clawgram 2.28.1 → 2.29.1

package/README.md

@@ -31,6 +31,7 @@ Clawgram is a personal-Telegram channel plugin for [OpenClaw](https://github.com
 - **@Mention detection** — respond only when mentioned in groups (text, caption, and ID-based mentions)
 - **Read receipts** — mark messages as read
 - **Emoji reactions** — acknowledge a message with a reaction instead of a reply (`react` action)
+- **Editing what was sent** — rewrite the account's own message in place instead of posting a correction beneath it (`edit` action)
 - **Chat metadata** — title, type, member count, description, forum flag and pinned message (`chatInfo` action)
 - **Attachments on demand** — fetch the photo or voice note on any message in read scope, as a reading, a file, or both (`fetch-media` action)
 - **Chat management** — create supergroups, add/remove members, promote/demote admins, transfer ownership, export invite links (`createGroup`, `addMembers`, `removeMember`, `promoteAdmin`, `demoteAdmin`, `transferOwnership`, `inviteLink`) — off until `manageChats` allows it
@@ -260,7 +261,7 @@ loud where it does occur.
 | `groups` | object | `{}` | Allowed groups map keyed by explicit group id or `*` |
 | `proxy` | object | unset | Optional SOCKS4/SOCKS5 proxy for this account — see [Proxy (SOCKS4/SOCKS5)](#proxy-socks4socks5) |
 | `manageChats` | string[] | unset | Chats the assistant may **manage** — see [Chat management](#chat-management). Absent or empty = management off; `["*"]` = every chat |
-| `sendChats` | string[] | unset | Chats the assistant may **send to** — `send`, `upload-file`, `react` and core's own delivery path (`--deliver`, sub-agent announcements). Absent = every chat; `[]` = none. Phone-number targets are refused regardless (2.18.0; core delivery covered since 2.25.0) |
+| `sendChats` | string[] | unset | Chats the assistant may **send to** — `send`, `upload-file`, `react`, `edit` and core's own delivery path (`--deliver`, sub-agent announcements). Absent = every chat; `[]` = none. Phone-number targets are refused regardless (2.22.0; core delivery covered since 2.25.0) |
 | `replyParseMode` | `"html"` \| `"markdown"` \| `"none"` | unset | Outbound format for replies, core-delivered text, captions and `send` calls that omit `parseMode` — see [Message formatting](#message-formatting) |
 | `twoFaPassword` | string \| SecretRef | unset | The account's Telegram 2FA password; read only by `transferOwnership` |
 | `reactionModel` | string | unset | Model ref or alias for the emoji pick on a silent mention. Unset = the agent's own model. Needs `plugins.entries.clawgram.llm.allowModelOverride: true` in the gateway config; without it the override is refused and the pick quietly falls back to the default model |

package/dist/actions-read.js

@@ -133,116 +133,133 @@ async function handleReadAction(ctx) {
             : node_path_1.default.join(node_os_1.default.tmpdir(), `clawgram-${typeof process.getuid === "function" ? process.getuid() : "user"}`);
         await (0, media_1.ensurePrivateDir)(mediaRoot);
         const sharedFetchDir = node_path_1.default.join(mediaRoot, "clawgram-fetched");
+        const described = (0, media_1.describeMedia)(found.message?.media);
+        // A PDF is not read here: the agent is handed the path for its PDF tool,
+        // so even in `read` mode the file has to outlive the answer. It goes to
+        // the shared directory, which is pruned by age — a private temp directory
+        // is removed only by the `read` branch below, and a PDF skips that branch,
+        // so every PDF read used to stay on disk for good (audit r3 C2-02).
+        const keepsFile = fetchParams.mode !== "read" || (0, media_1.fetchMediaUnderstanding)(described) === "pdf";
         let fetchDir = sharedFetchDir;
-        if (fetchParams.mode === "read") {
-            const { mkdtemp } = await import("node:fs/promises");
-            fetchDir = await mkdtemp(node_path_1.default.join(mediaRoot, "clawgram-media-"));
+        if (keepsFile) {
+            await (0, media_1.pruneFetchedMedia)(sharedFetchDir, FETCHED_MEDIA_TTL_MS, Date.now());
         }
         else {
-            await (0, media_1.pruneFetchedMedia)(sharedFetchDir, FETCHED_MEDIA_TTL_MS, Date.now());
+            const { mkdtemp } = await import("node:fs/promises");
+            fetchDir = await mkdtemp(node_path_1.default.join(mediaRoot, "clawgram-media-"));
         }
-        const described = (0, media_1.describeMedia)(found.message?.media);
-        const downloaded = await (0, media_1.downloadMessageMediaToFile)({
-            client: fetchGram.getClient(),
-            message: found.message,
-            maxBytes: attachments_1.INBOUND_MEDIA_MAX_BYTES,
-            dir: fetchDir,
-            understanding: (0, media_1.fetchMediaUnderstanding)(described),
-            fileNameFor: ({ media, extension }) => (0, fetch_media_1.fetchedMediaFileName)({
-                chatId: fetchChatId,
-                messageId: fetchParams.messageId,
-                extension,
-                fileName: media.fileName,
-            }),
-        });
-        if (!downloaded) {
-            // Three different nothings, and the agent has to be able to tell
-            // them apart: a message with no attachment, an attachment this
-            // channel does not read (a video, a spreadsheet), and one too
-            // large to be worth the transfer. Saying "could not fetch" to all
-            // three is how "she ignored the picture" starts.
-            const tooLarge = typeof described?.size === "number" && described.size > attachments_1.INBOUND_MEDIA_MAX_BYTES;
-            const error = !described
-                ? "no-media"
-                : tooLarge
-                    ? "media-too-large"
-                    : "unsupported-media";
-            actionLog.info("clawgram fetch-media returned nothing", {
+        // Every way out of here removes the private temp directory — the early
+        // "nothing to fetch" answer and a download that throws included. Only the
+        // success branch used to, so a message without media, a video, or a
+        // failed download each left a directory behind for good (audit r3 V1-10).
+        try {
+            const downloaded = await (0, media_1.downloadMessageMediaToFile)({
+                client: fetchGram.getClient(),
+                message: found.message,
+                maxBytes: attachments_1.INBOUND_MEDIA_MAX_BYTES,
+                dir: fetchDir,
+                understanding: (0, media_1.fetchMediaUnderstanding)(described),
+                fileNameFor: ({ media, extension }) => (0, fetch_media_1.fetchedMediaFileName)({
+                    chatId: fetchChatId,
+                    messageId: fetchParams.messageId,
+                    extension,
+                    fileName: media.fileName,
+                }),
+            });
+            if (!downloaded) {
+                // Three different nothings, and the agent has to be able to tell
+                // them apart: a message with no attachment, an attachment this
+                // channel does not read (a video, a spreadsheet), and one too
+                // large to be worth the transfer. Saying "could not fetch" to all
+                // three is how "she ignored the picture" starts.
+                const tooLarge = typeof described?.size === "number" && described.size > attachments_1.INBOUND_MEDIA_MAX_BYTES;
+                const error = !described
+                    ? "no-media"
+                    : tooLarge
+                        ? "media-too-large"
+                        : "unsupported-media";
+                actionLog.info("clawgram fetch-media returned nothing", {
+                    accountId: fetchAccountId,
+                    chatId: fetchChatId,
+                    messageId: fetchParams.messageId,
+                    kind: described?.kind ?? null,
+                    error,
+                });
+                return (0, core_1.jsonResult)({
+                    ok: false,
+                    accountId: fetchAccountId,
+                    chatId: fetchChatId,
+                    messageId: String(fetchParams.messageId),
+                    media: described ?? null,
+                    error,
+                });
+            }
+            let read;
+            let readError;
+            if (fetchParams.mode !== "file") {
+                try {
+                    read = await (0, attachments_1.understandAttachmentFile)({
