Codex review: needs maintainer review before merge. Reviewed June 15, 2026, 12:47 PM ET / 16:47 UTC.

Summary
The PR adds an owner-or-Gateway-operator.admin guard before /plugins install, /plugins enable, and /plugins disable, plus regression coverage for blocked channel-originated non-owner writes and allowed Gateway admin writes.

PR surface: Source +11, Tests +118. Total +129 across 3 files.

Reproducibility: Do we have a high-confidence way to reproduce the issue? Yes from source path inspection and the contributor's terminal proof: current main lacks an owner guard before plugin write mutation, while PR head blocks a Telegram-shaped authorized non-owner before persistence.

Review metrics: 1 noteworthy metric.

• Plugin write authorization surfaces: 3 commands tightened. install, enable, and disable mutate trusted plugin state, so maintainers should notice the changed authorization boundary before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Have a maintainer explicitly accept or reject the fail-closed owner/admin policy for existing channel-authorized plugin write users.

Mantis proof suggestion
A live Telegram transcript would add useful maintainer proof for the visible non-owner rejection and owner/admin allow paths. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

telegram live: verify that a non-owner Telegram sender cannot run /plugins install, enable, or disable, while owner and Gateway operator.admin paths still work.

Risk before merge

• [P1] Existing non-owner channel users with /plugins enabled and allowlist authorization can lose install, enable, and disable ability after this PR unless they are in the owner allowlist or use a Gateway client with operator.admin.

Maintainer options:

1. Accept the tighter plugin-write gate (recommended)
   A maintainer can land the PR as a deliberate security hardening change after acknowledging that some existing authorized channel users lose plugin write access.
2. Stage the compatibility change
   Require a compatibility plan, migration note, or explicit strict-mode path before enforcing owner-only plugin writes for existing channel users.
3. Pause if delegated plugin admin is intended
   Pause or close the PR if non-owner channel delegation for plugin writes is an intentional product capability.

Next step before merge

• [P2] The remaining action is maintainer acceptance of a protected-label, compatibility-sensitive permission hardening change, not an automated code repair.

Security
Cleared: No concrete security or supply-chain regression was found; the diff tightens a plugin write authorization boundary and does not add dependencies, workflows, package scripts, or secret handling.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27561365995
• Updated: 2026-06-15T16:48:10.738Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Behavioral proof for the plugin write authorization change.

I ran a disposable terminal scenario against the PR head (e978fc9d1568f160909c2dae6ef8bd145b006a59). This was not just the unit test suite: it invoked handlePluginsCommand with Telegram native-command metadata, a real temporary openclaw.json, and real local plugin install persistence into a temporary state directory. No real user config, credentials, or external network calls were used.

Command run:

corepack pnpm exec tsx <inline disposable proof script>

Redacted output:

CASE: telegram native authorized non-owner is blocked before plugin install persistence
origin=telegram commandSource=native authorized=true owner=false gatewayScopes=null
reply="You are not authorized to use this command."
configChanged=false
installRecordBefore=false installRecordAfter=false

CASE: telegram native owner can still install
origin=telegram commandSource=native authorized=true owner=true gatewayScopes=null
reply="🔌 Installed plugin \"proof-owner-allowed\". Gateway restart will load the new plugin source."
configChanged=true
installRecordBefore=false installRecordAfter=true
installRecord={"source":"path","sourcePath":"/tmp/.../workspace/proof-owner-allowed","installPath":"/tmp/.../state/extensions/proof-owner-allowed","version":"0.0.1","installedAt":"2026-06-15T16:30:16.804Z"}

CASE: gateway operator.admin can still install without owner identity
origin=telegram commandSource=native authorized=true owner=false gatewayScopes=["operator.admin","operator.write"]
reply="🔌 Installed plugin \"proof-gateway-admin-allowed\". Gateway restart will load the new plugin source."
configChanged=true
installRecordBefore=false installRecordAfter=true
installRecord={"source":"path","sourcePath":"/tmp/.../workspace/proof-gateway-admin-allowed","installPath":"/tmp/.../state/extensions/proof-gateway-admin-allowed","version":"0.0.1","installedAt":"2026-06-15T16:30:17.500Z"}

What this proves:

• A Telegram-shaped authorized non-owner plugin write with absent Gateway scopes now returns the visible native-command rejection and does not change config or persist an install record.
• A Telegram-shaped owner request still installs and persists a local plugin.
• A Gateway operator.admin request still installs and persists a local plugin without owner identity.

Focused validation also still passes:

node scripts/run-vitest.mjs run --config test/vitest/vitest.auto-reply-reply.config.ts src/auto-reply/reply/commands-plugins.install.test.ts src/auto-reply/reply/commands-plugins.test.ts --reporter=dot

Test Files  2 passed (2)
Tests       17 passed (17)
Duration    1.23s

git diff --check passed.

@clawsweeper re-review

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Summary of All Checks Completed

Relevance

Three independent checks confirmed the vulnerability is in scope (CWE-862/CWE-269 — Missing Authorization / Improper Privilege Management, CVSS 8.8 High), still present on current main and all shipped releases from v2026.5.20 through v2026.6.6, and has a compatible fix path. Plugin installation modifies the trusted computing base per SECURITY.md, so the authorization bypass is a legitimate security boundary violation.

Compatibility

A dedicated compatibility assessment found no supported user contract break. The PR does not change exported APIs, config schemas, CLI flags, Gateway protocol messages, plugin SDK types, storage formats, or docs contracts. The only newly blocked behavior is the vulnerability itself — a channel-authorized non-owner sender mutating trusted plugin state. Owner senders and Gateway operator.admin clients remain unaffected. Read-only /plugins list|inspect stays open to all authorized senders.

ClawSweeper

ClawSweeper reviewed the PR twice. The first review rated patch quality as platinum hermit but blocked on missing real behavior proof. After terminal-based behavioral proof was posted showing a non-owner channel /plugins write is blocked before mutation, and owner/Gateway admin paths still work, ClawSweeper updated its verdict to platinum hermit overall, proof: sufficient, ready for maintainer look. No concrete code defects were found in either review.

Code Reviews Completed

Multiple code reviews examined the implementation: the targeted 11-line production diff, the 17 regression tests, the three-layer authorization gate (Gateway scope → owner/admin → Nix mode), the use of existing rejectNonOwnerCommand helper, and the correct placement of the gate before installer dispatch, persistence, config mutation, and registry refresh. All reviews confirmed the fix is correct, well-scoped, follows established patterns, and has no code-blocking findings.

Checks Completed

Abbreviations

Mantis Telegram Desktop Proof

Summary: Mantis captured native Telegram Desktop before/after GIF evidence for the plugin write authorization change.

• Scenario: telegram-desktop-proof
• Trigger: pull_request_target
• Run: https://github.com/openclaw/openclaw/actions/runs/27560292964
• Artifact: https://github.com/openclaw/openclaw/actions/runs/27560292964/artifacts/7647675880
• Baseline: pass at 85a635368e2fa58ac2755e6cbb06a1a461d14e72, expected baseline visual proof captured
• Candidate: pass at e978fc9d1568f160909c2dae6ef8bd145b006a59, expected candidate visual proof captured
• Overall: true

Main screenshot	This PR screenshot

Main	This PR

Motion-trimmed clips:

• Main MP4
• This PR MP4

Raw QA files: https://artifacts.openclaw.ai/mantis/telegram-desktop/pr-93353/run-27560292964-1/index.json