clawgram 2.30.1 → 2.31.1

package/README.md

@@ -305,12 +305,19 @@ addresses wait for 6 seconds of quiet; consecutive messages by the same sender
 in the same chat/topic are collected into one turn within a 2-minute window.
 An unanswered bare tag can still receive a late continuation within that window.
 Other senders and topics do not inherit the address. Detailed requests proceed
-immediately. Before answering an address, the agent receives up to 12 recent
-messages from the same chat/topic (3 minutes before the triggering message,
+immediately. Before answering an address, the agent receives up to 100 recent
+messages from the same chat/topic (10 minutes before the triggering message,
 including explanations that arrived afterwards), subject to `readChats`.
 History failures leave the original request usable. Attachment metadata includes
 message ids so the agent can read a relevant image with `fetchMedia`.
 
+Plain replies also carry the original message body, fetched independently of
+the nearby-history window. If Telegram rejects an emoji such as ❌ as a standard
+reaction, a Premium account can send the matching custom emoji instead. The
+`react` action resolves it through Telegram's emoji search; it never substitutes
+a different emoji. Account and chat restrictions still apply, and a failed
+reaction remains an error.
+
 ### Per-group tools, skills and system prompt
 
 Since 2.17.0 a group entry can narrow what the assistant does *in that chat*
@@ -951,6 +958,39 @@ npm run clawgram-cli:auth
 
 ## Releases
 
+The **Release** workflow uses npm [trusted publishing](https://docs.npmjs.com/trusted-publishers/)
+through GitHub OIDC. npm issues short-lived credentials per run; `NPM_TOKEN` is
+not used. One-time setup in the npm package's **Settings → Trusted publishing**:
+
+| Field | Value |
+|---|---|
+| Provider | GitHub Actions |
+| Organization/user | `d3pre5s` |
+| Repository | `clawgram` |
+| Workflow filename | `release.yml` |
+| Environment | `npm-publish` |
+| Allowed actions | Enable `npm publish` |
+
+Complete the first real publish within two days of creating the trust. A dry
+run does not validate OIDC. After a successful OIDC release, revoke the old npm
+publishing token and remove its unused GitHub secret.
+
+npm and ClawHub run as separate jobs, with release writes serialized. Re-running
+a release skips an existing npm version only if its `gitHead` matches the release
+commit. If npm succeeds but ClawHub fails, run **Release** from `main` with
+`clawhub_only=true` and `release_tag` set to the existing tag. Recovery uses current
+release safeguards with the original tag's code, builds and tests it, and never
+publishes to npm. Manual runs without this option build, test and run
+`npm pack --dry-run`, which also works when the version already exists on npm.
+
+ClawHub still uses `CLAWHUB_TOKEN` for tag releases: its OIDC path currently only
+supports `workflow_dispatch` via its official reusable workflow. Explicit rate
+limits are retried up to four times. An existing pending release is polled without
+another upload, for up to 30 minutes. Success requires public availability and a
+matching source commit; failed scans, auth errors and timeouts remain failures.
+Login checks and dry runs also retry transient network failures; an ambiguous
+upload failure does not trigger another upload.
+
 Every push and pull request is built and tested on Node 22 and 24. Releases are cut by pushing a
 `v<version>` tag: CI then builds from a clean checkout and publishes to npm with
 [provenance](https://docs.npmjs.com/generating-provenance-statements), so each published tarball is

package/dist/gramjs-client.js

@@ -541,11 +541,29 @@ class GramJsClientManager {
      */
     async sendReaction(args) {
         const resolved = await this.resolvePeer(args.target);
-        await this.client.invoke(new telegram_1.Api.messages.SendReaction({
-            peer: resolved.peer,
-            msgId: args.messageId,
-            reaction: args.remove ? [] : [new telegram_1.Api.ReactionEmoji({ emoticon: args.emoji })],
+        const send = (reaction) => this.client.invoke(new telegram_1.Api.messages.SendReaction({
+            peer: resolved.peer, msgId: args.messageId, reaction,
         }));
+        try {
+            await send(args.remove ? [] : [new telegram_1.Api.ReactionEmoji({ emoticon: args.emoji })]);
+        }
+        catch (error) {
+            // Unicode such as ❌ is not necessarily a standard Telegram reaction.
+            // A Premium account can use the matching custom emoji. Retry only a
+            // definite rejection, never a timeout with an ambiguous send outcome.
+            if (args.remove || error?.errorMessage !== "REACTION_INVALID")
+                throw error;
+            const me = await this.client.getMe();
+            if (!me.premium)
+                throw error;
+            const found = await this.client.invoke(new telegram_1.Api.messages.SearchCustomEmoji({
+                emoticon: args.emoji, hash: BigInt(0),
+            }));
+            const documentId = found.documentId?.[0];
+            if (!documentId)
+                throw error;
+            await send([new telegram_1.Api.ReactionCustomEmoji({ documentId })]);
+        }
     }
     /**
      * Reads a window of chat history.

package/dist/nearby-conversation.js

@@ -85,8 +85,8 @@ async function readNearbyConversation(params) {
         params.gram.listMessages({
             target: params.chatId,
             messageThreadId: params.threadId,
-            limit: 12,
-            since: anchor - 180,
+            limit: 100,
+            since: anchor - 600,
             until: now,
         }),
         new Promise((_resolve, reject) => {
@@ -95,7 +95,7 @@ async function readNearbyConversation(params) {
     ]).finally(() => clearTimeout(timer));
     const messages = result.messages.filter((message) => message.messageId !== params.messageId &&
         (!params.threadId || message.messageThreadId === String(params.threadId)) &&
-        (!message.chatId || message.chatId === params.chatId)).slice(-12).sort((a, b) => Number(a.messageId) - Number(b.messageId));
+        (!message.chatId || message.chatId === params.chatId)).slice(-100).sort((a, b) => Number(a.messageId) - Number(b.messageId));
     if (!messages.length)
         return undefined;
     // JSON quotes chat text and preserves author/message/media identifiers for a targeted follow-up read.

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "clawgram",
-  "version": "2.30.1",
+  "version": "2.31.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "clawgram",
-      "version": "2.30.1",
+      "version": "2.31.1",
       "license": "MIT",
       "dependencies": {
         "json5": "2.2.3",

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawgram",
   "name": "Clawgram",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
-  "version": "2.30.1",
+  "version": "2.31.1",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawgram",
-  "version": "2.30.1",
+  "version": "2.31.1",
   "description": "Clawgram — personal Telegram (MTProto userbot) channel for OpenClaw. Your AI assistant reads and responds as you.",
   "main": "./dist/index.js",
   "scripts": {
@@ -8,7 +8,7 @@
     "verify:actions": "node scripts/verify/action-probe.cjs",
     "build": "tsc -p tsconfig.json",
     "build:test": "tsc -p tsconfig.test.json",
-    "test": "node scripts/check-pii.mjs && npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\"",
+    "test": "node scripts/check-pii.mjs && npm run build:test && node test/ensure-compiled.mjs && node --test \"dist-test/test/*.test.js\" \"test/*.test.mjs\"",
     "check:pii": "node scripts/check-pii.mjs",
     "prepublishOnly": "npm run build && npm test",
     "release:clawhub": "node scripts/publish-clawhub.mjs",