Add experimental WeChat text approval

[yikkuro (yikkuro)]

Summary

Fix the experimental WeChat plain-text approval flow so approval prompts cannot disclose unknown or secret-bearing command values before approval.

• Replace finite credential denylisting/free-text rendering with a fail-closed exact tuple allowlist.
• Derive a main-process-only presentation DTO and render only constant localized labels and recognized containment enums.
• Keep the complete raw approval exclusively in Electron memory for exact binding, drift detection, and the existing one-use proof flow.
• Keep unknown executables, operands, paths, declarations, non-scratch CWDs, mutable operands, unknown modes, arbitrary free text, and secret-bearing requests local-only.

Trusted-plugin provenance assumption

The product intentionally treats normalized ingress metadata from the allowlisted openclaw-weixin plugin and Gateway as authentic user input: account/sender/direct-chat identity, upstream message ID, cursor/order, content, and quote/forward/group metadata. Independent upstream WeChat signatures or immutable lookup are out of scope. Compromise of the authenticated WeChat session, plugin, or Gateway remains an explicit documented product risk.

Electron main remains the sole approval authority. The plugin cannot create challenge state, enumerate approvals, resolve through the ordinary message tool, mint execution/readiness proofs, or create durable approvals. Candidate replies are consumed before agent history/dispatch.

Remote eligibility and exact semantics

Remote prompts are limited to exact built-in read-only Windows query tuples: hostname.exe; whoami.exe with no arguments or exactly /user, /groups, /priv; ipconfig.exe with no arguments or exactly /all; and systeminfo.exe. They additionally require the exact System32 path, scratch CWD, no declarations, no mutable file operand, recognized containment, and both allow-once and deny. Prompts send no raw command, argv, executable path/hash, CWD, declarations, agent/session, or other free text to WeChat.

• 1 CODE: approve the exact current request once.
• 2 CODE: deny the exact current request.
• 3 CODE: approve only the exact currently enumerated originating-message batch once.

No option creates durable, global, folder, or future approval. Raw request/security fields remain integrity-bound and are revalidated before the existing one-use proof is issued. Local and remote approval remain first-valid-response-wins with existing identity, replay, cursor, drift, relock, Off, restart, logout/rebind, disable/revoke, timeout, and shutdown invalidation.

Regression coverage

Covers default-off owner binding and EN/ZH copy; options 1/2/3 and exact batches; pre-agent consumption and no history leakage; replay/expiry/attempt limits; exact request/security drift and lifecycle invalidation; no durable approval; exact allowlisted tuples; rejection of unknown executable/path/argv/CWD/declarations/mutable operands/modes; and positional passwords, passphrases, Azure AccountKey/SAS sig, npm tokens, Slack xoxb, custom auth headers, opaque base64/random values, unknown switches, duplicate-key JSON, decomposed Unicode, controls/bidi/zero-width values. Tests assert prompts contain constant labels but no raw authorization fields.

Validation

Passed:

• focused desktop/plugin approval tests: 109
• focused Settings UI tests: 32
• OpenClaw compatibility: 50 passed, 6 skipped
• staged OpenClaw 2026.10.2 WeChat runtime compatibility: 5
• full desktop: 1,556 passed, 12 skipped
• full renderer: 500 passed
• desktop + renderer production build and desktop TypeScript check
• targeted ESLint for changed files
• npm run lint:weixin --prefix desktop (0 errors; 7 pre-existing warnings)
• targeted Prettier and git diff --check

Repository-wide checks were also attempted and still report unrelated default-branch debt: two ESLint errors in chat-attachments.ts and openclaw-upgrade-recovery.ts, plus Prettier drift in 20 unchanged files. No changed file fails lint or formatting.

A final independent read-only security review found no findings under the documented trusted-plugin provenance assumption.

No live WeChat account, Electron app, Gateway, or current runtime was started, restarted, or modified; no live-account E2E was performed.