clawgram 2.21.0 → 2.22.0

package/dist/channel.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createChannelPlugin = exports.CORE_ACTION_SYNONYMS = void 0;
+exports.canonicalAction = canonicalAction;
 const core_1 = require("openclaw/plugin-sdk/core");
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -20,7 +21,10 @@ const INBOUND_MEDIA_MAX_BYTES = 25 * 1024 * 1024;
  * that a chat full of images does not silently become a copy of itself in the
  * temp directory.
  */
-const FETCHED_MEDIA_TTL_MS = 24 * 60 * 60 * 1000;
+// Час, а не сутки: `fetch-media` существует ради «прочитать и переслать», и
+// файл нужен ровно на время хода. Сутки означали сутки чужой личной переписки
+// на диске (A5-13).
+const FETCHED_MEDIA_TTL_MS = 60 * 60 * 1000;
 /**
  * What this channel promises the Gateway.
  *
@@ -67,11 +71,13 @@ const constants_1 = require("./constants");
 const gramjs_client_1 = require("./gramjs-client");
 const normalize_1 = require("./normalize");
 const history_1 = require("./history");
+const send_scope_1 = require("./send-scope");
 const joins_1 = require("./joins");
 const reactions_1 = require("./reactions");
 const manage_1 = require("./manage");
 const silent_reaction_1 = require("./silent-reaction");
 const system_notice_1 = require("./system-notice");
+const state_dir_1 = require("./state-dir");
 const chat_info_1 = require("./chat-info");
 const topics_1 = require("./topics");
 const dialogs_1 = require("./dialogs");
@@ -159,12 +165,71 @@ function readAccountReadChats(account) {
 function resolveAccountReadChats(cfg, accountId) {
     return readAccountReadChats(cfg?.channels?.["clawgram"]?.accounts?.[accountId]);
 }
+/**
+ * Outbound scope as configured. Handed to `isChatSendable` raw: an absent
+ * value means "unrestricted" and an empty list means "deny", and only the
+ * raw value tells those apart — same shape as `readChats`.
+ */
+/**
+ * Хэндл в `allowFrom` — обещание, которое Telegram не держит.
+ *
+ * Запись `@username` утверждает не про человека, а про хэндл: хэндл можно
+ * освободить, и тогда его берёт кто угодно — запись начинает пускать
+ * постороннего, ничего об этом не сказав. Числовой id так не переходит из рук
+ * в руки. Отказываться от хэндлов нельзя (люди пишут ими, и конфиг у многих
+ * уже такой), но молчать об этом тоже не годится — поэтому предупреждение
+ * один раз при старте аккаунта (находка A5-16).
+ */
+function warnAboutHandleAllowlistEntries(cfg, accountId) {
+    const account = cfg?.channels?.["clawgram"]?.accounts?.[accountId];
+    const entries = Array.isArray(account?.allowFrom) ? account.allowFrom : [];
+    const handles = entries
+        .map((entry) => String(entry ?? "").trim())
+        .filter((entry) => entry.startsWith("@"));
+    if (handles.length === 0) {
+        return;
+    }
+    actionLog.warn("clawgram allowFrom names handles, not ids", {
+        accountId,
+        // Сами хэндлы — это про людей: в лог уходит только их число.
+        handleEntries: handles.length,
+        why: "a released handle can be taken by someone else; numeric ids do not change hands",
+    });
+}
+function resolveAccountSendChats(cfg, accountId) {
+    return cfg?.channels?.["clawgram"]?.accounts?.[accountId]?.sendChats;
+}
+/** One refusal for every outbound action, so the three read the same. */
+function refuseOutboundOutsideScope(action, accountId, target) {
+    const reason = (0, send_scope_1.isPhoneNumberTarget)(target) ? "phone-number target" : "chat outside send scope";
+    actionLog.warn(`clawgram ${action} refused: ${reason}`, { accountId, target });
+    throw new Error(`clawgram: not-allowed-chat ${target}`);
+}
 /**
  * Management scope as configured. Handed to `isChatManageable` raw: unlike
  * `readChats`, an absent value already means "deny", so there is nothing to
  * tell apart here.
