…wlist

Review feedback on #69258:

1. Aisle Medium (CWE-400): "Unbounded DM message coalescing can create
   oversized payloads." With coalesceSameSenderDms enabled, a sender
   who rapid-fires many small DMs inside the debounce window would see
   all of them concatenated into one merged turn. Add explicit bounds
   in `combineDebounceEntries`:
   - Cap source entries at 10; beyond that, keep the first (original
     command/context) and the last (most recent payload) rather than
     silently dropping the tail.
   - Cap combined text at 4000 chars with an explicit `…[truncated]`
     marker so downstream LLM prompt size is bounded.
   - Cap merged attachments at 20 so media fan-out stays proportional
     to what a single message would carry.

2. CI `check-additional-boundaries` / `lint:tmp:no-raw-channel-fetch`:
   the drive-by signature change in `types.ts` shifted the raw-fetch
   callsite from line 189 to line 204. Update the allowlist.

Test: new `bounds the coalesced output when many messages merge into
one turn` exercises a 25-message flood and asserts the output text is
truncated and the attachment list is capped. All 74 monitor tests and
10 inbound-dedupe tests pass.

…wlist

Review feedback on #69258:

1. Aisle Medium (CWE-400): "Unbounded DM message coalescing can create
   oversized payloads." With coalesceSameSenderDms enabled, a sender
   who rapid-fires many small DMs inside the debounce window would see
   all of them concatenated into one merged turn. Add explicit bounds
   in `combineDebounceEntries`:
   - Cap source entries at 10; beyond that, keep the first (original
     command/context) and the last (most recent payload) rather than
     silently dropping the tail.
   - Cap combined text at 4000 chars with an explicit `…[truncated]`
     marker so downstream LLM prompt size is bounded.
   - Cap merged attachments at 20 so media fan-out stays proportional
     to what a single message would carry.

2. CI `check-additional-boundaries` / `lint:tmp:no-raw-channel-fetch`:
   the drive-by signature change in `types.ts` shifted the raw-fetch
   callsite from line 189 to line 204. Update the allowlist.

Test: new `bounds the coalesced output when many messages merge into
one turn` exercises a 25-message flood and asserts the output text is
truncated and the attachment list is capped. All 74 monitor tests and
10 inbound-dedupe tests pass.

…dedupe

P1 review feedback (Codex, Aisle, independent reviewers) on #69258: when
coalesceSameSenderDms merges N webhook events into one agent turn,
combineDebounceEntries picks a single representative messageId for the
merged NormalizedWebhookMessage. processMessage then claims and finalizes
only that one key via the inbound dedupe store. The other source messageIds
are never marked as seen, so a later BlueBubbles MessagePoller replay (after
a BB Server restart or the ~1-week lookback window) re-processes them as
fresh agent turns — opt-in coalescing silently loses idempotency.

Fix:
- Add NormalizedWebhookMessage.coalescedMessageIds so combineDebounceEntries
  can pass every unique source messageId through to the processing layer.
  Populated from the unbounded entries list — IDs whose text/attachments
  the truncation caps dropped still reach dedupe.
- Add commitBlueBubblesCoalescedMessageIds in inbound-dedupe.ts that skips
  claim() and commits each id directly (best-effort, per-id disk errors go
  to onDiskError without aborting the batch).
- In processMessage, after finalize() of the primary succeeds, commit every
  other coalesced messageId so MessagePoller replay of any individual
  source event is recognized as a duplicate.
- Tests:
  - inbound-dedupe.test.ts asserts replay of any coalesced source id is
    deduped, account scoping, and empty/overlong guid sanitation.
  - monitor.test.ts asserts coalescedMessageIds is populated end-to-end,
    including the 25-message flood test where text/attachments were capped.

Test: pnpm test extensions/bluebubbles — 501 tests pass (+4 new).
Test: pnpm tsgo:extensions:test clean.

…-send traffic

Live smoke testing against real BlueBubbles webhooks on #69258 showed the
flag was a no-op for its primary motivating case. Three independent gates
were swallowing traffic; all three are fixed here.

1. shouldDebounce bypassed for control commands.
   DM control-command text (e.g. 'Dump' as a registered skill alias) made
   hasControlCommand() return true, so the debouncer's shouldDebounce
   callback returned false and flushed the text event immediately — before
   the window ever armed for the follow-up URL-balloon webhook. Gate the
   instant-flush exit on the same conditions as the buildKey coalesce
   branch so group chats, balloon events linked via associatedMessageGuid,
   and disabled accounts keep instant dispatch; only DMs with the flag on
   and no associated parent now wait for the window.

