Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

The message tool is no longer exposed to the weixin agent after upgrading from 2026.5.16-beta.2 to 2026.5.16-beta.3, despite tools.alsoAllow: ["message"] being explicitly configured.

Steps to reproduce

1. Configure a weixin agent with "tools": { "alsoAllow": ["cron", "read", "exec", "web_search", "web_fetch", "memory_get", "memory_search", "message"] } in openclaw.json.
2. Run the agent via the openclaw-weixin channel (WeChat IM bot).
3. Ask the agent to send a message using the message tool (e.g., send an audio attachment generated by a TTS skill).
4. Observe that the message tool is not present in the available tool list — only read, exec, and session_status are provided.

Expected behavior

In 2026.5.16-beta.2, the message tool was available to the agent and could send media attachments (audio files) successfully to the WeChat session.

Actual behavior

In 2026.5.16-beta.3, the message tool is absent from the agent's tool list. The agent only receives read, exec, and session_status. CLI openclaw message send --dry-run produces the correct payload, but actual delivery fails (weixin not configured) because the CLI lacks the IM bot's login session.

OpenClaw version

2026.5.16-beta.3

Operating system

Linux 6.8.0-106-generic (x64) — Ubuntu (VM)

Install method

npm global

Model

ali/qwen3.6-plus (with fallback to ali/glm-5)

Provider / routing chain

openclaw-weixin -> gateway -> ali (DashScope) -> qwen3.6-plus

Additional provider/model setup details

Configured models: ali/qwen3.6-plus (primary for this session), ali/glm-5 (default).
The weixin agent has sandbox mode set to "all" with workspaceAccess "none".
Tools deny list: ["write", "edit", "apply_patch", "process", "browser", "canvas", "gateway", "nodes", "tts", "video_generate", "sessions_list", "sessions_send", "sessions_spawn", "sessions_history"].

Logs, screenshots, and evidence

## Config (tools section for weixin agent):
{
  "tools": {
    "profile": "minimal",
    "alsoAllow": [
      "cron", "read", "exec", "web_search", "web_fetch",
      "memory_get", "memory_search", "message"
    ],
    "deny": [
      "write", "edit", "apply_patch", "process", "browser",
      "canvas", "gateway", "nodes", "tts", "video_generate",
      "sessions_list", "sessions_send", "sessions_spawn", "sessions_history"
    ]
  }
}

## CLI dry-run succeeds (payload is correct):
$ openclaw message send --channel openclaw-weixin \
  --target "xxx-tknm@im.wechat" \
  --media /path/to/tts_xxx.mp3 --dry-run --json

{
  "action": "send",
  "channel": "openclaw-weixin",
  "dryRun": true,
  "handledBy": "core",
  "payload": {
    "channel": "openclaw-weixin",
    "to": "xxx-tknm@im.wechat",
    "via": "direct",
    "mediaUrl": "/path/to/tts_xxx.mp3"
  }
}

## CLI actual send fails:
$ openclaw message send --channel openclaw-weixin \
  --target "xxx-tknm@im.wechat" \
  --media /path/to/tts_xxx.mp3

OutboundDeliveryError: weixin not configured: please run `openclaw channels login --channel openclaw-weixin`

## Agent-available tools at runtime:
Only: read, exec, session_status

Impact and severity

Affected: weixin agent users relying on the message tool for outbound delivery (audio attachments, scheduled notifications, etc.)
Severity: High — blocks any workflow that requires the agent to proactively send messages or media outside the current reply turn
Frequency: Always — reproduced on every agent turn since upgrading to beta.3
Consequence: TTS voice messages, outbound notifications, and file sharing via the agent are non-functional; CLI workaround is not viable because the IM bot session is not accessible from CLI.

Additional information

Last known good: 2026.5.16-beta.2
First known bad: 2026.5.16-beta.3

The release notes for beta.2 and beta.3 do not mention any changes to message tool registration or sandbox tool filtering. The regression appears to be an internal Gateway-side change that was not documented.

Possible related change in beta.3's changelog: "Gateway/agents: abort active embedded runs when diagnostics detect a stale native tool call, preventing nested agent sessions from staying deadlocked through restart recovery. Fixes #81976. (#82369)" — though this may be unrelated.

Sandbox config: mode "all", scope "agent", workspaceAccess "none". The regression may be related to stricter sandbox tool filtering introduced in beta.3.