clawgram 2.26.1 → 2.28.0

package/dist/actions-read.js

@@ -119,19 +119,23 @@ async function handleReadAction(ctx) {
         // that path would pull the file out from under an earlier `both`
         // fetch of the same message that handed the caller a path.
         // Не общий /tmp: там файлы видит каждый локальный пользователь, а на
-        // этом хосте живёт ещё и раннер деплоя. Каталог состояния OpenClaw
-        // принадлежит агенту; если он не задан, остаётся /tmp — но права
-        // 0700/0600 ставятся в любом случае (A5-13).
-        // Каталог состояния принадлежит агенту; при явно заданном
-        // OPENCLAW_STATE_DIR вложения не покидают его.
+        // этом хосте живёт ещё и раннер деплоя (A5-13). При заданном
+        // OPENCLAW_STATE_DIR вложения не покидают каталог состояния; иначе
+        // корень лежит в /tmp и несёт uid процесса в имени.
+        //
+        // Прежде это был `/tmp/clawgram-fetched` — постоянное имя в каталоге,
+        // который делят все пользователи хоста. Когда агент переехал на свою
+        // учётку, имя осталось занято каталогом прежней, и каждая картинка с
+        // 05.09 по 07.09.2026 падала с `EACCES`. Имя с uid разводит учётки, а
+        // `ensurePrivateDir` проверяет, что каталог действительно наш и закрыт.
         const mediaRoot = process.env.OPENCLAW_STATE_DIR?.trim()
             ? node_path_1.default.join((0, state_dir_1.resolveStateDir)(), "tmp")
-            : node_os_1.default.tmpdir();
+            : node_path_1.default.join(node_os_1.default.tmpdir(), `clawgram-${typeof process.getuid === "function" ? process.getuid() : "user"}`);
+        await (0, media_1.ensurePrivateDir)(mediaRoot);
         const sharedFetchDir = node_path_1.default.join(mediaRoot, "clawgram-fetched");
         let fetchDir = sharedFetchDir;
         if (fetchParams.mode === "read") {
-            const { mkdtemp, mkdir } = await import("node:fs/promises");
-            await mkdir(mediaRoot, { recursive: true, mode: 0o700 });
+            const { mkdtemp } = await import("node:fs/promises");
             fetchDir = await mkdtemp(node_path_1.default.join(mediaRoot, "clawgram-media-"));
         }
         else {

package/dist/group-reply-address.js

@@ -79,5 +79,10 @@ function buildGroupReplyAddress(input) {
     if (display && display !== "Telegram") {
         return display;
     }
-    return input.senderId;
+    // No handle and no name means no greeting, not a numeric one. The id
+    // used to be the fallback, and in a basic group — where GramJS attaches
+    // no sender profile to the message — every reply of a day opened with
+    // «890975818, …» (07.09.2026). A person does not know their own
+    // telegram id and reads it as a malfunction.
+    return undefined;
 }

