You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- **Sender-aware authorization policies:** let trusted plugins veto prepared tool calls, message actions, and commands from host-authenticated per-turn principals, with scoped fail-closed policy pins and authority-safe queue, steering, delegation, and native-harness propagation. (#103780)
9
10
- **External gateway supervision:** add `OPENCLAW_SUPERVISOR_MODE=external` for lifecycle owners such as OCM, preserving verified restart and deferral behavior without exposing native service authority, blocking native service mutation and self-update, and providing a versioned atomic restart-handoff consume contract. Thanks @shakkernerd.
10
11
- **ClickClack guided setup:** configure ClickClack from `openclaw onboard` or `openclaw channels add clickclack` with URL, token, and workspace prompts, default-account env fallback, nonfatal live connection validation, and gateway-aware next steps that connect automatically when OpenClaw is already running. Thanks @shakkernerd.
11
12
- **ClickClack command menus:** publish each bot's native OpenClaw commands to ClickClack composer autocomplete at gateway startup, with per-account opt-out and nonfatal compatibility handling for older tokens and servers. Thanks @shakkernerd.
Copy file name to clipboardExpand all lines: docs/concepts/queue-steering.md
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -38,15 +38,17 @@ Codex review and manual compaction turns reject same-turn steering. When a runti
38
38
39
39
## Burst example
40
40
41
-
If four users send messages while the agent is executing a tool call:
41
+
If one user sends four messages while the agent is executing a tool call:
42
42
43
43
- With default behavior, the active runtime receives all four messages in arrival order before its next model decision. OpenClaw drains them at the next model boundary; Codex receives them as one batched `turn/steer`.
44
44
- With `/queue collect`, OpenClaw does not steer. It waits until the active run ends, then creates a followup turn with compatible queued messages after the debounce window.
45
45
- With `/queue interrupt`, OpenClaw aborts the active run and starts the newest message instead of steering.
46
46
47
47
## Scope
48
48
49
-
Steering always targets the current active session run. It does not create a new session, change the active run's tool policy, or split messages by sender. In multi-user channels, inbound prompts already include sender and route context, so the next model call can see who sent each message.
49
+
Steering always targets the current active session run. It never changes that run's tool policy. OpenClaw compares the authenticated sender, account, roles, owner/authorization bits, agent, session, and conversation/thread scope with the immutable identity that minted the active run's tools. Only an exact match can enter that run.
50
+
51
+
In a multi-user channel, a message from another sender—or from the same sender after relevant role or authorization facts change—waits for a separate followup turn. This prevents one person from borrowing another person's active tool capability. The same check applies to `/steer` and other active-run injection paths.
50
52
51
53
Use `followup` or `collect` when you want messages to queue by default instead of steering the active run. Use `interrupt` when the newest prompt should replace the active run.
Copy file name to clipboardExpand all lines: docs/concepts/queue.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,7 +39,9 @@ Same-turn steering is the default. A prompt that arrives mid-run is injected int
39
39
-`steer`: inject messages into the active runtime. OpenClaw delivers all pending steering messages **after the current assistant turn finishes executing its tool calls**, before the next LLM call; Codex app-server receives one batched `turn/steer`. If the run is not actively streaming or steering is unavailable, OpenClaw waits until the active run ends before starting the prompt.
40
40
-`followup`: do not steer. Enqueue each message for a later agent turn after the current run ends.
41
41
-`collect`: do not steer. Coalesce queued messages into a **single** followup turn after the quiet window. If messages target different channels/threads, they drain individually to preserve routing.
42
-
-`interrupt`: abort the active run for that session, then run the newest message.
42
+
-`interrupt`: abort the active run only when the incoming turn has the same
43
+
authenticated controller authority (or an explicit owner/admin override),
44
+
then run the newest message. A different sender queues separately.
43
45
44
46
For runtime-specific timing and dependency behavior, see [Steering queue](/concepts/queue-steering). For the explicit `/steer <message>` command, see [Steer](/tools/steer).
Per-agent `agents.list[].tools.toolsBySender` overrides the global sender match when it matches, even with an empty `{}` policy.
174
174
175
+
Sender matches remain bound to the admitted channel route. A delegated turn that targets a different channel provider or account does not reuse unqualified sender selectors such as `id:`, `username:`, or `name:` from the source route; its sender tool policy denies all tools unless that target route admits a new turn. This prevents the same provider-local user ID or handle on another account from inheriting the source sender's tools.
176
+
175
177
### `tools.elevated`
176
178
177
179
Controls elevated exec access outside the sandbox:
Copy file name to clipboardExpand all lines: docs/gateway/configuration-reference.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -263,7 +263,7 @@ See [MCP](/cli/mcp#openclaw-as-an-mcp-client-registry) and
263
263
-`plugins.entries.<id>.llm.allowModelOverride`: explicitly trust this plugin to request model overrides for `api.runtime.llm.complete`.
264
264
-`plugins.entries.<id>.llm.allowedModels`: optional allowlist of canonical `provider/model` targets for trusted plugin LLM completion overrides. Use `"*"` only when you intentionally want to allow any model.
265
265
-`plugins.entries.<id>.llm.allowAgentIdOverride`: explicitly trust this plugin to run `api.runtime.llm.complete` against a non-default agent id.
266
-
-`plugins.entries.<id>.authorization.requiredPolicies`: operator-owned fail-closed pins. Each entry has a plugin-local `id` and one or more required `operations`: `tool.call`, `message.action`, or `command.invoke`. A missing registration or handler denies that operation. See [Authorization policies](/plugins/authorization-policies).
266
+
-`plugins.entries.<id>.authorization.requiredPolicies`: operator-owned fail-closed pins. Each entry has a plugin-local `id` and one or more required `operations`: `tool.call`, `message.action`, or `command.invoke`. A missing registration or handler denies that operation. Optional `scope` selectors for `agentIds`, `providers`, `accountIds`, and `conversationIds` limit where the pin applies; fields combine with AND semantics, and a parent conversation ID covers its threads. Omit `scope` for a global pin. See [Authorization policies](/plugins/authorization-policies).
267
267
-`plugins.entries.<id>.config`: plugin-defined config object (validated by native OpenClaw plugin schema when available).
268
268
- Channel plugin account/runtime settings live under `channels.<id>` and should be described by the owning plugin's manifest `channelConfigs` metadata, not by a central OpenClaw option registry.
0 commit comments