openclaw
diff --git a/‎docs/channels/googlechat.md‎
Lines changed: 3 additions & 1 deletion b/‎docs/channels/googlechat.md‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎docs/tools/exec-approvals-advanced.md‎
Lines changed: 8 additions & 0 deletions b/‎docs/tools/exec-approvals-advanced.md‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎extensions/googlechat/src/api.ts‎
Lines changed: 34 additions & 6 deletions b/‎extensions/googlechat/src/api.ts‎
Lines changed: 34 additions & 6 deletions
diff --git a/‎extensions/googlechat/src/approval-auth.ts‎
Lines changed: 14 additions & 9 deletions b/‎extensions/googlechat/src/approval-auth.ts‎
Lines changed: 14 additions & 9 deletions
diff --git a/‎extensions/googlechat/src/approval-card-actions.test.ts‎
Lines changed: 113 additions & 0 deletions b/‎extensions/googlechat/src/approval-card-actions.test.ts‎
Lines changed: 113 additions & 0 deletions
@@ -162,6 +162,7 @@ Configure your tunnel's ingress rules to only route the webhook path:
 4. DM access is pairing by default. Unknown senders receive a pairing code; approve with:
    - `openclaw pairing approve googlechat <code>`
 5. Group spaces require @-mention by default. Use `botUser` if mention detection needs the app's user name.
+6. When an exec or plugin approval request starts from Google Chat and a stable `users/<id>` approver is configured, OpenClaw posts a native Google Chat approval card in the originating space or thread. The card buttons use opaque callback tokens, and the manual `/approve <id> <decision>` prompt is only shown when native approval delivery is unavailable.
 
 ## Targets
 
@@ -214,8 +215,9 @@ Notes:
 - Default webhook path is `/googlechat` if `webhookPath` isn't set.
 - `dangerouslyAllowNameMatching` re-enables mutable email principal matching for allowlists (break-glass compatibility mode).
 - Reactions are available via the `reactions` tool and `channels action` when `actions.reactions` is enabled.
+- Native approval cards use Google Chat `cardsV2` button clicks, not reaction events. Approvers come from `dm.allowFrom` or `defaultTo` and must be stable numeric `users/<id>` values.
 - Message actions expose `send` for text and `upload-file` for explicit attachment sends. `upload-file` accepts `media` / `filePath` / `path` plus optional `message`, `filename`, and thread targeting.
-- `typingIndicator` supports `none`, `message` (default), and `reaction` (reaction requires user OAuth).
+- `typingIndicator` supports `message` (default), `none`, and `reaction` (reaction requires user OAuth).
 - Attachments are downloaded through the Chat API and stored in the media pipeline (size capped by `mediaMaxMb`).
 - Bot-authored Google Chat messages are ignored by default. If you intentionally set `allowBots: true`, accepted bot-authored messages use shared [bot loop protection](/channels/bot-loop-protection). Configure `channels.defaults.botLoopProtection`, then override with `channels.googlechat.botLoopProtection` or `channels.googlechat.groups.<space>.botLoopProtection` when one space needs a different budget.
 
 
@@ -287,6 +287,9 @@ Generic model:
 - Slack plugin approvals can use Slack's native approval client when the request comes from Slack
   and Slack plugin approvers resolve; `approvals.plugin` can also route plugin approvals to Slack
   sessions or targets even when Slack exec approvals are disabled
+- Google Chat native approval cards handle exec and plugin approvals that originate from Google
+  Chat spaces or threads when stable `users/<id>` approvers resolve from `dm.allowFrom` or
+  `defaultTo`; they do not use reaction events for decisions
 - WhatsApp and Signal reaction approval delivery are gated by `approvals.exec` and
   `approvals.plugin`; they do not have `channels.<channel>.execApprovals` blocks
 
@@ -306,6 +309,8 @@ FAQ: [Why are there two exec approval configs for chat approvals?](/help/faq-fir
 - Discord: `channels.discord.execApprovals.*`
 - Slack: `channels.slack.execApprovals.*`
 - Telegram: `channels.telegram.execApprovals.*`
+- Google Chat: configure stable approvers with `channels.googlechat.dm.allowFrom` or
+  `channels.googlechat.defaultTo`; no `execApprovals` block is required
 - WhatsApp: use `approvals.exec` and `approvals.plugin` to route approval prompts to WhatsApp
 - Signal: use `approvals.exec` and `approvals.plugin` to route approval prompts to Signal
 
@@ -325,6 +330,9 @@ Shared behavior:
   routing, not Slack exec approvers
 - Slack native buttons preserve approval id kind, so `plugin:` ids can resolve plugin approvals
   without a second Slack-local fallback layer
+- Google Chat native cards preserve the manual `/approve` fallback in message text but card button
+  callbacks carry only opaque action tokens; approval id and decision are recovered from server-side
+  pending state
 - WhatsApp emoji approvals handle both exec and plugin prompts only when the matching top-level
   forwarding family is enabled and routes to WhatsApp; target-only WhatsApp forwarding stays on
   the shared forwarding path unless it matches the same native origin target
 
@@ -5,8 +5,9 @@ import { parseMediaContentLength } from "openclaw/plugin-sdk/media-runtime";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
 import type { ResolvedGoogleChatAccount } from "./accounts.js";
+import { shouldSuppressGoogleChatManualExecApprovalFollowupText } from "./approval-card-actions.js";
 import { getGoogleChatAccessToken } from "./auth.js";
-import type { GoogleChatReaction } from "./types.js";
+import type { GoogleChatCardV2, GoogleChatReaction } from "./types.js";
 
 const CHAT_API_BASE = "https://chat.googleapis.com/v1";
 const CHAT_UPLOAD_BASE = "https://chat.googleapis.com/upload/v1";
@@ -139,13 +140,25 @@ export async function sendGoogleChatMessage(params: {
   space: string;
   text?: string;
   thread?: string;
+  cardsV2?: GoogleChatCardV2[];
   attachments?: Array<{ attachmentUploadToken: string; contentName?: string }>;
 }): Promise<{ messageName?: string } | null> {
-  const { account, space, text, thread, attachments } = params;
+  const { account, space, text, thread, cardsV2, attachments } = params;
+  if (
+    text &&
+    (!cardsV2 || cardsV2.length === 0) &&
+    (!attachments || attachments.length === 0) &&
+    shouldSuppressGoogleChatManualExecApprovalFollowupText(text)
+  ) {
+    return null;
+  }
   const body: Record<string, unknown> = {};
   if (text) {
     body.text = text;
   }
+  if (cardsV2 && cardsV2.length > 0) {
+    body.cardsV2 = cardsV2;
+  }
   if (thread) {
     body.thread = { name: thread };
   }
@@ -172,13 +185,28 @@ export async function sendGoogleChatMessage(params: {
 export async function updateGoogleChatMessage(params: {
   account: ResolvedGoogleChatAccount;
   messageName: string;
-  text: string;
+  text?: string;
+  cardsV2?: GoogleChatCardV2[];
 }): Promise<{ messageName?: string }> {
-  const { account, messageName, text } = params;
-  const url = `${CHAT_API_BASE}/${messageName}?updateMask=text`;
+  const { account, messageName, text, cardsV2 } = params;
+  const updateMask = [
+    ...(text !== undefined ? ["text"] : []),
+    ...(cardsV2 !== undefined ? ["cardsV2"] : []),
+  ];
+  if (updateMask.length === 0) {
+    throw new Error("Google Chat message update requires text or cardsV2.");
+  }
+  const url = `${CHAT_API_BASE}/${messageName}?updateMask=${updateMask.join(",")}`;
+  const body: Record<string, unknown> = {};
+  if (text !== undefined) {
+    body.text = text;
+  }
+  if (cardsV2 !== undefined) {
+    body.cardsV2 = cardsV2;
+  }
   const result = await fetchJson<{ name?: string }>(account, url, {
     method: "PATCH",
-    body: JSON.stringify({ text }),
+    body: JSON.stringify(body),
   });
   return { messageName: result.name };
 }
 
@@ -7,7 +7,7 @@ import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coer
 import { resolveGoogleChatAccount } from "./accounts.js";
 import { isGoogleChatUserTarget, normalizeGoogleChatTarget } from "./targets.js";
 
-function normalizeGoogleChatApproverId(value: string | number): string | undefined {
+export function normalizeGoogleChatApproverId(value: string | number): string | undefined {
   const normalized = normalizeGoogleChatTarget(String(value));
   if (!normalized || !isGoogleChatUserTarget(normalized)) {
     return undefined;
@@ -19,15 +19,20 @@ function normalizeGoogleChatApproverId(value: string | number): string | undefin
   return `users/${suffix}`;
 }
 
+export function getGoogleChatApprovalApprovers(params: {
+  cfg: Parameters<typeof resolveGoogleChatAccount>[0]["cfg"];
+  accountId?: string | null;
+}): string[] {
+  const account = resolveGoogleChatAccount(params).config;
+  return resolveApprovalApprovers({
+    allowFrom: account.dm?.allowFrom,
+    defaultTo: account.defaultTo,
+    normalizeApprover: normalizeGoogleChatApproverId,
+  });
+}
+
 export const googleChatApprovalAuth = createResolvedApproverActionAuthAdapter({
   channelLabel: "Google Chat",
-  resolveApprovers: ({ cfg, accountId }) => {
-    const account = resolveGoogleChatAccount({ cfg, accountId }).config;
-    return resolveApprovalApprovers({
-      allowFrom: account.dm?.allowFrom,
-      defaultTo: account.defaultTo,
-      normalizeApprover: normalizeGoogleChatApproverId,
-    });
-  },
+  resolveApprovers: getGoogleChatApprovalApprovers,
   normalizeSenderId: (value) => normalizeGoogleChatApproverId(value),
 });
@@ -0,0 +1,113 @@
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  clearGoogleChatApprovalCardBindingsForTest,
+  registerGoogleChatManualApprovalFollowupSuppression,
+  registerGoogleChatApprovalCardBinding,
+  shouldSuppressGoogleChatManualExecApprovalFollowupPayload,
+  shouldSuppressGoogleChatManualExecApprovalFollowupText,
+} from "./approval-card-actions.js";
+
+const approvalId = "12345678-1234-1234-1234-123456789012";
+type TestExecApprovalDecision = "allow-once" | "allow-always" | "deny";
+let tokenCounter = 0;
+
+function registerExecApprovalCard(overrides?: {
+  approvalId?: string;
+  expiresAtMs?: number;
+  allowedDecisions?: readonly TestExecApprovalDecision[];
+}): void {
+  registerGoogleChatApprovalCardBinding({
+    token: `token-${tokenCounter++}`,
+    accountId: "default",
+    approvalId: overrides?.approvalId ?? approvalId,
+    approvalKind: "exec",
+    decision: "allow-once",
+    allowedDecisions: overrides?.allowedDecisions ?? ["allow-once", "deny"],
+    spaceName: "spaces/AAA",
+    messageName: "spaces/AAA/messages/msg-1",
+    expiresAtMs: overrides?.expiresAtMs ?? Date.now() + 60_000,
+  });
+}
+
+describe("Google Chat approval card action registry", () => {
+  beforeEach(() => {
+    clearGoogleChatApprovalCardBindingsForTest();
+    tokenCounter = 0;
+  });
+
+  it("suppresses manual exec approval follow-up text for an active native card", () => {
+    registerExecApprovalCard();
+
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText(
+        `I need approval.\nReply with:\n/approve ${approvalId.slice(0, 8)} allow-once`,
+      ),
+    ).toBe(true);
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText(
+        `Run this if needed: \`/approve ${approvalId} deny\``,
+      ),
+    ).toBe(true);
+  });
+
+  it("suppresses manual exec approval follow-up text after native delivery before token binding", () => {
+    registerGoogleChatManualApprovalFollowupSuppression({
+      approvalId,
+      approvalKind: "exec",
+      allowedDecisions: ["allow-once", "deny"],
+      expiresAtMs: Date.now() + 60_000,
+    });
+
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText(
+        `Please reply with:\n/approve ${approvalId.slice(0, 8)} allow-once`,
+      ),
+    ).toBe(true);
+  });
+
+  it("keeps unrelated, expired, and non-sendable approval text visible", () => {
+    registerExecApprovalCard({ expiresAtMs: Date.now() - 1 });
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText(
+        `/approve ${approvalId.slice(0, 8)} allow-once`,
+      ),
+    ).toBe(false);
+
+    clearGoogleChatApprovalCardBindingsForTest();
+    registerExecApprovalCard();
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText("/approve deadbeef allow-once"),
+    ).toBe(false);
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupText(`/approve ${approvalId} nope`),
+    ).toBe(false);
+  });
+
+  it("suppresses only text-only manual approval follow-up payloads", () => {
+    registerExecApprovalCard();
+
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupPayload({
+        text: `/approve ${approvalId.slice(0, 8)} allow-once`,
+      }),
+    ).toBe(true);
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupPayload({
+        text: `/approve ${approvalId.slice(0, 8)} allow-once`,
+        mediaUrl: "https://example.test/image.png",
+      }),
+    ).toBe(false);
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupPayload({
+        text: `/approve ${approvalId.slice(0, 8)} allow-once`,
+        channelData: { execApproval: { approvalId } },
+      }),
+    ).toBe(true);
+    expect(
+      shouldSuppressGoogleChatManualExecApprovalFollowupPayload({
+        text: `/approve ${approvalId.slice(0, 8)} allow-once`,
+        presentation: { blocks: [] },
+      }),
+    ).toBe(false);
+  });
+});