Gate Matrix profile updates for non-owner message tool runs by eleqtrizit · Pull Request #62662 · openclaw/openclaw

eleqtrizit · 2026-04-07T18:18:33Z

Summary

gate Matrix self-profile message actions behind owner context
thread owner status through shared message action discovery and execution

Changes

hide Matrix set-profile from non-owner message tool discovery
reject Matrix set-profile execution for non-owner callers
pass senderIsOwner through shared message-tool discovery and action dispatch
add regression coverage for Matrix discovery/execution and shared message-tool context plumbing

Validation

Ran pnpm test extensions/matrix/src/actions.test.ts
Ran pnpm test extensions/matrix/src/actions.account-propagation.test.ts
Ran pnpm test src/agents/tools/message-tool.test.ts
Ran pnpm check via scripts/committer
Attempted claude -p "/review" before PR creation; it required a PR number to continue

Notes

This keeps owner/admin behavior intact while removing persistent Matrix profile mutation from non-owner agent runs.
No broader channel action behavior changed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55326ffb07

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

greptile-apps · 2026-04-07T18:23:17Z

Greptile Summary

This PR gates the Matrix set-profile message action behind an owner check at both discovery time (hidden from the schema for non-owners) and execution time (hard reject if senderIsOwner !== true). The senderIsOwner flag is threaded through the full call stack: createOpenClawTools → createMessageTool → runMessageAction → dispatchChannelMessageAction → handleAction(ctx), and through the discovery path: listChannelSupportedActions → createMessageActionDiscoveryContext → describeMessageTool.

Confidence Score: 5/5

Safe to merge; owner gate is correctly applied at both discovery and execution time with no bypass vectors via tool params.

All remaining findings are P2 or lower. The senderIsOwner flag is threaded correctly through every layer of the call stack, the fail-closed !== true guard provides defense in depth, and tests cover owner, non-owner, and unknown-status cases.

No files require special attention.

Vulnerabilities

No security concerns identified. senderIsOwner is sourced exclusively from server-side session context (never from tool/model-controlled params), and the execution-time guard in handleAction uses a strict !== true check that fails closed on undefined, false, or any unexpected value — consistent with the trust boundary established for requesterSenderId.

_{Reviews (5): Last reviewed commit: "fix(matrix): remove worklog artifact fro..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55326ffb07

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1724a92958

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1724a92958

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01476a7370

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 33ca2f3ee2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 236f01a1fe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f652e619ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fdad0eff6b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

eleqtrizit · 2026-04-08T22:35:25Z

@codex review

chatgpt-codex-connector · 2026-04-08T22:42:52Z

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

gumadeiras · 2026-04-10T16:56:20Z

Merged via squash.

Prepared head SHA: 602b16a676d1fd7ad8bd2a5ab3126b1a35f1ae9f
Merge commit: fe0f686c9228fffcec6de4011da45e69a6e23e54

Thanks @eleqtrizit!

@gumadeiras

…#62662) Merged via squash. Prepared head SHA: 602b16a Co-authored-by: eleqtrizit <31522568+eleqtrizit@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

@gumadeiras

…#62662) Merged via squash. Prepared head SHA: 602b16a Co-authored-by: eleqtrizit <31522568+eleqtrizit@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

@gumadeiras

…#62662) Merged via squash. Prepared head SHA: 602b16a Co-authored-by: eleqtrizit <31522568+eleqtrizit@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

@gumadeiras

…#62662) Merged via squash. Prepared head SHA: 602b16a Co-authored-by: eleqtrizit <31522568+eleqtrizit@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

@gumadeiras

…#62662) Merged via squash. Prepared head SHA: 602b16a Co-authored-by: eleqtrizit <31522568+eleqtrizit@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras

openclaw-barnacle Bot added channel: matrix Channel integration: matrix agents Agent runtime and tooling size: S maintainer Maintainer-authored PR labels Apr 7, 2026

chatgpt-codex-connector Bot reviewed Apr 7, 2026

View reviewed changes

Comment thread src/agents/tools/message-tool.ts Outdated

Comment thread extensions/matrix/src/actions.ts Outdated

gumadeiras self-assigned this Apr 7, 2026

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread src/agents/tools/message-tool.ts Outdated

openclaw-barnacle Bot added size: M and removed size: S labels Apr 8, 2026

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts Outdated

greptile-apps Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread USER.md Outdated

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts Outdated

openclaw-barnacle Bot added the gateway Gateway runtime label Apr 8, 2026

gumadeiras force-pushed the 354 branch from e3b9d25 to 01476a7 Compare April 8, 2026 20:03

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts Outdated

openclaw-barnacle Bot added size: L and removed size: M labels Apr 8, 2026

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts

openclaw-barnacle Bot added the commands Command implementations label Apr 8, 2026

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread extensions/matrix/src/actions.ts

chatgpt-codex-connector Bot reviewed Apr 8, 2026

View reviewed changes

Comment thread src/agents/cli-runner.ts

gumadeiras force-pushed the 354 branch 2 times, most recently from 22c6d7b to ab6c897 Compare April 10, 2026 16:43

eleqtrizit added 3 commits April 10, 2026 12:55

fix(matrix): gate profile updates for non-owner runs

d9c324d

fix(matrix): fail closed owner gate

1bc516e

fix(matrix): thread senderIsOwner into HTTP tool-invoke path

87fdf40

eleqtrizit and others added 11 commits April 10, 2026 12:55

fix(matrix): remove worklog artifact from pr

58d7bf0

fix(matrix): remove worklog artifact from pr

d0ebd59

fix(matrix): gate embedded profile hints for non-owner runs

4b4c0d6

test(agents): cover embedded owner discovery context

a52e597

refactor(agents): dedupe message action discovery params

2c2def8

fix(gateway): preserve owner auth over bundle MCP

fe6e20d

fix(cli): preserve owner auth for message actions

fc5d3e8

fix(agents): harden claude cli wrapper

17bf486

fix(matrix): preserve owner context in local dispatch

f3b41db

test(agents): fix embedded context harness

fa43aef

test(agents): remove rebase marker

602b16a

gumadeiras force-pushed the 354 branch from ab6c897 to 602b16a Compare April 10, 2026 16:55

gumadeiras merged commit fe0f686 into openclaw:main Apr 10, 2026
9 checks passed

github-actions Bot mentioned this pull request Apr 10, 2026

📡 Upstream Digest — 2026-04-10 18:41 UTC curtismercier/openclaw-mods#530

Open

Uh oh!

Conversation

eleqtrizit commented Apr 7, 2026

Summary

Changes

Validation

Notes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

eleqtrizit commented Apr 8, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 8, 2026

Uh oh!

Uh oh!

gumadeiras commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Apr 7, 2026 •

edited

Loading