clawgram 2.24.0 → 2.25.0

package/README.md

@@ -256,10 +256,11 @@ loud where it does occur.
 | `apiHash` | string | required | Telegram API hash |
 | `sessionString` | string | `""` | Authenticated StringSession |
 | `allowFrom` | string[] | `["*"]` | Allowed sender IDs/usernames for direct messages only. Three states: absent means everyone, `[]` denies everyone (a warning is logged at account start), a list allows those senders |
-| `operatorIds` | string[] | — | Who receives core's operational telemetry in a DM (tool-failure warnings, fallback notices). They quote shell commands and secret-store paths, so they go only to these ids. Absent falls back to `allowFrom` when it is a concrete list; a wildcard or an empty list means no operator is identified and the notices are dropped everywhere — they stay in the run diagnostics and the gateway log |
+| `operatorIds` | string[] | — | Who receives core's operational telemetry in a DM (tool-failure warnings, fallback notices). They quote shell commands and secret-store paths, so they go **only** to these ids. Absent, empty or containing `*` means no operator is identified and the notices are dropped everywhere — they stay in the run diagnostics, the job's `lastError` and the gateway log. `allowFrom` is **not** a fallback (2.25.0; it was until then, which made every allowed sender an operator) |
 | `groups` | object | `{}` | Allowed groups map keyed by explicit group id or `*` |
 | `proxy` | object | unset | Optional SOCKS4/SOCKS5 proxy for this account — see [Proxy (SOCKS4/SOCKS5)](#proxy-socks4socks5) |
 | `manageChats` | string[] | unset | Chats the assistant may **manage** — see [Chat management](#chat-management). Absent or empty = management off; `["*"]` = every chat |
+| `sendChats` | string[] | unset | Chats the assistant may **send to** — `send`, `upload-file`, `react` and core's own delivery path (`--deliver`, sub-agent announcements). Absent = every chat; `[]` = none. Phone-number targets are refused regardless (2.18.0; core delivery covered since 2.25.0) |
 | `replyParseMode` | `"html"` \| `"markdown"` \| `"none"` | unset | Outbound format for replies, core-delivered text, captions and `send` calls that omit `parseMode` — see [Message formatting](#message-formatting) |
 | `twoFaPassword` | string \| SecretRef | unset | The account's Telegram 2FA password; read only by `transferOwnership` |
 | `reactionModel` | string | unset | Model ref or alias for the emoji pick on a silent mention. Unset = the agent's own model. Needs `plugins.entries.clawgram.llm.allowModelOverride: true` in the gateway config; without it the override is refused and the pick quietly falls back to the default model |

package/dist/channel.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createChannelPlugin = exports.canonicalAction = exports.CORE_ACTION_SYNONYMS = void 0;
+exports.resolveAccountOperatorIds = resolveAccountOperatorIds;
 const core_1 = require("openclaw/plugin-sdk/core");
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -127,8 +128,10 @@ function resolveAccountSendChats(cfg, accountId) {
 }
 /** One refusal for every outbound action, so the three read the same. */
 function refuseOutboundOutsideScope(action, accountId, target) {
-    const reason = (0, send_scope_1.isPhoneNumberTarget)(target) ? "phone-number target" : "chat outside send scope";
-    actionLog.warn(`clawgram ${action} refused: ${reason}`, { accountId, target });
+    const phone = (0, send_scope_1.isPhoneNumberTarget)(target);
+    const reason = phone ? "phone-number target" : "chat outside send scope";
+    // Телефонный номер — персональные данные: в журнал идёт вид цели, не значение (B5-09).
+    actionLog.warn(`clawgram ${action} refused: ${reason}`, { accountId, ...(phone ? { targetKind: "phone" } : { target }) });
     throw new Error(`clawgram: not-allowed-chat ${target}`);
 }
 /**
@@ -149,8 +152,11 @@ function refuseOutboundOutsideScope(action, accountId, target) {
  */
 function resolveAccountOperatorIds(cfg, accountId) {
     const account = cfg?.channels?.["clawgram"]?.accounts?.[accountId];
-    const explicit = account?.operatorIds;
-    const raw = explicit !== undefined && explicit !== null ? explicit : account?.allowFrom;
+    // Только явный список. Умолчание «operatorIds = allowFrom» делало
+    // оператором каждого допущенного собеседника — и телеметрию с путями
+    // secret-store получал любой из них (D2-03, A5-11). Не назван — не
+    // назван: уведомления подавляются везде.
+    const raw = account?.operatorIds;
     if (raw === undefined || raw === null)
         return [];
     const entries = Array.isArray(raw) ? raw : [raw];
@@ -253,7 +259,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
             messageToolHints: () => [
                 "Use clawgram to send Telegram replies from the connected personal account.",
                 "When replying in the current Telegram chat, omit `to`/`target` and clawgram will send to the current conversation automatically.",
-                "Explicit targets may be @username, numeric Telegram user id, phone/contact resolvable by Telegram, group chat ids, or clawgram:<target>.",
+                "Explicit targets may be @username, numeric Telegram user id, group chat ids, or clawgram:<target>.",
                 "For Telegram forum topics, send to the group chat id and pass the topic id separately as `threadId`.",
                 "Use the `react` action to acknowledge a message with an emoji instead of sending a reply; pass an empty `emoji` (or `remove: true`) to take the reaction back.",
                 "Use the `channel-info` action to learn what a chat is — title, type, member count, description, pinned message — instead of guessing from its id. Name the chat with `chatId` and do not pass `target`: core refuses it for this action, and the descriptive spelling `chatInfo` is not callable from this tool at all.",

package/dist/chunk.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEGRAM_CAPTION_LIMIT = exports.TELEGRAM_TEXT_LIMIT = void 0;
+exports.chunkTelegramText = chunkTelegramText;
+/**
+ * Telegram limits: 4096 characters per message, 1024 per media caption.
+ *
+ * Core chunks only the replies it dispatches itself; a `send` issued through
+ * the message tool — the way the guard scripts deliver reports — reaches
+ * GramJS whole, and GramJS does not split either, so a long report failed
+ * with MESSAGE_TOO_LONG and the agent saw "✉️ Message failed" while the
+ * human saw nothing (audit B5-03).
+ *
+ * Splitting prefers paragraph breaks, then line breaks, then a hard cut at
+ * the limit. It runs on the text as the agent wrote it — before HTML
+ * rendering — so a chunk boundary can only fall between the agent's own
+ * lines, never inside an entity GramJS produced.
+ */
+exports.TELEGRAM_TEXT_LIMIT = 4096;
+exports.TELEGRAM_CAPTION_LIMIT = 1024;
+function chunkTelegramText(text, limit = exports.TELEGRAM_TEXT_LIMIT) {
+    const chars = Array.from(text);
+    if (chars.length <= limit)
+        return [text];
+    const chunks = [];
+    let rest = text;
+    while (Array.from(rest).length > limit) {
+        const window = Array.from(rest).slice(0, limit).join("");
+        let cut = window.lastIndexOf("\n\n");
+        if (cut < limit / 2)
+            cut = window.lastIndexOf("\n");
+        if (cut < limit / 2)
+            cut = window.lastIndexOf(" ");
+        if (cut < limit / 2)
+            cut = window.length;
+        const piece = rest.slice(0, cut).replace(/\s+$/u, "");
+        chunks.push(piece);
+        rest = rest.slice(cut).replace(/^\s+/u, "");
+    }
+    if (rest)
+        chunks.push(rest);
+    return chunks;
+}

package/dist/gramjs-client.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GramJsClientManager = void 0;
 exports.buildParticipantsQuery = buildParticipantsQuery;
 exports.buildVoiceNoteParams = buildVoiceNoteParams;
+const chunk_1 = require("./chunk");
 const telegram_1 = require("telegram");
 const sessions_1 = require("telegram/sessions");
 // Deep import, but the documented one: GramJS ships its SRP helper here and
@@ -313,7 +314,8 @@ class GramJsClientManager {
         // но теперь виден в логе: если он в логе частый, значит кэш не спасает и
         // адресация идёт не тем ключом (A6-14).
         peerLog.info("clawgram peer resolve falling back to dialog scan", {
-            target: raw,
+            // Цель может быть телефоном или @handle человека — в журнал идёт только её форма (B5-09).
+            targetShape: String(raw).startsWith("+") ? "phone" : String(raw).startsWith("@") ? "handle" : /^-?\d+/.test(String(raw)) ? "id" : "other",
             kind: kind ?? null,
         });
         const dialogs = await this.client.getDialogs({ limit: 200 }).catch(() => []);
@@ -418,6 +420,17 @@ class GramJsClientManager {
         const resolved = await this.resolvePeer(args.target, { kind: args.targetKind });
         const messageThreadId = args.messageThreadId ?? resolved.messageThreadId;
         const replyParams = buildForumReplyParams(messageThreadId, args.replyToMessageId);
+        // Длиннее лимита Telegram — несколько сообщений подряд, а не
+        // MESSAGE_TOO_LONG (B5-03). Нарезка — по тексту агента, до рендера.
+        const chunks = (0, chunk_1.chunkTelegramText)(args.text, chunk_1.TELEGRAM_TEXT_LIMIT);
+        if (chunks.length > 1) {
+            let last;
+            for (const [index, chunk] of chunks.entries()) {
+                last = await this.sendText({ ...args, text: chunk,
+                    ...(index > 0 ? { replyToMessageId: undefined } : {}) });
+            }
+            return last;
+        }
         return this.client.sendMessage(resolved.peer, {
             // In html mode the text is rendered first: the agent writes markdown,
             // Telegram HTML, or both, and GramJS's HTML parser alone would ship
@@ -757,6 +770,16 @@ class GramJsClientManager {
         const resolved = await this.resolvePeer(args.target);
         const messageThreadId = args.messageThreadId ?? resolved.messageThreadId;
         const replyParams = buildForumReplyParams(messageThreadId, args.replyToMessageId);
+        // Подпись длиннее 1024 — файл с первой частью, остальное текстом следом
+        // (B5-03); раньше вся подпись уезжала целиком и падала на лимите.
+        const captionChunks = args.caption ? (0, chunk_1.chunkTelegramText)(args.caption, chunk_1.TELEGRAM_CAPTION_LIMIT) : [];
+        if (captionChunks.length > 1) {
+            const sent = await this.sendMedia({ ...args, caption: captionChunks[0] });
+            for (const chunk of captionChunks.slice(1)) {
+                await this.sendText({ target: args.target, text: chunk, parseMode: args.parseMode, messageThreadId });
+            }
+            return sent;
+        }
         return this.client.sendFile(resolved.peer, {
             file: args.file,
             // Captions are agent prose too — the outbound path sends `caption ??

package/dist/inbound-pipeline.js

@@ -101,30 +101,6 @@ async function handleInboundEvent(event, ctx) {
             }
             return;
         }
-        const directReplyTarget = normalized.chatType === "direct"
-            ? undefined
-            : await (0, helpers_1.resolveReplyTarget)(rawMessage);
-        const senderProfile = normalized.chatType === "direct"
-            ? await (0, helpers_1.resolveSenderProfileWithTimeout)(rawMessage, {
-                senderId: normalized.senderId,
-                client,
-            }, 1500)
-            : await (0, helpers_1.resolveSenderProfile)(rawMessage, {
-                senderId: normalized.senderId,
-                client,
-            });
-        const replyTarget = normalized.chatType === "direct"
-            ? normalized.chatId
-            : await (0, helpers_1.resolveChatTarget)(rawMessage);
-        if (replyTarget) {
-            normalized.replyTarget = replyTarget;
-        }
-        if (!normalized.senderUsername && senderProfile.username) {
-            normalized.senderUsername = senderProfile.username;
-        }
-        if (!normalized.senderDisplay && senderProfile.display) {
-            normalized.senderDisplay = senderProfile.display;
-        }
         if (normalized.isOutgoing) {
             if (normalized.chatType === "direct") {
                 log?.info?.("clawgram skipping outgoing direct event", {
@@ -145,6 +121,61 @@ async function handleInboundEvent(event, ctx) {
             });
             return;
         }
+        // Ворота — ДО сети. До 2.25.0 на каждое сообщение из любой группы,
+        // где сидит аккаунт, — включая группы вне `groups` — плагин делал
+        // до семи запросов к Telegram (профиль отправителя, адрес ответа,
+        // цель чата) и только потом отбрасывал сообщение как чужое.
+        // Посторонний, флудящий в такой группе, тратил соединение и
+        // rate-limit аккаунта (B5-04, остаток A5-06). Группа вне конфига
+        // и выключенная группа заканчиваются здесь, без единого вызова.
+        const earlyScopes = (0, helpers_1.resolveAccountScopes)(cfg, accountId);
+        const earlyGroupConfig = normalized.chatType === "group"
+            ? (0, helpers_1.resolveGroupConfig)(earlyScopes.groups, normalized.chatId)
+            : undefined;
+        if (normalized.chatType === "group") {
+            if (!earlyGroupConfig) {
+                log?.info?.("clawgram skipping group not present in groups config", {
+                    accountId,
+                    chatId: normalized.chatId,
+                    messageId: normalized.messageId,
+                });
+                return;
+            }
+            if (earlyGroupConfig.enabled === false) {
+                log?.info?.("clawgram skipping disabled group", {
+                    accountId,
+                    chatId: normalized.chatId,
+                    messageId: normalized.messageId,
+                });
+                return;
+            }
+        }
+        // Профиль отправителя нужен воротам только когда allowFrom
+        // называет кого-то по @handle, а сообщение handle не принесло;
+        // числовые id сверяются без сети.
+        const gateAllowFrom = normalized.chatType === "group"
+            ? earlyGroupConfig?.allowFrom
+            : earlyScopes.allowFrom;
+        const allowFromNeedsHandle = Array.isArray(gateAllowFrom)
+            && gateAllowFrom.some((entry) => String(entry).trim().startsWith("@"));
+        const needsProfile = !normalized.senderUsername && allowFromNeedsHandle;
+        const senderProfile = needsProfile
+            ? (normalized.chatType === "direct"
+                ? await (0, helpers_1.resolveSenderProfileWithTimeout)(rawMessage, {
+                    senderId: normalized.senderId,
+                    client,
+                }, 1500)
+                : await (0, helpers_1.resolveSenderProfile)(rawMessage, {
+                    senderId: normalized.senderId,
+                    client,
+                }))
+            : {};
+        if (!normalized.senderUsername && senderProfile.username) {
+            normalized.senderUsername = senderProfile.username;
+        }
+        if (!normalized.senderDisplay && senderProfile.display) {
+            normalized.senderDisplay = senderProfile.display;
+        }
         let text = normalized.text?.trim();
         // Whether this sender may reach the agent at all — decided before
         // the attachment is fetched.
@@ -180,6 +211,16 @@ async function handleInboundEvent(event, ctx) {
         // voice note and a screenshot alike, the attachment *is* the
         // message. A caption is kept and the reading appended, because
         // "look at this" plus the picture is one thought, not two.
+        // Адрес ответа и цель чата — сеть, и нужны только тому, кому
+        // отвечают: считаются после ворот (B5-04).
+        const directReplyTarget = normalized.chatType === "direct" ? undefined
+            : senderMayReachAgent ? await (0, helpers_1.resolveReplyTarget)(rawMessage) : undefined;
+        const replyTarget = normalized.chatType === "direct"
+            ? normalized.chatId
+            : senderMayReachAgent ? await (0, helpers_1.resolveChatTarget)(rawMessage) : undefined;
+        if (replyTarget) {
+            normalized.replyTarget = replyTarget;
+        }
         const attachment = senderMayReachAgent ? await (0, attachments_1.readInboundAttachment)({
             gram,
             event,
@@ -315,7 +356,10 @@ async function handleInboundEvent(event, ctx) {
                     messageId: normalized.messageId,
                     senderId,
                     username: normalized.senderUsername,
-                    allowFrom: groupConfig.allowFrom,
+                    // Сам список — id владельца и допущенных — в журнал не идёт:
+                    // посторонний управлял бы числом его копий в journald (B5-09).
+                    allowFromCount: Array.isArray(groupConfig.allowFrom) ? groupConfig.allowFrom.length : 0,
+                    allowFromHasWildcard: Array.isArray(groupConfig.allowFrom) && groupConfig.allowFrom.some((e) => String(e).trim() === "*"),
                 });
                 return;
             }
@@ -706,7 +750,8 @@ async function handleInboundEvent(event, ctx) {
                 accountId,
                 senderId,
                 senderUsername: normalized.senderUsername,
-                allowFrom: directAllowFrom,
+                allowFromCount: Array.isArray(directAllowFrom) ? directAllowFrom.length : 0,
+                allowFromHasWildcard: Array.isArray(directAllowFrom) && directAllowFrom.some((e) => String(e).trim() === "*"),
             });
             return;
         }
@@ -820,6 +865,26 @@ async function handleInboundEvent(event, ctx) {
                         });
                         return;
                     }
+                    // Тот же фильтр, что у группового ответа и у outbound.sendText:
+                    // личный ответ идёт третьим путём, и закрытие A5-11 его не
+                    // покрывало — «⚠️ 🛠️ Bash failed: cat /opt/openclaw-secrets/…»
+                    // уходил любому из allowFrom, чей ход уронил инструмент (B5-01).
+                    const directNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
+                        targetKind: "user",
+                        text: visibleText,
+                        to: normalized.chatId,
+                        operatorIds: (0, system_notice_1.operatorIdsFor)(accountId),
+                    });
+                    if (directNotice) {
+                        log?.warn?.("clawgram suppressing system notice in direct reply", {
+                            accountId,
+                            chatId: normalized.chatId,
+                            messageId: normalized.messageId,
+                            noticeKind: directNotice,
+                            textLength: visibleText.length,
+                        });
+                        return;
+                    }
                     await sendTextToConversation({
                         text: visibleText,
                         replyToMessageId: payload.replyToId ? Number(payload.replyToId) : undefined,

package/dist/outbound.js

@@ -89,6 +89,19 @@ function createOutbound(runtimes) {
                 });
                 return { skipped: "silent" };
             }
+            // Область отправки — и здесь. Путь доставки ядра (`--deliver`,
+            // анонсы субагентов) зовёт sendText напрямую, минуя resolveTarget и
+            // handleAction, где барьер уже стоял: третий из трёх исходящих путей
+            // был открыт для любого адресата и телефонного номера (D2-01, A5-12).
+            const scopedTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
+            if (!(0, send_scope_1.isChatSendable)(scopedTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+                actionLog.warn("clawgram outbound sendText refused", {
+                    accountId: ctx.accountId,
+                    target: scopedTarget,
+                    reason: (0, send_scope_1.isPhoneNumberTarget)(scopedTarget) ? "phone-number target" : "chat outside send scope",
+                });
+                return { skipped: "not-allowed" };
+            }
             // Core's operational chatter (tool-error warnings, fallback notices)
             // stays out of group chats: it is telemetry for the operator, not a
             // reply to the room, and it has already been seen carrying shell

package/dist/update-config.js

@@ -36,14 +36,6 @@ function buildAccountPayload(auth) {
         sessionString: auth.sessionString,
     };
 }
-/** Первый конфиг закрыт: см. одноимённую функцию в cli-core.ts. */
-function buildAccountConfigFragment(auth) {
-    return {
-        ...buildAccountPayload(auth),
-        allowFrom: auth.selfId ? [auth.selfId] : [],
-        readChats: [],
-    };
-}
 /**
  * Credentials already moved into the secret store must survive re-auth.
  *

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "clawgram",
-  "version": "2.24.0",
+  "version": "2.25.0",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {
+    "verify:proxy": "node scripts/verify/gramjs-wiring.cjs && node scripts/verify/auth-preserves-proxy.cjs",
     "build": "tsc -p tsconfig.json",
     "build:test": "tsc -p tsconfig.test.json",
     "test": "npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",