@ihazz/bitrix24 1.0.3 → 1.1.1

package/src/channel.ts

@@ -17,19 +17,30 @@ import {
   checkAccessWithPairing,
   getWebhookUserId,
 } from './access-control.js';
+import {
+  checkGroupAccessPassive,
+  checkGroupAccessWithPairing,
+  resolveAgentWatchRules,
+  resolveGroupAccess,
+} from './group-access.js';
 import { DEFAULT_AVATAR_BASE64 } from './bot-avatar.js';
 import { Bitrix24ApiError, defaultLogger, CHANNEL_PREFIX_RE } from './utils.js';
 import { getBitrix24Runtime } from './runtime.js';
 import type { ChannelPairingAdapter } from './runtime.js';
 import { OPENCLAW_COMMANDS, buildCommandsHelpText, formatModelsCommandReply } from './commands.js';
 import {
-  forwardedMessageUnsupported,
+  accessApproved,
+  accessDenied,
+  groupPairingPending,
   mediaDownloadFailed,
   groupChatUnsupported,
   onboardingMessage,
+  ownerAndAllowedUsersOnly,
   personalBotOwnerOnly,
-  replyMessageUnsupported,
+  watchOwnerDmNotice,
 } from './i18n.js';
+import { HistoryCache } from './history-cache.js';
+import type { ConversationMeta } from './history-cache.js';
 import type {
   B24MsgContext,
   B24InputActionStatusCode,
@@ -37,6 +48,13 @@ import type {
   B24V2DeleteEventData,
   FetchContext,
   Bitrix24AccountConfig,
+  Bitrix24AgentWatchConfig,
+  Bitrix24DmPolicy,
+  Bitrix24GroupPolicy,
+  Bitrix24GroupWatchConfig,
+  B24V2GetMessageContextResult,
+  B24V2GetMessageResult,
+  B24V2User,
   B24Keyboard,
   KeyboardButton,
   Logger,
@@ -52,6 +70,13 @@ const ACCESS_DENIED_NOTICE_COOLDOWN_MS = 60000;
 const AUTO_BOT_CODE_MAX_CANDIDATES = 100;
 const MEDIA_DOWNLOAD_CONCURRENCY = 2;
 const MAX_WEBHOOK_BODY_BYTES = 1024 * 1024;
+const DEFAULT_HISTORY_LIMIT = 100;
+const HISTORY_CACHE_MAX_KEYS = 1000;
+const HISTORY_CONTEXT_MARKER = '[Chat messages since your last reply - for context]';
+const CROSS_CHAT_HISTORY_LIMIT = 20;
+const ACCESS_DENIED_REACTION = 'crossMark';
+const FORWARDED_CONTEXT_RANGE = 5;
+const REGISTERED_COMMANDS = new Set(OPENCLAW_COMMANDS.map((command) => command.command));
 
 // ─── Emoji → B24 reaction code mapping ──────────────────────────────────
 // B24 uses named reaction codes, not Unicode emoji.
@@ -127,6 +152,73 @@ function toMessageId(value: string | number | undefined): number | undefined {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
 }
 
+function escapeBbCodeText(value: string): string {
+  return value
+    .replace(/\[/g, '(')
+    .replace(/\]/g, ')');
+}
+
+function buildChatContextUrl(dialogId: string, messageId: string, chatName: string): string {
+  const dialogParam = encodeURIComponent(dialogId);
+  const messageParam = encodeURIComponent(messageId);
+  const label = escapeBbCodeText(chatName);
+  return `[URL=/online/?IM_DIALOG=${dialogParam}&IM_MESSAGE=${messageParam}]${label}[/URL]`;
+}
+
+function buildTopicsBbCode(topics: string[] | undefined): string | undefined {
+  if (!topics || topics.length === 0) {
+    return undefined;
+  }
+
+  return topics
+    .map((topic) => topic.trim())
+    .filter(Boolean)
+    .map((topic) => `[b]${escapeBbCodeText(topic)}[/b]`)
+    .join(', ');
+}
+
+function formatQuoteTimestamp(timestamp: number | undefined, language: string | undefined): string {
+  const locale = (language ?? 'ru').toLowerCase().slice(0, 2);
+  const value = timestamp ?? Date.now();
+
+  try {
+    return new Intl.DateTimeFormat(locale, {
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+    }).format(new Date(value)).replace(',', '');
+  } catch {
+    return new Intl.DateTimeFormat('ru', {
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit',
+    }).format(new Date(value)).replace(',', '');
+  }
+}
+
+function buildWatchQuoteText(params: {
+  senderName: string;
+  language?: string;
+  timestamp?: number;
+  anchor: string;
+  body: string;
+}): string {
+  const separator = '------------------------------------------------------';
+  const senderLine = `${escapeBbCodeText(params.senderName)} [${formatQuoteTimestamp(params.timestamp, params.language)}] ${params.anchor}`;
+  const body = escapeBbCodeText(params.body);
+
+  return [
+    separator,
+    senderLine,
+    body,
+    separator,
+  ].join('\n');
+}
+
 async function notifyStatus(
   sendService: SendService,
   sendCtx: SendContext,
@@ -283,8 +375,10 @@ export function mergeForwardedMessageContext(
   const previousText = previousMsgCtx.text.trim();
   const forwardedText = forwardedMsgCtx.text.trim();
   const mergedText = [
+    previousText ? '[User question about the forwarded message]' : '',
     previousText,
-    forwardedText ? `[Forwarded message]\n${forwardedText}` : '',
+    previousText ? '[/User question]' : '',
+    forwardedText,
   ].filter(Boolean).join('\n\n');
 
   return {
@@ -292,6 +386,7 @@ export function mergeForwardedMessageContext(
     text: mergedText,
     media: [...previousMsgCtx.media, ...forwardedMsgCtx.media],
     language: forwardedMsgCtx.language ?? previousMsgCtx.language,
+    replyToMessageId: undefined,
     isForwarded: false,
   };
 }
@@ -373,6 +468,316 @@ function resolveSecurityConfig(params: {
   return {};
 }
 
