clawgram 2.25.0 → 2.26.0

package/README.md

@@ -714,6 +714,35 @@ Bindings
 ```
 
 
+## Actions and the names that reach them
+
+Two grammars name the same actions. The **native** names (`read`, `participants`, `topics`,
+`dialogs`, `chatInfo`, `fetch-media`, `createGroup`, …) are what the gateway RPC, the tests and
+this README use. The agent's `message` tool, however, only dispatches names from **core's own
+vocabulary** (`CHANNEL_MESSAGE_ACTION_NAMES`), so every action worth reaching from a prompt also
+answers to core's nearest name. `src/actions.ts` is the single source of both lists
+(`ACTION_ALIASES`, `CORE_VOCABULARY_SPELLINGS`); that core really knows each name is asserted
+against the installed core in `test/core-action-synonyms.test.ts`, so a core release that drops
+one fails the suite rather than the chat.
+
+| Does | Native name | Callable from the `message` tool as | Gate |
+|---|---|---|---|
+| send text | `send` | `send` | `sendChats` |
+| send a file | `upload-file` | `upload-file`, `sendAttachment` | `sendChats`, media roots |
+| react to a message | `react` | `react` | `sendChats` |
+| read history | `read` (also `list`) | `read` | `readChats` |
+| fetch an attachment | `fetch-media` | `download-file` | `readChats` |
+| list members | `participants` | `member-info` | `readChats` |
+| list forum topics | `topics` | `thread-list` | `readChats` |
+| list chats | `dialogs` | `channel-list` | `discoverChats` |
+| describe a chat | `chatInfo` | `channel-info` (the chat arrives in `channelId`) | `readChats` |
+| where the account was added | `joins` | — (gateway RPC only) | — |
+| chat management | see the table below | see the table below | `manageChats` |
+
+Names outside core's vocabulary (`joins`, `transferOwnership`, `inviteLink`) are reachable through
+the gateway RPC only. A name core does not know fails as "requires a target" and "does not accept a
+target" at once — there is no call that satisfies both, which is why this table exists.
+
 ## Chat management
 
 Since 2.12.0 the assistant can assemble a chat, not only speak in it: create a supergroup, add and
@@ -728,15 +757,15 @@ management to those chats, `["*"]` allows every chat. A non-empty list also unlo
 (the chat being created is not in any list yet). All actions honour `dryRun`, and the gate is
 checked before the dry-run answer, so a dry run exercises the same refusals a real call would hit.
 
-| Action | Parameters | Notes |
-|---|---|---|
-| `createGroup` | `title`, `about?`, `users?` | Creates a **supergroup** (megagroup) — granular admin rights, bans and ownership transfer only exist there. Initial members are invited right after creation; who could not be added is returned in `missing` |
-| `addMembers` | `chatId`, `users` | Adds to supergroups in one call, to basic groups one by one. Ids Telegram refused (privacy settings) come back in `missing` instead of failing the call |
-| `removeMember` | `chatId`, `user`, `ban?` | Soft kick by default — the person may be re-invited later. `ban: true` keeps them out until unbanned |
-| `promoteAdmin` | `chatId`, `user`, `rank?`, `rights?` | Grants a deliberate default set (change info, delete messages, ban, invite, pin, calls, topics). `addAdmins` and `anonymous` stay **off** unless explicitly set in `rights` |
-| `demoteAdmin` | `chatId`, `user` | Strips every admin right |
-| `transferOwnership` | `chatId`, `user` | Supergroups only. Requires `twoFaPassword` (below); Telegram's own rules surface as errors — see the fine print |
-| `inviteLink` | `chatId`, `expireDate?`, `usageLimit?`, `title?`, `requestNeeded?` | The path for people whose privacy settings refuse a direct add. `expireDate` takes unix seconds or an ISO date |
+| Action | Callable from the `message` tool as | Parameters | Notes |
+|---|---|---|---|
+| `createGroup` | `channel-create` | `title`, `about?`, `users?` | Creates a **supergroup** (megagroup) — granular admin rights, bans and ownership transfer only exist there. Initial members are invited right after creation; who could not be added is returned in `missing` |
+| `addMembers` | `addParticipant` | `chatId`, `users` | Adds to supergroups in one call, to basic groups one by one. Ids Telegram refused (privacy settings) come back in `missing` instead of failing the call |
+| `removeMember` | `kick` | `chatId`, `user`, `ban?` | Soft kick by default — the person may be re-invited later. `ban: true` keeps them out until unbanned |
+| `promoteAdmin` | `role-add` | `chatId`, `user`, `rank?`, `rights?` | Grants a deliberate default set (change info, delete messages, ban, invite, pin, calls, topics). `addAdmins` and `anonymous` stay **off** unless explicitly set in `rights` |
+| `demoteAdmin` | `role-remove` | `chatId`, `user` | Strips every admin right |
+| `transferOwnership` | — (gateway RPC only) | `chatId`, `user` | Supergroups only. Requires `twoFaPassword` (below); Telegram's own rules surface as errors — see the fine print |
+| `inviteLink` | — (gateway RPC only) | `chatId`, `expireDate?`, `usageLimit?`, `title?`, `requestNeeded?` | The path for people whose privacy settings refuse a direct add. `expireDate` takes unix seconds or an ISO date |
 
 User references in `users`/`user` are `@username` or a numeric Telegram id. A `@username` always
 resolves; a bare numeric id only when the account has already seen the user (shared chat, dialog,

package/dist/account-registry.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rememberAccount = rememberAccount;
+exports.forgetAccount = forgetAccount;
+exports.sendScopeFor = sendScopeFor;
+exports.operatorIdsFor = operatorIdsFor;
+exports.requireRuntime = requireRuntime;
+const records = new Map();
+function rememberAccount(accountId, record) {
+    records.set(accountId, { sendChats: record.sendChats, operatorIds: [...record.operatorIds] });
+}
+function forgetAccount(accountId) {
+    records.delete(accountId);
+}
+function sendScopeFor(accountId) {
+    return records.get(accountId)?.sendChats;
+}
+function operatorIdsFor(accountId) {
+    return records.get(accountId)?.operatorIds ?? [];
+}
+/**
+ * The connected runtime for an account, or a refusal naming it.
+ *
+ * One helper instead of the copies of this three-liner that used to sit in
+ * each dispatch branch (A6-11 removed six; D2-11 the remaining seven).
+ */
+function requireRuntime(runtimes, accountId) {
+    const gram = runtimes.get(accountId);
+    if (!gram) {
+        throw new Error(`clawgram: runtime not found for account ${accountId}`);
+    }
+    return gram;
+}

package/dist/channel.js

@@ -55,15 +55,14 @@ const fetch_media_1 = require("./fetch-media");
 const channel_runtime_1 = require("openclaw/plugin-sdk/channel-runtime");
 const param_readers_1 = require("openclaw/plugin-sdk/param-readers");
 const tool_send_1 = require("openclaw/plugin-sdk/tool-send");
-const channel_pairing_1 = require("openclaw/plugin-sdk/channel-pairing");
 const events_1 = require("telegram/events");
 const gramjs_client_1 = require("./gramjs-client");
 const history_1 = require("./history");
 const send_scope_1 = require("./send-scope");
+const account_registry_1 = require("./account-registry");
 const joins_1 = require("./joins");
 const reactions_1 = require("./reactions");
 const manage_1 = require("./manage");
-const system_notice_1 = require("./system-notice");
 const state_dir_1 = require("./state-dir");
 const chat_info_1 = require("./chat-info");
 const topics_1 = require("./topics");
@@ -76,6 +75,12 @@ const group_visible_reply_guard_1 = require("./group-visible-reply-guard");
 const helpers_1 = require("./helpers");
 const proxy_config_1 = require("./proxy-config");
 const constants_1 = require("./constants");
+const actions_1 = require("./actions");
+Object.defineProperty(exports, "CORE_ACTION_SYNONYMS", { enumerable: true, get: function () { return actions_1.CORE_ACTION_SYNONYMS; } });
+Object.defineProperty(exports, "canonicalAction", { enumerable: true, get: function () { return actions_1.canonicalAction; } });
+const outbound_1 = require("./outbound");
+const inbound_pipeline_1 = require("./inbound-pipeline");
+const attachments_1 = require("./attachments");
 const actionLog = (0, core_1.createSubsystemLogger)("channels/clawgram");
 /**
  * Read scope as configured for the account. Left `undefined` when the key is
@@ -83,20 +88,11 @@ const actionLog = (0, core_1.createSubsystemLogger)("channels/clawgram");
  * the first means no restriction, the second denies everything.
  */
 function readAccountReadChats(account) {
-    const raw = account?.readChats;
-    if (raw === undefined || raw === null)
-        return undefined;
-    const entries = Array.isArray(raw) ? raw : [raw];
-    return entries.map((entry) => String(entry).trim()).filter(Boolean);
+    return (0, history_1.normalizeScopeList)(account?.readChats);
 }
 function resolveAccountReadChats(cfg, accountId) {
     return readAccountReadChats(cfg?.channels?.["clawgram"]?.accounts?.[accountId]);
 }
-/**
- * Outbound scope as configured. Handed to `isChatSendable` raw: an absent
- * value means "unrestricted" and an empty list means "deny", and only the
- * raw value tells those apart — same shape as `readChats`.
- */
 /**
  * Хэндл в `allowFrom` — обещание, которое Telegram не держит.
  *
@@ -123,16 +119,19 @@ function warnAboutHandleAllowlistEntries(cfg, accountId) {
         why: "a released handle can be taken by someone else; numeric ids do not change hands",
     });
 }
+/**
+ * Outbound scope as configured. Handed to `isChatSendable` raw: an absent
+ * value means "unrestricted" and an empty list means "deny", and only the
+ * raw value tells those apart — same shape as `readChats`.
+ */
 function resolveAccountSendChats(cfg, accountId) {
     return cfg?.channels?.["clawgram"]?.accounts?.[accountId]?.sendChats;
 }
 /** One refusal for every outbound action, so the three read the same. */
 function refuseOutboundOutsideScope(action, accountId, target) {
-    const phone = (0, send_scope_1.isPhoneNumberTarget)(target);
-    const reason = phone ? "phone-number target" : "chat outside send scope";
-    // Телефонный номер — персональные данные: в журнал идёт вид цели, не значение (B5-09).
-    actionLog.warn(`clawgram ${action} refused: ${reason}`, { accountId, ...(phone ? { targetKind: "phone" } : { target }) });
-    throw new Error(`clawgram: not-allowed-chat ${target}`);
+    const refusal = (0, send_scope_1.describeSendRefusal)(target);
+    actionLog.warn(`clawgram ${action} refused: ${refusal.reason}`, { accountId, ...refusal.logFields });
+    throw refusal.error;
 }
 /**
  * Management scope as configured. Handed to `isChatManageable` raw: unlike
@@ -170,31 +169,8 @@ function resolveAccountManageChats(cfg, accountId) {
 }
 /** Same normalization `readChats` gets, for the resolved-account copy. */
 function readAccountManageChats(account) {
-    const raw = account?.manageChats;
-    if (raw === undefined || raw === null)
-        return undefined;
-    const entries = Array.isArray(raw) ? raw : [raw];
-    return entries.map((entry) => String(entry).trim()).filter(Boolean);
+    return (0, history_1.normalizeScopeList)(account?.manageChats);
 }
-const actions_1 = require("./actions");
-Object.defineProperty(exports, "CORE_ACTION_SYNONYMS", { enumerable: true, get: function () { return actions_1.CORE_ACTION_SYNONYMS; } });
-Object.defineProperty(exports, "canonicalAction", { enumerable: true, get: function () { return actions_1.canonicalAction; } });
-const outbound_1 = require("./outbound");
-const inbound_pipeline_1 = require("./inbound-pipeline");
-/**
- * Turns an inbound attachment into text the agent can read.
- *
- * The work is deliberately delegated: `runtime.mediaUnderstanding` already
- * knows which backend this installation uses for speech and for images, so
- * the channel stays out of that choice — a local model today, something else
- * tomorrow, without touching this file.
- *
- * Failure is not an error worth dropping the message over. An attachment that
- * could not be read still happened, and the assistant is better off saying
- * "you sent something I could not read" than staying silent, which is
- * indistinguishable from being offline.
- */
-const attachments_1 = require("./attachments");
 const createChannelPlugin = (runtimes, pluginRuntime) => {
     const resolveRuntimeAccountId = (cfg, preferred) => {
         const configured = (0, helpers_1.resolveConfiguredAccountId)(cfg, preferred);
@@ -206,20 +182,8 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
         }
         return configured ?? runtimes.keys().next().value;
     };
-    /**
-     * The connected runtime for an account, or a refusal naming it.