package/dist/inbound-pipeline.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.visibleReplyText = visibleReplyText;
 exports.handleInboundEvent = handleInboundEvent;
+exports.agentFacingGroupBody = agentFacingGroupBody;
 // Входящий контур: одно событие Telegram от нормализации до ответа.
 //
 // Вынесено из `channel.ts` — 856 строк внутри `gateway.startAccount`, самый
@@ -252,6 +253,13 @@ async function handleInboundEvent(event, ctx) {
                 senderId: inboundSenderId,
                 senderUsername: normalized.senderUsername,
             });
+        // The name of a direct-message sender who may reach the agent. The gate
+        // above stays where B5-04 put it — a blocked sender still costs no
+        // call. A group sender is looked up later, after the mention gate, for
+        // the same reason (see the group branch).
+        if (normalized.chatType === "direct" && senderMayReachAgent) {
+            await resolveNamelessSender(normalized, rawMessage, client);
+        }
         // An attachment carries no text of its own, and dropping it as
         // "empty" is how the assistant used to go silent on being spoken
         // to or shown something. Read it into the body instead: for a
@@ -485,16 +493,32 @@ async function handleInboundEvent(event, ctx) {
                 });
                 return;
             }
+            // Who is speaking, resolved only now — past the group gate and the
+            // mention gate, so a message the agent will not even read costs no
+            // call (B5-04). GramJS attaches `_sender` only from its entity cache,
+            // and in a basic group (or after a restart) that cache is empty: the
+            // turn then had nothing but the numeric id, the reply greeting fell
+            // back to it, and a management chat spent 07.09.2026 being addressed
+            // as «890975818, …». One source of truth for the name: the address
+            // the channel would prepend is also what the agent reads, so the
+            // model cannot greet «Вася Ш.» while the channel greets «@vasya».
+            await resolveNamelessSender(normalized, rawMessage, client);
+            const groupSenderLabel = normalized.senderDisplay || normalized.senderUsername || senderId;
+            const groupReplyAddress = (0, group_reply_address_1.buildGroupReplyAddress)({
+                senderUsername: normalized.senderUsername,
+                senderDisplay: normalized.senderDisplay,
+                senderId,
+            });
             const { storePath, body } = buildEnvelope({
                 channel: "Telegram",
-                from: senderLabel,
+                from: groupSenderLabel,
                 body: text,
                 timestamp: normalized.timestamp,
             });
             const conversationRouteTarget = (0, helpers_1.buildConversationTarget)(normalized.chatId);
             const ctxPayload = channelRuntime.reply.finalizeInboundContext({
                 Body: body,
-                BodyForAgent: text,
+                BodyForAgent: agentFacingGroupBody({ address: groupReplyAddress, senderId, text }),
                 RawBody: text,
                 CommandBody: text,
                 From: conversationRouteTarget,
@@ -502,7 +526,7 @@ async function handleInboundEvent(event, ctx) {
                 SessionKey: route.sessionKey,
                 AccountId: route.accountId ?? accountId,
                 ChatType: "group",
-                ConversationLabel: senderLabel,
+                ConversationLabel: groupSenderLabel,
                 SenderId: senderId,
                 SenderUsername: normalized.senderUsername,
                 SenderName: normalized.senderDisplay,
@@ -535,11 +559,6 @@ async function handleInboundEvent(event, ctx) {
                 OriginatingChannel: "clawgram",
                 OriginatingTo: conversationRouteTarget,
             });
-            const groupReplyAddress = (0, group_reply_address_1.buildGroupReplyAddress)({
-                senderUsername: normalized.senderUsername,
-                senderDisplay: normalized.senderDisplay,
-                senderId,
-            });
             (0, group_reply_address_1.rememberGroupReplyAddress)({
                 accountId: route.accountId ?? accountId,
                 chatId: normalized.chatId,
@@ -897,3 +916,51 @@ async function handleInboundEvent(event, ctx) {
         });
     }
 }
+/**
+ * A sender who arrived without a name or handle gets one profile lookup.
+ *
+ * GramJS attaches `_sender` only from its in-memory entity cache; a basic
+ * group's update carries no users, so after a restart the cache is empty
+ * until something else (a `participants` read) fills it. The lookup may
+ * therefore still come back empty — then the sender stays nameless, the
+ * greeting is omitted and the agent reads `id:<n>`. Callers decide *when*
+ * this runs: after every gate, never for traffic the agent will not read.
+ */
+async function resolveNamelessSender(normalized, rawMessage, client) {
+    if (!normalized.senderId || normalized.senderDisplay || normalized.senderUsername) {
+        return;
+    }
+    const profile = await (0, helpers_1.resolveSenderProfileWithTimeout)(rawMessage, {
+        senderId: normalized.senderId,
+        client,
+    }, 1500);
+    if (profile.username) {
+        normalized.senderUsername = profile.username;
+    }
+    // `toDisplayName` answers "Telegram" when it knows nothing; that is not
+    // a name and must not become one here.
+    if (profile.display && profile.display !== "Telegram") {
+        normalized.senderDisplay = profile.display;
+    }
+}
+/**
+ * What the agent reads for a group message: `Адрес: текст`.
+ *
+ * Until 2.27.0 the turn received the bare text. Core's own Telegram channel
+ * prefixes the sender for groups (`formatInboundEnvelope`), and without that
+ * the agent could tell speakers apart only by the numeric id in metadata —
+ * which is exactly what it then used as an address. The prefix is the very
+ * address the channel would prepend to a reply (`buildGroupReplyAddress`),
+ * so what the model addresses and what the channel greets never differ —
+ * a display name in the body with a handle in the greeting would have
+ * produced «@vasya, Вася Ш., готово». No address known: `id:<n>`, marked
+ * so it is never mistaken for a name.
+ */
+function agentFacingGroupBody(input) {
+    const address = input.address?.trim();
+    if (address) {
+        return `${address}: ${input.text}`;
+    }
+    const id = input.senderId !== undefined ? String(input.senderId).trim() : "";
+    return id ? `id:${id}: ${input.text}` : input.text;
+}

package/dist/media.js

@@ -18,6 +18,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeMedia = describeMedia;
 exports.inboundMediaUnderstanding = inboundMediaUnderstanding;
 exports.downloadInboundMediaToTempFile = downloadInboundMediaToTempFile;
+exports.describePrivateDirProblem = describePrivateDirProblem;
+exports.ensurePrivateDir = ensurePrivateDir;
 exports.downloadMessageMediaToFile = downloadMessageMediaToFile;
 exports.pruneFetchedMedia = pruneFetchedMedia;
 exports.isLocalMediaPath = isLocalMediaPath;
@@ -153,6 +155,79 @@ async function downloadInboundMediaToTempFile(params) {
         fileNameFor: ({ extension }) => `attachment.${extension}`,
     });
 }
+/**
+ * Why a directory that merely exists is not good enough.
+ *
+ * `mkdir(..., { recursive: true })` is a no-op on an existing directory and
+ * `chmod` on a directory owned by somebody else fails — and that failure used
+ * to be swallowed. The write then hit `EACCES` and the agent was handed the
+ * bare errno with nothing to act on.
+ *
+ * That is not hypothetical: the shared fetch directory had a fixed name in
+ * world-writable `/tmp`, and when the agent moved to its own account
+ * (04.09.2026) the old account's leftover kept the name. Every picture sent
+ * to the agent failed from 05.09 to 07.09 with
+ * `EACCES: permission denied, open '/tmp/clawgram-fetched/…'`, and the agent
+ * told its owner its "disk access was not restored" — the closest reading it
+ * could make of an errno.
+ *
+ * The same shape is a way in, not only an accident: any local user (this host
+ * also runs a deploy runner) could pre-create that predictable path and read
+ * every attachment written into it. So the check is ownership and mode, not
+ * existence.
+ */
+function describePrivateDirProblem(input) {
+    if (input.isSymbolicLink) {
+        return `clawgram: ${input.path} is a symlink — refusing to write attachments through it`;
+    }
+    if (!input.isDirectory) {
+        return `clawgram: ${input.path} exists and is not a directory`;
+    }
+    if (input.selfUid !== undefined && input.uid !== input.selfUid) {
+        return `clawgram: ${input.path} belongs to uid ${input.uid}, this process runs as ${input.selfUid}`
+            + " — a leftover from another account is holding the path; remove it or give it to this account";
+    }
+    const bits = input.mode & 0o777;
+    if ((bits & 0o077) !== 0) {
+        return `clawgram: ${input.path} is readable beyond this account (mode ${bits.toString(8)})`;
+    }
+    return undefined;
+}
+/**
+ * Creates the directory, makes it private, and proves it — see above.
+ */
+async function ensurePrivateDir(dir) {
+    const { mkdir, chmod, lstat } = await import("node:fs/promises");
+    // `EEXIST` means something already holds the name — a file, a symlink,
+    // another account's directory. The check below says which, and that is
+    // the whole point; an errno is what the agent could not act on. Any other
+    // failure (no space, read-only mount) is still the caller's problem.
+    await mkdir(dir, { recursive: true, mode: 0o700 }).catch((err) => {
+        if (err?.code !== "EEXIST") {
+            throw err;
+        }
+    });
+    // Only tighten what is already our directory: `chmod` on a stray file
+    // would change a mode that is none of our business, and on somebody
+    // else's directory it fails anyway — silently, which is how this stayed
+    // invisible for three days.
+    const found = await lstat(dir);
+    if (found.isDirectory()) {
+        await chmod(dir, 0o700).catch(() => undefined);
+    }
+    const stats = await lstat(dir);
+    const problem = describePrivateDirProblem({
+        path: dir,
+        isDirectory: stats.isDirectory(),
+        isSymbolicLink: stats.isSymbolicLink(),
+        uid: stats.uid,
+        mode: stats.mode,
+        selfUid: typeof process.getuid === "function" ? process.getuid() : undefined,
+    });
+    if (problem) {
+        throw new Error(problem);
+    }
+}
 /**
  * Downloads an attachment into a directory the caller names and owns.
  *
@@ -178,7 +253,7 @@ async function downloadMessageMediaToFile(params) {
     if (!buffer || !(buffer instanceof Buffer) || buffer.length === 0) {
         return undefined;
     }
-    const { mkdir, writeFile, chmod } = await import("node:fs/promises");
+    const { writeFile, chmod } = await import("node:fs/promises");
     const { join } = await import("node:path");
     // Личная переписка на диске: каталог и файл принадлежат только агенту.
     // По умолчанию (umask 022) выходило 0755/0644, то есть вложения из личных
@@ -186,8 +261,7 @@ async function downloadMessageMediaToFile(params) {
     // gitlab-runner (A5-13). `mode` у mkdir и writeFile маскируется umask,
     // поэтому права выставляются отдельным chmod, как это уже делается для
     // конфига в update-config.ts.
-    await mkdir(params.dir, { recursive: true, mode: 0o700 });
-    await chmod(params.dir, 0o700).catch(() => undefined);
+    await ensurePrivateDir(params.dir);
     const extension = extensionFor(described, understanding);
     const path = join(params.dir, params.fileNameFor({ media: described, extension }));
     await writeFile(path, buffer, { mode: 0o600 });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.26.1",
+  "version": "2.28.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.26.1",
+      "version": "2.28.0",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.26.1",
+  "version": "2.28.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawgram",
-  "version": "2.26.1",
+  "version": "2.28.0",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {