Environment

• OpenClaw version: 2026.4.5
• Channel: Telegram
• OS: macOS
• Proxy: Clash Verge (transparent proxy mode)
• Node: v25.6.0

Description

When using a transparent proxy (e.g. Clash Verge, Surge, Quantumult), api.telegram.org DNS resolves to a proxy virtual IP (127.0.0.1 or 198.18.0.68 — RFC 2544 benchmark range). OpenClaw SSRF guard blocks the download with:

[security] blocked URL fetch (url-fetch) target=https://api.telegram.org/file/bot.../photos/file_XX.jpg 
  reason=Blocked hostname (not in allowlist): 127.0.0.1

User-facing error: ⚠️ Failed to download media. Please try again.

Root Cause

buildTelegramMediaSsrfPolicy() in the compiled bundle sets allowRfc2544BenchmarkRange: false (as noted in #57452). Even after that fix was merged, proxy users whose DNS resolves api.telegram.org to private/loopback addresses are still blocked because the hostname api.telegram.org itself is not in the default hostname allowlist (which only allows api.telegram.org when it resolves to a public IP).

Reproduction

1. Run any transparent proxy (Clash Verge, Surge, etc.) that rewrites DNS for proxied domains
2. Configure OpenClaw Telegram bot
3. Send any image to the bot via Telegram
4. Observe: ⚠️ Failed to download media. Please try again.

Expected Behavior

Telegram media downloads should work when:

• The proxy is transparent (system-level)
• Bot API polling/webhook works fine (which it does — only file downloads fail)
• The user has NOT configured channels.telegram.accounts.<id>.proxy explicitly (system proxy handles everything)

Workaround

None currently. The user either has to:

1. Disable their proxy for api.telegram.org (breaks other things)
2. Wait for a fix

Suggested Fix

One of:

1. Add api.telegram.org to the default hostname allowlist for Telegram media downloads (regardless of resolved IP)
2. Honor channels.telegram.accounts.<id>.network.dangerouslyAllowPrivateNetwork for media downloads
3. Make the Telegram media SSRF policy accept RFC 2544 / loopback addresses (it already does for the benchmark range in some builds, but not loopback)