2. buildKey excluded orphan URL-balloons.
   The new DM coalesce branch had a !balloonBundleId guard. Apple's pasted-
   URL webhook carries balloonBundleId='com.apple.messages.URLBalloonProvider'
   with no associatedMessageGuid linking it back to the text event — so it
   fell through to msg:<own id> and never shared a bucket with 'Dump'. The
   legacy text+balloon pairing case (both balloonBundleId AND
   associatedMessageGuid set) is already handled by the earlier branch, so
   the belt-and-suspenders check here was doing no safety work — only
   blocking the feature. Removed.

3. Default debounce window too narrow.
   DEFAULT_INBOUND_DEBOUNCE_MS=500 ms is tuned for BlueBubbles's own text+
   balloon follow-ups (~100-300 ms). Live traces show Apple split-send
   cadence is 770-1771 ms — 500 ms flushes the first webhook before the
   second arrives. Introduce DEFAULT_COALESCE_INBOUND_DEBOUNCE_MS=2500 ms
   and use it when coalesceSameSenderDms is on AND no explicit
   messages.inbound.byChannel.bluebubbles override is set. Explicit user
   config still wins. Legacy (flag-off) users keep 500 ms.

Also resolve the debounce value directly from config.messages.inbound
instead of delegating to core.channel.debounce.resolveInboundDebounceMs,
which the test runtime mock returned 0 for (tests previously relied on
the unsetting path returning the default).

Docs:
- docs/channels/bluebubbles.md: new 'Coalescing split-send DMs' section
  with scenarios table, enablement, trade-offs, and a troubleshooting
  checklist covering the three layers above plus session-log-vs-BB-log
  timestamps, memory pressure, and reply-quote sends (which use
  replyToBody, not a second webhook).
- docs/concepts/messages.md: cross-reference the exception for channels
  that opt into same-sender DM coalescing.
- CHANGELOG.md: expanded entry to reflect all three fixes + default
  window change + docs link.

Tests (506 pass, +5 new):
- debounces DM control commands when coalesceSameSenderDms is on so a
  split-send URL can join the bucket
- coalesces an orphan URL-balloon with a preceding DM control command
  (Apple split-send) — mirrors the live BB server log trace
- widens the default debounce window when coalesceSameSenderDms is enabled
  without explicit config
- keeps the legacy 500 ms default window when coalesceSameSenderDms is off
- keeps control commands instant for group chats even when
  coalesceSameSenderDms is enabled

Smoke-tested end-to-end against live BlueBubbles traffic: 'Dump <URL>' as
one iMessage composition now arrives as a single merged agent turn with
the URL + OG-preview attachments, and the dump skill runs the real
payload.

…runtime actually reads it

Live smoke testing exposed the final missing piece. Earlier commits on
#69258 added coalesceSameSenderDms to the core zod schema (src/config/
zod-schema.providers-core.ts) and to the runtime type (extensions/
bluebubbles/src/types.ts), so 'openclaw config set channels.bluebubbles
.coalesceSameSenderDms true' wrote the flag to openclaw.json and the
CLI validator accepted it. But the plugin-local account schema at
extensions/bluebubbles/src/config-schema.ts never saw the new key, so
it was silently stripped during config resolution by the plugin
runtime. Downstream, 'account.config.coalesceSameSenderDms' was
undefined at debouncer-registry creation time, and both the buildKey
coalesce branch and the shouldDebounce override fell through to the
per-message legacy path. Result: even with the flag written to config,
the registry was being built with coalesceSameSenderDms=false and the
feature was a no-op at runtime.

Root cause confirmed via instrumentation: the plugin trace showed
'coalesceRaw=undefined' and the list of resolved account.config keys
did not contain coalesceSameSenderDms. Adding the key to the
plugin-local schema fixes both the strip and the generated channel
metadata consumer.

Fix:
- extensions/bluebubbles/src/config-schema.ts: add
  coalesceSameSenderDms: z.boolean().optional() to bluebubblesAccountSchema
  so it survives plugin-side account resolution.
- src/config/bundled-channel-config-metadata.generated.ts: regenerate
  via 'pnpm config:channels:gen' to pick up the new field. The gateway
  preflight config validator reads this JSON schema (with
  additionalProperties: false) and was rejecting any config that set
  the flag until this generated output was refreshed.
- docs/.generated/config-baseline.sha256: refreshed via 'pnpm
  config:docs:gen' to track the new metadata shape so the baseline
  drift check (check:base-config-schema) stays green.

Live smoke test: BB dispatched 'Dump' at 22:25:06.625 and the URL
webhook at 22:25:07.810 (1185 ms gap, inside the 2500 ms window); the
dump skill ran on the merged payload in a single agent turn.

Tests: pnpm test extensions/bluebubbles - 506 pass (no new cases
needed, the existing 'coalesces same-sender DM messages' / 'orphan
URL-balloon' etc. tests already covered the buildKey + shouldDebounce
logic, and the config-schema gap was only visible at runtime through
the plugin loader). Added a follow-up item for the test suite to lock
in that the plugin-local schema preserves every public BB config
field, so a future field addition cannot re-open the same gap.

… helper

Revert a short-lived local workaround in resolveBlueBubblesDebounceMs
that read messages.inbound.byChannel.bluebubbles directly and skipped
core.channel.debounce.resolveInboundDebounceMs. The workaround existed
only because the test-runtime mock returned 0 unconditionally, which
broke flag-on tests that pinned an explicit short window via config.
Bypassing the shared helper in production just to satisfy a mock
trades delegation correctness for test convenience: every other
channel (Discord, iMessage, msteams, Signal, Slack, Telegram)
delegates, and any future scaling/clamping/per-channel logic added
to the helper would silently skip BlueBubbles.

Fix the mock instead:
- test/helpers/plugins/plugin-runtime-mock.ts: replace the
  `() => 0` stub with a config-aware implementation that reads
  overrideMs -> byChannel[channel] -> debounceMs -> 0, mirroring the
  production resolveInboundDebounceMs contract. Every channel that
  delegates now sees the same per-channel/global/default precedence
  in tests as it would at runtime.

With the mock fixed, restore the clean resolve function shape in
monitor-debounce.ts: if messages.inbound has no explicit debounce
configured, return the flag-aware default (2500 ms when
coalesceSameSenderDms is on, 500 ms otherwise); otherwise delegate
to the shared helper.

Verified:
- pnpm test extensions/bluebubbles: 506 passed (unchanged).
- pnpm test extensions (all bundled channel plugins): every shard
  passed tests; one shard reported a host JS-heap OOM at the worker
  level (8 GB Mac memory pressure), unrelated.
- pnpm test:changed with FAST_COMMIT=1 pre-hook: every populated
  shard passed; same OOM artifact in one shard. ~3,400 tests green
  across the touched-helper fan-out.

No functional change for production. Pays down the design debt
flagged during PR review of the coalesceSameSenderDms feature
(#69258) and keeps BB aligned with the shared inbound-debounce seam.

* 'main' of https://github.com/openclaw/openclaw: (653 commits)
  docs(changelog): deduplicate openclaw#67800 entries in Unreleased (openclaw#69670)
  fix(agents): honor explicit long Anthropic cache TTL on custom hosts (openclaw#67800)
  fix: fix Telegram media file delivery (openclaw#69641)
  fix(media): preserve outbound attachment filenames
  fix(media): parse lowercase media directives
  fix(bluebubbles): add opt-in coalesceSameSenderDms for split-send DMs (openclaw#69258)
  fix: centralize provider thinking profiles
  docs: prepare 2026.4.20 changelog
  fix: stage ACP and Codex runtime deps
  fix(gateway): drop stale service env on reinstall
  test: add bundled channel dependency Docker smoke
  test: relax detached task recovery timing assertion
  fix: ignore placeholder shells in runtime detection (openclaw#69308)
  shell: fall back to sh when SHELL is /usr/bin/false or nologin
  fix(browser): clarify DevToolsActivePort attach failures
  fix: sanitize mcp transport warning fields
  fix: launch Windows startup gateway directly
  fix(openai-codex): normalize legacy copilot transport
  fix: narrow MCP stdio env safety filter (openclaw#69540)
  fix(mcp): block dangerous stdio env overrides
  ...

…openclaw#69258)

Merged via squash.

Prepared head SHA: 8f1bd3c
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Reviewed-by: @omarshahine

…openclaw#69258)

Merged via squash.

Prepared head SHA: 8f1bd3c
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Reviewed-by: @omarshahine

…openclaw#69258)

Merged via squash.

Prepared head SHA: 8f1bd3c
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Reviewed-by: @omarshahine

…openclaw#69258)

Merged via squash.

Prepared head SHA: 8f1bd3c
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Reviewed-by: @omarshahine

…openclaw#69258)

Merged via squash.

Prepared head SHA: 8f1bd3c
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Co-authored-by: omarshahine <10343873+omarshahine@users.noreply.github.com>
Reviewed-by: @omarshahine