grok-telegram-bot 2.4.0 → 2.6.0

package/docs/GROUP.md

@@ -0,0 +1,260 @@
+# Forum project group
+
+Use a **Telegram forum supergroup** so each project gets its own topic. The bot
+runs Grok sessions **in the bound project path** for that topic, while the
+default **AI Chat** topic stays on your workspace (`GROK_WORKSPACE`).
+
+This is optional. Private DMs with the bot still work exactly as before.
+
+---
+
+## Prerequisites
+
+1. A **supergroup** with **Topics** enabled (Telegram group settings → Topics).
+2. The bot is an **administrator** with **Manage Topics** (and enough rights to
+   post / pin when you want icons or setup announcements).
+3. Your bot token and allowlist configured as usual:
+   - `TELEGRAM_BOT_TOKEN`
+   - **`ALLOWED_USERS`** — required for groups. Unauthorized members are
+     **ignored silently** (no ⛔ spam). Empty allowlist with a forum group is
+     unsafe (any member could drive the host).
+4. `PROJECT_ROOTS` / catalog so project names resolve (same roots as `/projects`).
+
+---
+
+## Configure
+
+In `.env` (or `~/.grok/tg/.env` for a global npm install):
+
+```ini
+# Negative Telegram chat id of the forum supergroup
+TOPIC_GROUP_ID=-100xxxxxxxxxx
+
+# Default true: create one topic per catalog project (paced + 429-retried)
+TOPIC_AUTO_CREATE=true
+
+# Display name for the workspace topic (default AI Chat)
+TOPIC_AI_CHAT_NAME=AI Chat
+
+# Workspace used in General / AI Chat
+GROK_WORKSPACE=C:\path\to\workspace
+
+# Where /projects and exact-name topic binds look for folders
+PROJECT_ROOTS=C:\path\to\Domains,H:\Lucru\Domains
+```
+
+Restart the bot after changing these. On startup the bot **probes** the group:
+
+| Probe result | Behavior |
+|---|---|
+| Not admin / no Manage Topics | Group **ignored** for topic features |
+| Topics off | Best-effort try to enable; if Telegram has no API for it, group ignored until you enable Topics manually |
+| Admin + Topics on | **Ready** — creates AI Chat (and optional project topics) |
+
+Re-run setup any time from inside the group:
+
+```
+/forum_setup
+```
+
+You get a clear **ready** vs **disabled (reason)** status and the mapped topic count.
+
+When the bot is later promoted to admin, it re-probes automatically (`my_chat_member`).
+
+---
+
+## Topic model
+
+| Topic | Working directory | Typical use |
+|---|---|---|
+| **General** | `GROK_WORKSPACE` | **Manager chat** (OpenClaw-style): routes work, memory-first, no coding spam |
+| **AI Chat** | `GROK_WORKSPACE` | Normal coding/conversation in the workspace |
+| **Project topic** | Bound project path | All coding work for that folder |
+| **User-created topic** | Bound after name/path match | Ad-hoc projects or new folders |
+
+### General = manager
+
+Messages in **General** drive a chat-like orchestrator, not a coding agent:
+
+1. User asks in General (e.g. “fix login in MyApp”).
+2. Bot uses **memory + topic catalog** (auto-injected) and may call `search_memory` / `list_topics`.
+3. It replies briefly (“OK — I’ll start … in **MyApp**”) with **no progress bars / tool dumps**.
+4. It **dispatches** via `create_topic` / `set_path` / `send_prompt` into the right project topic.
+5. When that child turn finishes, the bridge **wakes General** with a `MANAGER WORK REPORT` so the manager summarizes success/fail for you.
+
+Real implementation stays in **project topics**. General should not edit app code.
+
+Messages you send **inside a project topic** are prompts for a session whose `cwd` is
+that topic’s path. Menus, model/reasoning picks, `/sessions`, `/running`, and
+Stop are **topic-scoped** so one project does not steal another’s session.
+
+In topics the persistent reply keyboard is unreliable, so use the **topic
+inline menu** (Stop + Running + …) or slash commands (`/new`, `/stop`, …).
+
+---
+
+## Binding a topic to a project
+
+### Auto-bind (exact name only)
+
+If you create a topic whose title **exactly** matches a catalog project name
+(case-insensitive), the bot binds it immediately and confirms the path.
+
+Fuzzy / partial matching is **not** used (it used to pick the wrong folder).
+
+### Manual bind
+
+If there is no exact catalog match, the bot asks you to send:
+
+- an **absolute directory path**, or
+- an **exact** catalog project name
+
+Examples:
+
+```text
+H:\Lucru\Domains\MyApp
+MyApp
+```
+
+### Agent bind (Telegram bridge)
+
+From **AI Chat / General**, the agent can create topics and bind paths via a
+fenced JSON block (see [Agent bridge](#agent-bridge-cross-topic-actions)).
+Absolute paths that **do not exist yet are created on disk**, then bound
+(new-project flow).
+
+### One path, one topic
+
+A catalog path is only bound to **one** topic. If the same exact name/path is
+already used, the bot says so and asks for another path or name.
+
+---
+
+## Day-to-day usage
+
+1. Open the **project topic** (or create one and bind it).
+2. Chat normally — each message is a Grok prompt in that project.
+3. **`/new`** or the menu **New** button starts a fresh session in that topic.
+4. **Stop** / `/stop` / `/cancel` only cancels **this topic’s** in-flight turn —
+   never the shared `grok agent` process (other topics keep running).
+5. Attach photos, documents, and (with STT configured) voice the same as in DM.
+6. User prompts are re-posted as **prompt anchors** with a searchable
+   `#prompt_…` tag; replies and Done messages thread to that anchor.
+
+### Multi-project orchestration
+
+In **AI Chat**, ask the agent to open a project elsewhere, e.g. “Create a topic
+for MyApp at `H:\Projects\MyApp` and scaffold a README there.” The agent emits
+bridge actions; the bot creates the topic, binds the path, and can
+`send_prompt` into that topic without you switching threads manually.
+
+---
+
+## Agent bridge (cross-topic actions)
+
+On the **first prompt of a session** the bot teaches the agent a small protocol:
+emit a fenced `json` block with a `"telegram"` array (up to **9** actions per
+turn; up to **5** `send_prompt`). The bridge strips the fence from the chat and
+may feed results back as a quiet system turn (not a second Done).
+
+| Action | Purpose |
+|---|---|
+| `create_topic` | New forum topic; optional `path` binds immediately |
+| `set_path` | Bind/rebind topic by title or `#threadId` |
+| `send_prompt` | Inject a prompt into another topic (`ran` / `queued`; optional `new_session`, **`session_id`** to resume a specific session) |
+| `notify` | Optional extra ping. In **General** the user already sees short chat prose; `notify` is not required. |
+| `search_memory` | Search topic + session indexes (memory-first) |
+| `list_topics` | List mapped forum topics (name, `#id`, path) |
+| `list_jobs` | List recent General → project dispatches |
+| `list_bots` | List allowlisted sibling bots |
+| `bot_command` | Call `/command@bot` and wait for that bot to settle |
+
+Example (from General / AI Chat):
+
+```json
+{
+  "telegram": [
+    {
+      "action": "create_topic",
+      "name": "MyApp",
+      "path": "H:\\Projects\\MyApp"
+    },
+    {
+      "action": "send_prompt",
+      "topic": "MyApp",
+      "prompt": "1) scaffold\n2) tests\n3) README"
+    }
+  ]
+}
+```
+
+`topic` may be the exact title, `#threadId`, `general`, or `ai chat`.
+
+To **resume a related session** found via memory (not the topic's currently open session):
+
+```json
+{
+  "telegram": [
+    {
+      "action": "send_prompt",
+      "topic": "MyApp",
+      "session_id": "019fc9ec",
+      "prompt": "Continue: apply the follow-up fix."
+    }
+  ]
+}
+```
+
+`session_id` may be a full UUID or a short prefix from memory hits. Without it, the bridge uses the topic's foreground session.
+
+`topic` must be an **exact** mapped title or `#threadId` (never placeholders like `…`). If only the session is known, omit `topic` — the bridge maps `session.cwd` → forum topic.
+
+---
+
+## Sibling bots (optional)
+
+To let the agent call other Telegram bots you control:
+
+```ini
+ALLOWED_TELEGRAM_BOTS=helperbot,other_bot
+# Optional catalogs for list_bots / teaching:
+# TELEGRAM_BOT_COMMANDS=helperbot:status,help;otherbot:start|Start,info
+# TELEGRAM_BOT_REPLY_TIMEOUT_MS=45000
+# TELEGRAM_BOT_SETTLE_MS=2000
+```
+
+Only usernames on the allowlist can be invoked. Timeouts return `ok=false` and
+do **not** count as Done.
+
+---
+
+## Access control
+
+| Setting | Effect |
+|---|---|
+| `ALLOWED_USERS` set | Only listed user IDs can prompt (DM **and** group topics) |
+| Not allowlisted | Updates ignored **silently** in the group |
+| Empty allowlist | Anyone can use the bot — **do not combine with `TOPIC_GROUP_ID`** |
+
+---
+
+## Troubleshooting
+
+| Symptom | What to check |
+|---|---|
+| Topics never created | Bot admin + Manage Topics; Topics enabled; `TOPIC_GROUP_ID` exact (negative id); `/forum_setup` |
+| “Group ignored” | Status text from `/forum_setup` (`not_admin`, `not_forum`, …) |
+| Wrong folder bound | Title must **exactly** match catalog name; re-bind with absolute path |
+| Agent can’t create topics | Forum must be **ready**; work from AI Chat / General for orchestration |
+| Unauthorized spam / silent ignore | Confirm your id in `ALLOWED_USERS`; others are silent by design |
+| Stop kills everything | Should not — upgrade if an old build killed the shared agent; Stop is session-scoped |
+| Large catalog slow | Bulk create is paced and 429-retried; re-run `/forum_setup` to continue |
+
+---
+
+## Related
+
+- [README](../README.md) — full feature list and config table
+- [INSTALL.md](./INSTALL.md) — first-time setup
+- [UPGRADE.md](./UPGRADE.md) — updating an existing install
+- `.env.example` — all forum / bridge env vars with comments

