block unauthorized Telegram DM text from prompt context by sallyom · Pull Request #91478 · openclaw/openclaw

sallyom · 2026-06-08T17:19:25Z

Summary

Move Telegram DM access enforcement before dispatch dedupe, reply-chain recording, prompt-context selection, and message processing for normal inbound DMs.
Apply the same passive allow check to edited private Telegram messages before they can update the conversation cache.
Preserve direct.<chatId>.requireTopic behavior by dropping root DMs before pairing challenges, and add focused regressions for blocked text, edited text, and topic-required root DMs.

Issue Scope

The local reproducer for this branch is slightly narrower than the originally reported delivery-failure chain:

Not proven here: unauthorized text DM -> agent turn -> reply to unauthorized user.
Proven here: unauthorized text DM -> recorded in Telegram conversation cache -> authorized user sends a later DM -> that authorized agent turn can include the unauthorized text in prompt context.

So this fixes a pre-dispatch state and prompt-context leak. The early gate is still necessary because blocked Telegram DM text must not be recorded before authorization.

Verification

node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts -t "does not leak blocked allowlist text DMs into authorized prompt context"
node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts -t "does not cache blocked allowlist edited DMs into authorized prompt context"
node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts -t "drops topic-required root DMs before pairing challenges"
node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts
pnpm format:fix extensions/telegram/src/bot-handlers.runtime.ts extensions/telegram/src/bot.create-telegram-bot.test.ts extensions/telegram/src/dm-access.ts
git diff --check origin/main...HEAD
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main — clean, no accepted/actionable findings

Real Behavior Proof

Automated Testbox proof:

Provider/id: blacksmith-testbox, tbx_01ktm10y41r4k7pvk2k6dqn0j2
Actions run: https://github.com/openclaw/openclaw/actions/runs/27151886658
Red on clean origin/main (303873e835c983318c1404cc1cbe0bddaeef87fd): unauthorized sender text appeared in a later authorized turn's UntrustedStructuredContext.
Green after this patch: focused Telegram bot regression passed; dm-access tests passed.
Scope: proves the pre-dispatch cache/prompt-context leak. This does not replace Telegram Desktop visual proof.

clawsweeper · 2026-06-08T17:21:28Z

Codex review: needs real behavior proof before merge. Reviewed June 10, 2026, 6:19 AM ET / 10:19 UTC.

Summary
The PR adds one pre-cache Telegram inbound authorization gate for fresh messages, edited messages, channel posts, and edited channel posts, plus regressions for blocked DM and group-edit prompt-context leaks.

PR surface: Source +105, Tests +187. Total +292 across 3 files.

Reproducibility: yes. for the scoped bug: current main and v2026.6.5 still show the media-gated handler-level DM access check, and the PR provides Testbox red/green evidence for the cache/prompt-context leak. I did not establish a live Telegram reproduction for the full delivery-drain chain.

Review metrics: 2 noteworthy metrics.

Pre-cache authorization surfaces: 4 message-like surfaces covered. The shared gate now covers fresh messages, edited messages, channel posts, and edited channel posts, which is the key security/delivery surface reviewers need to prove.
Closing references: 1 open linked issue. The closing reference can close a broader report unless maintainers accept this PR as the complete resolution or adjust the issue linkage.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted Telegram Desktop or bot-to-bot proof showing unauthorized plain and edited DMs stay out of prompt context while an authorized follow-up still works.
Redact private details such as API keys, phone numbers, IP addresses, and non-public endpoints before posting proof.
Update the PR body after adding proof so ClawSweeper re-reviews automatically; if it does not, ask a maintainer to comment @clawsweeper re-review.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: Automated Testbox red/green evidence and production workaround logs are useful, but they do not show the exact branch behavior in a real Telegram setup, and the PR itself says Telegram Desktop proof is still not replaced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
A native Telegram proof would directly show blocked unauthorized DMs and an authorized follow-up on the real transport path. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

telegram desktop proof: verify unauthorized plain and edited Telegram DMs are blocked from prompt context while an authorized follow-up still replies.