+function resolveHistoryLimit(config: Bitrix24AccountConfig): number {
+  return Math.max(0, config.historyLimit ?? DEFAULT_HISTORY_LIMIT);
+}
+
+export interface Bitrix24ConversationRef {
+  dialogId: string;
+  address: string;
+  historyKey: string;
+  peer: {
+    kind: 'direct' | 'group';
+    id: string;
+  };
+}
+
+export function resolveConversationRef(params: {
+  accountId: string;
+  dialogId: string;
+  isDirect: boolean;
+}): Bitrix24ConversationRef {
+  const dialogId = String(params.dialogId);
+  return {
+    dialogId,
+    address: `bitrix24:${dialogId}`,
+    historyKey: `${params.accountId}:${dialogId}`,
+    peer: {
+      kind: params.isDirect ? 'direct' : 'group',
+      id: dialogId,
+    },
+  };
+}
+
+export function buildConversationSessionKey(
+  routeSessionKey: string,
+  conversation: Pick<Bitrix24ConversationRef, 'address'>,
+): string {
+  return `${routeSessionKey}:${conversation.address}`;
+}
+
+function buildHistoryBody(msgCtx: B24MsgContext): string {
+  const text = msgCtx.text.trim();
+  if (text) {
+    return text;
+  }
+
+  if (msgCtx.media.length === 0) {
+    return '';
+  }
+
+  const hasImage = msgCtx.media.some((mediaItem) => mediaItem.type === 'image');
+  return hasImage ? '<media:image>' : '<media:document>';
+}
+
+function buildConversationMeta(msgCtx: B24MsgContext): Omit<ConversationMeta, 'key'> {
+  return {
+    dialogId: msgCtx.chatId,
+    chatId: msgCtx.chatInternalId,
+    chatName: msgCtx.chatName,
+    chatType: msgCtx.chatType,
+    isGroup: msgCtx.isGroup,
+    lastActivityAt: msgCtx.timestamp ?? Date.now(),
+  };
+}
+
+function appendMessageToHistory(params: {
+  historyCache: HistoryCache;
+  historyKey: string;
+  historyLimit: number;
+  msgCtx: B24MsgContext;
+  body?: string;
+}): void {
+  const historyBody = (params.body ?? buildHistoryBody(params.msgCtx)).trim();
+  if (!historyBody) {
+    return;
+  }
+
+  params.historyCache.append({
+    key: params.historyKey,
+    limit: params.historyLimit,
+    entry: {
+      messageId: params.msgCtx.messageId,
+      sender: params.msgCtx.senderName,
+      senderId: params.msgCtx.senderId,
+      body: historyBody,
+      timestamp: params.msgCtx.timestamp ?? Date.now(),
+      wasMentioned: params.msgCtx.wasMentioned,
+      eventScope: params.msgCtx.eventScope ?? 'bot',
+    },
+    meta: buildConversationMeta(params.msgCtx),
+  });
+}
+
+function formatHistoryEntry(params: {
+  sender: string;
+  body: string;
+  messageId?: string;
+}): string {
+  const idSuffix = params.messageId ? ` [id:${params.messageId}]` : '';
+  return `[${params.sender}] ${params.body}${idSuffix}`;
+}
+
+function buildHistoryContext(params: {
+  entries: Array<{ sender: string; body: string; messageId?: string }>;
+  currentBody: string;
+}): string {
+  if (params.entries.length === 0) {
+    return params.currentBody;
+  }
+
+  const historyText = params.entries
+    .map((entry) => formatHistoryEntry(entry))
+    .join('\n');
+
+  return [
+    HISTORY_CONTEXT_MARKER,
+    historyText,
+    '',
+    params.currentBody,
+  ].join('\n');
+}
+
+function formatReplyContext(params: {
+  body: string;
+  replyEntry?: { sender: string; body: string; messageId: string };
+}): string {
+  if (!params.replyEntry) {
+    return params.body;
+  }
+
+  return [
+    params.body,
+    '',
+    `[Replying to ${params.replyEntry.sender} id:${params.replyEntry.messageId}]`,
+    params.replyEntry.body,
+    '[/Replying]',
+  ].filter(Boolean).join('\n');
+}
+
+function resolveFetchedUserName(usersById: Map<number, B24V2User>, authorId: number): string {
+  return usersById.get(authorId)?.name?.trim() || `User ${authorId}`;
+}
+
+function resolveFetchedMessageBody(text: string): string {
+  const trimmed = text.trim();
+  return trimmed.length > 0 ? trimmed : '<empty message>';
+}
+
+function formatFetchedForwardContext(params: {
+  context: B24V2GetMessageContextResult;
+  currentMessageId: number;
+}): string {
+  const usersById = new Map(params.context.users.map((user) => [user.id, user]));
+  const lines = params.context.messages
+    .filter((message) => message.id !== params.currentMessageId)
+    .map((message) => {
+      const sender = resolveFetchedUserName(usersById, message.authorId);
+      const body = resolveFetchedMessageBody(message.text);
+      return `[${sender} id:${message.id}] ${body}`;
+    })
+    .filter(Boolean);
+
+  if (lines.length === 0) {
+    return '';
+  }
+
+  return [
+    '[Bitrix24 surrounding context around this forwarded message - not the forwarded message body]',
+    ...lines,
+    '[/Bitrix24 surrounding context]',
+  ].join('\n');
+}
+
+function extractMentionedChatIds(text: string): string[] {
+  const matches = [...text.matchAll(/\[CHAT=(?:chat)?(\d+)(?:[^\]]*)\][\s\S]*?\[\/CHAT\]/gi)];
+  return [...new Set(matches.map((match) => match[1]).filter(Boolean))];
+}
+
+function formatReferencedGroupHistory(params: {
+  conversation: ConversationMeta;
+  entries: Array<{ sender: string; body: string; messageId?: string }>;
+}): string {
+  const chatId = params.conversation.chatId ?? params.conversation.dialogId.replace(/^chat/i, '');
+  const chatName = params.conversation.chatName ?? params.conversation.dialogId;
+  const header = `[Visible group chat history: [CHAT=${chatId}]${chatName}[/CHAT]]`;
+
+  if (params.entries.length === 0) {
+    return [
+      header,
+      'No messages from this chat are currently available in RAM memory.',
+    ].join('\n');
+  }
+
+  return [
+    header,
+    ...params.entries.map((entry) => formatHistoryEntry(entry)),
+  ].join('\n');
+}
+
+function buildCrossChatMemoryContext(params: {
+  query: string;
+  historyCache: HistoryCache;
+}): string | undefined {
+  const chatMentions = extractMentionedChatIds(params.query);
+  if (chatMentions.length === 0) {
+    return undefined;
+  }
+
+  const visibleGroupChats = params.historyCache
+    .listConversations()
+    .filter((conversation) => conversation.isGroup)
+    .sort((left, right) => (right.lastActivityAt ?? 0) - (left.lastActivityAt ?? 0));
+
+  const referencedChats = visibleGroupChats.filter((conversation) => {
+    const chatId = conversation.chatId ?? '';
+    return chatMentions.includes(chatId);
+  });
+
+  const sections: string[] = [];
+
+  if (referencedChats.length > 0) {
+    sections.push(
+      ...referencedChats.map((conversation) => formatReferencedGroupHistory({
+        conversation,
+        entries: params.historyCache.get(conversation.key, CROSS_CHAT_HISTORY_LIMIT),
+      })),
+    );
+  } else if (chatMentions.length > 0) {
+    sections.push('[Referenced group chats]\nThe requested group chat mention is not available in RAM memory right now.');
+  }
+
+  return [
+    '[OpenClaw cross-chat memory]',
+    'The following Bitrix24 group chat memory is already available to you from RAM history.',
+    'Use it as trusted context for your answer.',
+    'Do not say that you only see the current chat if chats or messages are listed below.',
+    'Do not call tools to list chats when this memory block already contains the answer.',
+    '',
+    '[BEGIN OPENCLAW CROSS-CHAT MEMORY]',
+    sections.join('\n\n'),
+    '[END OPENCLAW CROSS-CHAT MEMORY]',
+  ].join('\n');
+}
+
+function buildAccessDeniedNotice(
+  lang: string | undefined,
+  policy: Bitrix24DmPolicy | Bitrix24GroupPolicy | undefined,
+  params?: { hasAllowList?: boolean },
+): string {
+  const effectivePolicy = policy ?? 'webhookUser';
+
+  if (effectivePolicy === 'webhookUser') {
+    return personalBotOwnerOnly(lang);
+  }
+
+  if (params?.hasAllowList) {
+    return ownerAndAllowedUsersOnly(lang);
+  }
+
+  return accessDenied(lang);
+}
+
+function normalizeTopicText(text: string): string {
+  return text.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+function tokenizeTopicText(text: string): string[] {
+  return normalizeTopicText(text)
+    .split(/[^a-zа-яё0-9]+/i)
+    .filter(Boolean);
+}
+
+function matchesWatchTopic(messageText: string, topic: string): boolean {
+  const normalizedMessage = normalizeTopicText(messageText);
+  const normalizedTopic = normalizeTopicText(topic);
+  if (!normalizedMessage || !normalizedTopic) {
+    return false;
+  }
+
+  if (normalizedMessage.includes(normalizedTopic)) {
+    return true;
+  }
+
+  const messageTokens = tokenizeTopicText(messageText);
+  const topicTokens = tokenizeTopicText(topic);
+  return topicTokens.length > 0
+    && topicTokens.every((topicToken) => messageTokens.some((messageToken) => messageToken.startsWith(topicToken)));
+}
+
+function findMatchingWatchRule<T extends { userId: string; topics?: string[] }>(
+  msgCtx: B24MsgContext,
+  watchRules: T[] | undefined,
+): T | undefined {
+  if (!Array.isArray(watchRules) || watchRules.length === 0) {
+    return undefined;
+  }
+
+  const senderId = normalizeAllowEntry(msgCtx.senderId);
+  return watchRules.find((rule) => {
+    const ruleUserId = normalizeAllowEntry(rule.userId);
+    if (ruleUserId !== '*' && ruleUserId !== senderId) {
+      return false;
+    }
+
+    if (!Array.isArray(rule.topics) || rule.topics.length === 0) {
+      return true;
+    }
+
+    return rule.topics.some((topic) => matchesWatchTopic(msgCtx.text, topic));
+  });
+}
+
 interface BufferedDirectMessageEntry {
   messages: B24MsgContext[];
   startedAt: number;
@@ -535,6 +940,25 @@ export interface ChannelButton {
   style?: string;
 }
 
