fix(elevated): reject group ids as senders by eleqtrizit · Pull Request #91748 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:48:40Z

Summary

Tighten elevated allowlist sender matching so shared conversation identifiers are not treated as sender identities.

Changes

Extract the existing From sender-fallback guard into src/auto-reply/sender-identity.ts.
Reuse that guard in elevated allowlist matching before adding ctx.From tokens.
Add regression coverage for group conversation IDs, missing chat type, and direct-chat from: fallback behavior.

Validation

node scripts/run-vitest.mjs src/auto-reply/reply/reply-elevated.test.ts src/auto-reply/command-auth.owner-default.test.ts
node --import tsx --input-type=module source-level elevated allowlist proof for group and missing-chat-type contexts
corepack pnpm exec oxfmt --check --threads=1 src/auto-reply/sender-identity.ts src/auto-reply/command-auth.ts src/auto-reply/reply/reply-elevated.ts src/auto-reply/reply/reply-elevated.test.ts
corepack pnpm tsgo:core
.agents/skills/autoreview/scripts/autoreview --mode local clean after one accepted finding was fixed

Notes

AI-assisted by Codex. CHANGELOG.md was not updated.

Real behavior proof:
Behavior addressed: elevated allowlist matching no longer treats group conversation IDs as sender identities.
Real environment tested: local OpenClaw source checkout on branch 743 after dependency hydration with corepack pnpm install --frozen-lockfile.
Exact steps or command run after this patch: targeted Vitest, source-level resolveElevatedPermissions proof, formatter check, core tsgo, and autoreview commands listed above.
Evidence after fix: group and missing-chat-type source-level checks returned allowed:false with tools.elevated.allowFrom.whatsapp failure.
Observed result after fix: direct-chat from: fallback remains allowed, while group conversation ID allowlist entries are rejected.
What was not tested: live WhatsApp device traffic.

clawsweeper · 2026-06-09T18:56:27Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 3:15 PM ET / 19:15 UTC.

Summary
The PR extracts the command-auth From fallback guard into a shared helper, applies it to elevated allowlist matching, and adds resolver regression tests for group conversation IDs and direct From fallback.

PR surface: Source +10, Tests +26. Total +36 across 4 files.

Reproducibility: yes. Current-main source inspection shows elevated matching unconditionally adds ctx.From, while the WhatsApp inbound contract uses From as the group conversation id and separate sender fields for the actor.

Review metrics: 1 noteworthy metric.

Elevated allowlist compatibility: 1 entry class now fails closed. WhatsApp group conversation-id entries in tools.elevated.allowFrom.whatsapp stop granting elevated mode, so maintainers should notice the upgrade behavior before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Have a maintainer explicitly accept the fail-closed WhatsApp group-id upgrade behavior or request upgrade-facing wording before merge.

Risk before merge

[P1] Existing tools.elevated.allowFrom.whatsapp entries that use a WhatsApp group conversation id will stop authorizing elevated mode after this PR; that fail-closed change is probably correct, but it is upgrade-visible.
[P1] The protected maintainer label means this should not be closed or auto-landed without explicit maintainer handling even though the code review found no blocking defect.

Maintainer options:

Accept fail-closed elevated authorization (recommended)
A maintainer can intentionally accept that group conversation-id entries no longer grant elevated access because elevated mode is a security boundary and sender identities remain supported.
Add upgrade-facing wording before merge
If maintainers want more operator guidance, require a PR-body, squash-message, or docs note explaining that WhatsApp elevated allowlists must use sender id or E.164 identities.
Pause if group-level elevated access is desired
If maintainers actually want shared group ids to authorize elevated mode, pause this PR and design that as an explicit product policy rather than preserving the accidental fallback.

Next step before merge

[P1] The remaining action is maintainer acceptance of the upgrade-visible fail-closed behavior, not a concrete automation repair.