Risk before merge

[P1] Live Telegram proof for the exact branch is still missing, so maintainers have not yet seen the real Bot API plain-DM, edited-DM, and authorized follow-up behavior after this patch.
[P1] The PR still uses a closing reference for dmPolicy allowFrom not enforced for Telegram text messages — unauthorized users reach agents #91209 even though the PR body scopes out the broader unauthorized-agent-turn and delivery-drain chain.
[P1] This changes a Telegram authorization and message-delivery boundary; green unit/Testbox regressions do not by themselves settle whether current user DM/topic flows are preserved in a real Telegram setup.

Maintainer options:

Require live proof and scope cleanup (recommended)
Before merge, add redacted Telegram Desktop or bot-to-bot proof for unauthorized plain and edited DMs plus an authorized follow-up, and update the linked issue reference if the broader delivery-drain report remains open.
Accept the scoped security fix
Maintainers may intentionally merge with Testbox and production-log evidence if they explicitly keep or reopen the broader linked issue for the unproven gateway/CLI delivery vector.
Pause for the full linked issue
If the desired outcome is one PR that resolves the whole reported failure chain, pause this branch until the unauthorized agent-turn and stuck-delivery paths are proven and covered.

Next step before merge

[P1] Protected maintainer handling, exact live Telegram proof, and linked-issue scope cleanup remain before merge; I did not find a narrow code defect for an automated repair lane.

Security
Cleared: No concrete supply-chain or newly introduced security regression was found in the diff; the remaining security issue is proof and maintainer acceptance for the changed Telegram authorization boundary.

Review details

Best possible solution:

Land the scoped fix after exact redacted live Telegram proof and a maintainer scope decision; keep the broader linked issue open or change the closing reference if the delivery-drain vector remains separate.

Do we have a high-confidence way to reproduce the issue?

Yes for the scoped bug: current main and v2026.6.5 still show the media-gated handler-level DM access check, and the PR provides Testbox red/green evidence for the cache/prompt-context leak. I did not establish a live Telegram reproduction for the full delivery-drain chain.

Is this the best way to solve the issue?

Yes for the scoped cache/prompt-context leak: a single pre-cache Telegram authorization gate is the right owner boundary and avoids a one-sided DM-only patch. It is not sufficient to close the broader linked report unless maintainers accept that remaining gateway/CLI delivery scope separately.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against c84e52192063.

Label changes

Label justifications:

P1: The PR addresses an urgent Telegram allowlist leak into prompt context and touches a real channel/security workflow.
merge-risk: 🚨 message-delivery: Moving Telegram authorization earlier can change whether private messages, edited messages, pairing prompts, and authorized follow-ups are delivered or dropped.
merge-risk: 🚨 security-boundary: The diff changes the authorization boundary that prevents unauthorized Telegram DM text from entering prompt context.
merge-risk: 🚨 other: The closing issue reference can prematurely resolve a broader linked report that this PR explicitly does not fully prove.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Automated Testbox red/green evidence and production workaround logs are useful, but they do not show the exact branch behavior in a real Telegram setup, and the PR itself says Telegram Desktop proof is still not replaced. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The PR changes visible Telegram DM authorization and reply-context behavior that can be demonstrated in a short Telegram Desktop or bot-to-bot proof.

Evidence reviewed

PR surface:

Source +105, Tests +187. Total +292 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	173	68	+105
Tests	1	187	0	+187
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	360	68	+292

What I checked:

Current main still has the handler gap: Current main only calls the early DM access gate for non-group messages when inbound media or reply-target media is present, so plain private text can reach cache/context side effects before handler-level authorization. (extensions/telegram/src/bot-handlers.runtime.ts:2832, c84e52192063)
Latest release still has the same gate: The latest release tag v2026.6.5 contains the same media-gated early DM access check, so the PR addresses behavior still present in the shipped release. (extensions/telegram/src/bot-handlers.runtime.ts:2847, 5181e4f7c82b)
PR centralizes pre-cache authorization: The branch adds authorizeInboundMessage and calls it before reply-chain recording or dispatch for message-like Telegram updates, with challenge mode for fresh messages and silent mode for edits. (extensions/telegram/src/bot-handlers.runtime.ts:2746, 488e328f413f)
PR adds focused regressions: The branch adds tests for unauthorized allowlist text DMs, unauthorized edited DMs, blocked group-sender edits, and topic-required root DMs not leaking or pairing before authorization. (extensions/telegram/src/bot.create-telegram-bot.test.ts:1618, 488e328f413f)
DM access helper keeps silent edit checks non-mutating: The new isTelegramDmAccessAllowed helper reuses the existing DM access resolver without issuing pairing replies, matching the intended edited-message behavior. (extensions/telegram/src/dm-access.ts:60, 488e328f413f)
Maintainer note requires live Telegram proof: Telegram maintainer notes say authorization or reply-context Telegram behavior PRs need real Telegram proof, so synthetic Testbox red/green proof is useful but not sufficient for merge clearance here. (.agents/maintainer-notes/telegram.md:37, c84e52192063)

Likely related people:

obviyus: The PR is assigned to obviyus, who pushed the latest unification commit, and local current-main history shows recent Ayaan Zaidi Telegram runtime/dedupe commits in the same handler area. (role: recent PR updater and likely follow-up owner; confidence: medium; commits: 488e328f413f, 9c6186de43, 9297c20a85; files: extensions/telegram/src/bot-handlers.runtime.ts, extensions/telegram/src/bot.create-telegram-bot.test.ts, extensions/telegram/src/dm-access.ts)
Vincent Koc: Recent Telegram handler/context history and the v2026.6.5 release tag pass through Vincent Koc commits near the affected runtime and callback/message paths. (role: recent Telegram area contributor; confidence: medium; commits: 5181e4f7c82b, 90b8f3fba2, 77f1ea0de8; files: extensions/telegram/src/bot-handlers.runtime.ts, extensions/telegram/src/bot-message-context.ts)
Peter Steinberger: History shows Peter Steinberger on plugin and Telegram message-context refactors that carried the current handler and context boundaries forward. (role: Telegram/plugin refactor contributor; confidence: medium; commits: cd5c2f4cb2c2, 491969efb0, 694d12a90b; files: extensions/telegram/src/bot-handlers.runtime.ts, extensions/telegram/src/bot-message-context.ts)
Josh Avant: Commit 68bc6ef touched Telegram pairing, session, forum routing, and reply formatting paths adjacent to this PR's DM authorization and requireTopic behavior. (role: adjacent Telegram routing contributor; confidence: medium; commits: 68bc6effc04a; files: extensions/telegram/src/bot-handlers.runtime.ts, extensions/telegram/src/bot-message-context.ts, extensions/telegram/src/dm-access.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

producedbysavant · 2026-06-09T08:46:06Z

Production Evidence: unauthorized DMs blocked — before/after proof

System: Production OpenClaw instance (v2026.6.1)

WSL2, Node.js, telethon-bridge MCP server (MTProto via SOCKS5)
Owner chat_id: 1144466778 (@savantbeats)
Bot: @savantclaw_bot (chat_id: 8243344628)

Before fix (June 5–7, 2026): 1,884 unauthorized deliveries

Root cause confirmed: gateway.mjs passed --to <original_sender_chat_id> instead of owner's chat_id. Replies to unauthorized users bypassed dmPolicy because messages entered via CLI agent path (not channel ingress). Bot API returned 403 Forbidden / 400 chat not found.

