Codex review: needs maintainer review before merge. Reviewed May 30, 2026, 6:40 PM ET / 22:40 UTC.

Summary
This PR changes Telegram outbound direct-topic routing to build chat-scoped session suffixes, re-normalizes delivery thread IDs to numeric topic IDs, and updates session-route regression tests.

PR surface: Source +5, Tests +17. Total +22 across 2 files.

Reproducibility: yes. The current main resolver and inbound session code show the mismatched outbound bare-topic suffix versus inbound chat-scoped suffix; I did not execute tests because this review is read-only.

Review metrics: 1 noteworthy metric.

• Telegram session-key shape: 1 direct-topic session suffix changed. The PR intentionally changes the persisted key shape for Telegram direct-topic proactive sessions, which is the main compatibility point to accept before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Maintainer should explicitly accept the scoped DM-topic session-key cutover or request a narrow compatibility bridge before merge.

Risk before merge

• [P1] Merging this changes the persisted Telegram direct-topic session key used by proactive sends from a bare topic suffix to a chat-scoped suffix; existing outbound-only DM-topic session rows under the old key may not be reused unless maintainers accept that one-time cutover or add a narrow compatibility bridge.
• [P1] The highest-risk behavior is keeping scoped session suffixes out of Telegram delivery metadata; the patch and live logs support the separation, but a regression here would misroute or fail visible Telegram sends.
• [P1] The live proof exercised the shared proactive send resolver, not a full scheduled cron run; the code path is shared, but maintainers may still want to decide whether that is enough for the linked cron-origin issue.

Maintainer options:

1. Accept the scoped-key cutover (recommended)
   Maintainers can accept the one-time session-key cutover because the old outbound key did not match inbound replies and the PR proves the new key plus numeric delivery metadata in a live Telegram topic.
2. Add a narrow compatibility bridge
   If old outbound-only DM-topic rows must remain readable, require a focused alias or lookup path for the previous bare-topic suffix before merge.
3. Hold for live cron proof
   If the linked cron workflow must be proven end to end, pause merge until the same resolver path is exercised from an actual scheduled run into a real Telegram DM topic.

Next step before merge

• Manual review is appropriate because the remaining action is maintainer acceptance of a compatibility-sensitive Telegram session-key cutover, not a narrow repairable defect.

Security
Cleared: The diff only changes Telegram route computation and a focused test file; it does not add dependencies, workflows, secrets handling, package scripts, or new code-execution surfaces.

@openclaw-mantis telegram-visible-proof requested for PR 88421 / issue 80212.

Please use the Crabbox native Telegram Desktop proof path for the exact ClawSweeper proof shape:

• proactive Telegram DM-topic send under isolated DM scope
• user reply in that same DM topic lands back in the same OpenClaw session
• outbound delivery uses numeric Telegram message_thread_id/topic id, not the scoped chatId:topicId session token

Redact bot tokens and user identifiers as needed. Do not trigger ClawSweeper re-review.

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Real behavior proof attempt for the Telegram DM-topic path is currently blocked by the live QA credential, not by a local test failure.

Behavior addressed: attempted proactive Telegram DM-topic send plus same-topic user reply routing for PR 88421 under isolated DM scope.

Real environment tested: AWS Crabbox cbx_d788acfdae23 / blue-lobster; OpenClaw PR head c60dd2907c1663fc0f9b207de3b31af73608f13f; SUT bot @foremanclawbot; tester/user IDs redacted in this comment.

Exact steps or command run after this patch: started scripts/e2e/telegram-user-crabbox-proof.ts start with the Telegram user Crabbox harness, set root session.dmScope=per-account-channel-peer, restarted the local SUT gateway with the harness private payload token, then probed Telegram DM-topic behavior through Bot API and TDLib.

Evidence after fix: the gateway came up with the PR head and isolated DM scope, but Telegram capability probing returned getMe.has_topics_enabled=false for the leased SUT bot. A Bot API DM send to the tester with numeric message_thread_id=42 returned 400 Bad Request: message thread not found. A TDLib user send to @foremanclawbot with --thread-id 42 returned Invalid message thread ID specified. @BotFather /mybots from the leased tester account returned You have currently no bots, so this Crabbox user cannot enable Threaded Mode for the SUT bot.

Observed result after fix: no valid Telegram private DM topic could be created or opened with the current QA credential, so the requested real DM-topic roundtrip proof cannot be produced from this lease. The Crabbox credential and AWS box were released after the attempt.

What was not tested: the requested successful proof shape, namely proactive DM-topic send, same-topic user reply into the same OpenClaw session, and successful outbound delivery into a Telegram private topic. That needs a topics-enabled SUT bot credential, or the owner of @foremanclawbot to enable Threaded Mode in BotFather Mini App, then rerun this same proof path.

Proof status reminder for issue #80212 / PR #88421:

The source regression and local route proof are in place, but the remaining requested proof is still the live/real-behavior Telegram DM-topic path:

• proactive Telegram DM-topic send under isolated DM scope
• reply in that same DM topic lands back in the same OpenClaw session
• outbound delivery keeps using the numeric Telegram message_thread_id / topic id, not the scoped chatId:topicId session token

Current blocker: the available Crabbox/Mantis Telegram proof path is not producing that artifact yet. A prior maintainer-triggered Mantis run reached Crabbox but failed because the harness could not open a comparable direct Telegram DM-topic view; local runner access is also blocked without the Convex Telegram QA credential env. We also intentionally did not use the reporter's VPS group/forum topics because group-topic proof would not cover the direct DM-topic issue shape.

No re-review request intended from this comment. This is just a reminder/status note until the Telegram Crabbox credential/harness path is healthy or a maintainer provides equivalent redacted proof.

Live Telegram DM-topic proof addendum

Ran a live proof on the user's OpenClaw VPS with a temporary PR-equivalent bundle patch, then restored the installed bundle from backup.

Environment:

• OpenClaw 2026.5.27 (27ae826) on VPS polymarket-mc
• Bot: Ant_clawd_bot
• Private Telegram DM topic created by the user
• Chat/user ids redacted below as <chatId>

Proof flow:

1. User sent oc-88421 proof start inside a private Telegram DM topic.
2. Before the patch, installed OpenClaw recorded the inbound topic under the base direct session key while preserving numeric threadId=40931.
3. Applied the PR-equivalent outbound route patch to the installed bundle and restarted the gateway.
4. Verified the patched route before sending:

{
  "sessionKeyShape": "agent:main:telegram:direct:<chatId>:thread:<chatId>:40931",
  "baseSessionKeyShape": "agent:main:telegram:direct:<chatId>",
  "threadId": 40931,
  "fromShape": "telegram:<chatId>:topic:40931",
  "toShape": "telegram:<chatId>",
  "chatType": "direct"
}

5. Sent proactive Telegram message via OpenClaw:

openclaw message send --channel telegram --target <chatId> --thread-id 40931 --message "oc-88421 proof proactive send from patched OpenClaw route..." --json

Result:

{
  "action": "send",
  "channel": "telegram",
  "dryRun": false,
  "handledBy": "plugin",
  "messageId": "9465",
  "payload": { "ok": true, "messageId": "9465" }
}

Server log confirms delivery used the numeric topic id, not the scoped session token:

[telegram] outbound send ok accountId=default chatId=<chatId> messageId=9465 operation=sendMessage deliveryKind=text threadId=40931 chunkCount=1

6. User replied in the same Telegram topic with oc-88421 proof reply.

Server log confirms the reply landed back in the same scoped session:

[telegram] Inbound message telegram:<chatId> -> @Ant_clawd_bot (direct, 22 chars)
[plugins] active-memory: agent=main session=agent:main:telegram:direct:<chatId>:thread:<chatId>:40931 activeProvider=codex activeModel=gpt-5.5 start timeoutMs=5000 queryChars=22 searchQueryChars=22

The bot's timeout/status response also delivered back into the same numeric topic id:

Request timed out before a response was generated. Please try again, or increase `agents.defaults.timeoutSeconds` in your config.
[telegram] outbound send ok accountId=default chatId=<chatId> messageId=9467 operation=sendMessage deliveryKind=text threadId=40931 chunkCount=1

Cleanup/restoration:

• Restored /usr/lib/node_modules/openclaw/dist/channel-GZO0Y5Xk.js from timestamped backup.
• Verified restored file hash matches backup.
• Verified gateway returned ready after restore.
• Local worktree remains clean and git diff --check passes.

Residual note: the visible bot reply was a normal agent timeout, not a routing failure; it still proves the reply was processed in the scoped DM-topic session and delivered back to numeric threadId=40931.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Superseded
• Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/26696333837
• Updated: 2026-05-30T22:19:49.107Z