Security
Cleared: The diff does not add dependencies, scripts, secret handling, or supply-chain surface, and it tightens elevated authorization; compatibility is tracked separately.

Review details

Best possible solution:

Land this after a maintainer explicitly accepts the fail-closed elevated allowlist behavior and the PR body or squash message names the operator-facing upgrade note: allowlist individual sender identities, not shared group conversation ids.

Do we have a high-confidence way to reproduce the issue?

Yes. Current-main source inspection shows elevated matching unconditionally adds ctx.From, while the WhatsApp inbound contract uses From as the group conversation id and separate sender fields for the actor.

Is this the best way to solve the issue?

Yes, with a maintainer compatibility decision still required. Sharing the existing generic From fallback guard is narrower than a WhatsApp-specific parser in core and keeps the owner boundary clean.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 8b84e951e5a6.

Label changes

Label changes:

add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The follow-up comment includes terminal proof against the patched resolver showing group context denied and direct from: fallback allowed after the fix.
remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P1: The PR affects elevated-mode authorization, which is a user-facing security boundary for sandbox escape behavior.
merge-risk: 🚨 compatibility: Merging changes how existing elevated allowlist entries containing WhatsApp group conversation ids behave during upgrade.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The follow-up comment includes terminal proof against the patched resolver showing group context denied and direct from: fallback allowed after the fix.
proof: sufficient: Contributor real behavior proof is sufficient. The follow-up comment includes terminal proof against the patched resolver showing group context denied and direct from: fallback allowed after the fix.

Evidence reviewed

PR surface:

Source +10, Tests +26. Total +36 across 4 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	38	28	+10
Tests	1	26	0	+26
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	4	64	28	+36

What I checked:

Current-main bug path: Current main unconditionally adds ctx.From to elevated sender identity tokens, so a group conversation id can satisfy tools.elevated.allowFrom before this PR. (src/auto-reply/reply/reply-elevated.ts:97, 8b84e951e5a6)
PR guarded elevated From fallback: At the PR head, elevated matching only adds ctx.From when shouldUseFromAsSenderFallback accepts it, aligning elevated matching with command authorization. (src/auto-reply/reply/reply-elevated.ts:98, fe8020d99dab)
Shared generic helper: The new helper rejects non-direct chat From fallback and generic conversation-shaped identifiers without embedding WhatsApp-specific group-JID parsing in core. (src/auto-reply/sender-identity.ts:19, fe8020d99dab)
Regression coverage: The PR adds tests that reject a WhatsApp group conversation id as an elevated sender and preserve direct-chat from: fallback behavior. (src/auto-reply/reply/reply-elevated.test.ts:73, fe8020d99dab)
WhatsApp inbound contract: WhatsApp marks from as the conversation id and carries the actor through sender identity fields, so core elevated authorization should use sender fields for group senders. (extensions/whatsapp/src/inbound/types.ts:59, 8b84e951e5a6)
Generic inbound context contract: The channel inbound builder projects From, ChatType, and SenderId as separate fields, supporting the PR's separation between conversation id and sender identity. (src/channels/inbound-event/context.ts:483, 8b84e951e5a6)

Likely related people:

vincentkoc: git blame and git show --stat tie the current elevated resolver, command-auth guard, docs, and WhatsApp inbound contract in this checkout to commit b08e110 authored by Vincent Koc. (role: introduced behavior and recent area contributor; confidence: high; commits: b08e1109c67e; files: src/auto-reply/reply/reply-elevated.ts, src/auto-reply/command-auth.ts, extensions/whatsapp/src/inbound/types.ts)
thomas.krohnfuss: The same root commit that introduced the relevant current-main surfaces includes Thomas Krohnfuss as a co-author, but the local history does not show a more specific per-file split. (role: adjacent co-author signal; confidence: low; commits: b08e1109c67e; files: src/auto-reply/reply/reply-elevated.ts, src/auto-reply/command-auth.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:09:13Z

ClawSweeper follow-up for the owner-boundary finding is addressed in fe8020d99d.

