Add experimental WeChat text approval

[yikkuro (yikkuro)]

Summary

Adds a separate, default-off experimental WeChat text approval path for Windows Node + MXC execution.

• Settings locally enables and binds the single authenticated, explicitly allowlisted WeChat owner.
• Only the bound owner's direct chat can answer an active challenge.
• Exact replies 1 CODE, 2 CODE, and 3 CODE approve once, deny, or approve only the explicitly listed current batch once; bare 1/2/3 remain ordinary messages.
• Electron main is the sole approval authority. The plugin uses a generation-local token-authenticated named pipe, consumes candidates before agent/history dispatch, and cannot mint execution proofs or durable/global/future approvals.
• Challenges are one-use, short-lived, rate-limited, and exactly bound to source message/cursor, account/sender/chat, request/batch/session, Gateway generation, policy, node, activation lease, and approval identity. Local and remote resolution are first-valid-response-wins.
• Relock, Off, restart, logout, rebind, disable/revoke, delivery failure, security drift, lease/generation change, timeout, and shutdown invalidate the challenge while failed prompt delivery leaves local approval pending.

Threat assumption

The product intentionally trusts normalized account, sender, direct-chat, upstream message ID/cursor/order, exact content, and quote/forward/group metadata supplied by the allowlisted openclaw-weixin plugin and Gateway as authentic user input. It does not require an independent WeChat server signature. Settings and the MXC documentation disclose that compromise of the phone/session, plugin, or Gateway can authorize local command execution.

Secret handling

OpenClaw 2026.10.2 does not provide reliable sensitive-value provenance for every displayed execution field. Remote prompts therefore use a conservative structured allowlist and exact lossless rendering. The command must reconstruct exactly from signed argv; only classified structural paths/switches/values are eligible. Secret-bearing, arbitrary positional text or numbers, short opaque values, inline option values, URLs, long tokens, credential-semantic names, Unicode/free-form data, and all unknown forms remain local-only. Regression coverage includes passphrases, Azure AccountKey/SAS sig, npm-style tokens, Slack-style tokens, short passphrases, PIN/OTP-like values, and unknown credential forms.

Validation

• Focused desktop approval/transport/owner and OpenClaw compatibility tests
• WeChat plugin ingress/cursor/lifecycle/security tests
• Renderer Settings/i18n tests
• Full desktop suite: 1,541 passed, 12 skipped; staged WeChat/OpenClaw 2026.10.2 compatibility: 5 passed
• Full renderer suite: 500 passed
• Desktop tsc --noEmit and renderer vue-tsc --noEmit
• Desktop production build
• Targeted desktop/renderer ESLint and WeChat lint: zero errors
• git diff --check
• Independent read-only security review; its MEDIUM short opaque/numeric disclosure finding was fixed and regression-tested

Residual risk

This is experimental and intentionally conservative: legitimate commands can remain local-only when display sensitivity cannot be proven. Security still depends on the trusted plugin/Gateway ingress metadata and the authenticated WeChat session. No live-account end-to-end test was performed, and no live Electron/Gateway/WeChat runtime was started or restarted during validation.