+function parseRegisteredCommandTrigger(callbackData: string): { command: string; commandParams?: string } | undefined {
+  const trimmed = callbackData.trim();
+  const isSlashCommand = trimmed.startsWith('/');
+  const normalized = trimmed.replace(/^\/+/, '');
+  if (!normalized) {
+    return undefined;
+  }
+
+  const [commandName, ...params] = normalized.split(/\s+/);
+  if (!isSlashCommand && !REGISTERED_COMMANDS.has(commandName)) {
+    return undefined;
+  }
+
+  return {
+    command: commandName,
+    ...(params.length > 0 ? { commandParams: params.join(' ') } : {}),
+  };
+}
+
 /**
  * Convert OpenClaw button rows to B24 flat KEYBOARD array.
  */
@@ -550,11 +974,14 @@ export function convertButtonsToKeyboard(input: ChannelButton[][] | ChannelButto
     for (const btn of rows[i]) {
       const b24Btn: KeyboardButton = { TEXT: btn.text, DISPLAY: 'LINE' };
 
-      if (btn.callback_data?.startsWith('/')) {
-        const parts = btn.callback_data.substring(1).split(' ');
-        b24Btn.COMMAND = parts[0];
-        if (parts.length > 1) {
-          b24Btn.COMMAND_PARAMS = parts.slice(1).join(' ');
+      const parsedCommand = btn.callback_data
+        ? parseRegisteredCommandTrigger(btn.callback_data)
+        : undefined;
+
+      if (parsedCommand) {
+        b24Btn.COMMAND = parsedCommand.command;
+        if (parsedCommand.commandParams) {
+          b24Btn.COMMAND_PARAMS = parsedCommand.commandParams;
         }
       } else if (btn.callback_data) {
         b24Btn.ACTION = 'SEND';
@@ -1032,7 +1459,7 @@ export const bitrix24Plugin = {
   },
 
   capabilities: {
-    chatTypes: ['direct'] as const,
+    chatTypes: ['direct', 'group'] as const,
     media: true,
     reactions: true,
     threads: false,
@@ -1060,9 +1487,10 @@ export const bitrix24Plugin = {
   security: {
     resolveDmPolicy: (params: { cfg?: Record<string, unknown>; accountId?: string; account?: { config?: Record<string, unknown> } }) => {
       const securityConfig = resolveSecurityConfig(params);
+      const policy = securityConfig.dmPolicy ?? 'webhookUser';
 
       return {
-        policy: securityConfig.dmPolicy === 'pairing' ? 'pairing' : 'webhookUser',
+        policy,
         allowFrom: normalizeAllowList(securityConfig.allowFrom),
         policyPath: 'channels.bitrix24.dmPolicy',
         allowFromPath: 'channels.bitrix24.allowFrom',
@@ -1086,7 +1514,7 @@ export const bitrix24Plugin = {
         dialogId: params.id,
       };
       try {
-        await gatewayState.sendService.sendText(sendCtx, '\u2705 OpenClaw access approved.');
+        await gatewayState.sendService.sendText(sendCtx, `\u2705 ${accessApproved(undefined)}`);
       } catch (err) {
         defaultLogger.warn('Failed to notify approved Bitrix24 user', err);
       }
@@ -1383,12 +1811,13 @@ export const bitrix24Plugin = {
         return;
       }
       const welcomedDialogs = new Set<string>();
-      const deniedDialogs = new Map<string, number>();
+      const dialogNoticeTimestamps = new Map<string, number>();
+      const historyCache = new HistoryCache({ maxKeys: HISTORY_CACHE_MAX_KEYS });
 
       // Cleanup stale denied dialog entries once per day
       const DENIED_CLEANUP_INTERVAL_MS = 24 * 60 * 60 * 1000;
       const deniedCleanupTimer = setInterval(() => {
-        deniedDialogs.clear();
+        dialogNoticeTimestamps.clear();
       }, DENIED_CLEANUP_INTERVAL_MS);
       if (deniedCleanupTimer && typeof deniedCleanupTimer === 'object' && 'unref' in deniedCleanupTimer) {
         deniedCleanupTimer.unref();
@@ -1409,6 +1838,7 @@ export const bitrix24Plugin = {
       }
 
       const bot: BotContext = { botId: botRegistration.botId, botToken };
+      const webhookOwnerId = getWebhookUserId(config.webhookUrl);
 
       // Sync user event subscription with agent mode setting
       if (eventMode === 'fetch') {
@@ -1427,15 +1857,126 @@ export const bitrix24Plugin = {
 
       const sendService = new SendService(api, logger);
       const mediaService = new MediaService(api, logger);
+      const hydrateReplyEntry = async (
+        replyToMessageId: string | undefined,
+      ): Promise<{ sender: string; body: string; messageId: string } | undefined> => {
+        const bitrixMessageId = toMessageId(replyToMessageId);
+        if (!bitrixMessageId) {
+          return undefined;
+        }
+
+        try {
+          const result: B24V2GetMessageResult = await api.getMessage(
+            webhookUrl,
+            bot,
+            bitrixMessageId,
+          );
+
+          return {
+            sender: result.user?.name?.trim() || `User ${result.message.authorId}`,
+            body: resolveFetchedMessageBody(result.message.text),
+            messageId: String(result.message.id),
+          };
+        } catch (err) {
+          logger.debug('Failed to hydrate reply context from Bitrix24 API', {
+            replyToMessageId,
+            error: err,
+          });
+          return undefined;
+        }
+      };
+      const hydrateForwardedMessageContext = async (
+        msgCtx: B24MsgContext,
+      ): Promise<B24MsgContext> => {
+        const currentMessageId = toMessageId(msgCtx.messageId);
+        if (!currentMessageId) {
+          return {
+            ...msgCtx,
+            isForwarded: false,
+          };
+        }
+
+        try {
+          const result = await api.getMessageContext(
+            webhookUrl,
+            bot,
+            currentMessageId,
+            FORWARDED_CONTEXT_RANGE,
+          );
+          const currentMessage = result.messages.find((message) => message.id === currentMessageId);
+          const currentBody = resolveFetchedMessageBody(currentMessage?.text ?? msgCtx.text);
+          const fetchedContext = formatFetchedForwardContext({
+            context: result,
+            currentMessageId,
+          });
+
+          if (!currentBody && !fetchedContext) {
+            return {
+              ...msgCtx,
+              isForwarded: false,
+            };
+          }
+
+          return {
+            ...msgCtx,
+            text: [
+              currentBody ? '[Forwarded message body]' : '',
+              currentBody,
+              currentBody ? '[/Forwarded message body]' : '',
+              fetchedContext,
+            ].filter(Boolean).join('\n\n'),
+            isForwarded: false,
+          };
+        } catch (err) {
+          logger.debug('Failed to hydrate forwarded message context from Bitrix24 API', {
+            messageId: msgCtx.messageId,
+            chatId: msgCtx.chatId,
+            error: err,
+          });
+          return {
+            ...msgCtx,
+            isForwarded: false,
+          };
+        }
+      };
       const processAllowedMessage = async (msgCtx: B24MsgContext): Promise<void> => {
         const runtime = getBitrix24Runtime();
         const cfg = runtime.config.loadConfig();
+        const conversation = resolveConversationRef({
+          accountId: ctx.accountId,
+          dialogId: msgCtx.chatId,
+          isDirect: msgCtx.isDm,
+        });
         const sendCtx: SendContext = {
           webhookUrl,
           bot,
-          dialogId: msgCtx.chatId,
+          dialogId: conversation.dialogId,
         };
+        const historyKey = conversation.historyKey;
+        const historyLimit = resolveHistoryLimit(config);
+        const fallbackHistoryBody = buildHistoryBody(msgCtx);
         let downloadedMedia: DownloadedMedia[] = [];
+        let historyRecorded = false;
+
+        const recordHistory = (bodyOverride?: string): void => {
+          if (historyRecorded) {
+            return;
+          }
+
+          const historyBody = (bodyOverride ?? fallbackHistoryBody).trim();
+          if (!historyBody) {
+            return;
+          }
+
+          appendMessageToHistory({
+            historyCache,
+            historyKey,
+            historyLimit,
+            msgCtx,
+            body: historyBody,
+          });
+          historyRecorded = true;
+        };
 
         try {
           const replyStatusHeartbeat = createReplyStatusHeartbeat({
@@ -1459,7 +2000,7 @@ export const bitrix24Plugin = {
                 extension: mediaItem.extension,
                 webhookUrl,
                 bot,
-                dialogId: msgCtx.chatId,
+                dialogId: conversation.dialogId,
               }),
             )).filter(Boolean) as DownloadedMedia[];
 
@@ -1475,6 +2016,7 @@ export const bitrix24Plugin = {
             } else {
               const fileNames = msgCtx.media.map((mediaItem) => mediaItem.name).join(', ');
               logger.warn('All media downloads failed, notifying user', { fileNames });
+              recordHistory();
               await sendService.sendText(
                 sendCtx,
                 mediaDownloadFailed(msgCtx.language, fileNames),
@@ -1494,15 +2036,35 @@ export const bitrix24Plugin = {
             body = hasImage ? '<media:image>' : '<media:document>';
           }
 
+          const previousEntries = historyCache.get(historyKey, historyLimit);
+          const replyEntry = historyCache.findByMessageId(historyKey, msgCtx.replyToMessageId)
+            ?? await hydrateReplyEntry(msgCtx.replyToMessageId);
+          const bodyWithReply = formatReplyContext({
+            body,
+            replyEntry,
+          });
+          const crossChatContext = buildCrossChatMemoryContext({
+            query: bodyWithReply,
+            historyCache,
+          });
+          const bodyForAgent = crossChatContext
+            ? [crossChatContext, bodyWithReply].filter(Boolean).join('\n\n')
+            : bodyWithReply;
+          const combinedBody = msgCtx.isGroup
+            ? buildHistoryContext({
+              entries: previousEntries,
+              currentBody: bodyForAgent,
+            })
+            : bodyForAgent;
+
+          recordHistory(body);
+
           // Resolve which agent handles this conversation
           const route = runtime.channel.routing.resolveAgentRoute({
             cfg,
             channel: 'bitrix24',
             accountId: ctx.accountId,
-            peer: {
-              kind: msgCtx.isDm ? 'direct' : 'group',
-              id: msgCtx.chatId,
-            },
+            peer: conversation.peer,
           });
 
           logger.debug('Resolved route', {
@@ -1512,12 +2074,19 @@ export const bitrix24Plugin = {
           });
 
           const inboundCtx = runtime.channel.reply.finalizeInboundContext({
-            Body: body,
-            BodyForAgent: body,
+            Body: combinedBody,
+            BodyForAgent: bodyForAgent,
+            InboundHistory: msgCtx.isGroup && previousEntries.length > 0
+              ? previousEntries.map((entry) => ({
+                sender: entry.sender,
+                body: entry.body,
+                timestamp: entry.timestamp,
+              }))
+              : undefined,
             RawBody: body,
-            From: `bitrix24:${msgCtx.chatId}`,
-            To: `bitrix24:${msgCtx.chatId}`,
-            SessionKey: `${route.sessionKey}:bitrix24:${msgCtx.chatId}`,
+            From: conversation.address,
+            To: conversation.address,
+            SessionKey: buildConversationSessionKey(route.sessionKey, conversation),
             AccountId: route.accountId,
             ChatType: msgCtx.isDm ? 'direct' : 'group',
             ConversationLabel: msgCtx.senderName,
@@ -1526,11 +2095,14 @@ export const bitrix24Plugin = {
             Provider: 'bitrix24',
             Surface: 'bitrix24',
             MessageSid: msgCtx.messageId,
-            Timestamp: Date.now(),
-            WasMentioned: false,
+            Timestamp: msgCtx.timestamp ?? Date.now(),
+            ReplyToId: replyEntry?.messageId ?? msgCtx.replyToMessageId,
+            ReplyToBody: replyEntry?.body,
+            ReplyToSender: replyEntry?.sender,
+            WasMentioned: msgCtx.wasMentioned ?? false,
             CommandAuthorized: true,
             OriginatingChannel: 'bitrix24',
-            OriginatingTo: `bitrix24:${msgCtx.chatId}`,
+            OriginatingTo: conversation.address,
             ...mediaFields,
           });
 
@@ -1548,7 +2120,7 @@ export const bitrix24Plugin = {
                       fileName: basename(mediaUrl),
                       webhookUrl,
                       bot,
-                      dialogId: msgCtx.chatId,
+                      dialogId: conversation.dialogId,
                     });
 
                     if (!uploadResult.ok) {
@@ -1594,26 +2166,113 @@ export const bitrix24Plugin = {
         onFlush: processAllowedMessage,
         logger,
       });
-      const maybeNotifyDeniedDialog = async (
-        dialogId: string,
-        language: string | undefined,
+      const maybeSendDialogNotice = async (
+        noticeKey: string,
         sendCtx: SendContext,
+        text: string,
       ): Promise<void> => {
         const now = Date.now();
-        const lastSentAt = deniedDialogs.get(dialogId) ?? 0;
+        const lastSentAt = dialogNoticeTimestamps.get(noticeKey) ?? 0;
         if ((now - lastSentAt) < ACCESS_DENIED_NOTICE_COOLDOWN_MS) {
           return;
         }
 
-        deniedDialogs.set(dialogId, now);
+        dialogNoticeTimestamps.set(noticeKey, now);
         try {
-          await sendService.sendText(
-            sendCtx,
-            personalBotOwnerOnly(language),
-            { convertMarkdown: false },
+          await sendService.sendText(sendCtx, text, { convertMarkdown: false });
+        } catch (err) {
+          logger.warn('Failed to send dialog notice', err);
+        }
+      };
+      const maybeReactToDeniedMention = async (msgCtx: B24MsgContext): Promise<void> => {
+        if (!msgCtx.isGroup || !msgCtx.wasMentioned) {
+          return;
+        }
+
+        const messageId = toMessageId(msgCtx.messageId);
+        if (!messageId) {
+          return;
+        }
+
+        try {
+          await api.addReaction(
+            webhookUrl,
+            bot,
+            messageId,
+            ACCESS_DENIED_REACTION,
+          );
+        } catch (err) {
+          logger.debug('Failed to add access-denied reaction', {
+            chatId: msgCtx.chatId,
+            messageId: msgCtx.messageId,
+            error: err,
+          });
+        }
+      };
+      const notifyWebhookOwnerAboutWatchMatch = async (
+        msgCtx: B24MsgContext,
+        watchRule: Bitrix24GroupWatchConfig | Bitrix24AgentWatchConfig,
+      ): Promise<boolean> => {
+        const ownerId = webhookOwnerId;
+        const forwardedMessageId = toMessageId(msgCtx.messageId);
+        if (!ownerId || !forwardedMessageId) {
+          logger.warn('Skipping owner watch notification: missing owner dialog or message id', {
+            ownerId,
+            messageId: msgCtx.messageId,
+            chatId: msgCtx.chatId,
+          });
+          return false;
+        }
+
+        const ownerSendCtx: SendContext = {
+          webhookUrl,
+          bot,
+          dialogId: ownerId,
+        };
+
+        const noticeText = watchOwnerDmNotice(msgCtx.language, {
+          chatRef: buildChatContextUrl(
+            msgCtx.chatId,
+            msgCtx.messageId,
+            msgCtx.isDm
+              ? (msgCtx.senderName || msgCtx.chatName || msgCtx.chatId)
+              : (msgCtx.chatName ?? msgCtx.chatId),
+          ),
+          topicsRef: buildTopicsBbCode(watchRule.topics),
+          sourceKind: msgCtx.isDm ? 'dm' : 'chat',
+        });
+
+        try {
+          await sendService.sendText(ownerSendCtx, noticeText, {
+            convertMarkdown: false,
+          });
+
+          if (msgCtx.eventScope === 'user' && msgCtx.isDm) {
+            const quoteText = buildWatchQuoteText({
+              senderName: msgCtx.senderName || msgCtx.chatName || msgCtx.chatId,
+              language: msgCtx.language,
+              timestamp: msgCtx.timestamp,
+              anchor: `#${msgCtx.chatId}:${ownerId}/${msgCtx.messageId}`,
+              body: msgCtx.text.trim(),
+            });
+
+            await sendService.sendText(ownerSendCtx, quoteText, {
+              convertMarkdown: false,
+            });
+            return true;
+          }
+
+          await api.sendMessage(
+            webhookUrl,
+            bot,
+            ownerId,
+            null,
+            { forwardMessages: [forwardedMessageId] },
           );
+          return true;
         } catch (err) {
-          logger.warn('Failed to send access denied notice', err);
+          logger.warn('Failed to send owner watch notification with native forward', err);
+          return false;
         }
       };
 
@@ -1649,20 +2308,6 @@ export const bitrix24Plugin = {
             ? directTextCoalescer.take(ctx.accountId, msgCtx.chatId)
             : null;
 
-          if (msgCtx.isGroup) {
-            logger.warn('Group chat is not supported, leaving chat', {
-              chatId: msgCtx.chatId,
-              senderId: msgCtx.senderId,
-            });
-
-            try {
-              await api.leaveChat(webhookUrl, bot, msgCtx.chatId);
-            } catch (err) {
-              logger.error('Failed to leave group chat after message', err);
-            }
-            return;
-          }
-
           const runtime = getBitrix24Runtime();
 