What changed after the review:

Removed the WhatsApp-specific @g.us detector from core src/auto-reply/sender-identity.ts.
Removed the missing-ChatType regression that depended on that service-specific parser.
Kept the generic elevated fix: core only uses ctx.From as a sender fallback when the normalized chat type is direct, or when the value has generic conversation-like prefixes such as group: / channel: / thread:.

Why this satisfies the boundary concern:

WhatsApp-owned code still provides the canonical contract: extensions/whatsapp/src/inbound/types.ts defines from as the conversation id, and extensions/whatsapp/src/auto-reply/monitor/on-message.ts sends group messages with ChatType: "group", From as the group conversation id, and the actual actor in SenderId / SenderE164.
Core no longer embeds WhatsApp group-JID syntax. The elevated authorization decision now relies on the channel-provided ChatType / sender identity contract, which is the generic seam ClawSweeper asked for.

Real behavior proof after the patch:

node --import tsx --input-type=module <<'NODEPROOF'
import { resolveElevatedPermissions } from './src/auto-reply/reply/reply-elevated.ts';

const cfg = {
  tools: {
    elevated: {
      enabled: true,
      allowFrom: { whatsapp: ['120363411111111111@g.us'] },
    },
  },
};
const groupCtx = {
  Provider: 'whatsapp',
  Surface: 'whatsapp',
  ChatType: 'group',
  SenderId: '+15550002222',
  From: '120363411111111111@g.us',
  SenderE164: '+15550002222',
  To: '+15559990000',
};
const directCfg = {
  tools: {
    elevated: {
      enabled: true,
      allowFrom: { whatsapp: ['from:whatsapp:+15550001111'] },
    },
  },
};
const directCtx = {
  Provider: 'whatsapp',
  Surface: 'whatsapp',
  ChatType: 'direct',
  SenderId: undefined,
  From: 'whatsapp:+15550001111',
  SenderE164: undefined,
  To: '+15559990000',
};
console.log('GROUP=' + JSON.stringify(resolveElevatedPermissions({ cfg, agentId: 'main', provider: 'whatsapp', ctx: groupCtx })));
console.log('DIRECT=' + JSON.stringify(resolveElevatedPermissions({ cfg: directCfg, agentId: 'main', provider: 'whatsapp', ctx: directCtx })));
NODEPROOF

Observed output:

GROUP={"enabled":true,"allowed":false,"failures":[{"gate":"allowFrom","key":"tools.elevated.allowFrom.whatsapp"}]}
DIRECT={"enabled":true,"allowed":true,"failures":[]}

Validation run:

node scripts/run-vitest.mjs src/auto-reply/reply/reply-elevated.test.ts src/auto-reply/command-auth.owner-default.test.ts
-> 2 files passed, 14 tests passed

corepack pnpm exec oxfmt --check --threads=1 src/auto-reply/sender-identity.ts src/auto-reply/command-auth.ts src/auto-reply/reply/reply-elevated.ts src/auto-reply/reply/reply-elevated.test.ts
-> All matched files use the correct format.

corepack pnpm tsgo:core
-> passed

Upgrade behavior is intentional: existing tools.elevated.allowFrom.whatsapp entries that contain a WhatsApp group conversation id now fail closed for elevated mode. Operators should allowlist individual sender identities such as sender id / E.164 values for elevated access. The config schema is unchanged and direct-chat from: fallback behavior remains allowed.

What was not tested: live WhatsApp device traffic.

eleqtrizit · 2026-06-09T20:18:39Z

Relevance

The PR addresses GHSA-fh38-965w-f6c3, a high-severity authorization bypass in the elevated-mode sender allowlist. Three independent relevance checks confirmed the issue is in scope: the elevated allowlist unconditionally treated ctx.From as a sender identity, but on WhatsApp group ingress From is the shared group conversation JID while the actual sender is carried in SenderId/SenderE164. The sibling command-auth path already had the correct invariant via shouldUseFromAsSenderFallback(), but the elevated path did not reuse it. The vulnerability was verified unfixed on both the latest main commit and the latest shipped stable tag.

