OpenClaw Main Repairs Five Channel and Capability Boundaries

OpenClaw merged five boundary fixes into main on 6 August. They affect different components, but the operator lesson is the same: an authorization rule is only as strong as the identifier, context and lifecycle checks applied at the final action boundary.

The changes cover Slack channel-policy matching, Feishu cross-context message mutations, Telegram quote attribution, Telegram callback ownership and Gateway capability revocation for removed nodes. Operators using any of those paths should prioritize a containing release and rerun negative policy tests after upgrading.

No containing OpenClaw package release was identified in the reviewed official evidence. These are merged source changes, not a claim that every currently installed version contains them.

Operator decision

Until you can update, treat channel identifiers as authorization inputs. Avoid granting consequential tools to broad channel scopes merely because a narrower rule appears configured, and revoke any capability URLs associated with a removed node at the surrounding proxy or service layer where possible.

Slack: normalization had to happen before policy lookup

PR #119408 fixes a mismatch between uppercase Slack IDs commonly used in configuration, such as C01234567, and lowercase persisted session targets such as channel:c01234567.

The official pull-request record says that mismatch could cause channel tool allowlists, sender policies and mention requirements to be dropped. The repair centralizes canonical candidate generation so ingress and group-policy resolution compare equivalent IDs without changing policy precedence.

Interpretation: this is not cosmetic normalization. If two spellings identify the same Slack channel but only one reaches policy lookup, a restriction can silently disappear. A useful regression test should prove that every accepted representation of one channel resolves to the same effective policy and that a nearby channel receives none of it.

Do not weaken a failing test by duplicating every case variant in configuration. The safe property is canonical matching inside the containing build.

Feishu: native target fields now enter the shared guard

PR #119845 addresses Feishu message edits, pins and unpins that used native chat identifiers. The official record says camel-case and snake-case target fields could bypass the configured within-provider cross-context restriction because the shared mutation guard did not recognize them as delivery targets.

The fix identifies those fields before action execution and routes them through the existing normalization and policy path.

Test the denied case, not just the permitted one: start in chat A, supply a valid message target from chat B, and verify that edit, pin and unpin all fail without mutation. Repeat for each supported native field spelling. Use disposable messages; an authorization test should not touch production records.

Telegram: quoted context and callback ownership are authority signals

Telegram sends quote ranges as blockquote and expandable_blockquote entities. PR #117021 fixes the inbound renderer so quoted lines reach the agent as attributed Markdown-style context, with quote termination preserved before ordinary following text.

That distinction matters because a quote can contain an instruction written by somebody else. Flattening it into the current sender’s text changes provenance and may make inert quoted language look active. The patch also accounts for Telegram’s UTF-16 offsets and nested formatting, according to the official source.

PR #116383 repairs a separate ownership boundary in callback routing. Native Telegram command buttons stay on the native path instead of being consumed by a plugin under the private tgcmd namespace. Stale or malformed typed callbacks now clear their controls and return visible unavailable feedback, while legacy raw plugin callbacks remain compatible.

A sensible acceptance suite includes quoted text followed immediately by live text, expandable quotes, Unicode around entity boundaries, native command buttons, valid plugin callbacks, expired typed callbacks and malformed typed callbacks. The visible unavailable response is important: silently acknowledging a dead control leaves the operator unable to tell whether an action ran.

Gateway: node removal now revokes Canvas capability use

PR #119848 makes client invalidation authoritative in the shared plugin-node capability authorizer. Previously issued Canvas capability URLs could remain usable by a node after that node was removed. The merged change rejects requests from invalidated clients immediately while retaining normal access for active nodes and without extending URL expiry.

A capability URL combines possession with lifecycle state. Expiry alone is not sufficient when an operator explicitly removes a node because removal is a revocation event, not a request to wait for the token’s clock to run out.

After adopting the fix, verify three states:

1. an active paired node can use its valid capability;
2. the same node loses access immediately after invalidation; and
3. re-pairing does not resurrect an old capability unintentionally.

Do not publish real capability URLs in tickets or test logs. Use short-lived disposable fixtures and record only status and redacted identifiers.

Scope and evidence limits

These fixes do not establish a universal channel sandbox. They repair named paths in Slack, Feishu, Telegram and Gateway node capability authorization. Other tools, plugins and target fields still need their own owner-boundary tests.

OpenClaw Academy reviewed the merged pull-request records and official commit evidence but did not independently operate live Slack, Telegram or Feishu tenants or a paired Canvas node for this report. The official evidence describes focused tests; that is not a substitute for validating your own configuration, plugin set and containing build.

Bottom line

Upgrade to a confirmed containing release, then test equivalent identifiers, denied cross-context mutations, quoted-input attribution, callback ownership and post-removal capability rejection. The common failure mode was not a missing top-level policy; it was losing policy meaning while identifiers and actions moved between layers.