clawchef 0.1.10 → 0.1.12

package/README.md

@@ -14,6 +14,7 @@ Recipe-driven OpenClaw environment orchestrator.
 - When installed OpenClaw version mismatches recipe version, prompts: ignore / abort / force reinstall (silent mode auto-picks force reinstall).
 - Supports scoped execution via `--scope full|files|workspace`.
 - `full` scope runs factory reset first (with confirmation prompt unless `-s/--silent` is used).
+- Factory reset includes removing local `~/.openclaw` directory.
 - If `openclaw` is missing, auto-installs the recipe version and skips factory reset.
 - Starts OpenClaw gateway after each recipe execution based on `--gateway-mode`.
 - Creates workspaces and agents (default workspace path: `~/.openclaw/workspace-<workspace-name>`).
@@ -392,6 +393,7 @@ channels:
     token: "${telegram_bot_token}"
     account: "default"
     agent: "main"
+    group_policy: "allowlist"
 
   - channel: "telegram"
     token: "${alerts_bot_token}"
@@ -412,11 +414,13 @@ channels:
 Supported common fields:
 
 - required: `channel`
-- optional: `account`, `agent`, `name`, `token`, `token_file`, `use_env`, `bot_token`, `access_token`, `app_token`, `webhook_url`, `webhook_path`, `signal_number`, `password`, `login`, `login_mode`, `login_account`
+- optional: `account`, `agent`, `group_policy`, `name`, `token`, `token_file`, `use_env`, `bot_token`, `access_token`, `app_token`, `webhook_url`, `webhook_path`, `signal_number`, `password`, `login`, `login_mode`, `login_account`
 - advanced passthrough: `extra_flags` (`snake_case` keys become `--kebab-case` CLI flags)
 
 `channels[].agent` currently supports `channel: "telegram"` only.
 If `agent` is set and `account` is omitted, clawchef defaults `account` to the same value as `agent`.
+`channels[].group_policy` currently supports `channel: "telegram"` only and is applied after `channels add` via `openclaw config set` so it is not overwritten by add-flow writes.
+If `channel: "telegram"` has `token: ""` or `bot_token: ""`, clawchef auto-disables that telegram account (`enabled=false`) and skips channel add/bind.
 
 ## Workspace path behavior
 

package/dist/openclaw/command-provider.js

@@ -1,4 +1,4 @@
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -129,6 +129,28 @@ function parseVersionOutput(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+)\b/);
     return match?.[1] ?? output.trim();
 }
+function telegramGroupPolicyPath(account) {
+    const trimmed = account?.trim();
+    if (!trimmed) {
+        return "channels.telegram.groupPolicy";
+    }
+    return `channels.telegram.accounts[${trimmed}].groupPolicy`;
+}
+function telegramEnabledPath(account) {
+    const trimmed = account?.trim();
+    if (!trimmed) {
+        return "channels.telegram.enabled";
+    }
+    return `channels.telegram.accounts[${trimmed}].enabled`;
+}
+function shouldAutoDisableTelegramChannel(channel) {
+    if (channel.channel !== "telegram") {
+        return false;
+    }
+    const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+    const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+    return emptyToken || emptyBotToken;
+}
 async function chooseVersionMismatchAction(currentVersion, expectedVersion, silent) {
     if (silent) {
         return "force";
@@ -341,10 +363,13 @@ export class CommandOpenClawProvider {
     async factoryReset(config, dryRun) {
         const bin = config.bin ?? "openclaw";
         const resetCmd = commandFor(config, "factory_reset", { bin, version: config.version });
-        if (!resetCmd.trim()) {
-            return;
+        if (resetCmd.trim()) {
+            await runShell(resetCmd, dryRun);
+        }
+        const openclawHome = path.join(homedir(), ".openclaw");
+        if (!dryRun) {
+            await rm(openclawHome, { recursive: true, force: true });
         }
-        await runShell(resetCmd, dryRun);
     }
     async installPlugin(config, pluginSpec, dryRun) {
         const trimmed = pluginSpec.trim();
@@ -393,6 +418,12 @@ export class CommandOpenClawProvider {
     }
     async configureChannel(config, channel, dryRun) {
         const bin = config.bin ?? "openclaw";
+        if (shouldAutoDisableTelegramChannel(channel)) {
+            const enabledPath = telegramEnabledPath(channel.account);
+            const disableCmd = `${bin} config set ${shellQuote(enabledPath)} false --strict-json`;
+            await runShell(disableCmd, dryRun);
+            return;
+        }
         const enablePluginTemplate = config.commands?.enable_plugin;
         if (enablePluginTemplate?.trim()) {
             const enablePluginCmd = fillTemplate(enablePluginTemplate, {
@@ -443,6 +474,12 @@ export class CommandOpenClawProvider {
         }
         const cmd = `${bin} channels add ${flags.join(" ")}`;
         await runShell(cmd, dryRun);
+        if (channel.channel === "telegram" && channel.group_policy) {
+            const configPath = telegramGroupPolicyPath(channel.account);
+            const policyValue = JSON.stringify(channel.group_policy);
+            const setPolicyCmd = `${bin} config set ${shellQuote(configPath)} ${shellQuote(policyValue)} --strict-json`;
+            await runShell(setPolicyCmd, dryRun);
+        }
     }
     async bindChannelAgent(config, channel, agent, dryRun) {
         const account = channel.account?.trim();