Gateway routing error (journalctl, June 6 00:28 MSK):

telegram message failed: Call to 'sendMessage' failed!
  (403: Forbidden: the bot can't send messages to the bot)
Delivery failed (telegram to telegram:8243344628)

telegram message failed: Call to 'sendMessage' failed!
  (400: Bad Request: chat not found)
Delivery failed (telegram to telegram:8717709174)

System impact (journalctl, June 5–7):

telegateway.service: 3.1 GB memory peak (normal: ~200 MB) — memory pressure from 1,884 pending retries
telegateway.service: 1h 30min accumulated CPU from retry drain loops
telethon-bridge.service: crash loop June 6 (exit code 3/NOTIMPLEMENTED) after proxy failure
72 unique unauthorized chat_id targets received delivery attempts
Bot's own ID received 845 failed deliveries

Handler-level gate (source-confirmed, bot-handlers.runtime.ts:2847):
enforceTelegramDmAccess is gated behind hasInboundMedia() / hasReplyTargetMedia() — plain text DMs bypass the allowFrom check entirely.

After fix (June 7, 22:30 MSK – present): 0 failed deliveries

Applied locally:

Changed gateway.mjs: --to = owner, TG_OWNER_ID filter from env
Removed hasInboundMedia gate from enforceTelegramDmAccess
Added hardcoded sender ID check in enforceTelegramDmAccess

Post-fix state:

delivery-queue/failed/: zero entries (was 1,884)
telegateway.service: stable memory under 200 MB
telethon-bridge.service: stable, no crash loops
All authorized replies deliver correctly (verified via Telegram Desktop)

Systemd journal (post-fix, June 7 22:09):

telethon-bridge: ✅ Logged in as: Anton (@savantbeats) [ID: 1144466778]
telethon-bridge: 📡 Forwarding messages to http://localhost:18793/api/telethon/webhook

No errors since restart.

Relevance to this PR

This PR's fix (moving DM access enforcement before dedupe/cache/context) addresses Vector 1 — the handler-level gate for plain text DMs. Our production evidence confirms this is a real, exploitable gap:

Handler gate captured all media DMs correctly → bot only leaked on plain text
This PR explicitly moves enforceTelegramDmAccess to run for non-group messages irrespective of media presence → exactly the fix we patched locally
The 1,884 database entries prove impact is not theoretical

The PR's 134 regression tests + this production evidence = coverage for both the synthetic and real paths.

@clawsweeper re-review

producedbysavant · 2026-06-09T08:53:30Z

Hey @sallyom — I added production evidence to this PR (1,884 failed deliveries before the fix, 0 after, with systemd journal + gateway logs confirming the root cause). ClawSweeper needs a maintainer @clawsweeper re-review to pick up the new proof. Could you trigger it? Thanks!

obviyus · 2026-06-10T10:03:58Z

Maintainer push: 3799a1b — folded the two authorization copies into one shared gate and extended pre-cache enforcement to the remaining edit surfaces.

What changed

authorizeInboundMessage is now the single pre-cache/pre-dispatch gate for fresh messages, edited messages, and (edited) channel posts: configured-channel check → group allowlist (shouldSkipGroupMessage) → DM requireTopic → DM access. Fresh messages use dmAccess: "challenge" (may send a pairing reply); edits use "silent" (edits never reply).
This closes a sibling gap: group edits and edited channel posts previously recorded into the reply-chain cache without the group allowlist / configured-channel checks that fresh messages get. New regression: does not cache blocked group-sender edits into authorized prompt context — red against the previous branch head, green after.
Behavior note (pre-existing in this PR, now explicit): media root DMs in requireTopic: true chats with dmPolicy: "pairing" used to receive a pairing challenge before any topic check on main; they are now dropped silently, consistent with text DMs.

Verification

node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts — 101 passed (3 existing regressions from this PR + 1 new).
Red-check: the new group-edit test fails with the previous branch-head runtime, passes with the unified gate.
oxfmt + oxlint clean on touched files; autoreview (branch mode vs merge-base): clean, no accepted/actionable findings.
Not re-run here: Telegram Desktop visible proof (the mantis: telegram-visible-proof ask stands).

…thorized text is never recorded Signed-off-by: sallyom <somalley@redhat.com>

Fold the fresh-message and edited-message authorization paths into a single authorizeInboundMessage gate (configured-group check, group allowlist, DM requireTopic, DM access with challenge/silent modes). Extends pre-cache enforcement to group edits and edited channel posts, which previously recorded into the reply-chain cache without the group allowlist or configured-channel checks applied to fresh messages.

obviyus · 2026-06-10T10:21:07Z

Landed via squash onto main: 05a3b44.