           // Pairing-aware access control
@@ -1671,73 +2316,233 @@ export const bitrix24Plugin = {
             bot,
             dialogId: msgCtx.chatId,
           };
-
-          const accessResult = await checkAccessWithPairing({
-            senderId: msgCtx.senderId,
+          const conversation = resolveConversationRef({
+            accountId: ctx.accountId,
             dialogId: msgCtx.chatId,
             isDirect: msgCtx.isDm,
-            config,
-            runtime,
-            accountId: ctx.accountId,
-            pairingAdapter: bitrix24Plugin.pairing,
-            sendReply: async (text: string) => {
-              await sendService.sendText(sendCtx, text, { convertMarkdown: false });
-            },
-            logger,
           });
+          const historyKey = conversation.historyKey;
+          const historyLimit = resolveHistoryLimit(config);
+          const groupAccess = msgCtx.isGroup
+            ? resolveGroupAccess({
+              config,
+              dialogId: msgCtx.chatId,
+              chatId: msgCtx.chatInternalId,
+            })
+            : null;
+          const agentWatchRules = config.agentMode && msgCtx.eventScope === 'user'
+            ? resolveAgentWatchRules({
+              config,
+              dialogId: msgCtx.chatId,
+              chatId: msgCtx.chatInternalId,
+            })
+            : [];
+          const watchRule = msgCtx.isGroup && groupAccess?.groupAllowed
+            ? findMatchingWatchRule(msgCtx, groupAccess?.watch)
+            : undefined;
+          const activeWatchRule = watchRule?.mode === 'notifyOwnerDm'
+            && webhookOwnerId
+            && msgCtx.senderId === webhookOwnerId
+            ? undefined
+            : watchRule;
+          const agentWatchRule = msgCtx.eventScope === 'user'
+            ? findMatchingWatchRule(msgCtx, agentWatchRules)
+            : undefined;
+
+          if (msgCtx.eventScope === 'user') {
+            const isBotDialogUserEvent = msgCtx.isDm && msgCtx.chatId === String(bot.botId);
+            const isBotAuthoredUserEvent = msgCtx.senderId === String(bot.botId);
+
+            if (isBotDialogUserEvent || isBotAuthoredUserEvent) {
+              logger.debug('Skipping agent-mode user event for bot-owned conversation', {
+                senderId: msgCtx.senderId,
+                chatId: msgCtx.chatId,
+                messageId: msgCtx.messageId,
+                isBotDialogUserEvent,
+                isBotAuthoredUserEvent,
+              });
+              return;
+            }
 
-          if (accessResult === 'deny') {
-            await sendService.markRead(sendCtx, toMessageId(msgCtx.messageId));
-            await maybeNotifyDeniedDialog(msgCtx.chatId, msgCtx.language, sendCtx);
-            logger.debug('Message blocked (deny)', { senderId: msgCtx.senderId, chatId: msgCtx.chatId });
+            appendMessageToHistory({
+              historyCache,
+              historyKey,
+              historyLimit,
+              msgCtx,
+            });
+
+            if (webhookOwnerId && msgCtx.senderId !== webhookOwnerId && agentWatchRule?.mode === 'notifyOwnerDm') {
+              await notifyWebhookOwnerAboutWatchMatch(msgCtx, agentWatchRule);
+              logger.debug('User-event watch matched and notified webhook owner in DM', {
+                senderId: msgCtx.senderId,
+                chatId: msgCtx.chatId,
+                messageId: msgCtx.messageId,
+              });
+            }
+            return;
+          }
+
+          if (msgCtx.isGroup && groupAccess?.groupPolicy === 'disabled') {
+            logger.info('Group chat is disabled by policy, leaving chat', {
+              chatId: msgCtx.chatId,
+              senderId: msgCtx.senderId,
+            });
+
+            try {
+              await sendService.sendText(sendCtx, groupChatUnsupported(msgCtx.language));
+              await api.leaveChat(webhookUrl, bot, msgCtx.chatId);
+            } catch (err) {
+              logger.error('Failed to leave disabled group chat', err);
+            }
             return;
           }
 
           await sendService.markRead(sendCtx, toMessageId(msgCtx.messageId));
-          await sendService.sendTyping(sendCtx);
 
-          if (accessResult !== 'allow') {
-            logger.debug(`Message blocked (${accessResult})`, { senderId: msgCtx.senderId });
+          if (
+            msgCtx.isGroup
+            && !activeWatchRule
+            && groupAccess?.requireMention
+            && !msgCtx.wasMentioned
+          ) {
+            appendMessageToHistory({
+              historyCache,
+              historyKey,
+              historyLimit,
+              msgCtx,
+            });
+
+            logger.info('Skipping group message without mention', {
+              chatId: msgCtx.chatId,
+              senderId: msgCtx.senderId,
+              messageId: msgCtx.messageId,
+            });
             return;
           }
 
-          if (msgCtx.isForwarded) {
-            if (pendingForwardContext) {
-              logger.info('Merging forwarded message with buffered context', {
-                senderId: msgCtx.senderId,
-                chatId: msgCtx.chatId,
-                previousMessageId: pendingForwardContext.messageId,
-                forwardedMessageId: msgCtx.messageId,
-              });
-              await processAllowedMessage(mergeForwardedMessageContext(pendingForwardContext, msgCtx));
-              return;
-            }
+          if (activeWatchRule?.mode === 'notifyOwnerDm') {
+            appendMessageToHistory({
+              historyCache,
+              historyKey,
+              historyLimit,
+              msgCtx,
+            });
 
-            logger.info('Forwarded message is not supported yet', {
+            await notifyWebhookOwnerAboutWatchMatch(msgCtx, activeWatchRule);
+            logger.debug('Group watch matched and notified webhook owner in DM', {
               senderId: msgCtx.senderId,
               chatId: msgCtx.chatId,
               messageId: msgCtx.messageId,
             });
-            await sendService.sendText(
+            return;
+          }
+
+          const accessResult = activeWatchRule
+            ? 'allow'
+            : msgCtx.isGroup
+            ? await checkGroupAccessWithPairing({
+              senderId: msgCtx.senderId,
+              dialogId: msgCtx.chatId,
+              chatId: msgCtx.chatInternalId,
+              config,
+              runtime,
+              accountId: ctx.accountId,
+              pairingAdapter: bitrix24Plugin.pairing,
+              logger,
+            })
+            : await checkAccessWithPairing({
+              senderId: msgCtx.senderId,
+              dialogId: msgCtx.chatId,
+              isDirect: msgCtx.isDm,
+              config,
+              runtime,
+              accountId: ctx.accountId,
+              pairingAdapter: bitrix24Plugin.pairing,
+              sendReply: async (text: string) => {
+                await sendService.sendText(sendCtx, text, { convertMarkdown: false });
+              },
+              logger,
+            });
+
+          if (accessResult === 'deny') {
+            if (msgCtx.isGroup) {
+              appendMessageToHistory({
+                historyCache,
+                historyKey,
+                historyLimit,
+                msgCtx,
+              });
+
+              if (!msgCtx.wasMentioned) {
+                logger.debug('Group message blocked silently without mention', {
+                  senderId: msgCtx.senderId,
+                  chatId: msgCtx.chatId,
+                  messageId: msgCtx.messageId,
+                });
+                return;
+              }
+            }
+
+            await maybeReactToDeniedMention(msgCtx);
+
+            const noticeKey = msgCtx.isDm
+              ? `deny:${msgCtx.chatId}`
+              : `group-deny:${msgCtx.chatId}:${msgCtx.senderId}`;
+            const policy = msgCtx.isDm
+              ? config.dmPolicy
+              : groupAccess?.groupPolicy;
+
+            await maybeSendDialogNotice(
+              noticeKey,
               sendCtx,
-              forwardedMessageUnsupported(msgCtx.language),
-              { convertMarkdown: false },
+              buildAccessDeniedNotice(msgCtx.language, policy, {
+                hasAllowList: msgCtx.isDm
+                  ? normalizeAllowList(config.allowFrom).length > 0
+                  : Boolean(groupAccess?.senderAllowFrom.length),
+              }),
             );
+            logger.debug('Message blocked (deny)', { senderId: msgCtx.senderId, chatId: msgCtx.chatId });
+            return;
+          }
+
+          if (accessResult === 'pairing') {
+            if (msgCtx.isGroup) {
+              appendMessageToHistory({
+                historyCache,
+                historyKey,
+                historyLimit,
+                msgCtx,
+              });
+
+              await maybeSendDialogNotice(
+                `group-pairing:${msgCtx.chatId}:${msgCtx.senderId}`,
+                sendCtx,
+                groupPairingPending(msgCtx.language),
+              );
+            }
+            logger.debug(`Message blocked (${accessResult})`, { senderId: msgCtx.senderId });
             return;
           }
 
-          if (msgCtx.replyToMessageId) {
-            logger.info('Reply-to-message is not supported yet', {
+          await sendService.sendTyping(sendCtx);
+
+          if (msgCtx.isForwarded) {
+            if (pendingForwardContext) {
+              const hydratedForwardContext = await hydrateForwardedMessageContext(msgCtx);
+              const mergedForwardContext = mergeForwardedMessageContext(
+                pendingForwardContext,
+                hydratedForwardContext,
+              );
+              await processAllowedMessage(mergedForwardContext);
+              return;
+            }
+
+            logger.info('Hydrating forwarded message context from Bitrix24 API', {
               senderId: msgCtx.senderId,
               chatId: msgCtx.chatId,
               messageId: msgCtx.messageId,
-              replyToMessageId: msgCtx.replyToMessageId,
             });
-            await sendService.sendText(
-              sendCtx,
-              replyMessageUnsupported(msgCtx.language),
-              { convertMarkdown: false },
-            );
+            await processAllowedMessage(await hydrateForwardedMessageContext(msgCtx));
             return;
           }
 
@@ -1758,11 +2563,16 @@ export const bitrix24Plugin = {
             commandText,
             senderId,
             dialogId,
+            chatId,
             chatType,
             messageId,
           } = cmdCtx;
           const isDm = chatType === 'P';
-          const peerId = isDm ? senderId : dialogId;
+          const conversation = resolveConversationRef({
+            accountId: ctx.accountId,
+            dialogId,
+            isDirect: isDm,
+          });
 
           logger.info('Inbound command', {
             commandId,
@@ -1771,13 +2581,14 @@ export const bitrix24Plugin = {
             commandText,
             senderId,
             dialogId,
-            peerId,
+            chatId,
+            conversationDialogId: conversation.dialogId,
           });
 
           const sendCtx: SendContext = {
             webhookUrl,
             bot,
-            dialogId: peerId,
+            dialogId: conversation.dialogId,
           };
 
           let runtime;
@@ -1799,28 +2610,46 @@ export const bitrix24Plugin = {
               commandDialogId: dialogId,
             }
             : null;
+          const groupAccess = !isDm
+            ? resolveGroupAccess({
+              config,
+              dialogId,
+              chatId,
+            })
+            : null;
 
           // Access control
           let accessResult;
           try {
-            accessResult = await checkAccessWithPairing({
-              senderId,
-              dialogId,
-              isDirect: isDm,
-              config,
-              runtime,
-              accountId: ctx.accountId,
-              pairingAdapter: bitrix24Plugin.pairing,
-              sendReply: async (text: string) => {
-                if (commandSendCtx) {
-                  await sendService.answerCommandText(commandSendCtx, text, { convertMarkdown: false });
-                  return;
-                }
+            accessResult = !isDm
+              ? await checkGroupAccessWithPairing({
+                senderId,
+                dialogId,
+                chatId,
+                config,
+                runtime,
+                accountId: ctx.accountId,
+                pairingAdapter: bitrix24Plugin.pairing,
+                logger,
+              })
+              : await checkAccessWithPairing({
+                senderId,
+                dialogId,
+                isDirect: isDm,
+                config,
+                runtime,
+                accountId: ctx.accountId,
+                pairingAdapter: bitrix24Plugin.pairing,
+                sendReply: async (text: string) => {
+                  if (commandSendCtx) {
+                    await sendService.answerCommandText(commandSendCtx, text, { convertMarkdown: false });
+                    return;
+                  }
 
-                await sendService.sendText(sendCtx, text, { convertMarkdown: false });
-              },
-              logger,
-            });
+                  await sendService.sendText(sendCtx, text, { convertMarkdown: false });
+                },
+                logger,
+              });
           } catch (err) {
             logger.error('Access check failed for command', err);
             return;
@@ -1830,7 +2659,16 @@ export const bitrix24Plugin = {
             logger.warn('Command event has invalid messageId, skipping response', { commandId, messageId, dialogId });
             return;
           }
-          const canMarkRead = dialogId === peerId;
+          const canMarkRead = true;
+
+          if (!isDm && groupAccess?.groupPolicy === 'disabled') {
+            await sendService.answerCommandText(
+              commandSendCtx,
+              groupChatUnsupported(cmdCtx.language),
+              { convertMarkdown: false },
+            );
+            return;
+          }
 
           await sendService.sendStatus(sendCtx, 'IMBOT_AGENT_ACTION_THINKING', 8);
 
@@ -1840,7 +2678,15 @@ export const bitrix24Plugin = {
             }
             await sendService.answerCommandText(
               commandSendCtx,
-              personalBotOwnerOnly(cmdCtx.language),
+              buildAccessDeniedNotice(
+                cmdCtx.language,
+                isDm ? config.dmPolicy : groupAccess?.groupPolicy,
+                {
+                  hasAllowList: isDm
+                    ? normalizeAllowList(config.allowFrom).length > 0
+                    : Boolean(groupAccess?.senderAllowFrom.length),
+                },
+              ),
               { convertMarkdown: false },
             );
             logger.debug('Command blocked (deny)', { senderId, dialogId });
@@ -1851,16 +2697,23 @@ export const bitrix24Plugin = {
             await sendService.markRead(sendCtx, commandMessageId);
           }
 
-          if (accessResult !== 'allow') {
+          if (accessResult === 'pairing') {
+            if (!isDm) {
+              await sendService.answerCommandText(
+                commandSendCtx,
+                groupPairingPending(cmdCtx.language),
+                { convertMarkdown: false },
+              );
+            }
             logger.debug(`Command blocked (${accessResult})`, { senderId });
             return;
           }
 
-          await directTextCoalescer.flush(ctx.accountId, peerId);
+          await directTextCoalescer.flush(ctx.accountId, conversation.dialogId);
 
           if (commandName === 'help' || commandName === 'commands') {
-            await sendService.sendText(
-              sendCtx,
+            await sendService.answerCommandText(
+              commandSendCtx,
               buildCommandsHelpText(cmdCtx.language, { concise: commandName === 'help' }),
               { keyboard: DEFAULT_COMMAND_KEYBOARD, convertMarkdown: false },
             );
@@ -1871,7 +2724,7 @@ export const bitrix24Plugin = {
             cfg,
             channel: 'bitrix24',
             accountId: ctx.accountId,
-            peer: { kind: isDm ? 'direct' : 'group', id: peerId },
+            peer: conversation.peer,
           });
 
           const slashSessionKey = `bitrix24:slash:${senderId}:${Date.now()}`;
@@ -1883,8 +2736,8 @@ export const bitrix24Plugin = {
             CommandBody: commandText,
             CommandAuthorized: true,
             CommandSource: 'native',
-            CommandTargetSessionKey: `${route.sessionKey}:bitrix24:${peerId}`,
-            From: `bitrix24:${peerId}`,
+            CommandTargetSessionKey: buildConversationSessionKey(route.sessionKey, conversation),
+            From: conversation.address,
             To: `slash:${senderId}`,
             SessionKey: slashSessionKey,
             AccountId: route.accountId,
@@ -1898,7 +2751,7 @@ export const bitrix24Plugin = {
             Timestamp: Date.now(),
             WasMentioned: true,
             OriginatingChannel: 'bitrix24',
-            OriginatingTo: `bitrix24:${peerId}`,
+            OriginatingTo: conversation.address,
           });
 
           const replyStatusHeartbeat = createReplyStatusHeartbeat({
@@ -1926,14 +2779,6 @@ export const bitrix24Plugin = {
                     });
                     if (!commandReplyDelivered) {
                       commandReplyDelivered = true;
-                      if (isDm) {
-                        await sendService.sendText(sendCtx, formattedPayload.text, {
-                          keyboard,
-                          convertMarkdown: formattedPayload.convertMarkdown,
-                        });
-                        return;
-                      }
-
                       await sendService.answerCommandText(commandSendCtx, formattedPayload.text, {
                         keyboard,
                         convertMarkdown: formattedPayload.convertMarkdown,
@@ -1963,12 +2808,16 @@ export const bitrix24Plugin = {
         },
 
         onJoinChat: async (joinCtx: FetchJoinChatContext) => {
-          const { dialogId, chatType, language } = joinCtx;
-          logger.info('Bot joined chat', { dialogId, chatType });
+          const { senderId, dialogId, chatId, chatType, language } = joinCtx;
+          logger.info('Bot joined chat', { senderId, dialogId, chatId, chatType });
 
           if (!dialogId) return;
+          const isGroupChat = chatType === 'chat' || chatType === 'open';
+          const groupAccess = isGroupChat
+            ? resolveGroupAccess({ config, dialogId, chatId })
+            : null;
 
-          if (shouldSkipJoinChatWelcome({
+          if (!isGroupChat && shouldSkipJoinChatWelcome({
             dialogId,
             chatType,
             webhookUrl,
@@ -1984,9 +2833,8 @@ export const bitrix24Plugin = {
             dialogId,
           };
 
-          // Reject group chats
-          if (chatType === 'chat' || chatType === 'open') {
-            logger.info('Group chat not supported, leaving', { dialogId });
+          if (isGroupChat && (!groupAccess?.groupAllowed || groupAccess.groupPolicy === 'disabled')) {
+            logger.info('Group chat blocked by policy, leaving', { dialogId });
             try {
               await sendService.sendText(sendCtx, groupChatUnsupported(language));
               await api.leaveChat(webhookUrl, bot, dialogId);
@@ -1996,6 +2844,45 @@ export const bitrix24Plugin = {
             return;
           }
 
+          if (isGroupChat) {
+            const runtime = getBitrix24Runtime();
+            const inviterAccessResult = await checkGroupAccessPassive({
+              senderId,
+              dialogId,
+              chatId,
+              config,
+              runtime,
+              accountId: ctx.accountId,
+              logger,
+            });
+
+            if (inviterAccessResult !== 'allow') {
+              const noticeText = inviterAccessResult === 'pairing'
+                ? groupPairingPending(language)
+                : buildAccessDeniedNotice(language, groupAccess?.groupPolicy, {
+                  hasAllowList: Boolean(groupAccess?.senderAllowFrom.length),
+                });
+
+              logger.info('Leaving group chat invited by user without access', {
+                dialogId,
+                chatId,
+                senderId,
+                inviterAccessResult,
+              });
+
+              try {
+                await sendService.sendText(sendCtx, noticeText, { convertMarkdown: false });
+                await api.leaveChat(webhookUrl, bot, dialogId);
+              } catch (err) {
+                logger.error('Failed to leave group chat after inviter access check', err);
+              }
+              return;
+            }
+
+            logger.info('Group chat enabled by policy, skipping auto-welcome', { dialogId });
+            return;
+          }
+
           if (welcomedDialogs.has(dialogId)) {
             logger.info('Skipping duplicate welcome for already welcomed dialog', { dialogId });
             return;
@@ -2037,6 +2924,7 @@ export const bitrix24Plugin = {
           accountId: ctx.accountId,
           pollingIntervalMs: config.pollingIntervalMs ?? 3000,
           pollingFastIntervalMs: config.pollingFastIntervalMs ?? 100,
+          withUserEvents: Boolean(config.agentMode),
           onEvent: async (event: B24V2FetchEventItem) => {
             const fetchCtx: FetchContext = {
               webhookUrl,