package/docs/INSTALL.md

@@ -41,6 +41,9 @@ grok-tg run                     # run in the foreground (Ctrl-C to stop)
 
 > ⚠️ **Set `ALLOWED_USERS`** in `.env` to your Telegram user ID(s). Empty means
 > *anyone* who finds the bot can run commands on your machine.
+>
+> Optional: drive one project per **forum topic** with `TOPIC_GROUP_ID` — see
+> **[GROUP.md](./GROUP.md)** after the bot is running.
 
 ### Startup options (`grok-tg <command>`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grok-telegram-bot",
-  "version": "2.4.0",
+  "version": "2.6.0",
   "description": "Control the official Grok Build CLI from Telegram over the Agent Client Protocol (ACP). Sign in with your xAI account, switch projects, resume sessions, stream responses with diffs, queue follow-ups, manage multiple sign-ins, and run 24/7 as a cross-platform background service.",
   "type": "module",
   "main": "src/index.ts",
@@ -60,15 +60,15 @@
   "dependencies": {
     "diff": "^7.0.0",
     "dotenv": "^16.4.7",
-    "grammy": "^1.30.0",
-    "tsx": "^4.19.2"
+    "grammy": "^1.46.0",
+    "tsx": "^4.23.13"
   },
   "optionalDependencies": {
     "@homebridge/node-pty-prebuilt-multiarch": "0.13.1"
   },
   "devDependencies": {
     "@types/diff": "^7.0.0",
-    "@types/node": "^22.10.0",
+    "@types/node": "^22.20.1",
     "typescript": "^5.7.2"
   }
 }

package/src/app/lifetime-flag.ts

@@ -0,0 +1,20 @@
+/**
+ * Cross-module intentional-exit flag so beforeExit keep-alive and the polling
+ * loop do not fight updater re-exec / fatal exits / SIGINT.
+ */
+let intentional = false;
+let reason = "";
+
+/** Mark that the process is exiting on purpose (do not keep-alive). */
+export function markIntentionalShutdown(why: string): void {
+  intentional = true;
+  reason = why;
+}
+
+export function isIntentionalShutdown(): boolean {
+  return intentional;
+}
+
+export function intentionalShutdownReason(): string {
+  return reason;
+}

package/src/app/settings-store.ts

@@ -1,6 +1,8 @@
 /**
- * Per-chat settings persistence (project, agent, model, reasoning, pinned
- * status message id). Backed by a single JSON file so state survives restarts.
+ * Per-chat / per-forum-topic settings persistence (project, agent, model,
+ * reasoning, pinned status message id, controlled sessions).
+ * Keys: `"12345"` for private chats, `"12345:t7"` for forum topic thread 7.
+ * Backed by a single JSON file so state survives restarts.
  */
 import { join } from "node:path";
 import { JsonStore } from "./json-store.js";
@@ -15,24 +17,61 @@ export class SettingsStore {
     this.store = new JsonStore<SettingsMap>(join(dataDir, "settings.json"), {});
   }
 