Scoped tests: node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts — 103 passed after rebase onto latest main, including this PR's 3 regressions plus the new group-edit regression (proven red against the pre-distill head). oxfmt + oxlint clean on touched files; autoreview (branch mode) clean.
Changelog: not edited — CHANGELOG.md is release-only in this repo; release-note context is carried in the squash commit message.
Land commit: 488e328 (rebased head, includes the maintainer distill commit)
Merge commit: 05a3b44
CI: green on 488e328 except build-artifacts, which fails identically on current main (run 27266624512, check-deadcode-unused-files.test.ts > falls back to bare pnpm when no managed pnpm runner is available) — pre-existing runner-environment drift, unrelated to this PR.

Thanks @sallyom!

@sallyom

…xt (openclaw#91478) Move Telegram inbound authorization into a single pre-cache gate so unauthorized DM text is never recorded into the reply-chain cache or dispatch-dedupe state before allowlist/pairing checks run. The gate covers fresh messages, edited messages, group edits, and edited channel posts; edits are authorized silently and never trigger pairing challenges, and requireTopic root DMs are dropped before pairing challenges. Fixes openclaw#91209. Thanks @sallyom!

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

openclaw-barnacle Bot added channel: telegram Channel integration: telegram size: M maintainer Maintainer-authored PR labels Jun 8, 2026

clawsweeper Bot had a problem deploying to qa-live-shared June 8, 2026 17:29 Failure

sallyom changed the title ~~[codex] block unauthorized Telegram DM text from prompt context~~ block unauthorized Telegram DM text from prompt context Jun 8, 2026

sallyom marked this pull request as ready for review June 8, 2026 18:41

sallyom force-pushed the codex/issue-91209-investigation branch from d7d9634 to 7798c0e Compare June 8, 2026 22:47

sallyom and others added 2 commits June 10, 2026 15:39

move DM access check before dedupe/cache/context side effects so unau…

68203a6

…thorized text is never recorded Signed-off-by: sallyom <somalley@redhat.com>

obviyus force-pushed the codex/issue-91209-investigation branch from 3799a1b to 488e328 Compare June 10, 2026 10:11

obviyus self-assigned this Jun 10, 2026

obviyus merged commit 05a3b44 into openclaw:main Jun 10, 2026
153 of 154 checks passed

obviyus mentioned this pull request Jun 10, 2026

dmPolicy allowFrom not enforced for Telegram text messages — unauthorized users reach agents #91209

Closed

github-actions Bot mentioned this pull request Jun 10, 2026

📡 Upstream Digest — 2026-06-10 12:49 UTC curtismercier/openclaw-mods#1052

Open

clawsweeper Bot mentioned this pull request Jun 10, 2026

Feature request: api.callGatewayMethod() for inter-plugin communication #39000

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

block unauthorized Telegram DM text from prompt context#91478

block unauthorized Telegram DM text from prompt context#91478
obviyus merged 2 commits into
openclaw:mainfrom
sallyom:codex/issue-91209-investigation

sallyom commented Jun 8, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

producedbysavant commented Jun 9, 2026

Uh oh!

producedbysavant commented Jun 9, 2026

Uh oh!

obviyus commented Jun 10, 2026

Uh oh!

Uh oh!

obviyus commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

sallyom commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Issue Scope

Verification

Real Behavior Proof

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

producedbysavant commented Jun 9, 2026

Production Evidence: unauthorized DMs blocked — before/after proof

System: Production OpenClaw instance (v2026.6.1)

Before fix (June 5–7, 2026): 1,884 unauthorized deliveries

After fix (June 7, 22:30 MSK – present): 0 failed deliveries

Relevance to this PR

Uh oh!

producedbysavant commented Jun 9, 2026

Uh oh!

obviyus commented Jun 10, 2026

Uh oh!

Uh oh!

obviyus commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sallyom commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading