clawgram 2.27.0 → 2.28.0

package/dist/actions-read.js

@@ -119,19 +119,23 @@ async function handleReadAction(ctx) {
         // that path would pull the file out from under an earlier `both`
         // fetch of the same message that handed the caller a path.
         // Не общий /tmp: там файлы видит каждый локальный пользователь, а на
-        // этом хосте живёт ещё и раннер деплоя. Каталог состояния OpenClaw
-        // принадлежит агенту; если он не задан, остаётся /tmp — но права
-        // 0700/0600 ставятся в любом случае (A5-13).
-        // Каталог состояния принадлежит агенту; при явно заданном
-        // OPENCLAW_STATE_DIR вложения не покидают его.
+        // этом хосте живёт ещё и раннер деплоя (A5-13). При заданном
+        // OPENCLAW_STATE_DIR вложения не покидают каталог состояния; иначе
+        // корень лежит в /tmp и несёт uid процесса в имени.
+        //
+        // Прежде это был `/tmp/clawgram-fetched` — постоянное имя в каталоге,
+        // который делят все пользователи хоста. Когда агент переехал на свою
+        // учётку, имя осталось занято каталогом прежней, и каждая картинка с
+        // 05.09 по 07.09.2026 падала с `EACCES`. Имя с uid разводит учётки, а
+        // `ensurePrivateDir` проверяет, что каталог действительно наш и закрыт.
         const mediaRoot = process.env.OPENCLAW_STATE_DIR?.trim()
             ? node_path_1.default.join((0, state_dir_1.resolveStateDir)(), "tmp")
-            : node_os_1.default.tmpdir();
+            : node_path_1.default.join(node_os_1.default.tmpdir(), `clawgram-${typeof process.getuid === "function" ? process.getuid() : "user"}`);
+        await (0, media_1.ensurePrivateDir)(mediaRoot);
         const sharedFetchDir = node_path_1.default.join(mediaRoot, "clawgram-fetched");
         let fetchDir = sharedFetchDir;
         if (fetchParams.mode === "read") {
-            const { mkdtemp, mkdir } = await import("node:fs/promises");
-            await mkdir(mediaRoot, { recursive: true, mode: 0o700 });
+            const { mkdtemp } = await import("node:fs/promises");
             fetchDir = await mkdtemp(node_path_1.default.join(mediaRoot, "clawgram-media-"));
         }
         else {

package/dist/media.js

@@ -18,6 +18,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeMedia = describeMedia;
 exports.inboundMediaUnderstanding = inboundMediaUnderstanding;
 exports.downloadInboundMediaToTempFile = downloadInboundMediaToTempFile;
+exports.describePrivateDirProblem = describePrivateDirProblem;
+exports.ensurePrivateDir = ensurePrivateDir;
 exports.downloadMessageMediaToFile = downloadMessageMediaToFile;
 exports.pruneFetchedMedia = pruneFetchedMedia;
 exports.isLocalMediaPath = isLocalMediaPath;
@@ -153,6 +155,79 @@ async function downloadInboundMediaToTempFile(params) {
         fileNameFor: ({ extension }) => `attachment.${extension}`,
     });
 }
+/**
+ * Why a directory that merely exists is not good enough.
+ *
+ * `mkdir(..., { recursive: true })` is a no-op on an existing directory and
+ * `chmod` on a directory owned by somebody else fails — and that failure used
+ * to be swallowed. The write then hit `EACCES` and the agent was handed the
+ * bare errno with nothing to act on.
+ *
+ * That is not hypothetical: the shared fetch directory had a fixed name in
+ * world-writable `/tmp`, and when the agent moved to its own account
+ * (04.09.2026) the old account's leftover kept the name. Every picture sent
+ * to the agent failed from 05.09 to 07.09 with
+ * `EACCES: permission denied, open '/tmp/clawgram-fetched/…'`, and the agent
+ * told its owner its "disk access was not restored" — the closest reading it
+ * could make of an errno.
+ *
+ * The same shape is a way in, not only an accident: any local user (this host
+ * also runs a deploy runner) could pre-create that predictable path and read
+ * every attachment written into it. So the check is ownership and mode, not
+ * existence.
+ */
+function describePrivateDirProblem(input) {
+    if (input.isSymbolicLink) {
+        return `clawgram: ${input.path} is a symlink — refusing to write attachments through it`;
+    }
+    if (!input.isDirectory) {
+        return `clawgram: ${input.path} exists and is not a directory`;
+    }
+    if (input.selfUid !== undefined && input.uid !== input.selfUid) {
+        return `clawgram: ${input.path} belongs to uid ${input.uid}, this process runs as ${input.selfUid}`
+            + " — a leftover from another account is holding the path; remove it or give it to this account";
+    }
+    const bits = input.mode & 0o777;
+    if ((bits & 0o077) !== 0) {
+        return `clawgram: ${input.path} is readable beyond this account (mode ${bits.toString(8)})`;
+    }
+    return undefined;
+}
+/**
+ * Creates the directory, makes it private, and proves it — see above.
+ */
+async function ensurePrivateDir(dir) {
+    const { mkdir, chmod, lstat } = await import("node:fs/promises");
+    // `EEXIST` means something already holds the name — a file, a symlink,
+    // another account's directory. The check below says which, and that is
+    // the whole point; an errno is what the agent could not act on. Any other
+    // failure (no space, read-only mount) is still the caller's problem.
+    await mkdir(dir, { recursive: true, mode: 0o700 }).catch((err) => {
+        if (err?.code !== "EEXIST") {
+            throw err;
+        }
+    });
+    // Only tighten what is already our directory: `chmod` on a stray file
+    // would change a mode that is none of our business, and on somebody
+    // else's directory it fails anyway — silently, which is how this stayed
+    // invisible for three days.
+    const found = await lstat(dir);
+    if (found.isDirectory()) {
+        await chmod(dir, 0o700).catch(() => undefined);
+    }
+    const stats = await lstat(dir);
+    const problem = describePrivateDirProblem({
+        path: dir,
+        isDirectory: stats.isDirectory(),
+        isSymbolicLink: stats.isSymbolicLink(),
+        uid: stats.uid,
+        mode: stats.mode,
+        selfUid: typeof process.getuid === "function" ? process.getuid() : undefined,
+    });
+    if (problem) {
+        throw new Error(problem);
+    }
+}
 /**
  * Downloads an attachment into a directory the caller names and owns.
  *
@@ -178,7 +253,7 @@ async function downloadMessageMediaToFile(params) {
     if (!buffer || !(buffer instanceof Buffer) || buffer.length === 0) {
         return undefined;
     }
-    const { mkdir, writeFile, chmod } = await import("node:fs/promises");
+    const { writeFile, chmod } = await import("node:fs/promises");
     const { join } = await import("node:path");
     // Личная переписка на диске: каталог и файл принадлежат только агенту.
     // По умолчанию (umask 022) выходило 0755/0644, то есть вложения из личных
@@ -186,8 +261,7 @@ async function downloadMessageMediaToFile(params) {
     // gitlab-runner (A5-13). `mode` у mkdir и writeFile маскируется umask,
     // поэтому права выставляются отдельным chmod, как это уже делается для
     // конфига в update-config.ts.
-    await mkdir(params.dir, { recursive: true, mode: 0o700 });
-    await chmod(params.dir, 0o700).catch(() => undefined);
+    await ensurePrivateDir(params.dir);
     const extension = extensionFor(described, understanding);
     const path = join(params.dir, params.fileNameFor({ media: described, extension }));
     await writeFile(path, buffer, { mode: 0o600 });

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.27.0",
+  "version": "2.28.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.27.0",
+      "version": "2.28.0",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.27.0",
+  "version": "2.28.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawgram",
-  "version": "2.27.0",
+  "version": "2.28.0",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {