fix: reduce runtime mirror and signal group regressions

CHANGELOG.md

@@ -13,7 +13,7 @@ Docs: https://docs.openclaw.ai
 - Plugins/runtime-deps: keep bundled provider policy config loading from staging plugin runtime dependencies, so config reads no longer fail on locked-down `/var/lib/openclaw/plugin-runtime-deps` directories. Fixes #74971. Thanks @eurojojo.
 - Memory/runtime-deps: retain the native `node-llama-cpp` runtime only when local memory search is configured, so packaged installs can repair local embeddings without relying on unreachable global npm installs. Fixes #74777. Thanks @LLagoon3.
 - Gateway/startup: skip pre-bind web-fetch provider discovery for credential-free `tools.web.fetch` config, so Docker/Kubernetes gateways bind even when optional fetch limits are present. Fixes #74896. Thanks @KoykL.
-- Signal: match group allowlists against inbound Signal group ids as well as sender ids, so configured groups no longer drop every message before mention policy runs. Part of #53308. Thanks @minupla and @juan-flores077.
+- Signal: match group allowlists against inbound Signal group ids as well as sender ids, and process explicitly configured Signal groups without requiring mentions unless `requireMention` is set. Fixes #53308. Thanks @minupla and @juan-flores077.
 - Signal: bound `signal-cli` installer release and archive downloads with explicit timeouts, declared and streamed size checks, and partial-file cleanup. Fixes #54153. Thanks @jinduwang1001-max and @juan-flores077.
 - Slack: require bot-authored room messages with `allowBots=true` to come from an explicitly channel-allowlisted bot or from a room where an explicit Slack owner is present, so broad bot relays cannot run unattended. Fixes #59284. Thanks @andrewhong-translucent.
 - Signal: derive `getAttachment` HTTP response caps from `channels.signal.mediaMaxMb` with base64 headroom, so inbound photos and videos no longer drop behind the 1 MiB RPC default. Fixes #73564. Thanks @heyhudson.

docs/channels/signal.md

@@ -194,10 +194,10 @@ DMs:
 Groups:
 
 - `channels.signal.groupPolicy = open | allowlist | disabled`.
-- `channels.signal.groupAllowFrom` controls which groups or senders can trigger group replies when `allowlist` is set; entries can be Signal group IDs (raw, `group:<id>`, or `signal:group:<id>`), sender phone numbers, or `uuid:<id>` values.
+- `channels.signal.groupAllowFrom` controls which groups or senders can trigger group replies when `allowlist` is set; entries can be Signal group IDs (raw, `group:<id>`, or `signal:group:<id>`), sender phone numbers, `uuid:<id>` values, or `*`.
 - `channels.signal.groups["<group-id>" | "*"]` can override group behavior with `requireMention`, `tools`, and `toolsBySender`.
 - Use `channels.signal.accounts.<id>.groups` for per-account overrides in multi-account setups.
-- Allowlisting a Signal group does not disable mention gating. To process every message in an allowlisted group, set `channels.signal.groups["<group-id>"].requireMention=false` or use the `"*"` group default.
+- Allowlisting a Signal group through `groupAllowFrom` does not disable mention gating by itself. A specifically configured `channels.signal.groups["<group-id>"]` entry processes every group message unless `requireMention=true` is set.
 - Runtime note: if `channels.signal` is completely missing, runtime falls back to `groupPolicy="allowlist"` for group checks (even if `channels.defaults.groupPolicy` is set).
 
 ## How it works (behavior)

extensions/signal/src/monitor/event-handler.mention-gating.test.ts

@@ -134,6 +134,32 @@ describe("signal mention gating", () => {
     expect(getCapturedCtx()?.WasMentioned).toBe(false);
   });
 
+  it("allows explicitly configured Signal groups by group id without a mention", async () => {
+    const handler = createSignalEventHandler(
+      createBaseSignalEventHandlerDeps({
+        cfg: {
+          messages: {
+            inbound: { debounceMs: 0 },
+            groupChat: { mentionPatterns: ["@bot"] },
+          },
+          channels: {
+            signal: {
+              groupPolicy: "allowlist",
+              groupAllowFrom: ["group:g1"],
+              groups: { g1: {} },
+            },
+          },
+        } as unknown as OpenClawConfig,
+        groupPolicy: "allowlist",
+        groupAllowFrom: ["group:g1"],
+      }),
+    );
+
+    await handler(makeGroupEvent({ message: "hello everyone" }));
+    expect(capturedCtx).toBeTruthy();
+    expect(getCapturedCtx()?.WasMentioned).toBe(false);
+  });
+
   it("records pending history for skipped group messages", async () => {
     const { handler, groupHistories } = createMentionGatedHistoryHandler();
     await handler(makeGroupEvent({ message: "hello from alice" }));

extensions/signal/src/monitor/event-handler.ts

@@ -694,6 +694,7 @@ export function createSignalEventHandler(deps: SignalEventHandlerDeps) {
         channel: "signal",
         groupId,
         accountId: deps.accountId,
+        configuredGroupDefaultsToNoMention: true,
       });
     const canDetectMention = mentionRegexes.length > 0;
     const mentionDecision = resolveInboundMentionDecision({

src/config/group-policy.test.ts

@@ -1,6 +1,10 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import type { OpenClawConfig } from "./config.js";
-import { resolveChannelGroupPolicy, resolveToolsBySender } from "./group-policy.js";
+import {
+  resolveChannelGroupPolicy,
+  resolveChannelGroupRequireMention,
+  resolveToolsBySender,
+} from "./group-policy.js";
 
 describe("resolveChannelGroupPolicy", () => {
   it("fails closed when groupPolicy=allowlist and groups are missing", () => {
@@ -129,6 +133,34 @@ describe("resolveChannelGroupPolicy", () => {
     expect(policy.allowlistEnabled).toBe(true);
     expect(policy.allowed).toBe(false);
   });
+
+  it("can default explicitly configured groups to no mention for channels that opt in", () => {
+    const cfg = {
+      channels: {
+        whatsapp: {
+          groups: {
+            "123@g.us": {},
+          },
+        },
+      },
+    } as OpenClawConfig;
+
+    expect(
+      resolveChannelGroupRequireMention({
+        cfg,
+        channel: "whatsapp",
+        groupId: "123@g.us",
+      }),
+    ).toBe(true);
+    expect(
+      resolveChannelGroupRequireMention({
+        cfg,
+        channel: "whatsapp",
+        groupId: "123@g.us",
+        configuredGroupDefaultsToNoMention: true,
+      }),
+    ).toBe(false);
+  });
 });
 
 describe("resolveToolsBySender", () => {

src/config/group-policy.ts

@@ -372,6 +372,7 @@ export function resolveChannelGroupRequireMention(params: {
   accountId?: string | null;
   groupIdCaseInsensitive?: boolean;
   requireMentionOverride?: boolean;
+  configuredGroupDefaultsToNoMention?: boolean;
   overrideOrder?: "before-config" | "after-config";
 }): boolean {
   const { requireMentionOverride, overrideOrder = "after-config" } = params;
@@ -392,6 +393,9 @@ export function resolveChannelGroupRequireMention(params: {
   if (overrideOrder !== "before-config" && typeof requireMentionOverride === "boolean") {
     return requireMentionOverride;
   }
+  if (params.configuredGroupDefaultsToNoMention && groupConfig) {
+    return false;
+  }
   return true;
 }
 

src/plugins/bundled-runtime-deps-selection.ts

@@ -152,7 +152,7 @@ function readBundledPluginLocalMemoryEmbeddingRuntimeDeps(value: unknown): Runti
         "openclaw.plugin.json runtimeDependencies.localMemoryEmbedding must contain strings",
       );
     }
-    return { ...parseInstallableRuntimeDepSpec(spec), pluginIds: [] };
+    return Object.assign(parseInstallableRuntimeDepSpec(spec), { pluginIds: [] });
   });
 }
 

src/plugins/bundled-runtime-mirror.ts

@@ -117,7 +117,6 @@ function isBundledRuntimeMirrorFileAlreadyMaterialized(
     sourceStat.ino === targetStat.ino
   );
 }
-
 function chmodBundledRuntimeMirrorFileReadable(sourcePath: string, targetPath: string): void {
   try {
     const sourceMode = fs.statSync(sourcePath).mode;

src/plugins/bundled-runtime-root.test.ts

@@ -56,6 +56,29 @@ describe("prepareBundledPluginRuntimeRoot", () => {
     expect(fs.readFileSync(target, "utf8")).toBe("export const value = 'old';\n");
   });
 
+  it("reuses existing hardlinked mirror files without rewriting them", () => {
+    const root = makeTempRoot();
+    const source = path.join(root, "source.js");
+    const target = path.join(root, "mirror", "source.js");
+    fs.writeFileSync(source, "export const value = 'stable';\n", "utf8");
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.linkSync(source, target);
+    const initialTargetStat = fs.statSync(target, { bigint: true });
+
+    const linkSpy = vi.spyOn(fs, "linkSync");
+    const copySpy = vi.spyOn(fs, "copyFileSync");
+    const removeSpy = vi.spyOn(fs, "rmSync");
+
+    materializeBundledRuntimeMirrorFile(source, target);
+
+    const reusedTargetStat = fs.statSync(target, { bigint: true });
+    expect(reusedTargetStat.dev).toBe(initialTargetStat.dev);
+    expect(reusedTargetStat.ino).toBe(initialTargetStat.ino);
+    expect(linkSpy).not.toHaveBeenCalled();
+    expect(copySpy).not.toHaveBeenCalled();
+    expect(removeSpy).not.toHaveBeenCalled();
+  });
+
   it("materializes root JavaScript chunks in external mirrors", () => {
     const packageRoot = makeTempRoot();
     const stageDir = makeTempRoot();