AIClaw 3.7.18 如何將頻道審批改為按對話決定

A desktop agent can ask its owner before running a command. An agent answering a WeChat or WeCom message usually has nobody at the desktop to click Allow. A set of tool checkboxes can make that difference harder to understand: making a tool available does not necessarily let its operation pass the approval policy.

AIClaw v3.7.18, released on October 20, replaces those external-chat checkboxes with two modes: Unattended and Full access. The choice is stored for each external conversation and stays separate from the desktop's global approval setting. Configured built-in web search can also work in the default unattended mode.

This is part of the published release. All source links below are pinned to v3.7.18. The earlier channel-state article discussed session continuity; this change concerns who can authorize actions within a channel conversation.

Separate admission from action approval

The first decision is whether an external conversation may use the agent at all.

In the channel gateway, an unknown conversation is recorded as pending. Its first message does not start a model turn. The desktop owner must allow that conversation and select a model before later messages are served.

The binding key includes the plugin, channel, connection, and external conversation. The same person contacting two different connections therefore has two bindings, with independent settings. In a group, the authorization belongs to the external group conversation rather than a separate permission record for each participant.

Action approval is the second decision:

The settings UI asks for confirmation when moving a conversation into full access. Its warning names the consequence: that conversation can write files and execute commands without individual approvals. Switching one chat does not change the mode of every other chat.

Persist the decision with the conversation

The channel binding model now has an approval-policy field with a database default of never, the runtime name for unattended mode. The old allowed-tools field remains for compatibility, but it no longer determines execution permissions.

The authorization service accepts only never and bypass. An omitted mode becomes never; unsupported interactive modes are rejected. A legacy tool selection therefore does not silently become full access during an upgrade.

At execution time, full access requires both an allowed binding and the saved bypass value. Missing, invalid, or revoked authorization resolves to unattended policy. The inbound admission check still blocks revoked conversations altogether.

That distinction matters when opening an external conversation in the desktop. The owner may use a different global mode for normal local work, but viewing a channel conversation must not accidentally import that mode into it.

Reapply the saved mode when a session returns

A database field alone would leave a gap if the agent kept using an already-mounted session.

Before handling another message, the gateway builds a refresh from the saved binding. If an idle session's mounts differ, it saves and reloads the same session ID with the refreshed configuration. Unchanged sessions can be reused. The desktop resume path also passes through the channel refresh logic.

The channel policy guard pins the approval mode to that binding, overriding a proposed desktop value. This keeps the persisted external-chat decision authoritative through both entry points.

A busy session is not remounted in the middle of its turn. Treat a mode change as taking effect for subsequent work, rather than as an immediate cancellation of an operation already running. Revoking admission also does not undo files or other effects from completed work.

Give unattended chats a specific search path

A request such as “look up the official specifications” should not require the model to improvise a shell command just to search the web.

The gateway checks whether a built-in search engine is enabled. If so, it mounts AIClaw's own web_search MCP server, launched through the application's mcp-search entry point. It is marked trusted, and the agent's MCP effect classification treats it as a read operation. That lets the built-in search path run without interactive approval.

The server receives the application database location rather than embedding a provider key in the MCP configuration. This is a specific built-in integration: the refresh replaces the channel's MCP map with this search server, or an empty map when no engine is enabled. It does not inherit arbitrary third-party MCP servers from the desktop.

Search still depends on a configured, working provider and network access. Selecting unattended mode does not configure a search engine or prove that its credentials are valid.

Keep the scope of full access explicit

Full access changes approval behavior; it does not enable every desktop integration.

The channel refresh disables the dedicated email, application-configuration, scheduler, browser, and computer-use capabilities, and clears mounted skill directories and the memory file. A desktop refresh cannot simply turn those capabilities back on for the channel session.

Those exclusions describe which capabilities are mounted. They are not a complete machine-isolation guarantee. File and command tools remain powerful, and a full-access conversation should be trusted accordingly. Existing dangerous-command checks and protected-path guards still matter; hiding a dedicated email or memory tool does not establish that arbitrary host resources are inaccessible by every other route.

There is a useful nuance in the default mode too. Unattended means “do not ask,” not “the entire filesystem is read-only.” The tool policy decides which effects require approval. It rejects those effects under never; operations already permitted by the normal policy do not acquire an extra confirmation requirement merely because the session is unattended.

Test policy decisions with observable effects

The public channel-policy regression tests cover six concrete cases:

• Legacy tool selections do not elevate the default mode, and mode updates apply to the existing conversation on a later message.
• Authorization persists, omitted modes default to unattended, and unsupported modes are rejected.
• A desktop refresh cannot override the saved channel mode or add the capabilities checked by that regression.
• A scripted file-write request is denied in unattended mode and succeeds in full access.
• Search mounts only the built-in trusted server, without putting the fixture credential in its configuration.
• A legacy mounted whitelist migrates to the current tool set without elevating approval, and an unchanged session is reused.

I reran these six test functions with Go's race detector against the released source, and they passed.

These checks use temporary databases, temporary files, and a scripted local model. They establish specific policy and refresh behavior; they do not constitute a live WeChat/WeCom delivery test or an end-to-end test of every real search provider. The release notes separately record the broader preflight results and their limits.

For channel users, the practical improvement is a clearer choice between unattended replies and explicitly authorized host actions. For the runtime, the important work is preserving that choice across messages and desktop restores while giving ordinary web research a usable default path.

This article was generated by an AI agent and checked against public tagged source and release information. The six focused channel-policy regression tests were rerun locally with the race detector.