+  /** Settings for a private chat (or legacy callers). */
   get(chatId: number): ChatSettings {
-    const existing = this.store.get()[String(chatId)];
+    return this.getKey(String(chatId));
+  }
+
+  /** Settings by storage key (`chatId` or `chatId:t{threadId}`). */
+  getKey(key: string): ChatSettings {
+    const existing = this.store.get()[key];
     return existing ?? defaultSettings();
   }
 
   update(chatId: number, patch: Partial<ChatSettings>): ChatSettings {
-    const key = String(chatId);
-    const next = { ...this.get(chatId), ...patch };
+    return this.updateKey(String(chatId), patch);
+  }
+
+  updateKey(key: string, patch: Partial<ChatSettings>): ChatSettings {
+    const next = { ...this.getKey(key), ...patch };
     this.store.update((m) => {
       m[key] = next;
     });
     return next;
   }
 
+  /**
+   * All settings entries whose projectPath matches (for bidirectional
+   * bot ↔ forum session discovery).
+   */
+  entriesForProject(projectPath: string): Array<{ key: string; settings: ChatSettings }> {
+    const want = normPath(projectPath);
+    const out: Array<{ key: string; settings: ChatSettings }> = [];
+    for (const [key, s] of Object.entries(this.store.get())) {
+      if (s.projectPath && normPath(s.projectPath) === want) {
+        out.push({ key, settings: s });
+      }
+      for (const cs of s.controlledSessions ?? []) {
+        if (cs.projectPath && normPath(cs.projectPath) === want) {
+          out.push({ key, settings: s });
+          break;
+        }
+      }
+    }
+    return out;
+  }
+
   /** All chat ids that have interacted (for broadcast announcements). */
   chatIds(): number[] {
-    return Object.keys(this.store.get())
-      .map(Number)
-      .filter((n) => Number.isFinite(n));
+    const ids = new Set<number>();
+    for (const key of Object.keys(this.store.get())) {
+      const n = Number(key.split(":")[0]);
+      if (Number.isFinite(n)) ids.add(n);
+    }
+    return [...ids];
   }
 }
+
+function normPath(p: string): string {
+  return p.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+}

package/src/app/types.ts

@@ -13,6 +13,11 @@ export interface ChatSettings {
   agent?: string;
   model?: string;
   reasoning: ReasoningEffort;
+  /**
+   * Preferred saved Grok account login id for this chat/topic (optional).
+   * Applied when starting turns if different from the process-active account.
+   */
+  preferredAccountId?: string;
   /** Telegram message id of the pinned status panel, if any. */
   statusMessageId?: number;
   /** Sessions this chat controls (for multi-session switching). */
@@ -57,6 +62,11 @@ export interface PromptInput {
   resourceLinks?: PromptResourceLink[];
   /** Telegram message id of the prompt, so the reply threads to it. */
   replyTo?: number;
+  /**
+   * Short id for the bot-owned prompt anchor (`#prompt_<id>`). All AI messages
+   * for this turn carry the same tag so the user can search related replies.
+   */
+  promptId?: string;
   /**
    * Content of the message the user was replying to (or the portion they
    * quoted). Injected as context so the agent sees what the user is responding
@@ -68,20 +78,47 @@ export interface PromptInput {
    * trigger another self-recheck — only real user prompts do (once each).
    */
   skipSelfRecheck?: boolean;
+  /**
+   * Manager dispatch metadata for this prompt only (General → project).
+   * Carried through the queue so concurrent send_prompt jobs do not steal
+   * each other's report-back. Shape matches bot/manager-jobs ReportBackMeta.
+   */
+  reportBack?: {
+    jobId: string;
+    originChatId: number;
+    originThreadId: number;
+    userAskPreview: string;
+    targetName: string;
+    targetPath: string;
+    dispatchPrompt: string;
+  };
+  /**
+   * Pre-posted status bubble (General: "Starting…") that the turn edits to
+   * "Thinking…" then streams the agent reply into.
+   */
+  seedMessageId?: number;
 }
 
 export function textPrompt(
   text: string,
   replyTo?: number,
   quotedText?: string,
-  opts?: { skipSelfRecheck?: boolean },
+  opts?: {
+    skipSelfRecheck?: boolean;
+    promptId?: string;
+    reportBack?: PromptInput["reportBack"];
+    seedMessageId?: number;
+  },
 ): PromptInput {
   return {
     text,
     images: [],
     resourceLinks: [],
     replyTo,
+    promptId: opts?.promptId,
     quotedText,
     skipSelfRecheck: opts?.skipSelfRecheck,
+    reportBack: opts?.reportBack,
+    seedMessageId: opts?.seedMessageId,
   };
 }

package/src/app/updater.ts

@@ -17,6 +17,7 @@ import { get } from "node:https";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { JsonStore } from "./json-store.js";
+import { markIntentionalShutdown } from "./lifetime-flag.js";
 import { createLogger } from "../logger.js";
 import { extractChangelog, isNewer, isSafeVersion } from "./version.js";
 
@@ -145,27 +146,47 @@ export class Updater {
   }
 
   private async restart(): Promise<void> {
+    // Signal main/beforeExit that this exit is intentional (avoid keep-alive race).
+    markIntentionalShutdown("updater-reexec");
     await this.opts.shutdown().catch(() => {});
     // Under systemd/launchd, a clean exit triggers a managed relaunch (no double
     // instance). On Windows / foreground there is no supervisor, so re-exec.
     if (process.env.GROK_TG_SUPERVISED === "1") {
       log.info("exiting for supervisor to relaunch the updated bot");
+      try {
+        process.stderr.write("[updater] supervised exit for relaunch\n");
+      } catch {
+        /* ignore */
+      }
       setTimeout(() => process.exit(0), 250);
       return;
     }
     log.info("re-executing the updated bot");
     try {
+      // TTY: inherit stdio so `npm start` doesn't look like a silent death.
+      // Non-TTY (service): detach and ignore stdio.
+      const inherit = Boolean(process.stdout.isTTY);
       const child = spawn(
         process.execPath,
         ["--import", "tsx", join(this.opts.projectRoot, "src", "index.ts"), "--instance", this.opts.instanceDir],
-        { detached: true, stdio: "ignore", cwd: this.opts.projectRoot, env: process.env },
+        {
+          detached: !inherit,
+          stdio: inherit ? "inherit" : "ignore",
+          cwd: this.opts.projectRoot,
+          env: process.env,
+        },
       );
-      child.unref();
+      if (!inherit) child.unref();
       if (!child.pid) {
         log.error("re-exec spawn produced no pid — staying alive");
         return;
       }
-      log.info(`re-exec child pid ${child.pid}`);
+      log.info(`re-exec child pid ${child.pid} (stdio=${inherit ? "inherit" : "ignore"})`);
+      try {
+        process.stderr.write(`[updater] re-exec child pid ${child.pid}; parent exiting\n`);
+      } catch {
+        /* ignore */
+      }
     } catch (e) {
       // Never exit if replacement failed — silent death is worse than stale code.
       log.error(`re-exec failed: ${(e as Error).message} — staying alive`);

package/src/bot/auth.ts

@@ -1,5 +1,12 @@
 /**
  * Authorization middleware: restricts the bot to ALLOWED_USERS when configured.
+ *
+ * Applies to **private chats and groups/forum topics alike**. User IDs are
+ * comma-separated in env (`ALLOWED_USERS=111,222,333`). Empty set = allow all
+ * (unsafe — especially with TOPIC_GROUP_ID).
+ *
+ * Unauthorized users in groups are ignored silently (no ⛔ spam). Private chats
+ * get one clear denial. Callback taps get a toast.
  */
 import type { Context, NextFunction } from "grammy";
 import type { AppConfig } from "../config.js";
@@ -8,31 +15,109 @@ import { createLogger } from "../logger.js";
 const log = createLogger("auth");
 
 export function createAuthMiddleware(cfg: AppConfig) {
-  const allowAll = cfg.allowedUsers.size === 0;
-  if (allowAll) {
+  if (cfg.allowAllUsers) {
     log.warn("ALLOWED_USERS is empty — the bot will respond to ANY Telegram user.");
+    if (cfg.topicGroupId !== undefined) {
+      log.warn(
+        "TOPIC_GROUP_ID is set with empty ALLOWED_USERS — any group member can drive sessions.",
+      );
+    }
+  } else {
+    log.info(`ALLOWED_USERS: ${cfg.allowedUsers.size} id(s) (private + groups)`);
+    if (cfg.allowedUsers.size === 0) {
+      log.warn(
+        "ALLOWED_USERS was set but no valid numeric ids remain — denying everyone (fail closed).",
+      );
+    }
   }
 
   return async (ctx: Context, next: NextFunction): Promise<void> => {
+    // Bot membership changes (promote/demote) must always reach handlers so
+    // forum readiness can re-probe — not gated on ALLOWED_USERS or from.is_bot.
+    if (ctx.myChatMember) {
+      await next();
+      return;
+    }
+
     const from = ctx.from;
-    // Only a genuine USER action is subject to (and worth replying to) the auth
-    // gate. Ignore everything else silently — most importantly the bot's OWN
-    // updates: the status panel being pinned/unpinned emits a service message
-    // whose `from` is THIS bot (is_bot), and replying "⛔ Not authorized" to
-    // that (or to any service/no-`from` update) spammed the chat with false
-    // rejections. Real unauthorized users still get one clear reply below.
+    // Only a genuine USER action is subject to the auth gate. Ignore bot-authored
+    // updates and missing `from` (service noise) so we never ⛔-spam ourselves.
     if (!from || from.is_bot) return;
     const m = ctx.message ?? ctx.editedMessage;
-    if (m && (m.pinned_message || m.new_chat_members || m.left_chat_member)) return;
+    if (
+      m &&
+      (m.pinned_message ||
+        m.new_chat_members ||
+        m.left_chat_member ||
+        m.forum_topic_closed ||
+        m.forum_topic_reopened ||
+        m.forum_topic_edited ||
+        m.general_forum_topic_hidden ||
+        m.general_forum_topic_unhidden)
+    ) {
+      return;
+    }
 
-    const userId = String(from.id);
-    if (allowAll || cfg.allowedUsers.has(userId)) {
-      await next();
+    // forum_topic_created: only allowed users get the path-bind prompt.
+    if (m?.forum_topic_created) {
+      if (isAllowed(cfg, from.id)) {
+        await next();
+        return;
+      }
+      log.debug(`blocked unauthorized forum_topic_created from ${from.id}`);
       return;
     }
-    log.warn(`blocked unauthorized user ${userId}`);
-    if (ctx.chat) {
-      await ctx.reply("\u26D4 Not authorized. Ask the bot owner to add your Telegram ID.");
+
+    if (isAllowed(cfg, from.id)) {
+      await next();
+      return;
     }
+
+    log.warn(
+      `blocked unauthorized user ${from.id}` +
+        (ctx.chat ? ` in chat ${ctx.chat.id} (${ctx.chat.type})` : ""),
+    );
+    await denyUnauthorized(ctx, m);
   };
 }
+
+/**
+ * True when ALLOWED_USERS was blank (open) or `userId` is listed.
+ * When allowAllUsers is false and the set is empty, nobody is allowed.
+ */
+export function isAllowed(cfg: AppConfig, userId: number | string): boolean {
+  if (cfg.allowAllUsers) return true;
+  return cfg.allowedUsers.has(String(userId));
+}
+
+/** Groups, supergroups, and channels: never ⛔-reply (silent deny). */
+function isGroupChat(ctx: Context): boolean {
+  const t = ctx.chat?.type;
+  return t === "group" || t === "supergroup" || t === "channel";
+}
+
+/** Private: one ⛔ reply. Group: silent (or callback toast). Never spam topics. */
+async function denyUnauthorized(
+  ctx: Context,
+  m: { message_thread_id?: number } | undefined,
+): Promise<void> {
+  if (ctx.callbackQuery) {
+    await ctx
+      .answerCallbackQuery({
+        text: "\u26D4 Not authorized",
+        show_alert: true,
+      })
+      .catch(() => {});
+    return;
+  }
+  if (!ctx.chat || isGroupChat(ctx)) return; // groups: ignore quietly
+  const threadId = m && "message_thread_id" in m ? m.message_thread_id : undefined;
+  // Omit General (1) — Bot API rejects message_thread_id=1.
+  const extra =
+    threadId !== undefined && threadId !== 1
+      ? { message_thread_id: threadId as number }
+      : {};
+  await ctx
+    .reply("\u26D4 Not authorized. Ask the bot owner to add your Telegram ID to ALLOWED_USERS.", extra)
+    .catch(() => {});
+}