Skip to content

refactor(channels): migrate googlechat, imessage, and whatsapp group policy onto the scope tree#106830

Closed
steipete wants to merge 4 commits into
mainfrom
claude/chanref-scope-batch1
Closed

refactor(channels): migrate googlechat, imessage, and whatsapp group policy onto the scope tree#106830
steipete wants to merge 4 commits into
mainfrom
claude/chanref-scope-batch1

Conversation

@steipete

Copy link
Copy Markdown
Contributor

What Problem This Solves

First channel batch of the group-policy scope normalization (stage 2). Google Chat, iMessage, and WhatsApp resolved group requireMention/tool policy through the older generic resolver with per-channel plumbing; this migrates them onto the canonical ScopeTree resolvers so every channel converges on one resolution model before the custom-walker channels (discord, telegram, msteams, …) migrate and their ~600 LOC of private walkers get deleted.

Why This Change Was Made

Depends on #106819 (ScopeTree core resolver — this branch stacks on it). These three are pure delegates, so they prove the migration pattern at minimal risk. A shared buildChannelGroupsScopeTree(cfg, channel, accountId) builder was added to core because 13+ channels share the flat groups config shape (wildcard "*" → defaults node, exact keys → scopes); richer channels will ship their own builders. Account scoping stays core-owned via resolveChannelGroups, preserving the single-account empty-groups:{} fallback quirk.

User Impact

None — behavior parity: exact-group hit, wildcard fallback, account-level groups overriding root, sender-scoped tool policy (explicit messageProvider matches the old resolver's default), and default true/undefined when nothing is configured. Each plugin's group-policy module ended smaller than before (17/40/40 lines vs 18/41/41).

Evidence

  • Testbox (Blacksmith): pnpm test src/config/group-scope-tree.test.ts src/config/group-policy.test.ts extensions/googlechat extensions/imessage extensions/whatsapp all green; check:changed lanes green with the regenerated Plugin SDK API baseline hash committed.
  • New parity tests for googlechat and imessage (previously untested), extended whatsapp tests: exact/wildcard/absent, account override, single-account empty-groups fallback, toolsBySender sender scoping.
  • Autoreview (codex gpt-5.6-sol, xhigh): clean, "patch is correct (0.86)", no actionable findings.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation channel: googlechat Channel integration: googlechat channel: imessage Channel integration: imessage channel: whatsapp-web Channel integration: whatsapp-web scripts Repository scripts size: L maintainer Maintainer-authored PR labels Jul 13, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jul 13, 2026
@clawsweeper

clawsweeper Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 13, 2026, 8:00 PM ET / July 14, 2026, 00:00 UTC.

Summary
Migrates Google Chat, iMessage, and WhatsApp group-policy resolution to a shared ScopeTree API, adds parity tests, and expands the public Plugin SDK surface and generated baselines.

PR surface: Source +130, Tests +498, Generated 0, Other +2. Total +630 across 12 files.

Reproducibility: yes. Current main trims groupId before lookup, while each new ScopeTree path uses the raw value, so a whitespace-padded incoming ID can be evaluated against a different policy.

Review metrics: 1 noteworthy metric.

  • Public policy surface: 7 exports added; 3 of 16 channel callers migrated. The PR publishes a compatibility-sensitive API while most bundled callers and the existing public resolver remain on the old path.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Normalize group IDs before all three ScopeTree lookups and add regression coverage.
  • Resolve the public Plugin SDK contract and complete or explicitly approve the bundled migration plan.
  • [P1] Add redacted live channel output or logs proving mention and sender-tool parity.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR supplies tests, CI, and autoreview but no redacted live Google Chat, iMessage, or WhatsApp output or logs showing after-fix mention gating and sender-scoped tool selection; after adding proof, update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.

Risk before merge

  • [P1] Merging would publish a parallel public Plugin SDK policy contract before all bundled callers migrate, leaving two compatibility-sensitive paths to maintain and eventually deprecate.
  • [P1] Raw group IDs can miss their configured exact scope and fall through to wildcard or default mention and tool policies, potentially broadening sender tool access.
  • [P1] Unit and CI coverage do not prove live parity for mention gating and sender-scoped tool selection in any affected channel.

Maintainer options:

  1. Finish migration before SDK export (recommended)
    Remove the staged public exports, migrate all bundled callers, preserve ID normalization, and publish the canonical contract once.
  2. Own a staged compatibility window
    Keep both APIs temporarily with explicit maintainer approval, deprecation documentation, upgrade tests, and live authorization-parity proof.
  3. Review only the consolidated PR
    Pause this branch and use the broader consolidated PR as the landing candidate after its proof and correctness blockers are resolved.

Next step before merge

  • [P1] The contributor must fix ID normalization and add live proof, while the likely owner must decide the permanent Plugin SDK contract and whether this branch or the consolidated PR should remain the landing candidate.

Maintainer decision needed

  • Question: Should ScopeTree become a public Plugin SDK contract before every bundled group-policy caller has migrated?
  • Rationale: The PR expands a shipped external contract while retaining the legacy API and most bundled callers, so the permanent API and landing order require explicit owner intent.
  • Likely owner: steipete — Authored the resolver design and all linked migration and consolidation branches.
  • Options:
    • Migrate before export (recommended): Keep ScopeTree core-internal until all bundled callers migrate, then publish the canonical contract and deprecate the old API once.
    • Approve staged contract: Publish now only with an explicit compatibility window, migration plan, documentation, and parity coverage for both APIs.
    • Consolidate landing: Pause this stacked PR and make the broader consolidated PR the sole landing candidate after it resolves the same correctness and proof blockers.

Security
Needs attention: The raw group-ID path can alter exact scope selection for mention gating and sender-scoped tool authorization.

Review findings

  • [P1] Preserve group ID normalization before scope lookup — extensions/googlechat/src/group-policy.ts:9
  • [P1] Finish the bundled migration before publishing this SDK path — src/plugin-sdk/channel-policy.ts:51-59
Review details

Best possible solution:

Preserve legacy group-ID normalization, complete the bundled migration behind one canonical resolver, then publish one documented Plugin SDK contract with compatibility tests and redacted live channel parity proof.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main trims groupId before lookup, while each new ScopeTree path uses the raw value, so a whitespace-padded incoming ID can be evaluated against a different policy.

Is this the best way to solve the issue?

No. Canonicalizing policy resolution is a good direction, but the safest solution must preserve normalization and avoid publishing a second public SDK path during a partial bundled migration.

Full review comments:

  • [P1] Preserve group ID normalization before scope lookup — extensions/googlechat/src/group-policy.ts:9
    The old resolver trims groupId before exact lookup, but this helper inserts the raw value into the ScopeTree path. A value such as " group " previously matched configured key "group" and now falls through to wildcard/default policy; apply the same normalization in all three migrated channels and add parity coverage.
    Confidence: 0.99
  • [P1] Finish the bundled migration before publishing this SDK path — src/plugin-sdk/channel-policy.ts:51-59
    This exports a second public group-policy API while the legacy helpers and most bundled callers remain active, contrary to the scoped SDK migration rule. Keep ScopeTree internal until all bundled callers migrate, or obtain explicit approval for a documented compatibility and deprecation contract.
    Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 48817f6cea46.

Label changes

Label justifications:

  • P2: This bounded three-channel refactor has meaningful compatibility and authorization impact but is not an active user-facing emergency or regression.
  • merge-risk: 🚨 compatibility: The PR adds a parallel Plugin SDK policy contract before completing bundled migration or defining deprecation and upgrade behavior.
  • merge-risk: 🚨 security-boundary: Exact scope selection controls mention gating and sender-scoped tool policy, and the raw-ID lookup can select a broader fallback.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR supplies tests, CI, and autoreview but no redacted live Google Chat, iMessage, or WhatsApp output or logs showing after-fix mention gating and sender-scoped tool selection; after adding proof, update the PR body to trigger review or ask a maintainer for @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +130, Tests +498, Generated 0, Other +2. Total +630 across 12 files.

View PR surface stats
Area Files Added Removed Net
Source 6 176 46 +130
Tests 4 499 1 +498
Docs 0 0 0 0
Config 0 0 0 0
Generated 1 2 2 0
Other 1 7 5 +2
Total 12 684 54 +630

Security concerns:

  • [high] Raw IDs can select broader fallback policy — extensions/googlechat/src/group-policy.ts:9
    Dropping the legacy trim can turn an exact-scope match into wildcard or default selection, changing requireMention, tools, or toolsBySender enforcement.
    Confidence: 0.97

Acceptance criteria:

  • [P1] pnpm test src/config/group-scope-tree.test.ts src/config/group-policy.test.ts extensions/googlechat extensions/imessage extensions/whatsapp.
  • [P1] pnpm plugin-sdk:surface:check.
  • [P1] pnpm check:changed.
  • [P1] Run redacted live Google Chat, iMessage, or WhatsApp proof for exact-group mention gating and sender-scoped tool selection.

What I checked:

Likely related people:

  • steipete: Authored the core ScopeTree resolver, this first migration batch, and the linked consolidated migration, demonstrating ownership beyond merely opening this PR. (role: ScopeTree design owner and likely follow-up owner; confidence: high; commits: e5236611f882, d38f5b42d3ad, e3f99b94ce43; files: src/config/group-scope-tree.ts, src/plugin-sdk/channel-policy.ts, extensions/googlechat/src/group-policy.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (5 earlier review cycles)
  • reviewed 2026-07-13T21:55:21.210Z sha 5eee430 :: needs real behavior proof before merge. :: [P1] Avoid publishing a parallel SDK before migration completes
  • reviewed 2026-07-13T22:19:30.528Z sha f8ceb04 :: needs real behavior proof before merge. :: [P1] Keep one SDK path until bundled migration completes
  • reviewed 2026-07-13T22:37:57.100Z sha f8ceb04 :: needs real behavior proof before merge. :: [P1] Keep one SDK path until bundled migration completes
  • reviewed 2026-07-13T23:22:16.702Z sha 2ce5b63 :: needs real behavior proof before merge. :: [P1] Finish the bundled migration before publishing this SDK path | [P1] Preserve group ID normalization before scope lookup
  • reviewed 2026-07-13T23:42:31.210Z sha 2ce5b63 :: needs real behavior proof before merge. :: [P1] Finish the bundled migration before publishing this SDK path | [P1] Preserve group ID normalization before scope lookup

@steipete
steipete force-pushed the claude/chanref-scope-batch1 branch from 5eee430 to f8ceb04 Compare July 13, 2026 22:13
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 13, 2026
@steipete
steipete force-pushed the claude/chanref-scope-batch1 branch from f8ceb04 to 2ce5b63 Compare July 13, 2026 23:10
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jul 13, 2026
@steipete

Copy link
Copy Markdown
Contributor Author

Landed via #106846 (squash b9c4815) — consolidated stack landing; the googlechat/imessage/whatsapp migration commits are patch-identical in that squash's lineage.

@steipete steipete closed this Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

channel: googlechat Channel integration: googlechat channel: imessage Channel integration: imessage channel: whatsapp-web Channel integration: whatsapp-web docs Improvements or additions to documentation maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. scripts Repository scripts size: L status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant