fix(claws): freeze installed tool profile authority (#121327)

* fix(claws): freeze installed tool profile authority

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(claws): normalize consent helper file modes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): preserve consented tool authority

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(claws): normalize source file modes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(claws): allowlist runtime provenance probe

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): close consent review gaps

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* docs(claws): require concrete frozen tool grants

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): reject dynamic MCP selectors

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): type profile resolution at parse boundary

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): preserve bounded update authority

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): prepare consent provenance at config load

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): isolate consent provenance failures

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): keep runtime grants inside consent

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): own consent cache in state lifecycle

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): guide legacy full profile repair

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(claws): keep consent cache internals private

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): satisfy strict consent cache types

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): fail closed when state cache closes

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): integrate consent cache with state owner

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): fail closed before consent state opens

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): resume legacy v1 profile installs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* test(claws): isolate legacy resume regression

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): follow tool policy normalizer rename

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): bind runtime consent to agent config

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(claws): normalize digest helper mode

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): drop stale digest helper import

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* test(runtime): keep snapshot mocks complete

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): retain bounded legacy profile plans

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): verify ownership before runtime consent

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* test(claws): remove stale runtime import

* fix(claws): drop stale add import

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* fix(claws): resume failed v1 promotion

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* test(claws): codify cold-state authority fence

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

* chore(plugin-sdk): refresh API baseline

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

---------

Co-authored-by: Gio Della-Libera <235387111+giodl73-repo@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: db3a73db-01ff-428e-a451-b7b710cd5085

docs/cli/claws.md

@@ -79,8 +79,7 @@ conflict.
 schemaVersion: 1
 agent:
   tools:
-    profile: coding
-    alsoAllow: [cron]
+    allow: [read, write, cron]
     deny: [exec]
     fs:
       workspaceOnly: true
@@ -101,11 +100,18 @@ Grouped JSON discovers the same conventional profile rather than embedding a
 second copy of the OpenClaw settings. The remaining schema fragments on this
 page use JSON, with equivalent keys available in `CLAW.md` frontmatter.
 
-The OpenClaw package profile may select any built-in tool profile registered by
-the running OpenClaw version, then refine it with `alsoAllow`, `deny`, and
-`tools.fs.workspaceOnly: true`. A Claw cannot set that field to `false` and
-weaken host filesystem confinement. `tools.allow` remains available as an
-explicit allowlist but cannot be combined with `alsoAllow`. A Claw may also set
+The OpenClaw package profile may use an explicit `tools.allow` list or select
+any built-in tool profile registered by the running OpenClaw version. The
+`coding` and `messaging` profiles include the dynamic `bundle-mcp` selector, so
+a Claw that selects either profile must also provide a bounded `tools.allow`
+intersection. Name any MCP grants as concrete generated tool names such as
+`github__list_issues`; the package cannot freeze `bundle-mcp` itself.
+
+Profiles can otherwise be refined with `alsoAllow`, `deny`, and
+`tools.fs.workspaceOnly: true`. `tools.allow` cannot be combined with
+`alsoAllow`; use a standalone allowlist, as above, when the package needs tools
+outside its selected profile. A Claw cannot set `workspaceOnly` to `false` and
+weaken host filesystem confinement. A Claw may also set
 `memory.search.enabled`, choose the portable `memory` and `sessions` sources,
 and opt into cross-conversation memory with `rememberAcrossConversations`.
 Declaring the `sessions` source requires that opt-in.