAuthzLedger(), lambda: True, lambda: False)["action"] == "block"
+        assert decide(self._env(), authz.TurnAuthzLedger(), lambda: True, None)["action"] == "block"
+
+    def test_the_cron_environment_variable_alone_never_exempts(self):
+        env = self._env(HERMES_CRON_SESSION="1")
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger(), lambda: True)["action"] == "block"
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger(), lambda: True, lambda: False)["action"] == "block"
+
+    def test_an_is_cron_reader_that_raises_blocks(self):
+        def boom():
+            raise RuntimeError("no var")
+
+        assert authz.pre_tool_call_decision(self._env(), authz.TurnAuthzLedger(), lambda: True, boom)["action"] == "block"
+
+    def test_empty_platform_with_a_never_seen_chat_blocks_in_an_engaged_gateway(self):
+        env = self._env(HERMES_SESSION_CHAT_ID="never-seen", HERMES_SESSION_USER_ID="u")
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger(), lambda: True)["action"] == "block"
+        assert authz.pre_tool_call_decision(env, authz.TurnAuthzLedger(), lambda: False) is None
+
+    def test_an_engaged_reader_that_raises_blocks(self):
+        def boom():
+            raise RuntimeError("unknown")
+
+        assert authz.pre_tool_call_decision(self._env(), authz.TurnAuthzLedger(), boom)["action"] == "block"
+
+    def test_an_env_reader_that_raises_blocks(self):
+        def boom(name, default=""):
+            raise RuntimeError("no session")
+
+        assert authz.pre_tool_call_decision(boom, authz.TurnAuthzLedger())["action"] == "block"

package/connectors/openclaw/openclaw-entry.inbound.test.ts

@@ -204,7 +204,17 @@ describe("openclaw-entry — inbound sender, session, authority, dedup (P0 Task
     });
     const mod = await import("./openclaw-entry.js");
     let plugin: any;
-    mod.default.register({ runtime, registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; } });
+    // A current OpenClaw host: its plugin api exposes `on` (typed hooks) and
+    // registerTrustedToolPolicy (shipped 2026.4.27, #72287; both declared in
+    // plugin-api.types.ts), so register() trusts the tool veto and turns
+    // without a tool grant are dispatched with tools blocked. Hosts without
+    // them (those turns refused) are openclaw-entry.toolgate.test.ts's.
+    mod.default.register({
+      runtime,
+      on: () => {},
+      registerTrustedToolPolicy: () => {},
+      registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; },
+    });
     const { FakeWebSocket, instances } = makeFakeWebSocket();
     vi.stubGlobal("WebSocket", FakeWebSocket);
     const account = plugin.config.resolveAccount({}, "default");
@@ -259,9 +269,14 @@ describe("openclaw-entry — inbound sender, session, authority, dedup (P0 Task
     const rt = makeRuntime();
     const { instances } = await start(rt.runtime);
     const ws = instances[0];
-
-    deliver(ws, { channel_id: "chan-V", message_id: "m-V", sender_id: OWNER_ID, text: "what's the weather?", voice: true, guidance: "One short spoken sentence.", authorization: auth("owner_dm") });
-    deliver(ws, { channel_id: "chan-T", message_id: "m-T", sender_id: OWNER_ID, text: "hi", guidance: "ignored without voice", authorization: auth("owner_dm") });
+    // The pinned owner with the daemon's default read grants (the state
+    // authorizationFor produces unless the grants kill switch is off). A
+    // voice turn WITHOUT a grant also carries the no-tools note: see
+    // openclaw-entry.toolgate.test.ts.
+    const ownerGranted = { ...auth("owner_dm"), tool_grants: [{ tool: "current_time", mode: "read" }] };
+
+    deliver(ws, { channel_id: "chan-V", message_id: "m-V", sender_id: OWNER_ID, text: "what's the weather?", voice: true, guidance: "One short spoken sentence.", authorization: ownerGranted });
+    deliver(ws, { channel_id: "chan-T", message_id: "m-T", sender_id: OWNER_ID, text: "hi", guidance: "ignored without voice", authorization: ownerGranted });
     await waitFor(() => acksOf(ws).length === 2);
 
     const { VOICE_TURN_PREFIX } = await import("./openclaw-entry.js");

package/connectors/openclaw/openclaw-entry.js

@@ -142,6 +142,135 @@ export function isOwnerAuthorization(authorization) {
   );
 }
 
+// ---------------------------------------------------------------------------
+// Tool gate (security fix 2026-10-05).
+//
+// OpenClaw runs every turn with the agent's configured tools, so without this
+// a room member, a partner-org member or another agent reaches the same exec
+// and file tools as the owner. The daemon's authorization block says which
+// turn was granted tools: tool_grants is non-empty ONLY for the agent's pinned
+// owner in their DM, or a relayed voice turn the owner spoke
+// (BridgeAgent.authorizationFor). OpenClaw has no per-message "no tools"
+// switch the channel can set, so the connector registers a before_tool_call
+// hook and BLOCKS every tool call in a SecureComs session whose turn was not
+// granted tools. If the host gives the plugin no hook API, a turn without a
+// grant is refused outright (acked, never dispatched). Fail closed.
+//
+// What this cannot do: the model is still OFFERED the configured tools (each
+// call is refused when made), and enforcement holds only for tool calls that
+// OpenClaw routes through before_tool_call.
+// ---------------------------------------------------------------------------
+
+/** blockReason handed to OpenClaw for a vetoed call (becomes the tool result). */
+export const TOOL_VETO_REASON =
+  "Tool use is disabled for this message: SecureComs grants tools only to this agent's owner in their direct message. Answer in text only.";
+
+/**
+ * Posted once per channel when a turn is refused because this host cannot
+ * veto tool calls: the WHOLE turn is refused, so the room is told rather than
+ * left with a silent agent.
+ */
+export const REFUSED_TURN_NOTICE = "I can't respond in this room until my owner updates me.";
+
+/** before_tool_call priority: run ahead of other plugins' handlers. */
+export const TOOL_VETO_PRIORITY = 1000;
+
+/** Extra system prompt for a turn without tools, so the model answers in text. */
+export const NO_TOOLS_TURN_NOTE =
+  "Tools are disabled for this message because its sender is not this agent's owner in a direct message. Answer in text only and do not try to call any tool.";
+
+/**
+ * True only when the daemon granted this turn at least one tool: a v1 block,
+ * an active sender, and a non-empty list of `{ tool: <name> }` grants. The
+ * audience alone never grants tools (an unpinned or anomalous owner, or the
+ * grants kill switch, arrives as owner_dm with no grants). The daemon grants
+ * a DM's single human counterpart whom the server marks `is_agent_owner`; the
+ * pin is per channel, so a backend that mis-sets that flag would grant a DM
+ * member tools (review H2: binding the owner outside server control is an
+ * open follow-up).
+ */
+export function toolsAuthorized(authorization) {
+  if (authorization === null || typeof authorization !== "object") return false;
+  if (authorization.version !== 1 || authorization.sender_membership !== "active") return false;
+  const grants = authorization.tool_grants;
+  if (!Array.isArray(grants) || grants.length === 0) return false;
+  return grants.every((g) => g !== null && typeof g === "object" && typeof g.tool === "string" && g.tool !== "");
+}
+
+const TOOL_AUTHZ_MAX = 5000;
+// Latest turn's decision per session key, and per (session key, sender).
+const _sessionToolAuthz = new Map();
+const _senderToolAuthz = new Map();
+// Ungranted turns per session key whose dispatch has not returned.
+const _ungrantedInFlight = new Map();
+// Set by register(): true only on a host that proves before_tool_call blocks
+// (see register) AND accepted the hook.
+let _toolVetoActive = false;
+// The OpenClaw host version (api.runtime.version), reported in the hello.
+let _harnessVersion = null;
+// Channels already told that this agent cannot respond (veto inactive).
+const _refusalNoticeSent = new Set();
+// Inbound frames seen without an authorization block (daemon too old).
+let _framesWithoutAuthorization = 0;
+
+/** The hello frame telling the daemon the harness and whether its veto is active. */
+export function harnessHello() {
+  return {
+    type: "hello",
+    harness: { name: "openclaw", version: _harnessVersion, tool_veto: _toolVetoActive ? "active" : "inactive" },
+  };
+}
+
+function _boundedSet(map, key, value) {
+  map.delete(key);
+  map.set(key, value);
+  if (map.size > TOOL_AUTHZ_MAX) {
+    const oldest = map.keys().next();
+    if (!oldest.done) map.delete(oldest.value);
+  }
+}
+
+function _senderKey(sessionKey, senderId) {
+  return `${sessionKey}\u0000${senderId}`;
+}
+
+function _recordTurnToolAuthz(sessionKey, senderId, allowed) {
+  _boundedSet(_sessionToolAuthz, sessionKey, allowed === true);
+  _boundedSet(_senderToolAuthz, _senderKey(sessionKey, senderId), allowed === true);
+}
+
+const SECURECOMS_SESSION_MARK = ":securecoms:";
+
+function _isSecureComsTool(ctx) {
+  if (!ctx || typeof ctx !== "object") return false;
+  if (typeof ctx.sessionKey === "string" && ctx.sessionKey.includes(SECURECOMS_SESSION_MARK)) return true;
+  if (ctx.channelId === "securecoms") return true;
+  return ctx.requester?.channel === "securecoms";
+}
+
+/**
+ * before_tool_call: no opinion on other channels; for a SecureComs session,
+ * allow only when (1) its latest turn was granted tools, (2) no ungranted
+ * turn for it is still dispatching, and (3) when OpenClaw names the requester,
+ * that sender's latest turn in this session was granted. Anything it cannot
+ * establish, including a missing session key, is blocked.
+ */
+export function toolCallDecision(_event, ctx) {
+  try {
+    if (!_isSecureComsTool(ctx)) return undefined;
+    const key = ctx.sessionKey;
+    if (typeof key === "string" && key !== "" && _sessionToolAuthz.get(key) === true && !(_ungrantedInFlight.get(key) > 0)) {
+      const requester = ctx.requester?.senderId;
+      if (requester === undefined || requester === null) return undefined;
+      const sender = String(requester).replace(/^securecoms:/, "");
+      if (_senderToolAuthz.get(_senderKey(key, sender)) === true) return undefined;
+    }
+  } catch {
+    /* fall through: block */
+  }
+  return { block: true, blockReason: TOOL_VETO_REASON };
+}
+
 /** "direct" only for a DM the daemon classified as one; everything else is a group. */
 export function chatTypeFor(authorization) {
   const audience = authorization && typeof authorization === "object" ? authorization.audience : undefined;
@@ -427,6 +556,9 @@ export class LoopbackChannel {
       // enough (see comment in _probeAndGate) — and not while turns are
       // failing: a close we forced for redelivery must still back off.
       if (this._failStreak === 0) this._attempt = 0;
+      // Report the harness and its tool-veto state (versions/booleans only);
+      // a daemon that predates the field ignores it.
+      try { ws.send(JSON.stringify(harnessHello())); } catch { /* best effort */ }
     });
 
     ws.addEventListener("message", (ev) => {
@@ -715,6 +847,27 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
   const senderName = typeof metadata.senderName === "string" && metadata.senderName !== "" ? metadata.senderName : senderId;
   const chatType = chatTypeFor(metadata.authorization);
   const commandAuthorized = isOwnerAuthorization(metadata.authorization);
+  if (metadata.authorization === null || typeof metadata.authorization !== "object") {
+    _framesWithoutAuthorization++;
+    if (_framesWithoutAuthorization % 100 === 1) {
+      channel.log(
+        "[SecureComs] WARNING: inbound frame carries NO authorization block; the daemon predates the tool gate, so every turn runs without tools. Upgrade @securecoms/agent-bridge.",
+      );
+    }
+  }
+  const toolsAllowed = toolsAuthorized(metadata.authorization);
+  if (!toolsAllowed && !_toolVetoActive) {
+    // This OpenClaw host gave the plugin no way to refuse tool calls, so a
+    // turn the daemon did not grant tools never reaches the agent. Acked.
+    channel._logSafe("[securecoms] turn refused reason={r}", { r: "no_tool_veto" });
+    // One notice per channel; never to another agent (two refusing agents
+    // would answer each other).
+    if (metadata.authorization?.audience !== "agent_to_agent" && !_refusalNoticeSent.has(conv) && _refusalNoticeSent.size < TOOL_AUTHZ_MAX) {
+      _refusalNoticeSent.add(conv);
+      try { await channel.send(conv, REFUSED_TURN_NOTICE, metadata.messageId); } catch { /* best effort */ }
+    }
+    return;
+  }
 
   // Route by the CHANNEL, so each SecureComs room/DM is its own conversation.
   const route = core.channel.routing.resolveAgentRoute({
@@ -728,6 +881,7 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
   // main session, which would merge two different humans' DMs (and the
   // owner's) into one history. One session per SecureComs channel, always.
   const sessionKey = `agent:${route.agentId}:securecoms:${chatType}:${conv}`;
+  _recordTurnToolAuthz(sessionKey, senderId, toolsAllowed);
 
   const storePath = core.channel.session.resolveStorePath(cfg?.session?.store, {
     agentId: route.agentId,
@@ -748,6 +902,11 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
     body: text,
   });
 
+  const extraPrompt = [
+    metadata.voiceGuidance ? `${VOICE_TURN_PREFIX}${metadata.voiceGuidance}` : undefined,
+    toolsAllowed ? undefined : NO_TOOLS_TURN_NOTE,
+  ].filter(Boolean).join("\n\n");
+
   const ctxPayload = core.channel.reply.finalizeInboundContext({
     Body: body,
     RawBody: text,
@@ -770,9 +929,10 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
     // authorization block (isOwnerAuthorization). MLS membership proves a
     // sender is in the room, not that they own this agent.
     CommandAuthorized: commandAuthorized,
-    // Voice turn: OpenClaw folds GroupSystemPrompt into this turn's extra
-    // system prompt (get-reply's extraSystemPromptParts) for any chat type.
-    ...(metadata.voiceGuidance ? { GroupSystemPrompt: `${VOICE_TURN_PREFIX}${metadata.voiceGuidance}` } : {}),
+    // Voice turn and no-tools turn: OpenClaw folds GroupSystemPrompt into
+    // this turn's extra system prompt (get-reply's extraSystemPromptParts)
+    // for any chat type.
+    ...(extraPrompt ? { GroupSystemPrompt: extraPrompt } : {}),
   });
 
   await core.channel.session.recordInboundSession({
@@ -793,6 +953,7 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
   // "idle" waits for the last one to settle (success or failure) so the strip
   // does not clear before the reply is out. The turn itself does not wait for
   // that — ack/redelivery behavior is unchanged.
+  if (!toolsAllowed) _ungrantedInFlight.set(sessionKey, (_ungrantedInFlight.get(sessionKey) ?? 0) + 1);
   channel.reportStatus(conv, "working");
   const pendingDeliveries = new Set();
   let deliveredBlocks = 0;
@@ -825,6 +986,11 @@ async function _handleInbound({ text, metadata, channel, account, cfg }) {
   } finally {
     // One line per turn, content-free: tells whether dispatch returns before
     // its reply blocks are delivered (delivered_blocks=0 with pending > 0).
+    if (!toolsAllowed) {
+      const n = (_ungrantedInFlight.get(sessionKey) ?? 1) - 1;
+      if (n > 0) _ungrantedInFlight.set(sessionKey, n);
+      else _ungrantedInFlight.delete(sessionKey);
+    }
     channel._logSafe("[securecoms] turn dispatch_ms={ms} delivered_blocks={k} pending_deliveries={p}", {
       ms: Date.now() - dispatchStarted,
       k: deliveredBlocks,
@@ -965,6 +1131,21 @@ export default {
   description: "End-to-end encrypted messaging via the local SecureComs Agent Bridge daemon.",
   register(api) {
     _runtime = api.runtime;
+    _harnessVersion = typeof api.runtime?.version === "string" ? api.runtime.version.slice(0, 40) : null;
+    _toolVetoActive = false;
+    // Trust the veto only on a host that proves before_tool_call blocks:
+    // registerTrustedToolPolicy shipped in OpenClaw 2026.4.27 (#72287), after
+    // block results became terminal and hook errors became blocks (2026-04-04,
+    // #59822). An older host may accept api.on and ignore the registration,
+    // so below that floor turns without a grant are refused instead.
+    if (typeof api.on === "function" && typeof api.registerTrustedToolPolicy === "function") {
+      try {
+        api.on("before_tool_call", toolCallDecision, { priority: TOOL_VETO_PRIORITY });
+        _toolVetoActive = true;
+      } catch {
+        _toolVetoActive = false;
+      }
+    }
     api.registerChannel({ plugin: secureComsPlugin });
   },
 };

package/connectors/openclaw/openclaw-entry.status.test.ts

@@ -194,7 +194,17 @@ describe("openclaw-entry — per-channel status reporter (#910)", () => {
   async function startTurnHarness(runtime: unknown) {
     const mod = await loadModule(home);
     let plugin: any;
-    mod.default.register({ runtime, registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; } });
+    // A current OpenClaw host: its plugin api exposes `on` (typed hooks) and
+    // registerTrustedToolPolicy (shipped 2026.4.27, #72287; both declared in
+    // plugin-api.types.ts), so register() trusts the tool veto and turns
+    // without a tool grant are dispatched with tools blocked. Hosts without
+    // them (those turns refused) are openclaw-entry.toolgate.test.ts's.
+    mod.default.register({
+      runtime,
+      on: () => {},
+      registerTrustedToolPolicy: () => {},
+      registerChannel: ({ plugin: p }: { plugin: unknown }) => { plugin = p; },
+    });
     const { FakeWebSocket, instances } = makeFakeWebSocket();
     vi.stubGlobal("WebSocket", FakeWebSocket);
     const account = plugin.config.resolveAccount({}, "default");