  */
 /** Chat discovery as configured; absent means "deny", like management scope. */
+/**
+ * Кому уходит операционная телеметрия ядра в личке.
+ *
+ * `operatorIds` — если задан. Иначе `allowFrom`, но только когда это
+ * конкретный список: со звёздочкой он означает «пишет кто угодно», и слать
+ * туда пути secret-store нельзя (A5-11). Пустой результат означает «оператор
+ * не назван», и уведомление подавляется везде.
+ *
+ * Запоминается при старте аккаунта — см. реестр в system-notice.ts.
+ */
+function resolveAccountOperatorIds(cfg, accountId) {
+    const account = cfg?.channels?.["clawgram"]?.accounts?.[accountId];
+    const explicit = account?.operatorIds;
+    const raw = explicit !== undefined && explicit !== null ? explicit : account?.allowFrom;
+    if (raw === undefined || raw === null)
+        return [];
+    const entries = Array.isArray(raw) ? raw : [raw];
+    return entries.map((entry) => String(entry).trim()).filter(Boolean);
+}
 function resolveAccountDiscoverChats(cfg, accountId) {
     return cfg?.channels?.["clawgram"]?.accounts?.[accountId]?.discoverChats;
 }
@@ -180,55 +245,62 @@ function readAccountManageChats(account) {
     return entries.map((entry) => String(entry).trim()).filter(Boolean);
 }
 /**
- * Core's own name for a clawgram action, and the only thing that makes the
- * action reachable from the agent's `message` tool.
+ * Every accepted spelling of an action, mapped to its canonical name.
  *
- * Core keys its target policy by `CHANNEL_MESSAGE_ACTION_NAMES`, and an action
- * outside that vocabulary is simultaneously "requires a target" and "does not
- * accept a target" — there is no call that satisfies both. Declaring `chatId`
- * through `messageActionTargetAliases` looks like the fix and is not: core
- * resolves the channel with `getBootstrapChannelPlugin`, which only knows
- * bundled channels, so a plugin channel's declaration is never read. Measured
- * on 2026-08-30 — `thread-list` reached `handleAction` and `topics` did not,
- * from the same caller, on the same chat.
+ * One table, not three. The synonyms used to live in
+ * `CORE_ACTION_SYNONYMS`, again in `MANAGE_ACTION_ALIASES`, and a third time
+ * as `action === "…" || …` chains inside the dispatcher — and the dispatcher
+ * read only the chains. A name could therefore be added to a table and to the
+ * advertised list and still reach nothing, with the suite none the wiser:
+ * it only ever dispatched the native spellings (finding A6-10).
  *
- * Every name on the right maps to core target mode `"none"` except
- * `channel-info`, which is `"channelId"`: the chat arrives in
- * `params.channelId`, a spelling no parser here read until 2.21.0 — so the
- * call fell through to the current chat and answered about the wrong one.
- * `readChatTargetParam` is the single list of accepted spellings now.
+ * `canonicalAction` is now the only place a name is resolved, and
+ * `CORE_ACTION_SYNONYMS` below is derived from this table rather than kept
+ * beside it.
  */
-exports.CORE_ACTION_SYNONYMS = {
+const ACTION_ALIASES = {
+    send: "send",
+    read: "read",
+    // `list` is accepted so a caller that guessed the other obvious name is not
+    // silently refused.
+    list: "read",
+    react: "react",
+    joins: "joins",
+    "upload-file": "upload-file",
+    sendAttachment: "upload-file",
+    "fetch-media": "fetch-media",
+    fetchMedia: "fetch-media",
+    "download-media": "fetch-media",
+    downloadMedia: "fetch-media",
+    getMedia: "fetch-media",
+    "download-file": "fetch-media",
+    participants: "participants",
+    members: "participants",
+    "member-info": "participants",
+    topics: "topics",
+    forumTopics: "topics",
     "thread-list": "topics",
+    dialogs: "dialogs",
+    chats: "dialogs",
     "channel-list": "dialogs",
+    chatInfo: "chatInfo",
+    getChatInfo: "chatInfo",
     "channel-info": "chatInfo",
-    "member-info": "participants",
-    "download-file": "fetch-media",
+    chatMetadata: "chatInfo",
+    getChatMetadata: "chatInfo",
     // Chat management. `kick` was already accepted; the rest were advertised
     // under names core does not know and were therefore never callable from the
     // tool at all — 2.19.4 gives them core's nearest name. `transferOwnership`
     // and `inviteLink` have no counterpart in that vocabulary and stay
     // gateway-only, as does `joins`.
-    "channel-create": "createGroup",
-    addParticipant: "addMembers",
-    kick: "removeMember",
-    "role-add": "promoteAdmin",
-    "role-remove": "demoteAdmin",
-};
-/** Canonical management action for every accepted spelling. */
-const MANAGE_ACTION_ALIASES = {
-    // Core's spellings first — these are the only ones the agent's tool can
-    // reach; see CORE_ACTION_SYNONYMS.
-    "channel-create": "createGroup",
-    addParticipant: "addMembers",
-    "role-add": "promoteAdmin",
-    "role-remove": "demoteAdmin",
     createGroup: "createGroup",
     createChat: "createGroup",
     "create-group": "createGroup",
+    "channel-create": "createGroup",
     addMembers: "addMembers",
     addMember: "addMembers",
     "add-members": "addMembers",
+    addParticipant: "addMembers",
     removeMember: "removeMember",
     removeMembers: "removeMember",
     "remove-member": "removeMember",
@@ -237,9 +309,11 @@ const MANAGE_ACTION_ALIASES = {
     promote: "promoteAdmin",
     "promote-admin": "promoteAdmin",
     setAdmin: "promoteAdmin",
+    "role-add": "promoteAdmin",
     demoteAdmin: "demoteAdmin",
     demote: "demoteAdmin",
     "demote-admin": "demoteAdmin",
+    "role-remove": "demoteAdmin",
     transferOwnership: "transferOwnership",
     transferOwner: "transferOwnership",
     "transfer-ownership": "transferOwnership",
@@ -247,6 +321,43 @@ const MANAGE_ACTION_ALIASES = {
     exportInviteLink: "inviteLink",
     "invite-link": "inviteLink",
 };
+/** The canonical action for a spelling; an unknown name stays itself. */
+function canonicalAction(action) {
+    return ACTION_ALIASES[action] ?? action;
+}
+/**
+ * Core's own name for a clawgram action, and the only thing that makes the
+ * action reachable from the agent's `message` tool.
+ *
+ * Core keys its target policy by `CHANNEL_MESSAGE_ACTION_NAMES`, and an action
+ * outside that vocabulary is simultaneously "requires a target" and "does not
+ * accept a target" — there is no call that satisfies both. Declaring `chatId`
+ * through `messageActionTargetAliases` looks like the fix and is not: core
+ * resolves the channel with `getBootstrapChannelPlugin`, which only knows
+ * bundled channels, so a plugin channel's declaration is never read. Measured
+ * on 2026-08-30 — `thread-list` reached `handleAction` and `topics` did not,
+ * from the same caller, on the same chat.
+ *
+ * Every name on the right maps to core target mode `"none"` except
+ * `channel-info`, which is `"channelId"`: the chat arrives in
+ * `params.channelId`, a spelling no parser here read until 2.21.0 — so the
+ * call fell through to the current chat and answered about the wrong one.
+ * `readChatTargetParam` is the single list of accepted spellings now.
+ *
+ * These spellings are derived from `ACTION_ALIASES` rather than kept beside
+ * it; that core actually knows each of them is asserted against the installed
+ * core in `core-action-synonyms.test.ts`.
+ */
+const CORE_VOCABULARY_SPELLINGS = [
+    "thread-list", "channel-list", "channel-info", "member-info", "download-file",
+    "channel-create", "addParticipant", "kick", "role-add", "role-remove",
+];
+exports.CORE_ACTION_SYNONYMS = Object.fromEntries(CORE_VOCABULARY_SPELLINGS.map((name) => [name, ACTION_ALIASES[name]]));
+/** Canonical actions that go through the chat-management gate. */
+const MANAGE_ACTIONS = new Set([
+    "createGroup", "addMembers", "removeMember",
+    "promoteAdmin", "demoteAdmin", "transferOwnership", "inviteLink",
+]);
 function parseOptionalThreadId(value) {
     if (typeof value === "number") {
         return Number.isFinite(value) ? Math.trunc(value) : undefined;
@@ -285,9 +396,7 @@ function parseOptionalThreadId(value) {
  * the caller degrade instead of throwing.
  */
 function resolveAgentDirForMedia(cfg) {
-    const stateDir = typeof process.env.OPENCLAW_STATE_DIR === "string" && process.env.OPENCLAW_STATE_DIR.trim()
-        ? process.env.OPENCLAW_STATE_DIR.trim()
-        : node_path_1.default.join(node_os_1.default.homedir(), ".openclaw");
+    const stateDir = (0, state_dir_1.resolveStateDir)();
     const configuredId = cfg?.agents?.defaults?.id;
     const agentId = typeof configuredId === "string" && configuredId.trim() ? configuredId.trim() : "main";
     const dir = node_path_1.default.join(stateDir, "agents", agentId, "agent");
@@ -451,6 +560,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 "Use the `react` action to acknowledge a message with an emoji instead of sending a reply; pass an empty `emoji` (or `remove: true`) to take the reaction back.",
                 "Use the `channel-info` action to learn what a chat is — title, type, member count, description, pinned message — instead of guessing from its id. Name the chat with `chatId` and do not pass `target`: core refuses it for this action, and the descriptive spelling `chatInfo` is not callable from this tool at all.",
                 "Use the `thread-list` action to list a forum's topics by name (optional `query` narrows by title); that is where a `threadId` comes from when someone names a topic instead of quoting a message in it. Name the chat with `chatId` and do not pass `target` — core refuses it for this action. `topics` is the same call under a name core does not know, and is only reachable through the gateway RPC.",
+                "Name the chat for `read` with `target`, never `chatId`: `read` is in core's own vocabulary, so core resolves the destination itself and reads only `to`/`target` — `chatId` is silently ignored and the call is refused as targetless. The chat-shaped reads next to it (`thread-list`, `channel-info`, `member-info`) are the opposite, because core does not know them; that asymmetry is core's, not a typo, and it cost 745 refused reads in the week before 2026-09-04.",
                 "Pass that `threadId` to `read` as well: without it a forum read returns every topic interleaved rather than the one that was asked about.",
                 "Use the `download-file` action to fetch the attachment on a message `read` reported. Name the chat with `chatId` and the message with `messageId`; do not pass `target` — core refuses it for this action: `mode: \"read\"` returns a description of an image or a transcript of a voice note, `\"file\"` returns a path to reuse, `\"both\"` (default) returns both. `read` only says an attachment exists; this is what brings it.",
                 "Use the `channel-list` action to find out which group chats this account is actually in — including ones nobody has configured yet. It reports id, title and type only, never direct chats, and only when the account enables `discoverChats`.",
@@ -550,6 +660,11 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 const gram = new gramjs_client_1.GramJsClientManager(resolvedAccount);
                 await gram.start();
                 runtimes.set(accountId, gram);
+                (0, system_notice_1.rememberOperatorIds)(accountId, resolveAccountOperatorIds(cfg, accountId));
+                // Область отправки — туда же и по той же причине: в `outbound.*`
+                // конфига нет, а барьер нужен и на пути доставки ядра (A5-12).
+                (0, send_scope_1.rememberSendScope)(accountId, resolveAccountSendChats(cfg, accountId));
+                warnAboutHandleAllowlistEntries(cfg, accountId);
                 const pairing = (0, channel_pairing_1.createChannelPairingController)({
                     // The controller only reads core.channel.pairing, but its parameter is typed
                     // as the full PluginRuntime, and ctx (hence channelRuntime) is untyped.
@@ -1032,6 +1147,25 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                                                 });
                                                 return;
                                             }
+                                            // Ядро подклеивает свою телеметрию к полезной нагрузке
+                                            // хода, и сюда она приходит тем же путём, что ответ.
+                                            // Проверка стояла только в `outbound.sendText`, то есть
+                                            // класс инцидента 30.08–01.09 был закрыт для рассылок и
+                                            // открыт для обычного ответа на упоминание (A5-10).
+                                            const groupNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
+                                                targetKind: "group",
+                                                text: visibleText,
+                                            });
+                                            if (groupNotice) {
+                                                log?.warn?.("clawgram suppressing system notice in group reply", {
+                                                    accountId,
+                                                    chatId: normalized.chatId,
+                                                    messageId: normalized.messageId,
+                                                    noticeKind: groupNotice,
+                                                    textLength: visibleText.length,
+                                                });
+                                                return;
+                                            }
                                             const replyToMessageId = payload.replyToId ? Number(payload.replyToId) : Number(normalized.messageId);
                                             const rememberedAddress = (0, group_reply_address_1.consumeGroupReplyAddress)({
                                                 accountId: route.accountId ?? accountId,
@@ -1085,9 +1219,24 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                                     // `[[tts:text]]Привет, Вася!…[[/tts:text]]` verbatim. The
                                     // spoken words are kept — a synthesis that did not happen
                                     // should degrade to readable text, not to markup.
-                                    const visibleFallbackText = fallbackText
+                                    const rawFallback = fallbackText
                                         ? (0, helpers_1.stripTtsDirectives)((0, helpers_1.stripSilentReplyToken)(fallbackText))
                                         : "";
+                                    // Тот же фильтр и здесь: последняя реплика в стенограмме
+                                    // вполне может оказаться именно уведомлением об ошибке.
+                                    const fallbackNotice = rawFallback
+                                        ? (0, system_notice_1.shouldSuppressGroupSystemNotice)({ targetKind: "group", text: rawFallback })
+                                        : undefined;
+                                    if (fallbackNotice) {
+                                        log?.warn?.("clawgram suppressing system notice in transcript fallback", {
+                                            accountId,
+                                            chatId: normalized.chatId,
+                                            messageId: normalized.messageId,
+                                            noticeKind: fallbackNotice,
+                                            textLength: rawFallback.length,
+                                        });
+                                    }
+                                    const visibleFallbackText = fallbackNotice ? "" : rawFallback;
                                     if (!visibleFallbackText) {
                                         if (fallbackText) {
                                             log?.info?.("clawgram skipping silent transcript fallback", {
@@ -1569,10 +1718,14 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // Both count, because a rehearsal flag that is silently ignored puts
                 // a real message in a real chat — twice, so far (2.13.1).
                 const dryRun = (0, helpers_1.resolveDryRun)(dryRunFlag, params);
+                // Every branch below compares the canonical name, so a spelling is
+                // resolved once, here, and `ACTION_ALIASES` is the only place that
+                // decides what a name means. An unknown name stays itself and falls
+                // through to the unsupported-action error, as before.
+                const canonical = canonicalAction(action);
                 // `read` is what OpenClaw core dispatches (`openclaw message read`,
-                // MCP `messages_read`). `list` is accepted as a synonym so a caller that
-                // guessed the other obvious name is not silently refused.
-                if (action === "read" || action === "list") {
+                // MCP `messages_read`); `list` resolves to it too.
+                if (canonical === "read") {
                     const listParams = (0, history_1.parseListMessagesParams)(params);
                     const listAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!listAccountId) {
@@ -1621,9 +1774,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // channel and unreachable to the agent. Same `readChats` scope as
                 // history: this must not become a way to pull bytes out of a chat the
                 // account was never allowed to read.
-                if (action === "fetch-media" || action === "fetchMedia" ||
-                    action === "download-media" || action === "downloadMedia" ||
-                    action === "getMedia" || action === "download-file") {
+                if (canonical === "fetch-media") {
                     const fetchParams = (0, fetch_media_1.parseFetchMediaParams)(params);
                     const fetchAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!fetchAccountId) {
@@ -1664,11 +1815,21 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                     // the shared directory is keyed by chat and message, and deleting
                     // that path would pull the file out from under an earlier `both`
                     // fetch of the same message that handed the caller a path.
-                    const sharedFetchDir = node_path_1.default.join(node_os_1.default.tmpdir(), "clawgram-fetched");
+                    // Не общий /tmp: там файлы видит каждый локальный пользователь, а на
+                    // этом хосте живёт ещё и раннер деплоя. Каталог состояния OpenClaw
+                    // принадлежит агенту; если он не задан, остаётся /tmp — но права
+                    // 0700/0600 ставятся в любом случае (A5-13).
+                    // Каталог состояния принадлежит агенту; при явно заданном
+                    // OPENCLAW_STATE_DIR вложения не покидают его.
+                    const mediaRoot = process.env.OPENCLAW_STATE_DIR?.trim()
+                        ? node_path_1.default.join((0, state_dir_1.resolveStateDir)(), "tmp")
+                        : node_os_1.default.tmpdir();
+                    const sharedFetchDir = node_path_1.default.join(mediaRoot, "clawgram-fetched");
                     let fetchDir = sharedFetchDir;
                     if (fetchParams.mode === "read") {
-                        const { mkdtemp } = await import("node:fs/promises");
-                        fetchDir = await mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), "clawgram-media-"));
+                        const { mkdtemp, mkdir } = await import("node:fs/promises");
+                        await mkdir(mediaRoot, { recursive: true, mode: 0o700 });
+                        fetchDir = await mkdtemp(node_path_1.default.join(mediaRoot, "clawgram-media-"));
                     }
                     else {
                         await (0, media_1.pruneFetchedMedia)(sharedFetchDir, FETCHED_MEDIA_TTL_MS, Date.now());
@@ -1775,7 +1936,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // Membership is a read, so the same `readChats` scope that gates history
                 // gates it too: this cannot become a way to enumerate chats the account
                 // was never allowed to read.
-                if (action === "participants" || action === "members" || action === "member-info") {
+                if (canonical === "participants") {
                     const participantsParams = (0, history_1.parseListParticipantsParams)(params);
                     const participantsAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!participantsAccountId) {
@@ -1815,7 +1976,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // id could only be lifted off an inbound message — so a topic nobody had
                 // written in yet was unreachable, and one named in words was unfindable.
                 // Titles say what a chat is working on, so the read scope gates them.
-                if (action === "topics" || action === "forumTopics" || action === "thread-list") {
+                if (canonical === "topics") {
                     const topicsParams = (0, topics_1.parseTopicsParams)(params);
                     const topicsAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!topicsAccountId) {
@@ -1852,7 +2013,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // Which chats this account is in. Not gated by `readChats` — the whole
                 // point is to find chats that are not in it yet — so it has a gate of
                 // its own, is metadata only, and never reports direct chats.
-                if (action === "dialogs" || action === "chats" || action === "channel-list") {
+                if (canonical === "dialogs") {
                     const dialogsParams = (0, dialogs_1.parseDialogsParams)(params);
                     const dialogsAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!dialogsAccountId) {
@@ -1888,7 +2049,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // Where this account was recently added, and by whom. Reading the journal
                 // has no scope check of its own: it only ever contains chats this account
                 // was put into, which is exactly what the caller is allowed to learn.
-                if (action === "joins") {
+                if (canonical === "joins") {
                     const joinsParams = (0, joins_1.parseJoinsParams)(params);
                     const joinsAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!joinsAccountId) {
@@ -1912,8 +2073,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // Describing a chat is a read, so the same `readChats` scope that gates
                 // history gates it too — this must not become a way to learn the title
                 // and size of a chat the account was never allowed to read.
-                if (action === "chatInfo" || action === "getChatInfo" || action === "channel-info"
-                    || action === "chatMetadata" || action === "getChatMetadata") {
+                if (canonical === "chatInfo") {
                     const chatInfoParams = (0, chat_info_1.parseChatInfoParams)(params, toolContext);
                     const chatInfoAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!chatInfoAccountId) {
@@ -1949,12 +2109,17 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // A reaction is an outbound act on someone else's message, so it is
                 // gated like sending rather than like reading — and it respects
                 // `dryRun`, which reading does not need to.
-                if (action === "react") {
+                if (canonical === "react") {
                     const reactionParams = (0, reactions_1.parseReactionParams)(params, toolContext);
                     const reactionAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!reactionAccountId) {
                         throw new Error("clawgram: no configured account found");
                     }
+                    // Реакция — видимое действие от имени владельца в чужом чате, и
+                    // адресуется она так же, как сообщение: та же область (A5-12).
+                    if (!(0, send_scope_1.isChatSendable)(reactionParams.target, resolveAccountSendChats(cfg, reactionAccountId))) {
+                        refuseOutboundOutsideScope("react", reactionAccountId, String(reactionParams.target));
+                    }
                     actionLog.info("clawgram handleAction react", {
                         accountId: reactionAccountId,
                         dryRun: dryRun === true,
@@ -1999,7 +2164,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // returns after the gate so a dry run exercises the same refusals a
                 // real call would hit. People's ids stay out of the logs throughout;
                 // the JSON result carries them to the caller, the journal does not.
-                const manageAction = MANAGE_ACTION_ALIASES[action];
+                const manageAction = MANAGE_ACTIONS.has(canonical) ? canonical : undefined;
                 if (manageAction) {
                     const manageAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!manageAccountId) {
@@ -2210,13 +2375,17 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 // and arrives from older callers. A plain `send` carrying a file lands
                 // here too — `openclaw message send --media` does exactly that, and
                 // routing it to the text path dropped the file without a word.
-                if (action === "upload-file" || action === "sendAttachment" || (action === "send" && attachedFile)) {
+                if (canonical === "upload-file" || (canonical === "send" && attachedFile)) {
                     const rawUploadTo = (0, helpers_1.resolveActionTarget)(params, toolContext);
                     const uploadTo = (0, helpers_1.normalizeOutboundTarget)(rawUploadTo);
                     const uploadAccountId = resolveRuntimeAccountId(cfg, accountId);
                     if (!uploadAccountId) {
                         throw new Error("clawgram: no configured account found");
                     }
+                    // Та же граница, что у `send`: файл наружу — такое же исходящее.
+                    if (!(0, send_scope_1.isChatSendable)(uploadTo, resolveAccountSendChats(cfg, uploadAccountId))) {
+                        refuseOutboundOutsideScope("upload-file", uploadAccountId, uploadTo);
+                    }
                     const file = attachedFile;
                     if (!file) {
                         throw new Error("clawgram: upload-file requires filePath, path, media, or mediaUrl");
@@ -2306,6 +2475,12 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 if (!resolvedAccountId) {
                     throw new Error("clawgram: no configured account found");
                 }
+                // Проверка ПОСЛЕ резолва аккаунта и ДО любой доставки: область задаётся
+                // на аккаунт, а отказ должен случиться раньше, чем цель разрешена в
+                // Telegram-сущность — resolve сам по себе виден собеседнику (A5-12).
+                if (!(0, send_scope_1.isChatSendable)(to, resolveAccountSendChats(cfg, resolvedAccountId))) {
+                    refuseOutboundOutsideScope("send", resolvedAccountId, to);
+                }
                 const currentChannelId = toolContext?.currentChannelId?.trim() ?? "";
                 const currentMessageId = toolContext?.currentMessageId;
                 const currentChannelTarget = currentChannelId ? (0, helpers_1.normalizeOutboundTarget)(currentChannelId) : "";
@@ -2459,7 +2634,23 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                     if (!raw) {
                         return { ok: false, error: new Error("clawgram: no delivery target — pass `to` or use a session with a bound chat") };
                     }
-                    return { ok: true, to: (0, helpers_1.normalizeOutboundTarget)(raw) };
+                    const target = (0, helpers_1.normalizeOutboundTarget)(raw);
+                    // Тот же барьер, что у `handleAction`: доставка ядра (`--deliver`,
+                    // анонсы субагентов) идёт этим путём и мимо той проверки. Отказ
+                    // здесь возвращается результатом, а не броском: бросок в этом хуке
+                    // роняет весь gateway (грабли 06.08.2026, выше).
+                    if (!(0, send_scope_1.isChatSendable)(target, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+                        const reason = (0, send_scope_1.isPhoneNumberTarget)(target)
+                            ? "phone-number target"
+                            : "chat outside send scope";
+                        actionLog.warn("clawgram outbound resolveTarget refused", {
+                            accountId: ctx.accountId,
+                            target,
+                            reason,
+                        });
+                        return { ok: false, error: new Error(`clawgram: not-allowed-chat ${target}`) };
+                    }
+                    return { ok: true, to: target };
                 }
                 catch (err) {
                     return { ok: false, error: err instanceof Error ? err : new Error(String(err)) };
@@ -2495,6 +2686,8 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 const suppressedNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
                     targetKind: (0, helpers_1.inferOutboundTargetKind)(ctx.to),
                     text: ctx.text,
+                    to: ctx.to,
+                    operatorIds: (0, system_notice_1.operatorIdsFor)(ctx.accountId),
                 });
                 if (suppressedNotice) {
                     actionLog.warn("clawgram suppressing system notice in group", {
@@ -2584,6 +2777,43 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 if (!file) {
                     throw new Error("clawgram: sendMedia requires filePath or mediaUrl");
                 }
+                // Ниже — проверки, которые у `sendText` были, а здесь не было ни
+                // одной: путь доставки медиа писался отдельно и обзавёлся только
+                // своими границами (находка A6-18).
+                const mediaTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
+                // Область отправки: файл наружу — такое же исходящее, как текст.
+                // `resolveTarget` ядро зовёт не на каждом пути, поэтому проверяем и тут.
+                if (!(0, send_scope_1.isChatSendable)(mediaTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+                    actionLog.warn("clawgram outbound sendMedia refused", {
+                        accountId: ctx.accountId,
+                        target: mediaTarget,
+                        reason: (0, send_scope_1.isPhoneNumberTarget)(mediaTarget) ? "phone-number target" : "chat outside send scope",
+                    });
+                    return { skipped: "not-allowed" };
+                }
+                // Молчаливый ответ: подпись с токеном молчания означает «ничего не
+                // говорить», и отправлять файл с ним в подписи — тем более.
+                const mediaCaption = ctx.caption ?? ctx.text;
+                if (mediaCaption?.trim() && (0, helpers_1.isSilentReplyText)(mediaCaption)) {
+                    actionLog.info("clawgram suppressing silent outbound media", {
+                        accountId: ctx.accountId,
+                        rawTo: ctx.to,
+                    });
+                    return { skipped: "silent" };
+                }
+                // Обращение в группе — то же, что у текста: адрес принадлежит
+                // конкретному входящему сообщению, а не последнему говорившему.
+                const mediaReplyAddress = (0, group_reply_address_1.consumeGroupReplyAddress)({
+                    accountId: ctx.accountId,
+                    chatId: ctx.to,
+                    replyToId: ctx.replyToId,
+                });
+                // Чего здесь НЕТ намеренно:
+                // — подавление эха хода (`hadTurnSendJustNow`): у текста дубль стоит
+                //   лишнего сообщения, а у медиа отказ стоит потерянного файла —
+                //   картинку агент готовил, и второй раз она не появится;
+                // — подавление служебных сообщений ядра в группах: они текстовые,
+                //   медиа-доставка ими не бывает.
                 const messageThreadId = parseOptionalThreadId(ctx.threadId);
                 // Same normalization `sendText` does two functions up. Without it the
                 // channel prefix reaches peer resolution and the send throws — which is
@@ -2593,7 +2823,10 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 const sent = await gram.sendMedia({
                     target,
                     file,
-                    caption: ctx.caption ?? ctx.text,
+                    // Подпись получает то же обращение, что и текстовый ответ.
+                    caption: mediaCaption
+                        ? (0, helpers_1.prefixReplyTextToAddress)(mediaCaption, mediaReplyAddress)
+                        : mediaCaption,
                     // Captions follow the account reply format like every other reply:
                     // they are the same agent prose, just attached to a file (2.15.0).
                     parseMode: gram.replyParseMode,