OpenClaw Main Tightens Channel Ownership, Reply Privacy and Encrypted Media

OpenClaw has merged a channel-security wave that makes transport admission, command ownership, conversation identity and reply confidentiality distinct controls. The fixes cover Discord, Telegram, WhatsApp, Reef, Matrix and proxied Gateway clients.

These corrections are on main; the supplied packet does not establish release inclusion. Multi-user and reverse-proxied deployments should identify a containing build and retest negative authorization paths before trusting the upgrade.

Admission is not ownership

PR #118580 fixes WhatsApp senders who were admitted at ingress but were outside configured command-owner policy being able to rotate durable session state with /new or /reset. Reset detection now uses the same canonical sender authorization as command handling.

PR #118578 applies the equivalent rule to bundled Reef management commands. General command access remains available, but management actions require a host-derived owner fact.

Interpretation: reaching the bot is not the same authority as administering it. Allowing a sender, room member or voice participant through transport policy must not silently grant state-reset, configuration or management rights.

Conversation bindings require the current actor

PR #118704 denies unauthorized access to Discord and Telegram conversation bindings. Bindings decide which conversation, account or agent context receives subsequent work; reading or mutating them can cross privacy and authority boundaries even without an immediately visible message.

Test binding operations with four identities: owner, explicitly allowed participant, admitted non-owner and unrelated sender. Only the configured authorities should inspect or change the binding, and a denied attempt must leave durable state untouched.

A private Discord acknowledgement stays private

PR #118611 fixes Discord interaction replies after acknowledgement so their privacy classification is preserved. Interaction protocols often separate the initial acknowledgement from later edits or final responses; confidentiality cannot be inferred again from a generic follow-up path.

Use a harmless unique marker and inspect the final platform-visible message from another account. A reply requested as private must remain invisible to the channel after acknowledgement, edit, failure and reconnect paths.

Encrypted Matrix rooms cannot fall back to plaintext media

PR #118609 blocks plaintext attachments in encrypted Matrix rooms. Text encryption is not a room-wide confidentiality guarantee if an attachment path uploads or references media outside the encrypted contract.

The safe result when encrypted media preparation fails is an explicit delivery failure—not a usable plaintext attachment. Test images, documents and reply-associated media independently; do not place real confidential content in the fixture.

Proxied response history uses verified identity

PR #118607 binds Gateway response history to verified proxy identity. Reverse proxies can supply useful client identity only when the Gateway has authenticated and trusted that proxy boundary. Raw forwarding headers from an untrusted peer are not identity.

Validate direct, trusted-proxy and spoofed-header paths separately. Two downstream users sharing a proxy connection must not inherit one another’s response history, and a direct client must not self-assert a trusted proxy identity.

Multi-account client identity must be unambiguous

PR #119667 fixes Matrix client keys built by joining raw authentication fields with a delimiter. Distinct tuples could produce the same key and therefore share module-global client identity, encryption preparation, startup state or lease ownership. The landed path serializes the identity tuple unambiguously while preserving intentional sharing for the same account.

PR #103371 tightens QQBot account discovery, setup and logout so only own-property account containers and credential fields count as explicit user configuration. Prototype-inherited entries are ignored rather than being reported, resolved or cleaned up as if the operator owned them.

The records establish identity and configuration-ownership faults, not proven cross-account message disclosure. Interpretation: shared clients and inherited object properties are authority inputs; both need explicit structural identity before they can own credentials or lifecycle state.

Rollout matrix

1. Attempt /new, /reset and Reef management from an admitted non-owner; expect denial with no session rotation.
2. Repeat ordinary permitted commands to prove the authorization repair did not block general access.
3. Read and mutate Discord and Telegram bindings from each test identity; compare durable state before and after every denial.
4. Complete a private Discord interaction through acknowledgement and final response; inspect from an unrelated account.
5. Force encrypted Matrix media preparation to fail; confirm no plaintext upload or URL is emitted.
6. Send history requests through a trusted proxy with two verified identities, then spoof the same headers directly; histories must remain isolated.
7. Configure Matrix test accounts whose old delimiter-joined fields would collide; prove client, encryption, startup and lease state remain separate.
8. Exercise QQBot discovery and logout with inherited test properties; prove only explicitly owned account entries are visible or mutable.

Record stable synthetic identities, but do not log real access tokens, private room content or production session keys.

Evidence and limits

Official merged PR and commit records from the OpenClaw repository establish the reported defects and corrections. The Reef record includes documentation updates for owner recovery; the Matrix, Discord and Gateway records describe focused confidentiality and identity tests. Direct GitHub extraction returned HTTP 403 and web search was unavailable.

OpenClaw Academy did not join live rooms, exercise production reverse proxies or inspect a packaged release. Channel-specific permission setup must be confirmed against official documentation for the containing revision.

Primary collector IDs include 36055, 35981, 36428, 36289, 36209, 36118, 36203, 35817, 35710, 35804, 35697, 35820 and 35713. IDs 40446/40413 and 40522/40479 identify the new Matrix and QQBot boundaries.

Bottom line

Treat channel access as a chain of separate proofs: admitted transport, authorized actor, owned conversation, confidential reply and safe media path. A containing build must pass every negative test before a multi-user deployment can rely on the repaired boundaries.