+                        runtime: pluginRuntime,
+                        cfg,
+                        filePath: downloaded.path,
+                        mimeType: downloaded.mimeType,
+                        understanding: downloaded.understanding,
+                        fileName: downloaded.media.fileName,
+                    });
+                    if (!read) {
+                        readError = "read-empty";
+                    }
+                }
+                catch (err) {
+                    // The bytes are already here. A failed reading is worth
+                    // reporting, but it does not undo a successful fetch: the file
+                    // still exists and can still be forwarded.
+                    readError = String(err);
+                }
+            }
+            // `read` mode is the inbound contract — the words, not the file — so
+            // the bytes go away with the answer. Any other mode keeps them:
+            // that is the whole point of asking for a path.
+            const pdfNeedsFile = downloaded.understanding === "pdf";
+            const finalReadError = pdfNeedsFile ? "use the PDF tool on filePath to read this PDF" : readError;
+            actionLog.info("clawgram fetch-media completed", {
                 accountId: fetchAccountId,
                 chatId: fetchChatId,
                 messageId: fetchParams.messageId,
-                kind: described?.kind ?? null,
-                error,
+                mode: fetchParams.mode,
+                kind: downloaded.media.kind,
+                understanding: downloaded.understanding,
+                characters: read?.length ?? 0,
+                readError: finalReadError ?? null,
             });
             return (0, core_1.jsonResult)({
-                ok: false,
+                ok: true,
                 accountId: fetchAccountId,
                 chatId: fetchChatId,
                 messageId: String(fetchParams.messageId),
-                media: described ?? null,
-                error,
+                mode: fetchParams.mode,
+                media: downloaded.media,
+                understanding: downloaded.understanding,
+                filePath: fetchParams.mode === "read" && !pdfNeedsFile ? undefined : downloaded.path,
+                text: read,
+                readError: finalReadError,
             });
         }
-        let read;
-        let readError;
-        if (fetchParams.mode !== "file") {
-            try {
-                read = await (0, attachments_1.understandAttachmentFile)({
-                    runtime: pluginRuntime,
-                    cfg,
-                    filePath: downloaded.path,
-                    mimeType: downloaded.mimeType,
-                    understanding: downloaded.understanding,
-                    fileName: downloaded.media.fileName,
-                });
-                if (!read) {
-                    readError = "read-empty";
+        finally {
+            // Only the private temp directory is ever removed here — never the
+            // shared one, which other fetches still point at.
+            if (!keepsFile) {
+                try {
+                    const { rm } = await import("node:fs/promises");
+                    await rm(fetchDir, { recursive: true, force: true });
+                }
+                catch {
+                    // A private temp directory left behind is litter, not a leak of
+                    // anything the agent was not already shown; failing the call over it
+                    // would throw away a reading that already succeeded.
                 }
-            }
-            catch (err) {
-                // The bytes are already here. A failed reading is worth
-                // reporting, but it does not undo a successful fetch: the file
-                // still exists and can still be forwarded.
-                readError = String(err);
-            }
-        }
-        // `read` mode is the inbound contract — the words, not the file — so
-        // the bytes go away with the answer. Any other mode keeps them:
-        // that is the whole point of asking for a path.
-        const pdfNeedsFile = downloaded.understanding === "pdf";
-        if (fetchParams.mode === "read" && !pdfNeedsFile) {
-            try {
-                const { rm } = await import("node:fs/promises");
-                await rm(fetchDir, { recursive: true, force: true });
-            }
-            catch {
-                // A file left behind is pruned within a day; failing the call
-                // over it would throw away a reading that already succeeded.
             }
         }
-        const finalReadError = pdfNeedsFile ? "use the PDF tool on filePath to read this PDF" : readError;
-        actionLog.info("clawgram fetch-media completed", {
-            accountId: fetchAccountId,
-            chatId: fetchChatId,
-            messageId: fetchParams.messageId,
-            mode: fetchParams.mode,
-            kind: downloaded.media.kind,
-            understanding: downloaded.understanding,
-            characters: read?.length ?? 0,
-            readError: finalReadError ?? null,
-        });
-        return (0, core_1.jsonResult)({
-            ok: true,
-            accountId: fetchAccountId,
-            chatId: fetchChatId,
-            messageId: String(fetchParams.messageId),
-            mode: fetchParams.mode,
-            media: downloaded.media,
-            understanding: downloaded.understanding,
-            filePath: fetchParams.mode === "read" && !pdfNeedsFile ? undefined : downloaded.path,
-            text: read,
-            readError: finalReadError,
-        });
     }
     /**
      * The scaffold every chat-shaped read shares.

package/dist/actions-send.js

@@ -4,6 +4,7 @@ exports.handleSendAction = handleSendAction;
 const core_1 = require("openclaw/plugin-sdk/core");
 const param_readers_1 = require("openclaw/plugin-sdk/param-readers");
 const account_scopes_1 = require("./account-scopes");
+const edits_1 = require("./edits");
 const group_reply_address_1 = require("./group-reply-address");
 const group_visible_reply_guard_1 = require("./group-visible-reply-guard");
 const helpers_1 = require("./helpers");
@@ -30,7 +31,7 @@ async function handleSendAction(ctx) {
         if (!reactionAccountId) {
             throw new Error("clawgram: no configured account found");
         }
-        // Реакция — видимое действие от имени владельца в чужом чате, и
+        // Реакция — видимое действие от имени этой учётки в чужом чате, и
         // адресуется она так же, как сообщение: та же область (A5-12).
         if (!(0, send_scope_1.isChatSendable)(reactionParams.target, (0, account_scopes_1.resolveAccountSendChats)(cfg, reactionAccountId))) {
             (0, account_scopes_1.refuseOutboundOutsideScope)("react", reactionAccountId, String(reactionParams.target));
@@ -62,6 +63,66 @@ async function handleSendAction(ctx) {
             removed: reactionParams.remove,
         });
     }
+    // Rewriting a message already sent. Gated exactly like `react`: it is a
+    // visible act in someone else's chat under this account's name, so it takes
+    // the outbound scope check and honours `dryRun`, which reading does not need.
+    if (canonical === "edit") {
+        const editParams = (0, edits_1.parseEditParams)(params, toolContext);
+        const editAccountId = resolveRuntimeAccountId(cfg, accountId);
+        if (!editAccountId) {
+            throw new Error("clawgram: no configured account found");
+        }
+        if (!(0, send_scope_1.isChatSendable)(editParams.target, (0, account_scopes_1.resolveAccountSendChats)(cfg, editAccountId))) {
+            (0, account_scopes_1.refuseOutboundOutsideScope)("edit", editAccountId, editParams.target);
+        }
+        // The same sentinel guard as `send`, for the same reason: `NO_REPLY` is
+        // OpenClaw's "say nothing", and an explicit tool call is not a path that
+        // strips it. Editing a real answer down to the token would replace a good
+        // message with what looks like a malfunction — worse than the send case,
+        // because the original text is gone.
+        if ((0, helpers_1.isSilentReplyText)(editParams.text)) {
+            throw new Error("clawgram: edit refuses a silent-reply sentinel as the new text");
+        }
+        // No reply-address prefix, no visible-reply memory, no turn-send memory:
+        // those three exist to shape and de-duplicate NEW messages. An edit
+        // addresses nobody afresh and adds nothing to the chat, so recording it as
+        // "this turn has spoken" would suppress a later genuine answer.
+        const editParseMode = (0, helpers_1.resolveOutboundParseMode)(params, cfg, editAccountId);
+        actionLog.info("clawgram handleAction edit", {
+            accountId: editAccountId,
+            dryRun: dryRun === true,
+            target: editParams.target,
+            messageId: editParams.messageId,
+        });
+        if (dryRun === true) {
+            return (0, core_1.jsonResult)({
+                ok: true,
+                dryRun: true,
+                accountId: editAccountId,
+                chatId: editParams.target,
+                messageId: editParams.messageId,
+            });
+        }
+        const editGram = requireRuntimeFor(editAccountId);
+        await editGram.editText({
+            target: editParams.target,
+            messageId: editParams.messageId,
+            text: editParams.text,
+            parseMode: editParseMode,
+        });
+        actionLog.info("clawgram handleAction edit completed", {
+            accountId: editAccountId,
+            target: editParams.target,
+            messageId: editParams.messageId,
+        });
+        return (0, core_1.jsonResult)({
+            ok: true,
+            edited: true,
+            accountId: editAccountId,
+            chatId: editParams.target,
+            messageId: editParams.messageId,
+        });
+    }
     // Core normalizes whichever of these it filled in to a local path (see
     // `mediaSourceParams` above); `mediaUrl` stays a URL, which GramJS
     // accepts as well.

package/dist/actions.js

@@ -30,6 +30,14 @@ const ACTION_ALIASES = {
     list: "read",
     react: "react",
     joins: "joins",
+    // Rewriting a message already sent (2.29.0). Core has always known the name
+    // — it is in `CHANNEL_MESSAGE_ACTION_NAMES` — so the call reached this
+    // channel and was refused as unsupported, and a wrong answer could only be
+    // followed by a second message correcting it.
+    edit: "edit",
+    editMessage: "edit",
+    "edit-message": "edit",
+    update: "edit",
     "upload-file": "upload-file",
     sendAttachment: "upload-file",
     "fetch-media": "fetch-media",
@@ -108,6 +116,11 @@ function canonicalAction(action) {
  * call fell through to the current chat and answered about the wrong one.
  * `readChatTargetParam` is the single list of accepted spellings now.
  *
+ * `edit` (2.29.0) is the third shape: core resolves it as a *message* target,
+ * so both the chat and `messageId` arrive named. It needs no synonym — the
+ * name core uses is the name this channel uses — and it is listed here only so
+ * the suite asserts core still knows it.
+ *
  * These spellings are derived from `ACTION_ALIASES` rather than kept beside
  * it; that core actually knows each of them is asserted against the installed
  * core in `core-action-synonyms.test.ts`.
@@ -115,6 +128,7 @@ function canonicalAction(action) {
 const CORE_VOCABULARY_SPELLINGS = [
     "thread-list", "channel-list", "channel-info", "member-info", "download-file",
     "channel-create", "addParticipant", "kick", "role-add", "role-remove",
+    "edit",
 ];
 exports.CORE_ACTION_SYNONYMS = Object.fromEntries(CORE_VOCABULARY_SPELLINGS.map((name) => [name, ACTION_ALIASES[name]]));
 /** Canonical actions that go through the chat-management gate. */

package/dist/channel.js

@@ -454,6 +454,9 @@ const createChannelPlugin = (runtimes, pluginRuntime) => {
                     // one. `joins` likewise.
                     actions: [
                         "send", "read", "react", "upload-file",
+                        // Rewriting a message this account already sent (2.29.0). Core
+                        // knows the name, so it needs no synonym — unlike the reads below.
+                        "edit",
                         // Reading an attachment that is already in a chat. `read` reports
                         // that a photo exists; this is what turns it into something the
                         // agent can look at or pass on.

package/dist/edits.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Editing a message already sent — the `edit` action of OpenClaw's message
+ * tool.
+ *
+ * Telegram lets an account rewrite its own message in place, and until 2.29.0
+ * this channel had no way to ask for it: a wrong answer could only be followed
+ * by a second message correcting the first, which leaves both standing in the
+ * chat. `edit` is in core's `CHANNEL_MESSAGE_ACTION_NAMES`, so the name was
+ * reachable from the tool the whole time and simply arrived at a channel that
+ * refused it.
+ *
+ * Parsing lives here, apart from the network, so the argument handling can be
+ * tested without a Telegram connection — the same split as `reactions.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEditParams = parseEditParams;
+const helpers_1 = require("./helpers");
+const history_1 = require("./history");
+function parseEditParams(params, toolContext) {
+    const rawTarget = (0, helpers_1.readChatTargetParam)(params, toolContext);
+    const target = typeof rawTarget === "string" ? rawTarget.trim() : "";
+    if (!target) {
+        throw new Error("clawgram: edit requires a chatId");
+    }
+    // No fall-back to `currentMessageId`, and that is the difference from
+    // `react`. The current message is the one being answered — someone else's.
+    // Reacting to it is the normal case; editing it is never a thing this
+    // account may do, so a missing id is a caller mistake and not an invitation
+    // to guess. Telegram would refuse it, but the refusal would arrive as
+    // MESSAGE_AUTHOR_REQUIRED on a call nobody meant to make.
+    const messageId = (0, history_1.parseMessageId)(params.messageId ?? params.msgId ?? params.message_id, "edit messageId");
+    if (messageId === undefined) {
+        throw new Error("clawgram: edit requires a messageId — the id of the message to rewrite");
+    }
+    // `readMessageText` reads `message` then `text`, exactly as `send` does, so
+    // the same call shape works for both actions.
+    const text = (0, helpers_1.readMessageText)(params).replaceAll("\\n", "\n");
+    if (!text.trim()) {
+        // Telegram has no "edit to nothing": an empty edit is refused server-side,
+        // and a caller who meant to remove the message asked for the wrong action.
+        // Saying so here beats an MTProto error about message content.
+        throw new Error("clawgram: edit requires the new text — an empty edit is not a deletion");
+    }
+    return { target, messageId, text };
+}

package/dist/gramjs-client.js

@@ -427,6 +427,36 @@ class GramJsClientManager {
             ...replyParams,
         });
     }
+    /**
+     * Rewrites a message this account already sent.
+     *
+     * Rendering mirrors `sendText` deliberately: an edit that parsed its text
+     * differently from the send would change the formatting of a message nobody
+     * asked to reformat — markdown shipped as literal asterisks is exactly the
+     * failure that made `sendText` render HTML itself.
+     *
+     * No chunking here, unlike `sendText`. A send too long for Telegram becomes
+     * several messages; an edit cannot — there is one message to rewrite. Over
+     * the limit the call fails, and that is the honest outcome.
+     *
+     * Telegram's own refusals are left to reach the caller as they are:
+     * MESSAGE_AUTHOR_REQUIRED (not this account's message),
+     * MESSAGE_EDIT_TIME_EXPIRED (past the window Telegram allows) and
+     * MESSAGE_NOT_MODIFIED (the new text equals the old one). None of them is
+     * retryable, and dressing them up would hide which one happened.
+     */
+    async editText(args) {
+        const resolved = await this.resolvePeer(args.target);
+        return this.client.editMessage(resolved.peer, {
+            message: args.messageId,
+            text: args.parseMode === "html" ? (0, html_render_1.renderTelegramHtml)(args.text) : args.text,
+            ...(args.parseMode === "none"
+                ? { parseMode: false }
+                : args.parseMode
+                    ? { parseMode: args.parseMode === "markdown" ? "md" : "html" }
+                    : {}),
+        });
+    }
     /**
      * Reads what a chat is: title, type, member count, description, pinned
      * message.

package/dist/group-reply-address.js

@@ -82,7 +82,7 @@ function buildGroupReplyAddress(input) {
     // No handle and no name means no greeting, not a numeric one. The id
     // used to be the fallback, and in a basic group — where GramJS attaches
     // no sender profile to the message — every reply of a day opened with
-    // «890975818, …» (07.09.2026). A person does not know their own
+    // «<numeric id>, …» (07.09.2026). A person does not know their own
     // telegram id and reads it as a malfunction.
     return undefined;
 }

package/dist/inbound-pipeline.js

@@ -499,7 +499,7 @@ async function handleInboundEvent(event, ctx) {
             // and in a basic group (or after a restart) that cache is empty: the
             // turn then had nothing but the numeric id, the reply greeting fell
             // back to it, and a management chat spent 07.09.2026 being addressed
-            // as «890975818, …». One source of truth for the name: the address
+            // as «<numeric id>, …». One source of truth for the name: the address
             // the channel would prepend is also what the agent reads, so the
             // model cannot greet «Вася Ш.» while the channel greets «@vasya».
             await resolveNamelessSender(normalized, rawMessage, client);

package/dist/media.js

@@ -28,6 +28,7 @@ exports.assertLocalMediaWithinRoots = assertLocalMediaWithinRoots;
 exports.loadOutboundMedia = loadOutboundMedia;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
+const docx_text_1 = require("./docx-text");
 const util_1 = require("./util");
 /**
  * GramJS carries numbers as `big-integer` objects as often as native numbers —
@@ -131,19 +132,17 @@ function fetchMediaUnderstanding(media) {
     const inbound = inboundMediaUnderstanding(media);
     if (inbound)
         return inbound;
-    const fileName = media?.fileName?.toLowerCase() ?? "";
-    if (media?.kind === "document" && (media.mimeType === "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
-        || fileName.endsWith(".docx"))) {
+    if (media?.kind !== "document")
+        return undefined;
+    // One definition of "a document we can read": the same predicates decide
+    // how it is read in `understandAttachmentFile`, so a format added there
+    // cannot be downloaded here and then decoded as the wrong thing (r3 C2-03).
+    if ((0, docx_text_1.isDocxDocument)(media.mimeType, media.fileName))
         return "document";
-    }
-    if (media?.kind === "document" && (media.mimeType === "application/pdf" || fileName.endsWith(".pdf"))) {
+    if (media.mimeType === "application/pdf" || media.fileName?.toLowerCase().endsWith(".pdf"))
         return "pdf";
-    }
-    if (media?.kind === "document" && (media.mimeType?.startsWith("text/")
-        || ["txt", "md", "markdown", "csv", "tsv", "json", "jsonl", "yaml", "yml", "toml", "ini", "cfg", "conf", "xml", "html", "htm", "log", "rtf"]
-            .some((extension) => fileName.endsWith(`.${extension}`)))) {
+    if ((0, docx_text_1.isTextDocument)(media.mimeType, media.fileName))
         return "document";
-    }
     return undefined;
 }
 /**

package/dist/outbound.js

@@ -212,7 +212,7 @@ function createOutbound(runtimes) {
             }
             // Молчаливый ответ: подпись с токеном молчания означает «ничего не
             // говорить», и отправлять файл с ним в подписи — тем более.
-            const mediaCaption = ctx.caption ?? ctx.text;
+            let mediaCaption = ctx.caption ?? ctx.text;
             if (mediaCaption?.trim() && (0, helpers_1.isSilentReplyText)(mediaCaption)) {
                 actionLog.info("clawgram suppressing silent outbound media", {
                     accountId: ctx.accountId,
@@ -227,12 +227,30 @@ function createOutbound(runtimes) {
                 chatId: ctx.to,
                 replyToId: ctx.replyToId,
             });
-            // Чего здесь НЕТ намеренно:
-            // — подавление эха хода (`hadTurnSendJustNow`): у текста дубль стоит
-            //   лишнего сообщения, а у медиа отказ стоит потерянного файла —
-            //   картинку агент готовил, и второй раз она не появится;
-            // — подавление служебных сообщений ядра в группах: они текстовые,
-            //   медиа-доставка ими не бывает.
+            // Служебное уведомление ядра, склеенное с payload, уходило подписью:
+            // фильтр телеметрии стоял на трёх текстовых дверях и не стоял здесь
+            // (аудит r3 C0-11, «чинить каждый путь»). Файл при этом не теряется —
+            // уходит без подписи: картинку агент готовил, второй раз её не будет.
+            const captionNotice = mediaCaption?.trim()
+                ? (0, system_notice_1.shouldSuppressGroupSystemNotice)({
+                    targetKind: (0, helpers_1.inferOutboundTargetKind)(ctx.to),
+                    text: mediaCaption,
+                    to: ctx.to,
+                    operatorIds: (0, account_registry_1.operatorIdsFor)(ctx.accountId),
+                })
+                : undefined;
+            if (captionNotice) {
+                actionLog.warn("clawgram suppressing system notice in media caption", {
+                    accountId: ctx.accountId,
+                    rawTo: ctx.to,
+                    noticeKind: captionNotice,
+                    captionLength: mediaCaption.length,
+                });
+                mediaCaption = undefined;
+            }
+            // Чего здесь НЕТ намеренно: подавления эха хода (`hadTurnSendJustNow`):
+            // у текста дубль стоит лишнего сообщения, а у медиа отказ стоит
+            // потерянного файла.
             const messageThreadId = (0, helpers_2.parseOptionalThreadId)(ctx.threadId);
             // Same normalization `sendText` does two functions up. Without it the
             // channel prefix reaches peer resolution and the send throws — which is

package/dist/send-scope.js

@@ -11,8 +11,8 @@ const history_1 = require("./history");
  * Reading has had a declared scope since 2.x (`readChats`), management has
  * one (`manageChats`), and sending had none: `send`, `upload-file` and
  * `react` resolved whatever target the caller named and delivered it. The
- * account is a person's own Telegram account, so an injected turn could
- * message strangers under the owner's name, or carry a work chat's content
+ * account is a real Telegram account, so an injected turn could message
+ * strangers under this account's name, or carry a work chat's content
  * into an attacker's DM one `send` at a time (finding A5-12).
  *
  * Two decisions worth stating, because both could reasonably have gone the

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.28.0",
+  "version": "2.29.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.28.0",
+      "version": "2.29.1",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.28.1",
+  "version": "2.29.1",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -468,7 +468,7 @@
                   "items": {
                     "type": "string"
                   },
-                  "description": "Chat ids the account may SEND to (2.18.0): send, upload-file, react and core's delivery path. Same shape as readChats — absent means no restriction, [] denies everything, [\"*\"] allows every chat. A phone number is refused in every configuration, wildcard included: messaging a raw number starts a conversation with someone who never interacted with the account. Without this list an injected turn can message strangers from the owner's personal account or carry a work chat's content into a DM one send at a time."
+                  "description": "Chat ids the account may SEND to (2.22.0): send, upload-file, react, edit and core's delivery path. Same shape as readChats — absent means no restriction, [] denies everything, [\"*\"] allows every chat. A phone number is refused in every configuration, wildcard included: messaging a raw number starts a conversation with someone who never interacted with the account. Without this list an injected turn can message strangers from this account or carry a work chat's content into a DM one send at a time."
                 },
                 "manageChats": {
                   "type": "array",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawgram",
-  "version": "2.28.1",
+  "version": "2.29.1",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {
@@ -8,7 +8,8 @@
     "verify:actions": "node scripts/verify/action-probe.cjs",
     "build": "tsc -p tsconfig.json",
     "build:test": "tsc -p tsconfig.test.json",
-    "test": "npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",
+    "test": "node scripts/check-pii.mjs && npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",
+    "check:pii": "node scripts/check-pii.mjs",
     "prepublishOnly": "npm run build && npm test",
     "release:clawhub": "node scripts/publish-clawhub.mjs",
     "clawgram-cli": "node dist/clawgram-cli.js",