-     *
-     * One helper instead of the eleven copies of this three-liner that used to
-     * sit inside each dispatch branch — the same repetition that made every new
-     * action cost a scaffold (finding A6-11).
-     */
-    const requireRuntimeFor = (id) => {
-        const gram = runtimes.get(id);
-        if (!gram) {
-            throw new Error(`clawgram: runtime not found for account ${id}`);
-        }
-        return gram;
-    };
+    /** The connected runtime for an account, or a refusal naming it (A6-11, D2-11). */
+    const requireRuntimeFor = (id) => (0, account_registry_1.requireRuntime)(runtimes, id);
     return {
         id: "clawgram",
         meta: {
@@ -364,18 +328,14 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 const gram = new gramjs_client_1.GramJsClientManager(resolvedAccount);
                 await gram.start();
                 runtimes.set(accountId, gram);
-                (0, system_notice_1.rememberOperatorIds)(accountId, resolveAccountOperatorIds(cfg, accountId));
-                // Область отправки — туда же и по той же причине: в `outbound.*`
-                // конфига нет, а барьер нужен и на пути доставки ядра (A5-12).
-                (0, send_scope_1.rememberSendScope)(accountId, resolveAccountSendChats(cfg, accountId));
-                warnAboutHandleAllowlistEntries(cfg, accountId);
-                const pairing = (0, channel_pairing_1.createChannelPairingController)({
-                    // The controller only reads core.channel.pairing, but its parameter is typed
-                    // as the full PluginRuntime, and ctx (hence channelRuntime) is untyped.
-                    core: { channel: channelRuntime },
-                    channel: "clawgram",
-                    accountId,
+                // Что `outbound.*` должен знать об аккаунте без конфига: область
+                // отправки (A5-12) и операторы (A5-11). Одна запись, снимается при
+                // остановке аккаунта (D2-11).
+                (0, account_registry_1.rememberAccount)(accountId, {
+                    sendChats: resolveAccountSendChats(cfg, accountId),
+                    operatorIds: resolveAccountOperatorIds(cfg, accountId),
                 });
+                warnAboutHandleAllowlistEntries(cfg, accountId);
                 const me = await gram.getMe();
                 const selfId = me?.id ? String(me.id) : undefined;
                 const selfUsername = (0, helpers_1.resolveActiveUsername)(me);
@@ -394,7 +354,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 const client = gram.getClient();
                 const eventBuilder = new events_1.NewMessage({});
                 const eventHandler = async (event) => (0, inbound_pipeline_1.handleInboundEvent)(event, {
-                    accountId, cfg, channelRuntime, client, gram, log, pairing,
+                    accountId, cfg, channelRuntime, client, gram, log,
                     pluginRuntime, runtimes, selfId, selfLabel, selfUsername,
                 });
                 client.addEventHandler(eventHandler, eventBuilder);
@@ -431,6 +391,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                 await (0, channel_runtime_1.waitUntilAbort)(ctx.abortSignal, async () => {
                     client.removeEventHandler(eventHandler, eventBuilder);
                     client.removeEventHandler(joinEventHandler, joinEventBuilder);
+                    (0, account_registry_1.forgetAccount)(accountId);
                     const runtime = runtimes.get(accountId);
                     if (!runtime) {
                         return;
@@ -618,8 +579,9 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
             // bundled channels enforce them. This one used to take `filePath`
             // verbatim, so a path naming the secret store or the config holding
             // `sessionString` was uploaded like any attachment.
-            mediaLocalRoots, mediaAccess, }) => {
+            mediaLocalRoots, mediaReadFile, mediaAccess, }) => {
                 const allowedMediaRoots = mediaLocalRoots ?? mediaAccess?.localRoots;
+                const readMedia = mediaReadFile ?? mediaAccess?.readFile;
                 // Core passes the flag beside `params`; callers write it inside.
                 // Both count, because a rehearsal flag that is silently ignored puts
                 // a real message in a real chat — twice, so far (2.13.1).
@@ -646,10 +608,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                         });
                         throw new Error(`clawgram: not-allowed-chat ${listParams.target}`);
                     }
-                    const listGram = runtimes.get(listAccountId);
-                    if (!listGram) {
-                        throw new Error(`clawgram: runtime not found for account ${listAccountId}`);
-                    }
+                    const listGram = requireRuntimeFor(listAccountId);
                     const history = await listGram.listMessages(listParams);
                     // Metadata only. Message text is the user's correspondence and has no
                     // business in a log that is read while debugging something else.
@@ -693,10 +652,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                         });
                         throw new Error(`clawgram: not-allowed-chat ${fetchParams.target}`);
                     }
-                    const fetchGram = runtimes.get(fetchAccountId);
-                    if (!fetchGram) {
-                        throw new Error(`clawgram: runtime not found for account ${fetchAccountId}`);
-                    }
+                    const fetchGram = requireRuntimeFor(fetchAccountId);
                     // Fetching is a read: a dry run answers for real, the same way `read`
                     // does. Nothing leaves the machine — the file lands in a temp
                     // directory this channel prunes — so a rehearsal that reported
@@ -1024,10 +980,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                             removed: reactionParams.remove,
                         });
                     }
-                    const reactionGram = runtimes.get(reactionAccountId);
-                    if (!reactionGram) {
-                        throw new Error(`clawgram: runtime not found for account ${reactionAccountId}`);
-                    }
+                    const reactionGram = requireRuntimeFor(reactionAccountId);
                     await reactionGram.sendReaction(reactionParams);
                     return (0, core_1.jsonResult)({
                         ok: true,
@@ -1239,13 +1192,12 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                     if (!(0, send_scope_1.isChatSendable)(uploadTo, resolveAccountSendChats(cfg, uploadAccountId))) {
                         refuseOutboundOutsideScope("upload-file", uploadAccountId, uploadTo);
                     }
-                    const file = attachedFile;
-                    if (!file) {
+                    if (!attachedFile) {
                         throw new Error("clawgram: upload-file requires filePath, path, media, or mediaUrl");
                     }
                     // Before anything else about the message is considered: an
                     // out-of-scope path is refused, not sent and then regretted.
-                    (0, media_1.assertLocalMediaWithinRoots)(file, allowedMediaRoots);
+                    (0, media_1.assertLocalMediaWithinRoots)(attachedFile, allowedMediaRoots);
                     const captionText = (0, helpers_1.readMessageText)(params) || ((0, param_readers_1.readStringParam)(params, "caption") ?? "");
                     // A caption is optional, but the silent-reply sentinel must never
                     // reach Telegram as one — same reasoning as the `send` path below.