Compatibility

A dedicated compatibility check confirmed the fix is safe to merge. No exported symbols were removed or renamed, no config key shapes changed, no CLI flags or gateway protocol messages were altered, and no compatibility shims were added. The tools.elevated.allowFrom schema remains identical. Docs describe elevated allowlists as sender allowlists, not conversation allowlists, so the fix aligns runtime behavior with the documented contract. Direct-chat From fallback, individual SenderId/SenderE164 entries, wildcards, and mutable-field matchers all continue to work identically. The only user-visible change is that a group conversation JID configured in allowFrom will no longer grant elevated access to every group participant — which is the vulnerability being fixed, not a supported contract.

ClawSweeper

ClawSweeper started a review but did not complete it — the placeholder comment was posted but never edited with findingsched findings. After the initial review, the WhatsApp-specific @g.us detector was removed from core per the owner-boundary concern, keeping only the generic ChatType-based invariant and generic conversation-like prefix matching. The ClawSweeper review gap was noted but does not represent blocking findings against the code.

Code Reviews Completed

Multiple independent code reviews were conducted, each covering the full changed surface. All reviews confirmed the fix is correct, targeted, and follows OpenClaw best practices. The fix extracts the existing shouldUseFromAsSenderFallback() invariant from command-auth.ts into a shared module and reuses it in the elevated path before populating senderFromTokens. Defense-in-depth is provided by guarding on both ChatType metadata and generic conversation-like identity patterns. Regression tests cover the primary vulnerability path, the missing-metadata edge case, and the backward-compatibility guarantee. No bypass paths were identified. All reviews returned an approve-for-merge recommendation.

Checks Completed

Check	Status
Relevance verification (3 independent checks)	✅ Confirmed in scope, not yet fixed
Compatibility analysis	✅ Safe to merge, no config/schema/API changes
Source-level behavioral proof	✅ Group JID denied, direct-chat fallback allowed
Unit tests (`reply-elevated.test.ts`, `command-auth.owner-default.test.ts`)	✅ 2 files, 14 tests passed
Formatting (`oxfmt --check`)	✅ Passed
Type checking (`tsgo:core`)	✅ Passed
Import cycle check	✅ No new cycles
CI checks (lint, prod types, test types, auto-reply checks, security checks, boundary checks)	✅ All passing on head SHA
Code review — architecture and correctness	✅ Clean extraction, no dead code, no bypass paths
Code review — security and defense-in-depth	✅ Dual guard (ChatType + pattern), no new attack surface
Code review — testing and regression coverage	✅ 3 new focused test cases covering vulnerability, edge case, and compatibility
Code review — compatibility and migration	✅ No migration needed, no operator action required
`USER.md` not committed to PR	✅ Verified excluded

* fix(elevated): reject group ids as senders * fix(elevated): keep channel parsing out of core

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(elevated): reject group ids as senders

eeea24f

openclaw-barnacle Bot added size: S maintainer Maintainer-authored PR labels Jun 9, 2026

fix(elevated): keep channel parsing out of core

fe8020d

eleqtrizit merged commit a4e02cd into openclaw:main Jun 9, 2026
174 of 179 checks passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 21:46 UTC curtismercier/openclaw-mods#1048

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026

fix(elevated): reject group ids as senders (openclaw#91748)

061dc26

* fix(elevated): reject group ids as senders * fix(elevated): keep channel parsing out of core

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(elevated): reject group ids as senders#91748

fix(elevated): reject group ids as senders#91748
eleqtrizit merged 2 commits into
openclaw:mainfrom
eleqtrizit:743

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026

Summary

Changes

Validation

Notes

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

Checks Completed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading