Codex review: needs real behavior proof before merge. Reviewed May 28, 2026, 1:15 AM ET / 05:15 UTC.

Summary
The PR gates /phone arm and /phone disarm mutations on owner or operator.admin authorization, adds a trusted bundled-command owner-status exposure path, and updates focused phone-control/plugin-command tests.

PR surface: Source +35, Tests +185. Total +220 across 12 files.

Reproducibility: yes. from source inspection: current main and v2026.5.26 only require admin when gateway scopes are present or the channel is webchat, so an external Telegram /phone arm without gateway scope context can reach mutation. I did not run a live Telegram reproduction in this read-only review.

Review metrics: 2 noteworthy metrics.

• Plugin command API surface: 1 field added. exposeSenderIsOwner changes the command definition contract and affects the owner-status authorization boundary before merge.
• Phone-control mutation gates: 2 subcommands tightened. /phone arm and /phone disarm now fail closed for external non-owner callers, which is the compatibility behavior maintainers need to approve.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted real behavior proof showing a non-owner external caller is blocked and owner/admin paths still mutate as intended.
• Update the PR body with the actual focused validation commands/output instead of the current None testing section.
• Get maintainer approval for the trusted owner-status plugin command boundary.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body still says no live setup was tested, and the follow-up provides CI/local tests and builds rather than redacted live transport output showing the blocked and allowed /phone paths. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
Native Telegram proof would directly show the blocked non-owner /phone arm response and the allowed owner/admin mutation path. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

telegram desktop proof: verify /phone arm writes 30s blocks a non-owner Telegram caller and allows owner/admin mutation with private details redacted.

Risk before merge

• [P1] Merging intentionally fails closed for shared-channel users who previously could run /phone arm or /phone disarm with generic command authorization; they will now need owner status or operator.admin.
• [P1] The PR adds exposeSenderIsOwner to the plugin command definition path, which is a plugin API and authorization-boundary contract that needs maintainer approval before it becomes permanent.
• [P1] The current PR body and follow-up proof comment still provide tests/CI/build output rather than redacted live transport proof of the changed external-channel behavior.

Maintainer options:

1. Approve the trusted owner-status contract (recommended)
   A maintainer can confirm that bundled-only owner-status exposure and the fail-closed /phone mutation behavior are intended, then require redacted transport proof before merge.
2. Rework the owner-status seam
   If maintainers do not want a new command-definition field on the public plugin type, pause the PR and move the owner-status exposure into an internal bundled-only registration path or another approved API shape.
3. Pause if the compatibility break is too broad
   If existing shared-channel non-owner mutation should remain supported, pause or close this PR and design a narrower opt-in authorization model instead.

Next step before merge

• [P1] Human handling is needed because the protected maintainer-labeled PR changes a plugin API/security boundary and still needs maintainer approval plus contributor real behavior proof.

Security
Cleared: No supply-chain, credential-handling, or new code-execution regression was found; the authorization-boundary decision is tracked as merge risk for maintainer approval.

ClawSweeper PR egg: 🎁 locked until real behavior proof passes.

Not applicable to this automation stage; changelog/release-note and external real behavior proof requirements are handled outside auto-pr stages.

Quoted comment from @clawsweeper:

Codex review: needs real behavior proof before merge. Reviewed May 27, 2026, 12:47 AM ET / 04:47 UTC.

Summary
The PR gates /phone arm and /phone disarm mutations on owner/admin authorization, adds a trusted bundled-command owner-status exposure path, and updates phone-control/plugin-command regression coverage.

PR surface: Source +38, Tests +154. Total +192 across 9 files.

Reproducibility: yes. from source inspection, not from a live run: current main only requires operator.admin when gateway scopes are present or the channel is webchat, so a Telegram /phone arm without gateway scope context can reach the mutation path.

Review metrics: 1 noteworthy metric.

• Plugin command API surface: 1 command definition field added. exposeSenderIsOwner changes a public plugin command definition type and affects the owner-status authorization boundary before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Add redacted real behavior proof showing a non-owner external caller is blocked and owner/admin paths still mutate as intended.
• Run the focused plugin command tests and include the exact command output or CI link in the PR body.
• Update the PR body after adding proof; if ClawSweeper does not re-review automatically, ask a maintainer to comment ``@clawsweeper re-review.

Proof guidance:
Needs real behavior proof before merge: The PR body explicitly says no live OpenClaw setup or repository command was run; only regression coverage is offered, so contributor real behavior proof is still required with private details redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment ``@clawsweeper re-review.

Mantis proof suggestion
A native Telegram proof would directly show the blocked non-owner /phone arm response and the allowed owner/admin path. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

telegram desktop proof: verify `/phone arm writes 30s` blocks a non-owner caller and allows an owner/admin caller without leaking private details.

Risk before merge

• Merging intentionally fails closed for shared-channel users who previously could run /phone arm or /phone disarm with generic command authorization; they will now need owner status or operator.admin.
• The PR adds a trusted owner-status exposure field to the plugin command definition path, which is a plugin API and security-boundary decision that needs maintainer approval before it becomes the permanent contract.
• The external PR body says no live OpenClaw setup or repository command was run, so the changed transport-visible authorization behavior still lacks real behavior proof.

Maintainer options:

1. Approve the trusted owner-status boundary (recommended)
   A maintainer can confirm that a bundled-only owner-status exposure path is the intended plugin command contract, then require focused CI and redacted real behavior proof before merge.
2. Rework the owner-status seam
   If maintainers do not want a new command-definition field on the public plugin type, pause the PR and move the exposure into an internal bundled-only registration path or another approved API shape.
3. Accept the fail-closed behavior change
   Maintainers can explicitly accept that existing shared-channel non-owner /phone mutators will stop working unless the caller is owner/admin.

Next step before merge
The protected maintainer-labeled PR needs maintainer approval for the trusted owner-status plugin command boundary and contributor real behavior proof before merge.

Security
Cleared: No supply-chain or credential-handling regression was found in the diff; the security-sensitive authorization boundary still needs maintainer approval and real behavior proof.

Review details

Best possible solution:

Land a maintainer-approved narrow authorization fix that blocks non-owner external mutation, keeps read-only status/help usable, keeps owner status unavailable to external plugins, and includes focused tests plus redacted live transport proof.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection, not from a live run: current main only requires operator.admin when gateway scopes are present or the channel is webchat, so a Telegram /phone arm without gateway scope context can reach the mutation path.

Is this the best way to solve the issue?

Unclear without maintainer approval: the mutation guard is targeted and covered by focused tests, but the new trusted owner-status command field is a plugin API/security-boundary decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against bf1a5c330397.

Label changes

Label justifications:

• P1: The PR changes authorization for a high-risk phone-control mutation path used from external chat channels.
• merge-risk: 🚨 compatibility: Existing shared-channel callers that previously mutated phone-control state with generic command authorization will be blocked unless they are owner/admin.
• merge-risk: 🚨 security-boundary: The diff changes how owner status is exposed to plugin command handlers and uses that signal to authorize phone-control config mutations.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body explicitly says no live OpenClaw setup or repository command was run; only regression coverage is offered, so contributor real behavior proof is still required with private details redacted. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment ``@clawsweeper re-review.
• mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The changed /phone authorization response is visible in Telegram chat and can be demonstrated in a short Telegram Desktop proof.

Evidence reviewed

PR surface:

Source +38, Tests +154. Total +192 across 9 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	47	9	+38
Tests	3	158	4	+154
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	9	205	13	+192

What I checked:

• Current main allows external no-scope mutation: On current main, the phone-control mutation guard only requires admin when gateway scopes are present or the channel is webchat, so a Telegram command without gateway scope context can reach the arm/disarm mutation paths. (extensions/phone-control/index.ts:285, bf1a5c330397)
• Current test contract expected the unsafe path: Current main's phone-control tests explicitly expect external channel callers without operator.admin to arm phone control and write config, which matches the reported behavior the PR reverses. (extensions/phone-control/index.test.ts:166, bf1a5c330397)
• PR blocks non-owner external mutation: The PR changes the phone-control guard to require either gateway operator.admin or senderIsOwner === true, and marks the bundled /phone command as needing owner-status exposure. (extensions/phone-control/index.ts:285, 5cdcfe7533a1)
• PR covers blocked and trusted paths: The branch adds regression expectations for blocked non-owner Telegram callers, read-only status/help behavior, and owner/admin allowed paths; it also tests that external plugin opt-ins do not receive owner status while trusted bundled commands can. (src/plugins/commands.test.ts:736, 5cdcfe7533a1)
• Repository policy marks this compatibility-sensitive: Root policy treats plugin APIs, auth state, fail-closed changes, and new operator action as compatibility/upgrade-sensitive; scoped plugin policy lists src/plugins/types.ts as a public contract surface. (AGENTS.md:26, bf1a5c330397)
• History provenance points to recent plugin refactor: Blame and git log -S tie the current phone-control guard and plugin command owner-status logic to b74cd69c6f87e338805152cda37029b40a247f53, a recent gateway/plugin refactor commit by Peter Steinberger. (extensions/phone-control/index.ts:285, b74cd69c6f87)

Likely related people:

• steipete: Direct blame and feature-history search tie the current phone-control guard and plugin command execution contract to the same recent gateway/plugin refactor commit. (role: recent area contributor; confidence: medium; commits: b74cd69c6f87; files: extensions/phone-control/index.ts, src/plugins/commands.ts, src/plugins/registry.ts)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible ``@clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper` re-review` or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment ``@clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper` autofix`, @clawsweeper automerge, @clawsweeper` fix ci`, or @clawsweeper address review.
• Maintainers can comment @clawsweeper` explain` to ask for more context, or @clawsweeper stop to stop active automation.

Not applicable to this automation stage; changelog/release-note and external real behavior proof requirements are handled outside auto-pr stages.

Quoted comment from @clawsweeper:

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?

• The egg game starts only after the PR passes the real-behavior proof check.
• Before that, no creature or rarity is rolled. The treat waits for real proof.
• This is still just collectible flavor: proof affects review readiness, not creature quality.

@clawsweeper re-review

Real behavior proof is now green for the current head fdd3c67a8aeb42ceeaef320bf88b14d49d490ff7:

• Run: https://github.com/openclaw/openclaw/actions/runs/26555861816
• Job: https://github.com/openclaw/openclaw/actions/runs/26555861816/job/78227447019

Local proof also completed on this head:

• node scripts/run-vitest.mjs src/image-generation/provider-registry.test.ts src/video-generation/provider-registry.test.ts extensions/phone-control/index.test.ts src/plugins/commands.test.ts src/plugins/contracts/host-hooks.contract.test.ts
• git diff --check
• pnpm build
• pnpm build:plugin-sdk:strict-smoke

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26555988698
• Updated: 2026-05-28T05:16:19.529Z

Diff notes

Fix verdict: SOLVES.

The PR solves the GHSA root cause by replacing the old channel-based /phone mutation check with an authorization gate that requires operator.admin when Gateway scopes are present, or confirmed owner status when scope context is absent. It also adds trusted bundled-plugin-only owner-status exposure so phone-control can make that decision without exposing senderIsOwner to ordinary external plugins.

Evidence:

• extensions/phone-control/index.ts changes the helper from requiresAdminToMutatePhoneControl(channel, scopes) to lacksAdminToMutatePhoneControl({ senderIsOwner, gatewayClientScopes }); absent scopes now block mutation unless senderIsOwner is true.
• extensions/phone-control/index.ts applies the new gate before both disarm and arm, before disarmNow or mutateConfigFile can change gateway.nodes allowCommands/denyCommands.
• extensions/phone-control/index.ts sets exposeSenderIsOwner: true on the bundled phone command so the handler can distinguish owner from non-owner callers when gatewayClientScopes is absent.
• src/plugins/commands.ts and src/plugins/command-registry-state.ts only pass senderIsOwner to commands that are scoped or have trustedOwnerStatusExposure.
• src/plugins/command-registration.ts and src/plugins/registry.ts only grant trustedOwnerStatusExposure through trusted registration options, preventing ordinary external plugin opt-in from receiving owner status.
• extensions/phone-control/index.test.ts reverses the old permissive external-channel tests: Telegram-shaped non-owner callers without operator.admin are blocked for arm and disarm, while status/help remain readable and owner/operator.admin paths still mutate.
• src/plugins/commands.test.ts covers the owner-status plumbing: direct/external plugin opt-in is ignored, and trusted bundled phone-control opt-in receives senderIsOwner.

Plain-language post description

Someone who was already allowed to send commands to an OpenClaw bot from an external chat channel could use /phone arm or /phone disarm to temporarily loosen which phone actions the Gateway may run. That could make sensitive phone capabilities, such as camera, screen recording, calendar writes, contacts, reminders, or SMS, available even though the sender was not the owner or an operator admin.

The PR changes phone-control so /phone arm and /phone disarm require either operator.admin or confirmed owner status when the caller does not have Gateway scope context. Ordinary command-authorized channel users can still read /phone status and help, but they cannot change the phone permission policy.

Change Impact Analysis

• Change scope: Targeted
• Regression risk: Medium
• Change path: Standard fix

The fix is narrowly focused on the /phone mutation path, with a small supporting plugin-command change so trusted bundled commands can receive owner status for subcommand-level authorization. It does not change config shape, defaults, persisted data, CLI syntax, or Gateway wire protocol. The main practical impact is intentional: shared-channel deployments that previously let non-owner allowlisted users run /phone arm or /phone disarm must now use the owner or an operator.admin context.

Impact reasons:

• The authorization change is limited to /phone arm and /phone disarm; /phone status and help remain readable.
• The plugin API change is an optional field, exposeSenderIsOwner?: boolean, with trusted-owner exposure limited to bundled/trusted registration paths.
• No openclaw config migration, default change, persisted schema change, CLI syntax change, or Gateway protocol change is introduced.
• Regression risk is Medium because the PR touches command authorization plumbing and intentionally changes one shared-channel phone-control workflow.
• src/gateway/server-methods/config.ts is formatting-only and unrelated to the phone-control behavior.

Verification notes:

• Reviewed in read-only mode; no GitHub or git state was mutated.
• The local origin/main...HEAD checkout is an unrelated device-pairing branch, so PR Tighten phone-control mutation authorization [AI] #87150 impact was based on read-only GitHub PR metadata and previously inspected targeted hunks for the requested PR.
• Reviewed PR file metadata shows focused changes in phone-control, plugin-command owner-status plumbing, and targeted tests.
• No tests were executed for this impact write-up.

Caveats

Residual risks:

• The phone-control regression tests exercise the handler directly; runtime owner-status delivery is covered separately by plugin command registry tests rather than one end-to-end external-channel /phone dispatch test.
• No relevant affected /phone arm|disarm path remains unhandled in the reviewed diff; src/gateway/server-methods/config.ts is formatting-only and unrelated to the GHSA root cause.
• Tests were not executed in this read-only gate; verdict is based on the PR source diff and directly relevant regression test changes.

Automated review gate:

• Bot-only unresolved actionable comments: 0
• No unresolved/unreplied actionable bot comments.

Gate blockers:

• None

Backward Compatibility Review

Compatibility verdict: PASS.
Informational only: this section does not block GHSA PR gate outcome.

No blocking backward-compatibility concern in the reviewed PR diff. The PR adds an optional plugin command field and internal trusted-registration metadata without changing CLI syntax, config shape, defaults, Gateway wire payloads, or persisted data. The only meaningful user-visible behavior change is the intended hardening: non-owner external-channel users without operator.admin can no longer run /phone arm or /phone disarm.

Blocking concerns:

• (none)

Notes:

• API compatibility: OpenClawPluginCommandDefinition gains optional exposeSenderIsOwner?: boolean; existing typed plugin command definitions remain source-compatible.
• Runtime validation now reserves exposeSenderIsOwner as a boolean field, so an untyped plugin that already used that exact property with a non-boolean value could fail registration; this is narrow and not a blocking BC issue.
• CLI compatibility: no command names, arguments, or CLI invocation shapes change.
• Config/default compatibility: no openclaw config keys, default values, migrations, or persisted config schemas change.
• Wire/schema compatibility: no Gateway protocol, channel payload, or serialized API response shape changes are introduced by the relevant diff.
• Behavior compatibility: deployments that intentionally let non-owner allowlisted Telegram/Discord/Slack users run /phone arm or /phone disarm will need owner/operator.admin instead; /phone status and help remain available.
• src/gateway/server-methods/config.ts is formatting-only in this PR and does not change config.openFile behavior.
• Reviewed in read-only mode; no tests were run and no git/GitHub state was mutated.