package/dist/orchestrator.js

@@ -76,6 +76,14 @@ function isHttpUrl(value) {
         return false;
     }
 }
+function shouldAutoDisableTelegramChannel(channel) {
+    if (channel.channel !== "telegram") {
+        return false;
+    }
+    const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+    const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+    return emptyToken || emptyBotToken;
+}
 function isNotFoundError(err) {
     return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
@@ -314,7 +322,12 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
         const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
             ? { ...channel, account: channel.agent.trim() }
             : channel;
+        const autoDisabledTelegram = shouldAutoDisableTelegramChannel(effectiveChannel);
         await provider.configureChannel(recipe.openclaw, effectiveChannel, options.dryRun);
+        if (autoDisabledTelegram) {
+            logger.info(`Telegram channel disabled due to empty bot token: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
+            continue;
+        }
         logger.info(`Channel configured: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
         if (effectiveChannel.agent?.trim()) {
             await provider.bindChannelAgent(recipe.openclaw, effectiveChannel, effectiveChannel.agent, options.dryRun);

package/dist/recipe.js

@@ -44,6 +44,14 @@ const ALLOWED_CHANNELS = new Set([
 ]);
 const CHANNEL_SECRET_FIELDS = ["token", "bot_token", "access_token", "app_token", "password"];
 const TEMPLATE_TOKEN_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function hasExplicitEmptyTelegramToken(channel) {
+    if (channel.channel !== "telegram") {
+        return false;
+    }
+    const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+    const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+    return emptyToken || emptyBotToken;
+}
 function assertNoInlineSecrets(recipe) {
     const bootstrap = recipe.openclaw.bootstrap;
     if (bootstrap) {
@@ -193,6 +201,9 @@ function semanticValidate(recipe) {
             (channel.login || channel.login_mode !== undefined || channel.login_account !== undefined)) {
             throw new ClawChefError("channels[] entry for telegram does not support login/login_mode/login_account. Configure token (or use_env/token_file), then start gateway.");
         }
+        if (channel.group_policy !== undefined && channel.channel !== "telegram") {
+            throw new ClawChefError(`channels[] entry for ${channel.channel} does not support group_policy. Use channel: telegram.`);
+        }
         if (channel.agent?.trim()) {
             if (channel.channel !== "telegram") {
                 throw new ClawChefError(`channels[] entry for ${channel.channel} does not support agent binding. Use channel: telegram with agent.`);
@@ -219,6 +230,9 @@ function semanticValidate(recipe) {
                 }
                 return /(token|password|secret|api[_-]?key|webhook)/i.test(key) && String(value).trim().length > 0;
             });
+        if (hasExplicitEmptyTelegramToken(channel)) {
+            continue;
+        }
         if (!hasAuth) {
             throw new ClawChefError(`channels[] entry for ${channel.channel} requires at least one auth input (for example token/bot_token/access_token/token_file/use_env)`);
         }

package/dist/schema.d.ts

@@ -356,6 +356,7 @@ export declare const recipeSchema: z.ZodObject<{
         channel: z.ZodString;
         account: z.ZodOptional<z.ZodString>;
         agent: z.ZodOptional<z.ZodString>;
+        group_policy: z.ZodOptional<z.ZodEnum<["open", "allowlist", "disabled"]>>;
         login: z.ZodOptional<z.ZodBoolean>;
         login_mode: z.ZodOptional<z.ZodEnum<["interactive"]>>;
         login_account: z.ZodOptional<z.ZodString>;
@@ -376,6 +377,7 @@ export declare const recipeSchema: z.ZodObject<{
         token?: string | undefined;
         account?: string | undefined;
         agent?: string | undefined;
+        group_policy?: "open" | "allowlist" | "disabled" | undefined;
         login?: boolean | undefined;
         login_mode?: "interactive" | undefined;
         login_account?: string | undefined;
@@ -395,6 +397,7 @@ export declare const recipeSchema: z.ZodObject<{
         token?: string | undefined;
         account?: string | undefined;
         agent?: string | undefined;
+        group_policy?: "open" | "allowlist" | "disabled" | undefined;
         login?: boolean | undefined;
         login_mode?: "interactive" | undefined;
         login_account?: string | undefined;
@@ -572,6 +575,7 @@ export declare const recipeSchema: z.ZodObject<{
         token?: string | undefined;
         account?: string | undefined;
         agent?: string | undefined;
+        group_policy?: "open" | "allowlist" | "disabled" | undefined;
         login?: boolean | undefined;
         login_mode?: "interactive" | undefined;
         login_account?: string | undefined;
@@ -687,6 +691,7 @@ export declare const recipeSchema: z.ZodObject<{
         token?: string | undefined;
         account?: string | undefined;
         agent?: string | undefined;
+        group_policy?: "open" | "allowlist" | "disabled" | undefined;
         login?: boolean | undefined;
         login_mode?: "interactive" | undefined;
         login_account?: string | undefined;

package/dist/schema.js

@@ -102,14 +102,15 @@ const channelSchema = z
     channel: z.string().min(1),
     account: z.string().min(1).optional(),
     agent: z.string().min(1).optional(),
+    group_policy: z.enum(["open", "allowlist", "disabled"]).optional(),
     login: z.boolean().optional(),
     login_mode: z.enum(["interactive"]).optional(),
     login_account: z.string().min(1).optional(),
     name: z.string().min(1).optional(),
-    token: z.string().min(1).optional(),
+    token: z.string().optional(),
     token_file: z.string().min(1).optional(),
     use_env: z.boolean().optional(),
-    bot_token: z.string().min(1).optional(),
+    bot_token: z.string().optional(),
     access_token: z.string().min(1).optional(),
     app_token: z.string().min(1).optional(),
     webhook_url: z.string().min(1).optional(),

package/dist/types.d.ts

@@ -77,6 +77,7 @@ export interface ChannelDef {
     channel: string;
     account?: string;
     agent?: string;
+    group_policy?: "open" | "allowlist" | "disabled";
     login?: boolean;
     login_mode?: "interactive";
     login_account?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawchef",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Recipe-driven OpenClaw environment orchestrator",
   "homepage": "https://renorzr.github.io/clawchef",
   "repository": {

package/src/openclaw/command-provider.ts

@@ -1,4 +1,4 @@
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
@@ -178,6 +178,31 @@ function parseVersionOutput(output: string): string {
   return match?.[1] ?? output.trim();
 }
 
+function telegramGroupPolicyPath(account: string | undefined): string {
+  const trimmed = account?.trim();
+  if (!trimmed) {
+    return "channels.telegram.groupPolicy";
+  }
+  return `channels.telegram.accounts[${trimmed}].groupPolicy`;
+}
+
+function telegramEnabledPath(account: string | undefined): string {
+  const trimmed = account?.trim();
+  if (!trimmed) {
+    return "channels.telegram.enabled";
+  }
+  return `channels.telegram.accounts[${trimmed}].enabled`;
+}
+
+function shouldAutoDisableTelegramChannel(channel: ChannelDef): boolean {
+  if (channel.channel !== "telegram") {
+    return false;
+  }
+  const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+  const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+  return emptyToken || emptyBotToken;
+}
+
 type VersionMismatchChoice = "ignore" | "abort" | "force";
 
 async function chooseVersionMismatchAction(
@@ -440,10 +465,14 @@ export class CommandOpenClawProvider implements OpenClawProvider {
   async factoryReset(config: OpenClawSection, dryRun: boolean): Promise<void> {
     const bin = config.bin ?? "openclaw";
     const resetCmd = commandFor(config, "factory_reset", { bin, version: config.version });
-    if (!resetCmd.trim()) {
-      return;
+    if (resetCmd.trim()) {
+      await runShell(resetCmd, dryRun);
+    }
+
+    const openclawHome = path.join(homedir(), ".openclaw");
+    if (!dryRun) {
+      await rm(openclawHome, { recursive: true, force: true });
     }
-    await runShell(resetCmd, dryRun);
   }
 
   async installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void> {
@@ -498,6 +527,14 @@ export class CommandOpenClawProvider implements OpenClawProvider {
 
   async configureChannel(config: OpenClawSection, channel: ChannelDef, dryRun: boolean): Promise<void> {
     const bin = config.bin ?? "openclaw";
+
+    if (shouldAutoDisableTelegramChannel(channel)) {
+      const enabledPath = telegramEnabledPath(channel.account);
+      const disableCmd = `${bin} config set ${shellQuote(enabledPath)} false --strict-json`;
+      await runShell(disableCmd, dryRun);
+      return;
+    }
+
     const enablePluginTemplate = config.commands?.enable_plugin;
     if (enablePluginTemplate?.trim()) {
       const enablePluginCmd = fillTemplate(enablePluginTemplate, {
@@ -554,6 +591,13 @@ export class CommandOpenClawProvider implements OpenClawProvider {
 
     const cmd = `${bin} channels add ${flags.join(" ")}`;
     await runShell(cmd, dryRun);
+
+    if (channel.channel === "telegram" && channel.group_policy) {
+      const configPath = telegramGroupPolicyPath(channel.account);
+      const policyValue = JSON.stringify(channel.group_policy);
+      const setPolicyCmd = `${bin} config set ${shellQuote(configPath)} ${shellQuote(policyValue)} --strict-json`;
+      await runShell(setPolicyCmd, dryRun);
+    }
   }
 
   async bindChannelAgent(config: OpenClawSection, channel: ChannelDef, agent: string, dryRun: boolean): Promise<void> {

package/src/orchestrator.ts

@@ -8,7 +8,7 @@ import { validateReply } from "./assertions.js";
 import { ClawChefError } from "./errors.js";
 import { Logger } from "./logger.js";
 import { createProvider } from "./openclaw/factory.js";
-import type { Recipe, RunOptions } from "./types.js";
+import type { ChannelDef, Recipe, RunOptions } from "./types.js";
 import type { RecipeOrigin } from "./recipe.js";
 
 async function exists(filePath: string): Promise<boolean> {
@@ -84,6 +84,15 @@ function isHttpUrl(value: string): boolean {
   }
 }
 
+function shouldAutoDisableTelegramChannel(channel: ChannelDef): boolean {
+  if (channel.channel !== "telegram") {
+    return false;
+  }
+  const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+  const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+  return emptyToken || emptyBotToken;
+}
+
 function isNotFoundError(err: unknown): boolean {
   return typeof err === "object" && err !== null && "code" in err && (err as { code?: string }).code === "ENOENT";
 }
@@ -362,8 +371,16 @@ export async function runRecipe(
     const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
       ? { ...channel, account: channel.agent.trim() }
       : channel;
+    const autoDisabledTelegram = shouldAutoDisableTelegramChannel(effectiveChannel);
 
     await provider.configureChannel(recipe.openclaw, effectiveChannel, options.dryRun);
+    if (autoDisabledTelegram) {
+      logger.info(
+        `Telegram channel disabled due to empty bot token: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`,
+      );
+      continue;
+    }
+
     logger.info(`Channel configured: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
     if (effectiveChannel.agent?.trim()) {
       await provider.bindChannelAgent(recipe.openclaw, effectiveChannel, effectiveChannel.agent, options.dryRun);

package/src/recipe.ts

@@ -7,7 +7,7 @@ import YAML from "js-yaml";
 import { recipeSchema } from "./schema.js";
 import { ClawChefError } from "./errors.js";
 import { deepResolveTemplates } from "./template.js";
-import type { Recipe, RunOptions } from "./types.js";
+import type { ChannelDef, Recipe, RunOptions } from "./types.js";
 
 export type RecipeOrigin =
   | {
@@ -73,6 +73,15 @@ const CHANNEL_SECRET_FIELDS = ["token", "bot_token", "access_token", "app_token"
 
 const TEMPLATE_TOKEN_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
 
+function hasExplicitEmptyTelegramToken(channel: ChannelDef): boolean {
+  if (channel.channel !== "telegram") {
+    return false;
+  }
+  const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+  const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+  return emptyToken || emptyBotToken;
+}
+
 function assertNoInlineSecrets(recipe: Recipe): void {
   const bootstrap = recipe.openclaw.bootstrap;
   if (bootstrap) {
@@ -252,6 +261,12 @@ function semanticValidate(recipe: Recipe): void {
       );
     }
 
+    if (channel.group_policy !== undefined && channel.channel !== "telegram") {
+      throw new ClawChefError(
+        `channels[] entry for ${channel.channel} does not support group_policy. Use channel: telegram.`,
+      );
+    }
+
     if (channel.agent?.trim()) {
       if (channel.channel !== "telegram") {
         throw new ClawChefError(
@@ -285,6 +300,10 @@ function semanticValidate(recipe: Recipe): void {
         return /(token|password|secret|api[_-]?key|webhook)/i.test(key) && String(value).trim().length > 0;
       });
 
+    if (hasExplicitEmptyTelegramToken(channel)) {
+      continue;
+    }
+
     if (!hasAuth) {
       throw new ClawChefError(
         `channels[] entry for ${channel.channel} requires at least one auth input (for example token/bot_token/access_token/token_file/use_env)`,

package/src/schema.ts

@@ -112,14 +112,15 @@ const channelSchema = z
     channel: z.string().min(1),
     account: z.string().min(1).optional(),
     agent: z.string().min(1).optional(),
+    group_policy: z.enum(["open", "allowlist", "disabled"]).optional(),
     login: z.boolean().optional(),
     login_mode: z.enum(["interactive"]).optional(),
     login_account: z.string().min(1).optional(),
     name: z.string().min(1).optional(),
-    token: z.string().min(1).optional(),
+    token: z.string().optional(),
     token_file: z.string().min(1).optional(),
     use_env: z.boolean().optional(),
-    bot_token: z.string().min(1).optional(),
+    bot_token: z.string().optional(),
     access_token: z.string().min(1).optional(),
     app_token: z.string().min(1).optional(),
     webhook_url: z.string().min(1).optional(),

package/src/types.ts

@@ -85,6 +85,7 @@ export interface ChannelDef {
   channel: string;
   account?: string;
   agent?: string;
+  group_policy?: "open" | "allowlist" | "disabled";
   login?: boolean;
   login_mode?: "interactive";
   login_account?: string;