- Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down `/var/lib/openclaw/plugin-runtime-deps` directories. Fixes #74971. Thanks @eurojojo.

- Memory/runtime-deps: retain the native `node-llama-cpp` runtime only when local memory search is configured, so packaged installs can repair local embeddings without relying on unreachable global npm installs. Fixes #74777. Thanks @LLagoon3.

- Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free `tools.web.fetch` config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.

- Signal: match group allowlists against inbound Signal group ids as well as sender ids, so configured groups no longer drop every message before mention policy runs. Part of #53308. Thanks @minupla and @juan-flores077.

- Signal: match group allowlists against inbound Signal group ids as well as sender ids, and process explicitly configured Signal groups without requiring mentions unless `requireMention` is set. Fixes #53308. Thanks @minupla and @juan-flores077.

- Signal: bound `signal-cli` installer release and archive downloads with explicit timeouts, declared and streamed size checks, and partial-file cleanup. Fixes #54153. Thanks @jinduwang1001-max and @juan-flores077.

- Slack: require bot-authored room messages with `allowBots=true` to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.

- Signal: derive `getAttachment` HTTP response caps from `channels.signal.mediaMaxMb` with base64 headroom, so inbound photos and videos no longer drop behind the 1 MiB RPC default. Fixes #73564. Thanks @heyhudson.

Groups:

- `channels.signal.groupPolicy = open | allowlist | disabled`.

- `channels.signal.groupAllowFrom` controls which groups or senders can trigger group replies when `allowlist` is set; entries can be Signal group IDs (raw, `group:<id>`, or `signal:group:<id>`), sender phone numbers, or `uuid:<id>` values.

- `channels.signal.groupAllowFrom` controls which groups or senders can trigger group replies when `allowlist` is set; entries can be Signal group IDs (raw, `group:<id>`, or `signal:group:<id>`), sender phone numbers, `uuid:<id>` values, or `*`.

- `channels.signal.groups["<group-id>" | "*"]` can override group behavior with `requireMention`, `tools`, and `toolsBySender`.

- Use `channels.signal.accounts.<id>.groups` for per-account overrides in multi-account setups.

- Allowlisting a Signal group does not disable mention gating. To process every message in an allowlisted group, set `channels.signal.groups["<group-id>"].requireMention=false` or use the `"*"` group default.

- Allowlisting a Signal group through `groupAllowFrom` does not disable mention gating by itself. A specifically configured `channels.signal.groups["<group-id>"]` entry processes every group message unless `requireMention=true` is set.

- Runtime note: if `channels.signal` is completely missing, runtime falls back to `groupPolicy="allowlist"` for group checks (even if `channels.defaults.groupPolicy` is set).

## How it works (behavior)

expect(getCapturedCtx()?.WasMentioned).toBe(false);

});

it("allows explicitly configured Signal groups by group id without a mention", async () => {

const handler = createSignalEventHandler(

createBaseSignalEventHandlerDeps({

cfg: {

messages: {

inbound: { debounceMs: 0 },

groupChat: { mentionPatterns: ["@bot"] },

},

channels: {

signal: {

groupPolicy: "allowlist",

groupAllowFrom: ["group:g1"],

groups: { g1: {} },

},

},

} as unknown as OpenClawConfig,

groupPolicy: "allowlist",

groupAllowFrom: ["group:g1"],

}),

);

await handler(makeGroupEvent({ message: "hello everyone" }));

expect(capturedCtx).toBeTruthy();

expect(getCapturedCtx()?.WasMentioned).toBe(false);

});

it("records pending history for skipped group messages", async () => {

const { handler, groupHistories } = createMentionGatedHistoryHandler();

await handler(makeGroupEvent({ message: "hello from alice" }));

channel: "signal",

groupId,

accountId: deps.accountId,

configuredGroupDefaultsToNoMention: true,

});

const canDetectMention = mentionRegexes.length > 0;

const mentionDecision = resolveInboundMentionDecision({

import { afterEach, describe, expect, it, vi } from "vitest";

import type { OpenClawConfig } from "./config.js";

import { resolveChannelGroupPolicy, resolveToolsBySender } from "./group-policy.js";

import {

resolveChannelGroupPolicy,

resolveChannelGroupRequireMention,

resolveToolsBySender,

} from "./group-policy.js";

describe("resolveChannelGroupPolicy", () => {

it("fails closed when groupPolicy=allowlist and groups are missing", () => {

expect(policy.allowlistEnabled).toBe(true);

expect(policy.allowed).toBe(false);

});

it("can default explicitly configured groups to no mention for channels that opt in", () => {

const cfg = {

channels: {

whatsapp: {

groups: {

"123@g.us": {},

},

},

},

} as OpenClawConfig;

expect(

resolveChannelGroupRequireMention({

cfg,

channel: "whatsapp",

groupId: "123@g.us",

}),

).toBe(true);

expect(

resolveChannelGroupRequireMention({

cfg,

channel: "whatsapp",

groupId: "123@g.us",

configuredGroupDefaultsToNoMention: true,

}),

).toBe(false);

});

});

describe("resolveToolsBySender", () => {

accountId?: string | null;

groupIdCaseInsensitive?: boolean;

requireMentionOverride?: boolean;

configuredGroupDefaultsToNoMention?: boolean;

overrideOrder?: "before-config" | "after-config";

}): boolean {

const { requireMentionOverride, overrideOrder = "after-config" } = params;

if (overrideOrder !== "before-config" && typeof requireMentionOverride === "boolean") {

return requireMentionOverride;

}

if (params.configuredGroupDefaultsToNoMention && groupConfig) {

return false;

}

return true;

}

"openclaw.plugin.json runtimeDependencies.localMemoryEmbedding must contain strings",

);

}

return { ...parseInstallableRuntimeDepSpec(spec), pluginIds: [] };

return Object.assign(parseInstallableRuntimeDepSpec(spec), { pluginIds: [] });

});

}

sourceStat.ino === targetStat.ino

);

}

function chmodBundledRuntimeMirrorFileReadable(sourcePath: string, targetPath: string): void {

try {

const sourceMode = fs.statSync(sourcePath).mode;

expect(fs.readFileSync(target, "utf8")).toBe("export const value = 'old';\n");

});

it("reuses existing hardlinked mirror files without rewriting them", () => {

const root = makeTempRoot();

const source = path.join(root, "source.js");

const target = path.join(root, "mirror", "source.js");

fs.writeFileSync(source, "export const value = 'stable';\n", "utf8");

fs.mkdirSync(path.dirname(target), { recursive: true });

fs.linkSync(source, target);

const initialTargetStat = fs.statSync(target, { bigint: true });

const linkSpy = vi.spyOn(fs, "linkSync");

const copySpy = vi.spyOn(fs, "copyFileSync");

const removeSpy = vi.spyOn(fs, "rmSync");

materializeBundledRuntimeMirrorFile(source, target);

const reusedTargetStat = fs.statSync(target, { bigint: true });

expect(reusedTargetStat.dev).toBe(initialTargetStat.dev);

expect(reusedTargetStat.ino).toBe(initialTargetStat.ino);

expect(linkSpy).not.toHaveBeenCalled();

expect(copySpy).not.toHaveBeenCalled();

expect(removeSpy).not.toHaveBeenCalled();

});

it("materializes root JavaScript chunks in external mirrors", () => {

const packageRoot = makeTempRoot();

const stageDir = makeTempRoot();