Summary

Add TELEGRAM_ALLOWED_USERS and TELEGRAM_GROUP_ALLOWED_USERS support to the Telegram adapter, mirroring the existing WeChat implementation (fixes #7651).

Problem

Hermes's Telegram integration has no user-level access control. Any Telegram user can add the bot to their own group and trigger it via @mention — there is no way to restrict access to specific users.

Solution

Read TELEGRAM_ALLOWED_USERS and TELEGRAM_GROUP_ALLOWED_USERS environment variables (or config.yaml allow_from / group_allow_from fields) and check sender user ID before processing any message:

• TELEGRAM_ALLOWED_USERS: whitelist of Telegram user IDs who can DM the bot
• TELEGRAM_GROUP_ALLOWED_USERS: whitelist of Telegram user IDs who can @mention the bot in groups
• "*" wildcard disables the check (backwards-compatible default)

Changes

Usage

# DM: only user 6043083374 can interact
TELEGRAM_ALLOWED_USERS=123456

# Groups: only user 6043083374 can @mention in groups
TELEGRAM_GROUP_ALLOWED_USERS=123456

# Allow all users
TELEGRAM_ALLOWED_USERS=*

Or in config.yaml:

telegram:
  allow_from: "123456"
  group_allow_from: "123456"

Testing

All 11 tests pass (including 5 new ones):

tests/gateway/test_telegram_group_gating.py ........... 11 passed

Refs

• Fixes Telegram: Missing user-level access control — any user can trigger bot via @mention in any group #7651