clawgram 2.25.0 → 2.26.1

package/dist/gramjs-client.js

@@ -6,6 +6,7 @@ exports.buildVoiceNoteParams = buildVoiceNoteParams;
 const chunk_1 = require("./chunk");
 const telegram_1 = require("telegram");
 const sessions_1 = require("telegram/sessions");
+const uploads_1 = require("telegram/client/uploads");
 // Deep import, but the documented one: GramJS ships its SRP helper here and
 // the package has no `exports` field to forbid it.
 const Password_1 = require("telegram/Password");
@@ -63,29 +64,6 @@ function uniqueCandidates(values) {
     }
     return result;
 }
-function parseTargetWithThread(rawTarget) {
-    const raw = rawTarget.trim();
-    const topicMatch = /^(.+?):topic:(\d+)$/.exec(raw);
-    if (topicMatch) {
-        return {
-            raw,
-            chatId: topicMatch[1],
-            messageThreadId: Number.parseInt(topicMatch[2], 10),
-        };
-    }
-    const colonMatch = /^(.+):(\d+)$/.exec(raw);
-    if (colonMatch && /^-?\d+$/.test(colonMatch[1])) {
-        return {
-            raw,
-            chatId: colonMatch[1],
-            messageThreadId: Number.parseInt(colonMatch[2], 10),
-        };
-    }
-    return {
-        raw,
-        chatId: raw,
-    };
-}
 /**
  * Membership query for `getParticipants`.
  *
@@ -358,7 +336,7 @@ class GramJsClientManager {
                 peer: entity
             };
         }
-        const parsedTarget = parseTargetWithThread(rawTarget);
+        const parsedTarget = (0, history_1.parseTargetWithThread)(rawTarget);
         const raw = parsedTarget.raw;
         const chatLookupTarget = parsedTarget.chatId;
         const kind = options?.kind;
@@ -781,7 +759,11 @@ class GramJsClientManager {
             return sent;
         }
         return this.client.sendFile(resolved.peer, {
-            file: args.file,
+            // Bytes core read through its scoped reader keep the file's own name;
+            // a bare Buffer would reach Telegram as "unnamed" (B5-14).
+            file: typeof args.file === "string"
+                ? args.file
+                : new uploads_1.CustomFile(args.file.fileName, args.file.buffer.length, "", args.file.buffer),
             // Captions are agent prose too — the outbound path sends `caption ??
             // text` — so they render exactly like sendText does. Before 2.15.0
             // captions carried no mode at all, which meant GramJS's default

package/dist/helpers.js

@@ -834,8 +834,11 @@ function normalizeParseMode(raw) {
  * raw markup.
  */
 function resolveReplyParseMode(cfg, accountId) {
-    const channel = cfg?.channels?.["clawgram"];
-    const account = channel?.accounts?.[accountId] ?? channel;
+    // Account level only: the schema has never allowed `replyParseMode` on the
+    // channel itself, so the old fallback to `channels.clawgram.replyParseMode`
+    // read a key `openclaw config validate` rejects — a setting that could not
+    // exist was read, and a test pinned it (audit B5-10).
+    const account = cfg?.channels?.["clawgram"]?.accounts?.[accountId];
     return normalizeParseMode(account?.replyParseMode);
 }
 /**