@@ -1272,10 +1224,10 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                             accountId: uploadAccountId,
                         });
                     }
-                    const uploadGram = runtimes.get(uploadAccountId);
-                    if (!uploadGram) {
-                        throw new Error(`clawgram: runtime not found for account ${uploadAccountId}`);
-                    }
+                    const uploadGram = requireRuntimeFor(uploadAccountId);
+                    // Read last, through core's scoped reader when it gave one: a dry
+                    // run or a refusal above must not open the file.
+                    const file = await (0, media_1.loadOutboundMedia)(attachedFile, allowedMediaRoots, readMedia);
                     const uploaded = await uploadGram.sendMedia({
                         target: uploadTo,
                         file,
@@ -1413,10 +1365,7 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                         accountId: resolvedAccountId,
                     });
                 }
-                const gram = runtimes.get(resolvedAccountId);
-                if (!gram) {
-                    throw new Error(`clawgram: runtime not found for account ${resolvedAccountId}`);
-                }
+                const gram = requireRuntimeFor(resolvedAccountId);
                 const sent = await gram.sendText({
                     target: to,
                     text,

package/dist/gramjs-client.js

@@ -6,6 +6,7 @@ exports.buildVoiceNoteParams = buildVoiceNoteParams;
 const chunk_1 = require("./chunk");
 const telegram_1 = require("telegram");
 const sessions_1 = require("telegram/sessions");
+const uploads_1 = require("telegram/client/uploads");
 // Deep import, but the documented one: GramJS ships its SRP helper here and
 // the package has no `exports` field to forbid it.
 const Password_1 = require("telegram/Password");
@@ -63,29 +64,6 @@ function uniqueCandidates(values) {
     }
     return result;
 }
-function parseTargetWithThread(rawTarget) {
-    const raw = rawTarget.trim();
-    const topicMatch = /^(.+?):topic:(\d+)$/.exec(raw);
-    if (topicMatch) {
-        return {
-            raw,
-            chatId: topicMatch[1],
-            messageThreadId: Number.parseInt(topicMatch[2], 10),
-        };
-    }
-    const colonMatch = /^(.+):(\d+)$/.exec(raw);
-    if (colonMatch && /^-?\d+$/.test(colonMatch[1])) {
-        return {
-            raw,
-            chatId: colonMatch[1],
-            messageThreadId: Number.parseInt(colonMatch[2], 10),
-        };
-    }
-    return {
-        raw,
-        chatId: raw,
-    };
-}
 /**
  * Membership query for `getParticipants`.
  *
@@ -358,7 +336,7 @@ class GramJsClientManager {
                 peer: entity
             };
         }
-        const parsedTarget = parseTargetWithThread(rawTarget);
+        const parsedTarget = (0, history_1.parseTargetWithThread)(rawTarget);
         const raw = parsedTarget.raw;
         const chatLookupTarget = parsedTarget.chatId;
         const kind = options?.kind;
@@ -781,7 +759,11 @@ class GramJsClientManager {
             return sent;
         }
         return this.client.sendFile(resolved.peer, {
-            file: args.file,
+            // Bytes core read through its scoped reader keep the file's own name;
+            // a bare Buffer would reach Telegram as "unnamed" (B5-14).
+            file: typeof args.file === "string"
+                ? args.file
+                : new uploads_1.CustomFile(args.file.fileName, args.file.buffer.length, "", args.file.buffer),
             // Captions are agent prose too — the outbound path sends `caption ??
             // text` — so they render exactly like sendText does. Before 2.15.0
             // captions carried no mode at all, which meant GramJS's default

package/dist/helpers.js

@@ -834,8 +834,11 @@ function normalizeParseMode(raw) {
  * raw markup.
  */
 function resolveReplyParseMode(cfg, accountId) {
-    const channel = cfg?.channels?.["clawgram"];
-    const account = channel?.accounts?.[accountId] ?? channel;
+    // Account level only: the schema has never allowed `replyParseMode` on the
+    // channel itself, so the old fallback to `channels.clawgram.replyParseMode`
+    // read a key `openclaw config validate` rejects — a setting that could not
+    // exist was read, and a test pinned it (audit B5-10).
+    const account = cfg?.channels?.["clawgram"]?.accounts?.[accountId];
     return normalizeParseMode(account?.replyParseMode);
 }
 /**

package/dist/history.js

@@ -20,6 +20,8 @@ exports.normalizeParticipants = normalizeParticipants;
 exports.parseListParticipantsParams = parseListParticipantsParams;
 exports.buildHistoryQuery = buildHistoryQuery;
 exports.normalizeChatKey = normalizeChatKey;
+exports.normalizeScopeList = normalizeScopeList;
+exports.parseTargetWithThread = parseTargetWithThread;
 exports.chatKeyCandidates = chatKeyCandidates;
 exports.isChatReadable = isChatReadable;
 exports.isWithinWindow = isWithinWindow;
@@ -234,6 +236,20 @@ function buildHistoryQuery(args) {
 function normalizeChatKey(value) {
     return String(value ?? "").trim().replace(/^@/, "").toLowerCase();
 }
+/**
+ * A configured chat scope (`readChats`, `sendChats`, `manageChats`) as a list
+ * of chat keys — or `undefined` when the key is absent, because every gate
+ * tells "not configured" from "configured empty" by that difference.
+ *
+ * Four copies of this normalizer used to live in three files, two of them
+ * trimming only and two lowercasing, so the same entry could pass one gate
+ * and fail another (audit B5-13). One now.
+ */
+function normalizeScopeList(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    return (Array.isArray(raw) ? raw : [raw]).map(normalizeChatKey).filter(Boolean);
+}
 /**
  * Все написания одной цели, по которым её ищут в списке доступа.
  *
@@ -247,11 +263,44 @@ function normalizeChatKey(value) {
  * `-1001234:topic:5` сегодня работает как область в одну тему, и сведение
  * всего к чату молча расширило бы её на весь чат.
  */
+/**
+ * One target address, split into the chat and the forum topic it may name.
+ *
+ * Two spellings carry a topic: `-1001234:topic:5` and the short `-1001234:5`
+ * (a numeric chat, a colon, a number). This is the parser the resolver in
+ * `gramjs-client` uses, and since B5-08 the only one: the gates used to strip
+ * `:topic:N` with a regex of their own and did not know the short form, so
+ * `-1001234:5` passed the resolver as a topic of a listed chat and failed the
+ * gate as an unknown one.
+ */
+function parseTargetWithThread(rawTarget) {
+    const raw = rawTarget.trim();
+    const topicMatch = /^(.+?):topic:(\d+)$/.exec(raw);
+    if (topicMatch) {
+        return {
+            raw,
+            chatId: topicMatch[1],
+            messageThreadId: Number.parseInt(topicMatch[2], 10),
+        };
+    }
+    const colonMatch = /^(.+):(\d+)$/.exec(raw);
+    if (colonMatch && /^-?\d+$/.test(colonMatch[1])) {
+        return {
+            raw,
+            chatId: colonMatch[1],
+            messageThreadId: Number.parseInt(colonMatch[2], 10),
+        };
+    }
+    return {
+        raw,
+        chatId: raw,
+    };
+}
 function chatKeyCandidates(target) {
     const raw = String(target ?? "").trim();
     const withoutChannel = raw.replace(/^(?:clawgram|tguserbot|telegram|tg):/i, "");
     const withoutKind = withoutChannel.replace(/^(?:user|channel|group|conversation|room|dm):/i, "");
-    const chatOnly = withoutKind.replace(/:topic:\d+$/i, "");
+    const chatOnly = parseTargetWithThread(withoutKind).chatId;
     const candidates = [raw, withoutKind, chatOnly]
         .map(normalizeChatKey)
         .filter(Boolean);
@@ -280,11 +329,9 @@ function isChatReadable(target, readChats) {
     const candidates = chatKeyCandidates(target);
     if (candidates.includes(constants_1.TELEGRAM_SERVICE_CHAT_ID))
         return false;
-    if (readChats === undefined || readChats === null)
+    const entries = normalizeScopeList(readChats);
+    if (entries === undefined)
         return true;
-    const entries = (Array.isArray(readChats) ? readChats : [readChats])
-        .map(normalizeChatKey)
-        .filter(Boolean);
     // An empty list is a configured empty list — deny, rather than silently
     // reading everything because someone left brackets behind.
     if (entries.length === 0)

package/dist/inbound-pipeline.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.visibleReplyText = visibleReplyText;
 exports.handleInboundEvent = handleInboundEvent;
 // Входящий контур: одно событие Telegram от нормализации до ответа.
 //
@@ -26,6 +27,7 @@ const normalize_1 = require("./normalize");
 const reactions_1 = require("./reactions");
 const silent_reaction_1 = require("./silent-reaction");
 const system_notice_1 = require("./system-notice");
+const account_registry_1 = require("./account-registry");
 const group_reply_address_1 = require("./group-reply-address");
 const helpers_1 = require("./helpers");
 const constants_2 = require("./constants");
@@ -67,8 +69,53 @@ async function reactToSilentMentionForAccount(params) {
     });
 }
 const actionLog = (0, core_1.createSubsystemLogger)("channels/clawgram");
+/**
+ * The text a reply may carry into a chat, after the filters every reply path
+ * shares — or `undefined` when nothing should go out.
+ *
+ * Three doors deliver an agent's words: the group `deliver` closure, the
+ * direct-message `deliver` closure and the transcript fallback. Each carried
+ * its own copy of the same two checks — drop the silent token, drop core's
+ * telemetry — and the copies drifted: the DM path had no notice filter at
+ * all until B5-01 (audit B5-13). One function now; the log lines keep their
+ * historical wording so journals stay greppable.
+ */
+function visibleReplyText(params) {
+    // Not destructured: a wiring ratchet in test/inbound-pipeline.test.ts finds
+    // handleInboundEvent's own destructuring of its context by pattern, and
+    // nothing shaped like it may stand in front.
+    const accountId = params.accountId;
+    const chatId = params.chatId;
+    const messageId = params.messageId;
+    const log = params.log;
+    const outboundText = typeof params.text === "string" ? params.text.trim() : "";
+    if (!outboundText) {
+        return undefined;
+    }
+    // The agent may decline to answer by returning the shared silent token.
+    // Dropped before addressing: otherwise the reply-address prefix turns it
+    // into a visible message.
+    const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
+    if (!visibleText) {
+        log?.info?.(`clawgram suppressing silent ${params.where}`, { accountId, chatId, messageId });
+        return undefined;
+    }
+    // Core glues its telemetry to the turn's payload and it arrives here the
+    // same way an answer does. In a group it never goes out; in a DM only the
+    // named operator may receive it (A5-10, A5-11, B5-01).
+    const notice = (0, system_notice_1.shouldSuppressGroupSystemNotice)(params.kind === "group"
+        ? { targetKind: "group", text: visibleText }
+        : { targetKind: "user", text: visibleText, to: chatId, operatorIds: (0, account_registry_1.operatorIdsFor)(accountId) });
+    if (notice) {
+        log?.warn?.(`clawgram suppressing system notice in ${params.where}`, {
+            accountId, chatId, messageId, noticeKind: notice, textLength: visibleText.length,
+        });
+        return undefined;
+    }
+    return visibleText;
+}
 async function handleInboundEvent(event, ctx) {
-    const { accountId, cfg, channelRuntime, client, gram, log, pairing, pluginRuntime, runtimes, selfId, selfLabel, selfUsername } = ctx;
+    const { accountId, cfg, channelRuntime, client, gram, log, pluginRuntime, runtimes, selfId, selfLabel, selfUsername } = ctx;
     try {
         const rawMessage = event?.message;
         const rawPeerUserId = rawMessage?.peerId?.userId;
@@ -326,6 +373,12 @@ async function handleInboundEvent(event, ctx) {
         // the answer — and by the same resolver `resolveAccount` uses, so the
         // gate applied here is the one the account was started with.
         const { allowFrom: directAllowFrom } = inboundScopes;
+        // Fixed, not configurable: clawgram admits a DM by `allowFrom` alone
+        // (the roster) and offers no pairing challenge — a stranger cannot
+        // talk their way in. Core's resolver is still called for the block
+        // decision and `commandAuthorized`; with "open" it never answers
+        // "pairing", so the 30-line challenge branch that once followed it
+        // was unreachable and read like a barrier (audit B5-15).
         const dmPolicy = "open";
         if (normalized.chatType === "group") {
             const groupConfig = inboundGroupConfig;
@@ -555,38 +608,11 @@ async function handleInboundEvent(event, ctx) {
                                 payloadTextLength: outboundText.length,
                                 payloadReplyToId: payload.replyToId ?? null,
                             });
-                            if (!outboundText) {
-                                return;
-                            }
-                            // The agent may decline to answer by returning the shared
-                            // silent token. Drop it before addressing: otherwise the
-                            // reply-address prefix turns it into a visible message.
-                            const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
-                            if (!visibleText) {
-                                log?.info?.("clawgram suppressing silent group reply", {
-                                    accountId,
-                                    chatId: normalized.chatId,
-                                    messageId: normalized.messageId,
-                                });
-                                return;
-                            }
-                            // Ядро подклеивает свою телеметрию к полезной нагрузке
-                            // хода, и сюда она приходит тем же путём, что ответ.
-                            // Проверка стояла только в `outbound.sendText`, то есть
-                            // класс инцидента 30.08–01.09 был закрыт для рассылок и
-                            // открыт для обычного ответа на упоминание (A5-10).
-                            const groupNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
-                                targetKind: "group",
-                                text: visibleText,
+                            const visibleText = visibleReplyText({
+                                text: outboundText, kind: "group", where: "group reply",
+                                accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
                             });
-                            if (groupNotice) {
-                                log?.warn?.("clawgram suppressing system notice in group reply", {
-                                    accountId,
-                                    chatId: normalized.chatId,
-                                    messageId: normalized.messageId,
-                                    noticeKind: groupNotice,
-                                    textLength: visibleText.length,
-                                });
+                            if (!visibleText) {
                                 return;
                             }
                             const replyToMessageId = payload.replyToId ? Number(payload.replyToId) : Number(normalized.messageId);
@@ -647,19 +673,10 @@ async function handleInboundEvent(event, ctx) {
                         : "";
                     // Тот же фильтр и здесь: последняя реплика в стенограмме
                     // вполне может оказаться именно уведомлением об ошибке.
-                    const fallbackNotice = rawFallback
-                        ? (0, system_notice_1.shouldSuppressGroupSystemNotice)({ targetKind: "group", text: rawFallback })
-                        : undefined;
-                    if (fallbackNotice) {
-                        log?.warn?.("clawgram suppressing system notice in transcript fallback", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                            noticeKind: fallbackNotice,
-                            textLength: rawFallback.length,
-                        });
-                    }
-                    const visibleFallbackText = fallbackNotice ? "" : rawFallback;
+                    const visibleFallbackText = visibleReplyText({
+                        text: rawFallback, kind: "group", where: "transcript fallback",
+                        accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
+                    }) ?? "";
                     if (!visibleFallbackText) {
                         if (fallbackText) {
                             log?.info?.("clawgram skipping silent transcript fallback", {
@@ -769,7 +786,6 @@ async function handleInboundEvent(event, ctx) {
                 senderId,
                 senderUsername,
             }),
-            readStoreAllowFrom: pairing.readStoreForDmPolicy,
         });
         if (access.access.decision === "block") {
             log?.info?.("clawgram blocking inbound direct message", {
@@ -782,36 +798,6 @@ async function handleInboundEvent(event, ctx) {
             });
             return;
         }
-        if (access.access.decision === "pairing") {
-            await pairing.issueChallenge({
-                senderId,
-                senderIdLine: `Your Telegram user id: ${senderId}`,
-                meta: {
-                    username: normalized.senderUsername,
-                    name: normalized.senderDisplay,
-                },
-                sendPairingReply: async (pairingText) => {
-                    await sendTextToConversation({
-                        text: pairingText,
-                    });
-                },
-                onReplyError: (err) => {
-                    log?.info?.("clawgram pairing reply failed", {
-                        accountId,
-                        chatId: normalized.chatId,
-                        senderId,
-                        error: String(err),
-                    });
-                },
-            });
-            log?.info?.("clawgram pairing required for inbound direct message", {
-                accountId,
-                chatId: normalized.chatId,
-                messageId: normalized.messageId,
-                senderId,
-            });
-            return;
-        }
         // Same fetch as the group path. In a DM the parent is as often
         // the agent's own message as the person's — the owner answers a
         // notice she sent — and neither text is available any other way.
@@ -852,37 +838,13 @@ async function handleInboundEvent(event, ctx) {
                     NativeChannelId: normalized.chatId,
                 },
                 deliver: async (payload) => {
-                    const outboundText = typeof payload.text === "string" ? payload.text.trim() : "";
-                    if (!outboundText) {
-                        return;
-                    }
-                    const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
-                    if (!visibleText) {
-                        log?.info?.("clawgram suppressing silent direct reply", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                        });
-                        return;
-                    }
-                    // Тот же фильтр, что у группового ответа и у outbound.sendText:
-                    // личный ответ идёт третьим путём, и закрытие A5-11 его не
-                    // покрывало — «⚠️ 🛠️ Bash failed: cat /opt/openclaw-secrets/…»
-                    // уходил любому из allowFrom, чей ход уронил инструмент (B5-01).
-                    const directNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
-                        targetKind: "user",
-                        text: visibleText,
-                        to: normalized.chatId,
-                        operatorIds: (0, system_notice_1.operatorIdsFor)(accountId),
+                    // Тот же фильтр, что у группового ответа: личный ответ идёт
+                    // третьим путём, и закрытие A5-11 его не покрывало (B5-01).
+                    const visibleText = visibleReplyText({
+                        text: payload.text, kind: "user", where: "direct reply",
+                        accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
                     });
-                    if (directNotice) {
-                        log?.warn?.("clawgram suppressing system notice in direct reply", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                            noticeKind: directNotice,
-                            textLength: visibleText.length,
-                        });
+                    if (!visibleText) {
                         return;
                     }
                     await sendTextToConversation({

package/dist/manage.js

@@ -202,12 +202,7 @@ function parseInviteLinkParams(params, toolContext) {
     };
 }
 function normalizeScope(manageChats) {
-    if (manageChats === undefined || manageChats === null) {
-        return [];
-    }
-    return (Array.isArray(manageChats) ? manageChats : [manageChats])
-        .map(history_1.normalizeChatKey)
-        .filter(Boolean);
+    return (0, history_1.normalizeScopeList)(manageChats) ?? [];
 }
 /** True while the account is allowed to manage anything at all. */
 function isManagementEnabled(manageChats) {

package/dist/media.js

@@ -22,6 +22,7 @@ exports.downloadMessageMediaToFile = downloadMessageMediaToFile;
 exports.pruneFetchedMedia = pruneFetchedMedia;
 exports.isLocalMediaPath = isLocalMediaPath;
 exports.assertLocalMediaWithinRoots = assertLocalMediaWithinRoots;
+exports.loadOutboundMedia = loadOutboundMedia;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const util_1 = require("./util");
@@ -292,3 +293,24 @@ function assertLocalMediaWithinRoots(file, roots) {
         throw new Error(`clawgram: ${file} is outside the media roots this agent may read`);
     }
 }
+/**
+ * The file an outbound send should hand to GramJS.
+ *
+ * Core scopes a call in two ways: `mediaLocalRoots` names the directories the
+ * agent may read from, and `mediaReadFile` is a reader that enforces them
+ * inside core. Bundled channels read local files through that reader; this
+ * one opened the path itself as the gateway process — the roots were checked
+ * here, the reader ignored, so a call core scoped with a reader and no roots
+ * (the default on the RPC and TTS paths) was not scoped at all (audit B5-14).
+ *
+ * Roots are still checked first, symlinks resolved. A local path is then read
+ * through core's reader when one is given, and sent as bytes under the file's
+ * own name; without a reader, or for a URL, the file goes to GramJS as before.
+ */
+async function loadOutboundMedia(file, roots, readFile) {
+    assertLocalMediaWithinRoots(file, roots);
+    if (!readFile || !isLocalMediaPath(file)) {
+        return file;
+    }
+    return { buffer: await readFile(file), fileName: node_path_1.default.basename(file) };
+}

package/dist/outbound.js

@@ -10,6 +10,7 @@ exports.createOutbound = createOutbound;
 const core_1 = require("openclaw/plugin-sdk/core");
 const media_1 = require("./media");
 const send_scope_1 = require("./send-scope");
+const account_registry_1 = require("./account-registry");
 const system_notice_1 = require("./system-notice");
 const group_reply_address_1 = require("./group-reply-address");
 const group_visible_reply_guard_1 = require("./group-visible-reply-guard");
@@ -50,16 +51,14 @@ function createOutbound(runtimes) {
                 // анонсы субагентов) идёт этим путём и мимо той проверки. Отказ
                 // здесь возвращается результатом, а не броском: бросок в этом хуке
                 // роняет весь gateway (грабли 06.08.2026, выше).
-                if (!(0, send_scope_1.isChatSendable)(target, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
-                    const reason = (0, send_scope_1.isPhoneNumberTarget)(target)
-                        ? "phone-number target"
-                        : "chat outside send scope";
+                if (!(0, send_scope_1.isChatSendable)(target, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                    const refusal = (0, send_scope_1.describeSendRefusal)(target);
                     actionLog.warn("clawgram outbound resolveTarget refused", {
                         accountId: ctx.accountId,
-                        target,
-                        reason,
+                        reason: refusal.reason,
+                        ...refusal.logFields,
                     });
-                    return { ok: false, error: new Error(`clawgram: not-allowed-chat ${target}`) };
+                    return { ok: false, error: refusal.error };
                 }
                 return { ok: true, to: target };
             }
@@ -94,11 +93,12 @@ function createOutbound(runtimes) {
             // handleAction, где барьер уже стоял: третий из трёх исходящих путей
             // был открыт для любого адресата и телефонного номера (D2-01, A5-12).
             const scopedTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
-            if (!(0, send_scope_1.isChatSendable)(scopedTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+            if (!(0, send_scope_1.isChatSendable)(scopedTarget, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                const refusal = (0, send_scope_1.describeSendRefusal)(scopedTarget);
                 actionLog.warn("clawgram outbound sendText refused", {
                     accountId: ctx.accountId,
-                    target: scopedTarget,
-                    reason: (0, send_scope_1.isPhoneNumberTarget)(scopedTarget) ? "phone-number target" : "chat outside send scope",
+                    reason: refusal.reason,
+                    ...refusal.logFields,
                 });
                 return { skipped: "not-allowed" };
             }
@@ -111,7 +111,7 @@ function createOutbound(runtimes) {
                 targetKind: (0, helpers_1.inferOutboundTargetKind)(ctx.to),
                 text: ctx.text,
                 to: ctx.to,
-                operatorIds: (0, system_notice_1.operatorIdsFor)(ctx.accountId),
+                operatorIds: (0, account_registry_1.operatorIdsFor)(ctx.accountId),
             });
             if (suppressedNotice) {
                 actionLog.warn("clawgram suppressing system notice in group", {
@@ -122,10 +122,7 @@ function createOutbound(runtimes) {
                 });
                 return { skipped: "system-notice" };
             }
-            const gram = runtimes.get(ctx.accountId);
-            if (!gram) {
-                throw new Error(`clawgram: runtime not found for account ${ctx.accountId}`);
-            }
+            const gram = (0, account_registry_1.requireRuntime)(runtimes, ctx.accountId);
             // The agent already answered this message with its own `send`, and this
             // is core delivering the same turn's final text. Two messages for one
             // answer is how 2026-08-10 read in a work chat: every request reported
@@ -177,10 +174,7 @@ function createOutbound(runtimes) {
             };
         },
         async sendMedia(ctx) {
-            const gram = runtimes.get(ctx.accountId);
-            if (!gram) {
-                throw new Error(`clawgram: runtime not found for account ${ctx.accountId}`);
-            }
+            const gram = (0, account_registry_1.requireRuntime)(runtimes, ctx.accountId);
             // Same rule as the action path: a local file outside the declared
             // roots is refused before anything is uploaded.
             const outboundRoots = ctx.mediaLocalRoots ?? ctx.mediaAccess?.localRoots;
@@ -197,8 +191,8 @@ function createOutbound(runtimes) {
                 hasCaption: Boolean(ctx.caption),
                 asVoice: ctx.audioAsVoice === true,
             });
-            const file = ctx.filePath ?? ctx.mediaUrl;
-            if (!file) {
+            const named = ctx.filePath ?? ctx.mediaUrl;
+            if (!named) {
                 throw new Error("clawgram: sendMedia requires filePath or mediaUrl");
             }
             // Ниже — проверки, которые у `sendText` были, а здесь не было ни
@@ -207,11 +201,12 @@ function createOutbound(runtimes) {
             const mediaTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
             // Область отправки: файл наружу — такое же исходящее, как текст.
             // `resolveTarget` ядро зовёт не на каждом пути, поэтому проверяем и тут.
-            if (!(0, send_scope_1.isChatSendable)(mediaTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+            if (!(0, send_scope_1.isChatSendable)(mediaTarget, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                const refusal = (0, send_scope_1.describeSendRefusal)(mediaTarget);
                 actionLog.warn("clawgram outbound sendMedia refused", {
                     accountId: ctx.accountId,
-                    target: mediaTarget,
-                    reason: (0, send_scope_1.isPhoneNumberTarget)(mediaTarget) ? "phone-number target" : "chat outside send scope",
+                    reason: refusal.reason,
+                    ...refusal.logFields,
                 });
                 return { skipped: "not-allowed" };
             }
@@ -244,6 +239,9 @@ function createOutbound(runtimes) {
             // exactly how a synthesized group reply died on 2026-08-08, silently
             // enough that the transcript fallback posted it as raw text instead.
             const target = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
+            // Read last, through core's scoped reader when it gave one: every
+            // refusal above must have passed before the file is opened.
+            const file = await (0, media_1.loadOutboundMedia)(named, outboundRoots, ctx.mediaReadFile ?? ctx.mediaAccess?.readFile);
             const sent = await gram.sendMedia({
                 target,
                 file,

package/dist/send-scope.js

@@ -3,9 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPhoneNumberTarget = isPhoneNumberTarget;
 exports.isSendScopeConfigured = isSendScopeConfigured;
 exports.isChatSendable = isChatSendable;
-exports.rememberSendScope = rememberSendScope;
-exports.sendScopeFor = sendScopeFor;
-exports.forgetSendScope = forgetSendScope;
+exports.describeSendRefusal = describeSendRefusal;
 const history_1 = require("./history");
 /**
  * Outbound scope for the account: who this account may write to.
@@ -49,11 +47,7 @@ function isPhoneNumberTarget(target) {
     return /[\s()\-.]/.test(raw) && /^\+?\d[\d\s()\-.]{5,}$/.test(raw);
 }
 function normalizeScope(sendChats) {
-    if (sendChats === undefined || sendChats === null)
-        return [];
-    return (Array.isArray(sendChats) ? sendChats : [sendChats])
-        .map(history_1.normalizeChatKey)
-        .filter(Boolean);
+    return (0, history_1.normalizeScopeList)(sendChats) ?? [];
 }
 /** True while the account has a declared outbound scope at all. */
 function isSendScopeConfigured(sendChats) {
@@ -74,24 +68,17 @@ function isChatSendable(target, sendChats) {
     return (0, history_1.chatKeyCandidates)(target).some((candidate) => entries.includes(candidate));
 }
 /**
- * Область отправки каждого аккаунта, запомненная при его старте.
+ * One refusal for every outbound door — `handleAction`, `outbound.resolveTarget`,
+ * `sendText`, `sendMedia` — so the four read the same and log the same.
  *
- * В `outbound.resolveTarget` и `sendText` конфига нет — ядро зовёт их с
- * `{ accountId, to }`, — а тащить её туда параметром значило бы менять
- * контракт ядра ради одной проверки. Тот же приём уже применён к списку
- * операторов (`system-notice.ts`), и по той же причине.
- *
- * Перезапуск канала при правке конфига обновляет запись; аккаунт, о котором
- * ничего не помним, ведёт себя как аккаунт без области — то есть отправка
- * разрешена, но телефонный адресат всё равно отвергнут.
+ * A phone number is personal data: the journal gets the kind of target, not
+ * the value (B5-09). Two of the four doors used to log it anyway (D2-11).
  */
-const sendScopeByAccount = new Map();
-function rememberSendScope(accountId, sendChats) {
-    sendScopeByAccount.set(accountId, sendChats);
-}
-function sendScopeFor(accountId) {
-    return sendScopeByAccount.get(accountId);
-}
-function forgetSendScope(accountId) {
-    sendScopeByAccount.delete(accountId);
+function describeSendRefusal(target) {
+    const phone = isPhoneNumberTarget(target);
+    return {
+        reason: phone ? "phone-number target" : "chat outside send scope",
+        logFields: phone ? { targetKind: "phone" } : { target },
+        error: new Error(`clawgram: not-allowed-chat ${target}`),
+    };
 }

package/dist/system-notice.js

@@ -28,9 +28,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifySystemNotice = classifySystemNotice;
 exports.shouldSuppressGroupSystemNotice = shouldSuppressGroupSystemNotice;
 exports.isOperatorRecipient = isOperatorRecipient;
-exports.rememberOperatorIds = rememberOperatorIds;
-exports.operatorIdsFor = operatorIdsFor;
-exports.forgetOperatorIds = forgetOperatorIds;
 const TOOL_WARNING_PREFIX = "⚠️ 🛠️ ";
 const MESSAGE_FAILED_PREFIX = "⚠️ ✉️ message failed";
 const FALLBACK_NOTICE_PREFIX = "↪️ model fallback";
@@ -96,20 +93,3 @@ function isOperatorRecipient(to, operatorIds) {
     const target = String(to).trim().replace(/^@/, "").toLowerCase();
     return operatorIds.some((id) => String(id).trim().replace(/^@/, "").toLowerCase() === target);
 }
-/**
- * Кто оператор у каждого аккаунта.
- *
- * Список запоминается при старте аккаунта: в `outbound.sendText` конфига нет,
- * а тащить её туда параметром значило бы менять контракт ради одной проверки.
- * Перезапуск канала при правке конфига обновляет запись.
- */
-const operatorIdsByAccount = new Map();
-function rememberOperatorIds(accountId, ids) {
-    operatorIdsByAccount.set(accountId, [...ids]);
-}
-function operatorIdsFor(accountId) {
-    return operatorIdsByAccount.get(accountId) ?? [];
-}
-function forgetOperatorIds(accountId) {
-    operatorIdsByAccount.delete(accountId);
-}

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.22.0",
+  "version": "2.26.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.22.0",
+      "version": "2.26.0",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.25.0",
+  "version": "2.26.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "clawgram",
-  "version": "2.25.0",
+  "version": "2.26.0",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {
     "verify:proxy": "node scripts/verify/gramjs-wiring.cjs && node scripts/verify/auth-preserves-proxy.cjs",
+    "verify:actions": "node scripts/verify/action-probe.cjs",
     "build": "tsc -p tsconfig.json",
     "build:test": "tsc -p tsconfig.test.json",
     "test": "npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",