package/dist/history.js

@@ -20,6 +20,8 @@ exports.normalizeParticipants = normalizeParticipants;
 exports.parseListParticipantsParams = parseListParticipantsParams;
 exports.buildHistoryQuery = buildHistoryQuery;
 exports.normalizeChatKey = normalizeChatKey;
+exports.normalizeScopeList = normalizeScopeList;
+exports.parseTargetWithThread = parseTargetWithThread;
 exports.chatKeyCandidates = chatKeyCandidates;
 exports.isChatReadable = isChatReadable;
 exports.isWithinWindow = isWithinWindow;
@@ -234,6 +236,20 @@ function buildHistoryQuery(args) {
 function normalizeChatKey(value) {
     return String(value ?? "").trim().replace(/^@/, "").toLowerCase();
 }
+/**
+ * A configured chat scope (`readChats`, `sendChats`, `manageChats`) as a list
+ * of chat keys — or `undefined` when the key is absent, because every gate
+ * tells "not configured" from "configured empty" by that difference.
+ *
+ * Four copies of this normalizer used to live in three files, two of them
+ * trimming only and two lowercasing, so the same entry could pass one gate
+ * and fail another (audit B5-13). One now.
+ */
+function normalizeScopeList(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    return (Array.isArray(raw) ? raw : [raw]).map(normalizeChatKey).filter(Boolean);
+}
 /**
  * Все написания одной цели, по которым её ищут в списке доступа.
  *
@@ -247,11 +263,44 @@ function normalizeChatKey(value) {
  * `-1001234:topic:5` сегодня работает как область в одну тему, и сведение
  * всего к чату молча расширило бы её на весь чат.
  */
+/**
+ * One target address, split into the chat and the forum topic it may name.
+ *
+ * Two spellings carry a topic: `-1001234:topic:5` and the short `-1001234:5`
+ * (a numeric chat, a colon, a number). This is the parser the resolver in
+ * `gramjs-client` uses, and since B5-08 the only one: the gates used to strip
+ * `:topic:N` with a regex of their own and did not know the short form, so
+ * `-1001234:5` passed the resolver as a topic of a listed chat and failed the
+ * gate as an unknown one.
+ */
+function parseTargetWithThread(rawTarget) {
+    const raw = rawTarget.trim();
+    const topicMatch = /^(.+?):topic:(\d+)$/.exec(raw);
+    if (topicMatch) {
+        return {
+            raw,
+            chatId: topicMatch[1],
+            messageThreadId: Number.parseInt(topicMatch[2], 10),
+        };
+    }
+    const colonMatch = /^(.+):(\d+)$/.exec(raw);
+    if (colonMatch && /^-?\d+$/.test(colonMatch[1])) {
+        return {
+            raw,
+            chatId: colonMatch[1],
+            messageThreadId: Number.parseInt(colonMatch[2], 10),
+        };
+    }
+    return {
+        raw,
+        chatId: raw,
+    };
+}
 function chatKeyCandidates(target) {
     const raw = String(target ?? "").trim();
     const withoutChannel = raw.replace(/^(?:clawgram|tguserbot|telegram|tg):/i, "");
     const withoutKind = withoutChannel.replace(/^(?:user|channel|group|conversation|room|dm):/i, "");
-    const chatOnly = withoutKind.replace(/:topic:\d+$/i, "");
+    const chatOnly = parseTargetWithThread(withoutKind).chatId;
     const candidates = [raw, withoutKind, chatOnly]
         .map(normalizeChatKey)
         .filter(Boolean);
@@ -280,11 +329,9 @@ function isChatReadable(target, readChats) {
     const candidates = chatKeyCandidates(target);
     if (candidates.includes(constants_1.TELEGRAM_SERVICE_CHAT_ID))
         return false;
-    if (readChats === undefined || readChats === null)
+    const entries = normalizeScopeList(readChats);
+    if (entries === undefined)
         return true;
-    const entries = (Array.isArray(readChats) ? readChats : [readChats])
-        .map(normalizeChatKey)
-        .filter(Boolean);
     // An empty list is a configured empty list — deny, rather than silently
     // reading everything because someone left brackets behind.
     if (entries.length === 0)

package/dist/inbound-pipeline.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.visibleReplyText = visibleReplyText;
 exports.handleInboundEvent = handleInboundEvent;
 // Входящий контур: одно событие Telegram от нормализации до ответа.
 //
@@ -26,6 +27,7 @@ const normalize_1 = require("./normalize");
 const reactions_1 = require("./reactions");
 const silent_reaction_1 = require("./silent-reaction");
 const system_notice_1 = require("./system-notice");
+const account_registry_1 = require("./account-registry");
 const group_reply_address_1 = require("./group-reply-address");
 const helpers_1 = require("./helpers");
 const constants_2 = require("./constants");
@@ -67,8 +69,53 @@ async function reactToSilentMentionForAccount(params) {
     });
 }
 const actionLog = (0, core_1.createSubsystemLogger)("channels/clawgram");
+/**
+ * The text a reply may carry into a chat, after the filters every reply path
+ * shares — or `undefined` when nothing should go out.
+ *
+ * Three doors deliver an agent's words: the group `deliver` closure, the
+ * direct-message `deliver` closure and the transcript fallback. Each carried
+ * its own copy of the same two checks — drop the silent token, drop core's
+ * telemetry — and the copies drifted: the DM path had no notice filter at
+ * all until B5-01 (audit B5-13). One function now; the log lines keep their
+ * historical wording so journals stay greppable.
+ */
+function visibleReplyText(params) {
+    // Not destructured: a wiring ratchet in test/inbound-pipeline.test.ts finds
+    // handleInboundEvent's own destructuring of its context by pattern, and
+    // nothing shaped like it may stand in front.
+    const accountId = params.accountId;
+    const chatId = params.chatId;
+    const messageId = params.messageId;
+    const log = params.log;
+    const outboundText = typeof params.text === "string" ? params.text.trim() : "";
+    if (!outboundText) {
+        return undefined;
+    }
+    // The agent may decline to answer by returning the shared silent token.
+    // Dropped before addressing: otherwise the reply-address prefix turns it
+    // into a visible message.
+    const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
+    if (!visibleText) {
+        log?.info?.(`clawgram suppressing silent ${params.where}`, { accountId, chatId, messageId });
+        return undefined;
+    }
+    // Core glues its telemetry to the turn's payload and it arrives here the
+    // same way an answer does. In a group it never goes out; in a DM only the
+    // named operator may receive it (A5-10, A5-11, B5-01).
+    const notice = (0, system_notice_1.shouldSuppressGroupSystemNotice)(params.kind === "group"
+        ? { targetKind: "group", text: visibleText }
+        : { targetKind: "user", text: visibleText, to: chatId, operatorIds: (0, account_registry_1.operatorIdsFor)(accountId) });
+    if (notice) {
+        log?.warn?.(`clawgram suppressing system notice in ${params.where}`, {
+            accountId, chatId, messageId, noticeKind: notice, textLength: visibleText.length,
+        });
+        return undefined;
+    }
+    return visibleText;
+}
 async function handleInboundEvent(event, ctx) {
-    const { accountId, cfg, channelRuntime, client, gram, log, pairing, pluginRuntime, runtimes, selfId, selfLabel, selfUsername } = ctx;
+    const { accountId, cfg, channelRuntime, client, gram, log, pluginRuntime, runtimes, selfId, selfLabel, selfUsername } = ctx;
     try {
         const rawMessage = event?.message;
         const rawPeerUserId = rawMessage?.peerId?.userId;
@@ -326,6 +373,12 @@ async function handleInboundEvent(event, ctx) {
         // the answer — and by the same resolver `resolveAccount` uses, so the
         // gate applied here is the one the account was started with.
         const { allowFrom: directAllowFrom } = inboundScopes;
+        // Fixed, not configurable: clawgram admits a DM by `allowFrom` alone
+        // (the roster) and offers no pairing challenge — a stranger cannot
+        // talk their way in. Core's resolver is still called for the block
+        // decision and `commandAuthorized`; with "open" it never answers
+        // "pairing", so the 30-line challenge branch that once followed it
+        // was unreachable and read like a barrier (audit B5-15).
         const dmPolicy = "open";
         if (normalized.chatType === "group") {
             const groupConfig = inboundGroupConfig;
@@ -555,38 +608,11 @@ async function handleInboundEvent(event, ctx) {
                                 payloadTextLength: outboundText.length,
                                 payloadReplyToId: payload.replyToId ?? null,
                             });
-                            if (!outboundText) {
-                                return;
-                            }
-                            // The agent may decline to answer by returning the shared
-                            // silent token. Drop it before addressing: otherwise the
-                            // reply-address prefix turns it into a visible message.
-                            const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
-                            if (!visibleText) {
-                                log?.info?.("clawgram suppressing silent group reply", {
-                                    accountId,
-                                    chatId: normalized.chatId,
-                                    messageId: normalized.messageId,
-                                });
-                                return;
-                            }
-                            // Ядро подклеивает свою телеметрию к полезной нагрузке
-                            // хода, и сюда она приходит тем же путём, что ответ.
-                            // Проверка стояла только в `outbound.sendText`, то есть
-                            // класс инцидента 30.08–01.09 был закрыт для рассылок и
-                            // открыт для обычного ответа на упоминание (A5-10).
-                            const groupNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
-                                targetKind: "group",
-                                text: visibleText,
+                            const visibleText = visibleReplyText({
+                                text: outboundText, kind: "group", where: "group reply",
+                                accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
                             });
-                            if (groupNotice) {
-                                log?.warn?.("clawgram suppressing system notice in group reply", {
-                                    accountId,
-                                    chatId: normalized.chatId,
-                                    messageId: normalized.messageId,
-                                    noticeKind: groupNotice,
-                                    textLength: visibleText.length,
-                                });
+                            if (!visibleText) {
                                 return;
                             }
                             const replyToMessageId = payload.replyToId ? Number(payload.replyToId) : Number(normalized.messageId);
@@ -647,19 +673,10 @@ async function handleInboundEvent(event, ctx) {
                         : "";
                     // Тот же фильтр и здесь: последняя реплика в стенограмме
                     // вполне может оказаться именно уведомлением об ошибке.
-                    const fallbackNotice = rawFallback
-                        ? (0, system_notice_1.shouldSuppressGroupSystemNotice)({ targetKind: "group", text: rawFallback })
-                        : undefined;
-                    if (fallbackNotice) {
-                        log?.warn?.("clawgram suppressing system notice in transcript fallback", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                            noticeKind: fallbackNotice,
-                            textLength: rawFallback.length,
-                        });
-                    }
-                    const visibleFallbackText = fallbackNotice ? "" : rawFallback;
+                    const visibleFallbackText = visibleReplyText({
+                        text: rawFallback, kind: "group", where: "transcript fallback",
+                        accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
+                    }) ?? "";
                     if (!visibleFallbackText) {
                         if (fallbackText) {
                             log?.info?.("clawgram skipping silent transcript fallback", {
@@ -769,7 +786,6 @@ async function handleInboundEvent(event, ctx) {
                 senderId,
                 senderUsername,
             }),
-            readStoreAllowFrom: pairing.readStoreForDmPolicy,
         });
         if (access.access.decision === "block") {
             log?.info?.("clawgram blocking inbound direct message", {
@@ -782,36 +798,6 @@ async function handleInboundEvent(event, ctx) {
             });
             return;
         }
-        if (access.access.decision === "pairing") {
-            await pairing.issueChallenge({
-                senderId,
-                senderIdLine: `Your Telegram user id: ${senderId}`,
-                meta: {
-                    username: normalized.senderUsername,
-                    name: normalized.senderDisplay,
-                },
-                sendPairingReply: async (pairingText) => {
-                    await sendTextToConversation({
-                        text: pairingText,
-                    });
-                },
-                onReplyError: (err) => {
-                    log?.info?.("clawgram pairing reply failed", {
-                        accountId,
-                        chatId: normalized.chatId,
-                        senderId,
-                        error: String(err),
-                    });
-                },
-            });
-            log?.info?.("clawgram pairing required for inbound direct message", {
-                accountId,
-                chatId: normalized.chatId,
-                messageId: normalized.messageId,
-                senderId,
-            });
-            return;
-        }
         // Same fetch as the group path. In a DM the parent is as often
         // the agent's own message as the person's — the owner answers a
         // notice she sent — and neither text is available any other way.
@@ -852,37 +838,13 @@ async function handleInboundEvent(event, ctx) {
                     NativeChannelId: normalized.chatId,
                 },
                 deliver: async (payload) => {
-                    const outboundText = typeof payload.text === "string" ? payload.text.trim() : "";
-                    if (!outboundText) {
-                        return;
-                    }
-                    const visibleText = (0, helpers_1.stripSilentReplyToken)(outboundText);
-                    if (!visibleText) {
-                        log?.info?.("clawgram suppressing silent direct reply", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                        });
-                        return;
-                    }
-                    // Тот же фильтр, что у группового ответа и у outbound.sendText:
-                    // личный ответ идёт третьим путём, и закрытие A5-11 его не
-                    // покрывало — «⚠️ 🛠️ Bash failed: cat /opt/openclaw-secrets/…»
-                    // уходил любому из allowFrom, чей ход уронил инструмент (B5-01).
-                    const directNotice = (0, system_notice_1.shouldSuppressGroupSystemNotice)({
-                        targetKind: "user",
-                        text: visibleText,
-                        to: normalized.chatId,
-                        operatorIds: (0, system_notice_1.operatorIdsFor)(accountId),
+                    // Тот же фильтр, что у группового ответа: личный ответ идёт
+                    // третьим путём, и закрытие A5-11 его не покрывало (B5-01).
+                    const visibleText = visibleReplyText({
+                        text: payload.text, kind: "user", where: "direct reply",
+                        accountId, chatId: normalized.chatId, messageId: normalized.messageId, log,
                     });
-                    if (directNotice) {
-                        log?.warn?.("clawgram suppressing system notice in direct reply", {
-                            accountId,
-                            chatId: normalized.chatId,
-                            messageId: normalized.messageId,
-                            noticeKind: directNotice,
-                            textLength: visibleText.length,
-                        });
+                    if (!visibleText) {
                         return;
                     }
                     await sendTextToConversation({

package/dist/manage.js

@@ -202,12 +202,7 @@ function parseInviteLinkParams(params, toolContext) {
     };
 }
 function normalizeScope(manageChats) {
-    if (manageChats === undefined || manageChats === null) {
-        return [];
-    }
-    return (Array.isArray(manageChats) ? manageChats : [manageChats])
-        .map(history_1.normalizeChatKey)
-        .filter(Boolean);
+    return (0, history_1.normalizeScopeList)(manageChats) ?? [];
 }
 /** True while the account is allowed to manage anything at all. */
 function isManagementEnabled(manageChats) {

package/dist/media.js

@@ -22,6 +22,7 @@ exports.downloadMessageMediaToFile = downloadMessageMediaToFile;
 exports.pruneFetchedMedia = pruneFetchedMedia;
 exports.isLocalMediaPath = isLocalMediaPath;
 exports.assertLocalMediaWithinRoots = assertLocalMediaWithinRoots;
+exports.loadOutboundMedia = loadOutboundMedia;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const util_1 = require("./util");
@@ -292,3 +293,24 @@ function assertLocalMediaWithinRoots(file, roots) {
         throw new Error(`clawgram: ${file} is outside the media roots this agent may read`);
     }
 }
+/**
+ * The file an outbound send should hand to GramJS.
+ *
+ * Core scopes a call in two ways: `mediaLocalRoots` names the directories the
+ * agent may read from, and `mediaReadFile` is a reader that enforces them
+ * inside core. Bundled channels read local files through that reader; this
+ * one opened the path itself as the gateway process — the roots were checked
+ * here, the reader ignored, so a call core scoped with a reader and no roots
+ * (the default on the RPC and TTS paths) was not scoped at all (audit B5-14).
+ *
+ * Roots are still checked first, symlinks resolved. A local path is then read
+ * through core's reader when one is given, and sent as bytes under the file's
+ * own name; without a reader, or for a URL, the file goes to GramJS as before.
+ */
+async function loadOutboundMedia(file, roots, readFile) {
+    assertLocalMediaWithinRoots(file, roots);
+    if (!readFile || !isLocalMediaPath(file)) {
+        return file;
+    }
+    return { buffer: await readFile(file), fileName: node_path_1.default.basename(file) };
+}

package/dist/outbound.js

@@ -10,6 +10,7 @@ exports.createOutbound = createOutbound;
 const core_1 = require("openclaw/plugin-sdk/core");
 const media_1 = require("./media");
 const send_scope_1 = require("./send-scope");
+const account_registry_1 = require("./account-registry");
 const system_notice_1 = require("./system-notice");
 const group_reply_address_1 = require("./group-reply-address");
 const group_visible_reply_guard_1 = require("./group-visible-reply-guard");
@@ -50,16 +51,14 @@ function createOutbound(runtimes) {
                 // анонсы субагентов) идёт этим путём и мимо той проверки. Отказ
                 // здесь возвращается результатом, а не броском: бросок в этом хуке
                 // роняет весь gateway (грабли 06.08.2026, выше).
-                if (!(0, send_scope_1.isChatSendable)(target, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
-                    const reason = (0, send_scope_1.isPhoneNumberTarget)(target)
-                        ? "phone-number target"
-                        : "chat outside send scope";
+                if (!(0, send_scope_1.isChatSendable)(target, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                    const refusal = (0, send_scope_1.describeSendRefusal)(target);
                     actionLog.warn("clawgram outbound resolveTarget refused", {
                         accountId: ctx.accountId,
-                        target,
-                        reason,
+                        reason: refusal.reason,
+                        ...refusal.logFields,
                     });
-                    return { ok: false, error: new Error(`clawgram: not-allowed-chat ${target}`) };
+                    return { ok: false, error: refusal.error };
                 }
                 return { ok: true, to: target };
             }
@@ -94,11 +93,12 @@ function createOutbound(runtimes) {
             // handleAction, где барьер уже стоял: третий из трёх исходящих путей
             // был открыт для любого адресата и телефонного номера (D2-01, A5-12).
             const scopedTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
-            if (!(0, send_scope_1.isChatSendable)(scopedTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+            if (!(0, send_scope_1.isChatSendable)(scopedTarget, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                const refusal = (0, send_scope_1.describeSendRefusal)(scopedTarget);
                 actionLog.warn("clawgram outbound sendText refused", {
                     accountId: ctx.accountId,
-                    target: scopedTarget,
-                    reason: (0, send_scope_1.isPhoneNumberTarget)(scopedTarget) ? "phone-number target" : "chat outside send scope",
+                    reason: refusal.reason,
+                    ...refusal.logFields,
                 });
                 return { skipped: "not-allowed" };
             }
@@ -111,7 +111,7 @@ function createOutbound(runtimes) {
                 targetKind: (0, helpers_1.inferOutboundTargetKind)(ctx.to),
                 text: ctx.text,
                 to: ctx.to,
-                operatorIds: (0, system_notice_1.operatorIdsFor)(ctx.accountId),
+                operatorIds: (0, account_registry_1.operatorIdsFor)(ctx.accountId),
             });
             if (suppressedNotice) {
                 actionLog.warn("clawgram suppressing system notice in group", {
@@ -122,10 +122,7 @@ function createOutbound(runtimes) {
                 });
                 return { skipped: "system-notice" };
             }
-            const gram = runtimes.get(ctx.accountId);
-            if (!gram) {
-                throw new Error(`clawgram: runtime not found for account ${ctx.accountId}`);
-            }
+            const gram = (0, account_registry_1.requireRuntime)(runtimes, ctx.accountId);
             // The agent already answered this message with its own `send`, and this
             // is core delivering the same turn's final text. Two messages for one
             // answer is how 2026-08-10 read in a work chat: every request reported
@@ -177,10 +174,7 @@ function createOutbound(runtimes) {
             };
         },
         async sendMedia(ctx) {
-            const gram = runtimes.get(ctx.accountId);
-            if (!gram) {
-                throw new Error(`clawgram: runtime not found for account ${ctx.accountId}`);
-            }
+            const gram = (0, account_registry_1.requireRuntime)(runtimes, ctx.accountId);
             // Same rule as the action path: a local file outside the declared
             // roots is refused before anything is uploaded.
             const outboundRoots = ctx.mediaLocalRoots ?? ctx.mediaAccess?.localRoots;
@@ -197,8 +191,8 @@ function createOutbound(runtimes) {
                 hasCaption: Boolean(ctx.caption),
                 asVoice: ctx.audioAsVoice === true,
             });
-            const file = ctx.filePath ?? ctx.mediaUrl;
-            if (!file) {
+            const named = ctx.filePath ?? ctx.mediaUrl;
+            if (!named) {
                 throw new Error("clawgram: sendMedia requires filePath or mediaUrl");
             }
             // Ниже — проверки, которые у `sendText` были, а здесь не было ни
@@ -207,11 +201,12 @@ function createOutbound(runtimes) {
             const mediaTarget = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
             // Область отправки: файл наружу — такое же исходящее, как текст.
             // `resolveTarget` ядро зовёт не на каждом пути, поэтому проверяем и тут.
-            if (!(0, send_scope_1.isChatSendable)(mediaTarget, (0, send_scope_1.sendScopeFor)(ctx.accountId))) {
+            if (!(0, send_scope_1.isChatSendable)(mediaTarget, (0, account_registry_1.sendScopeFor)(ctx.accountId))) {
+                const refusal = (0, send_scope_1.describeSendRefusal)(mediaTarget);
                 actionLog.warn("clawgram outbound sendMedia refused", {
                     accountId: ctx.accountId,
-                    target: mediaTarget,
-                    reason: (0, send_scope_1.isPhoneNumberTarget)(mediaTarget) ? "phone-number target" : "chat outside send scope",
+                    reason: refusal.reason,
+                    ...refusal.logFields,
                 });
                 return { skipped: "not-allowed" };
             }
@@ -244,6 +239,9 @@ function createOutbound(runtimes) {
             // exactly how a synthesized group reply died on 2026-08-08, silently
             // enough that the transcript fallback posted it as raw text instead.
             const target = (0, helpers_1.normalizeOutboundTarget)(ctx.to);
+            // Read last, through core's scoped reader when it gave one: every
+            // refusal above must have passed before the file is opened.
+            const file = await (0, media_1.loadOutboundMedia)(named, outboundRoots, ctx.mediaReadFile ?? ctx.mediaAccess?.readFile);
             const sent = await gram.sendMedia({
                 target,
                 file,

package/dist/send-scope.js

@@ -3,9 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPhoneNumberTarget = isPhoneNumberTarget;
 exports.isSendScopeConfigured = isSendScopeConfigured;
 exports.isChatSendable = isChatSendable;
-exports.rememberSendScope = rememberSendScope;
-exports.sendScopeFor = sendScopeFor;
-exports.forgetSendScope = forgetSendScope;
+exports.describeSendRefusal = describeSendRefusal;
 const history_1 = require("./history");
 /**
  * Outbound scope for the account: who this account may write to.
@@ -49,11 +47,7 @@ function isPhoneNumberTarget(target) {
     return /[\s()\-.]/.test(raw) && /^\+?\d[\d\s()\-.]{5,}$/.test(raw);
 }
 function normalizeScope(sendChats) {
-    if (sendChats === undefined || sendChats === null)
-        return [];
-    return (Array.isArray(sendChats) ? sendChats : [sendChats])
-        .map(history_1.normalizeChatKey)
-        .filter(Boolean);
+    return (0, history_1.normalizeScopeList)(sendChats) ?? [];
 }
 /** True while the account has a declared outbound scope at all. */
 function isSendScopeConfigured(sendChats) {
@@ -74,24 +68,17 @@ function isChatSendable(target, sendChats) {
     return (0, history_1.chatKeyCandidates)(target).some((candidate) => entries.includes(candidate));
 }
 /**
- * Область отправки каждого аккаунта, запомненная при его старте.
+ * One refusal for every outbound door — `handleAction`, `outbound.resolveTarget`,
+ * `sendText`, `sendMedia` — so the four read the same and log the same.
  *
- * В `outbound.resolveTarget` и `sendText` конфига нет — ядро зовёт их с
- * `{ accountId, to }`, — а тащить её туда параметром значило бы менять
- * контракт ядра ради одной проверки. Тот же приём уже применён к списку
- * операторов (`system-notice.ts`), и по той же причине.
- *
- * Перезапуск канала при правке конфига обновляет запись; аккаунт, о котором
- * ничего не помним, ведёт себя как аккаунт без области — то есть отправка
- * разрешена, но телефонный адресат всё равно отвергнут.
+ * A phone number is personal data: the journal gets the kind of target, not
+ * the value (B5-09). Two of the four doors used to log it anyway (D2-11).
  */
-const sendScopeByAccount = new Map();
-function rememberSendScope(accountId, sendChats) {
-    sendScopeByAccount.set(accountId, sendChats);
-}
-function sendScopeFor(accountId) {
-    return sendScopeByAccount.get(accountId);
-}
-function forgetSendScope(accountId) {
-    sendScopeByAccount.delete(accountId);
+function describeSendRefusal(target) {
+    const phone = isPhoneNumberTarget(target);
+    return {
+        reason: phone ? "phone-number target" : "chat outside send scope",
+        logFields: phone ? { targetKind: "phone" } : { target },
+        error: new Error(`clawgram: not-allowed-chat ${target}`),
+    };
 }

package/dist/system-notice.js

@@ -28,9 +28,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.classifySystemNotice = classifySystemNotice;
 exports.shouldSuppressGroupSystemNotice = shouldSuppressGroupSystemNotice;
 exports.isOperatorRecipient = isOperatorRecipient;
-exports.rememberOperatorIds = rememberOperatorIds;
-exports.operatorIdsFor = operatorIdsFor;
-exports.forgetOperatorIds = forgetOperatorIds;
 const TOOL_WARNING_PREFIX = "⚠️ 🛠️ ";
 const MESSAGE_FAILED_PREFIX = "⚠️ ✉️ message failed";
 const FALLBACK_NOTICE_PREFIX = "↪️ model fallback";
@@ -96,20 +93,3 @@ function isOperatorRecipient(to, operatorIds) {
     const target = String(to).trim().replace(/^@/, "").toLowerCase();
     return operatorIds.some((id) => String(id).trim().replace(/^@/, "").toLowerCase() === target);
 }
-/**
- * Кто оператор у каждого аккаунта.
- *
- * Список запоминается при старте аккаунта: в `outbound.sendText` конфига нет,
- * а тащить её туда параметром значило бы менять контракт ради одной проверки.
- * Перезапуск канала при правке конфига обновляет запись.
- */
-const operatorIdsByAccount = new Map();
-function rememberOperatorIds(accountId, ids) {
-    operatorIdsByAccount.set(accountId, [...ids]);
-}
-function operatorIdsFor(accountId) {
-    return operatorIdsByAccount.get(accountId) ?? [];
-}
-function forgetOperatorIds(accountId) {
-    operatorIdsByAccount.delete(accountId);
-}