Skip to content

Control Telegram group history context#89547

Merged
eleqtrizit merged 3 commits into
openclaw:mainfrom
mmaps:telegram-history-context-controls
Jun 15, 2026
Merged

Control Telegram group history context#89547
eleqtrizit merged 3 commits into
openclaw:mainfrom
mmaps:telegram-history-context-controls

Conversation

@mmaps

@mmaps mmaps commented Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Adds a Telegram group history context mode with mention-only, recent, and none.
  • Defaults group prompt history to messages addressed to the bot while keeping recent as an explicit opt-in.
  • Applies the same mode during recovered forum-topic dispatch so non-recent modes do not rebuild ambient history after thread recovery.

Changes

  • Applies the mode to both structured chat-window context and the pending group-history body envelope.
  • Carries the resolved mode into Telegram dispatch and gates recovered Body, InboundHistory, and room-event history migration on recent.
  • Updates schema, config metadata, docs, and Telegram regression coverage.

Validation

  • pnpm test extensions/telegram/src/config-schema.test.ts extensions/telegram/src/message-cache.test.ts extensions/telegram/src/bot.test.ts extensions/telegram/src/bot-message-context.require-mention.test.ts extensions/telegram/src/bot-message-dispatch.test.ts
  • pnpm test extensions/telegram/src/bot-message-dispatch.test.ts
  • pnpm config:channels:check
  • pnpm config:schema:check
  • pnpm tsgo:prod
  • pnpm check:test-types
  • pnpm test:extensions:package-boundary:compile
  • Agentic review completed with no changes requested.

Real Behavior Proof

  • Behavior addressed: Default Telegram group history context excludes prior ambient group messages from the prompt body and inbound-history payload while recent keeps explicit opt-in behavior.
  • Real environment tested: Redacted Telegram gateway runtime harness using production Telegram inbound context construction after the patch.
  • Exact steps or command run after the patch: node --import tsx --input-type=module -e '<runtime harness invoking buildTelegramInboundContextPayload>'
  • Evidence after fix: Console output from the redacted runtime harness:
after-fix telegram runtime harness
default-mode: BodyHasAmbient=false InboundHistory=absent
recent-mode: BodyHasAmbient=true InboundHistory=1
  • Observed result after fix: The default mode omitted the prior ambient group line from both prompt body history and inbound history; the explicit recent mode included the same prior line.
  • What was not tested: Live Telegram Bot API delivery; this proof targets the changed prompt-context construction path.

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation channel: telegram Channel integration: telegram size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 2, 2026
@clawsweeper

clawsweeper Bot commented Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge. Reviewed June 15, 2026, 1:54 PM ET / 17:54 UTC.

Summary
Adds Telegram includeGroupHistoryContext modes across config/schema/docs/runtime/tests and gates group prompt history plus recovered forum dispatch on the selected mode.

PR surface: Source +157, Tests +255, Docs +17, Generated 0. Total +429 across 16 files.

Reproducibility: yes. from source: current main and v2026.6.6 include ambient group history by default, while this PR defaults unset configs to mention-only and gates ambient history on recent.

Review metrics: 1 noteworthy metric.

  • Config/default surfaces: 1 option added, 1 effective default changed. The new Telegram mode adds a user-facing config surface and changes unset group prompt-history behavior for existing installs.

Stored data model
Persistent data-model change detected: persistent cache schema: extensions/telegram/src/message-cache.test.ts, unknown-data-model-change: src/config/bundled-channel-config-metadata.generated.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Get explicit maintainer approval for the privacy-first unset default or revise the default to preserve shipped behavior.
  • Keep docs and tests aligned with the chosen upgrade/default contract.

Risk before merge

  • [P1] Existing Telegram group installations without the new setting will stop sending ambient recent group history to the model after upgrade unless operators set includeGroupHistoryContext: "recent".
  • [P1] The remaining blocker is product and upgrade policy: maintainers need to accept the privacy-first default or require a compatibility-preserving default/migration shape.

Maintainer options:

  1. Approve Privacy-First Default
    Maintainers can accept that unset Telegram group configs become mention-only after upgrade and rely on the documented recent opt-in for trusted groups.
  2. Preserve Existing Upgrades
    Change the PR so existing unset configs keep recent ambient history unless operators explicitly choose mention-only or none, with focused tests for both paths.
  3. Pause Until Policy Is Settled
    Hold or close the PR if the privacy-versus-context default is not ready to become the stable Telegram upgrade contract.

Next step before merge

  • [P2] A human maintainer needs to choose the Telegram upgrade/default policy; automation should not decide the privacy-versus-compatibility tradeoff.

Security
Cleared: The diff narrows Telegram group context by default and introduces no dependency, permission, credential, downloaded-code, or supply-chain concern.

Review findings

  • [P1] Preserve shipped group-history behavior by default — extensions/telegram/src/group-history-context.ts:8-9
Review details

Best possible solution:

Land only after maintainers explicitly approve the privacy-first unset default, or revise the PR so shipped unset upgrades preserve recent group history while mention-only and none remain opt-in modes.

Do we have a high-confidence way to reproduce the issue?

Yes from source: current main and v2026.6.6 include ambient group history by default, while this PR defaults unset configs to mention-only and gates ambient history on recent.

Is this the best way to solve the issue?

Unclear until maintainers choose the upgrade default; the owner-local implementation covers the right Telegram context paths, but the default flip is not a purely mechanical fix.

Full review comments:

  • [P1] Preserve shipped group-history behavior by default — extensions/telegram/src/group-history-context.ts:8-9
    This default is used when includeGroupHistoryContext is unset, so shipped Telegram group installs that relied on prior ambient group history will silently switch to mention-only. Please either preserve recent for unset upgrades or get explicit maintainer approval for the privacy-first default before merge.
    Confidence: 0.89

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a0b16f37e835.

Label changes

Label justifications:

  • P2: This is a bounded Telegram privacy/context improvement with meaningful but limited blast radius.
  • merge-risk: 🚨 compatibility: Unset Telegram group configurations can produce different model context after upgrade because ambient group history is removed unless recent is configured.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (recording): PR-body runtime output and prepared Telegram Desktop recordings show default mode excluding ambient group context while explicit recent preserves it.
  • proof: sufficient: Contributor real behavior proof is sufficient. PR-body runtime output and prepared Telegram Desktop recordings show default mode excluding ambient group context while explicit recent preserves it.
  • proof: 🎥 video: Contributor real behavior proof includes video or recording evidence. PR-body runtime output and prepared Telegram Desktop recordings show default mode excluding ambient group context while explicit recent preserves it.
  • mantis: telegram-visible-proof: Mantis should capture Telegram visible proof. The PR changes Telegram group replies by changing prompt context, which is visible enough for Telegram Desktop proof.
Evidence reviewed

PR surface:

Source +157, Tests +255, Docs +17, Generated 0. Total +429 across 16 files.

View PR surface stats
Area Files Added Removed Net
Source 9 170 13 +157
Tests 5 256 1 +255
Docs 1 17 0 +17
Config 0 0 0 0
Generated 1 5 5 0
Other 0 0 0 0
Total 16 448 19 +429

What I checked:

Likely related people:

  • steipete: Recent commits centralize inbound supplemental context, preserve forum topic origin targets, and move Telegram message cache behavior that this PR now filters. (role: recent area contributor; confidence: high; commits: 1507a9701b83, 9aa46843ec89, 090ca19c05a0; files: extensions/telegram/src/bot-message-context.session.ts, extensions/telegram/src/message-cache.ts, src/config/types.telegram.ts)
  • obviyus: Recent Telegram dispatch and rich-message work touches the same delivery/context-adjacent runtime paths. (role: recent Telegram dispatch contributor; confidence: medium; commits: f5a9456219d4, da92615816b6, fff5261ade58; files: extensions/telegram/src/bot-message-dispatch.ts, extensions/telegram/src/bot-handlers.runtime.ts, extensions/telegram/src/bot-message-context.session.ts)
  • joshavant: Recent Telegram spooled replay work is adjacent to the recovered forum-topic history path changed here. (role: adjacent forum and replay contributor; confidence: medium; commits: 9921825e1795, 422a1374e02b; files: extensions/telegram/src/bot-message-dispatch.ts, extensions/telegram/src/bot-message-context.session.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. mantis: telegram-visible-proof Mantis should capture Telegram visible proof. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jun 2, 2026
@openclaw-barnacle openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 2, 2026
@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. mantis: telegram-visible-proof Mantis should capture Telegram visible proof. labels Jun 2, 2026
@mmaps

mmaps commented Jun 2, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jun 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jun 2, 2026
@eleqtrizit

eleqtrizit commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Relevance

This PR addresses a Telegram group context poisoning concern where non-mention ambient messages from a shared Telegram group could be included as conversation history and later influence agent turns. The fix adds a configurable includeGroupHistoryContext option to the Telegram plugin with three modes: "mention-only" (default), "recent" (opt-in to old behavior), and "none" (no group history). The default "mention-only" mode excludes prior unmentioned ambient group messages from the prompt body and inbound-history payload, preventing injected tool commands from being executed via ambient context. The "recent" mode preserves the old behavior as an explicit opt-in for trusted groups. This is targeted hardening within the Telegram plugin boundary — no core runtime or other channels are affected.

Compatibility

The change is fully backward-compatible. The new includeGroupHistoryContext field is optional in the config schema. Operators who want the previous behavior can explicitly set includeGroupHistoryContext: "recent". The default change to "mention-only" is a privacy-first tightening that does not break existing configs. Config schema validation, docs, and metadata are all updated. No existing config keys are removed or renamed.

ClawSweeper

ClawSweeper reviewed the PR and confirmed the fix is bounded, targeted, and follows OpenClaw architecture rules (config in the Telegram plugin, not core). The review's substantive ask — making the privacy-first default explicit in docs and PR body — was addressed. All ClawSweeper findings were resolved.

Code Reviews Completed

Multiple code reviews were completed across the full changed surface: config schema and types, the new group-history-context.ts module, the context-build guard in bot-message-context.session.ts, the structured group chat-window filtering in bot-handlers.runtime.ts, the recovered dispatch path in bot-message-dispatch.ts, documentation updates in docs/channels/telegram.md, and all test files. Every review confirmed the fix is correct, well-bounded, and follows project patterns.

Checks Completed

Check Result
Telegram extension unit tests (config-schema, message-cache, bot, bot-message-context, bot-message-dispatch) 237+ tests passed
Config schema validation (config:channels:check, config:schema:check) Passed
Behavioral runtime harness proof (default, recent, none modes) All 3 modes verified correct
Autoreview (branch mode, full diff) Clean — no accepted/actionable findings
CI — Workflow Sanity ✅ Passed
CI — Preflight ✅ Passed
CI — Build artifacts ✅ Passed
CI — Check docs ✅ Passed
CI — Check prod types ✅ Passed
CI — Check guards ✅ Passed
CI — Check test types ✅ Passed
CI — Check dependencies ✅ Passed
CI — CodeQL ✅ Passed
CI — CodeQL Critical Quality ✅ Passed
CI — OpenGrep PR Diff ✅ Passed
CI — iOS Periphery Dead Code ✅ Passed
CI — All extension boundary checks ✅ Passed (4/4)
CI — All contract checks ✅ Passed (4/4)
CI — All agentic test shards ✅ Passed (30/30)
CI — All auto-reply test shards ✅ Passed (3/3)
CI — All core runtime test shards ✅ Passed (50/50)
CI — All gateway test shards ✅ Passed (2/2)
CI — All plugin SDK test shards ✅ Passed (1/1)
CI — All control plane test shards ✅ Passed (12/12)
CI — All CLI/command test shards ✅ Passed (all)
CI — All doctor test shards ✅ Passed (8/8)
CI — All agent core test shards ✅ Passed (5/5)
CI — All UI test shards ✅ Passed (1/1)
CI — All tooling test shards ✅ Passed (1/1)
CI — All security test shards ✅ Passed (1/1)
CI — All state/storage test shards ✅ Passed (1/1)
CI — All network/platform test shards ✅ Passed (1/1)
CI — All Bun launcher checks ✅ Passed (1/1)
CI — All Node 22 compat checks ✅ Passed (1/1)
Conflict-resolution validation (git diff --check) Passed
Mantis Telegram Desktop proof (before/after GIFs) Captured and verified

Note: Three CI failures are pre-existing and unrelated to this PR: security-fast (existing dependency advisories for form-data and vite), check-lint (unrelated findings in scripts/ios-release-signing.mjs), and checks-node-agentic-agents-support (a flaky test in session-manager.test.ts). None of these touch any file changed by this PR.

Abbreviations

Abbreviation Definition
PR Pull Request
CI Continuous Integration
GHSA GitHub Security Advisory
SDK Software Development Kit
CLI Command-Line Interface
E2E End-to-End
LOC Lines of Code
UI User Interface

@mmaps
mmaps force-pushed the telegram-history-context-controls branch from 62d0a28 to 8136c70 Compare June 9, 2026 19:20
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 9, 2026
@eleqtrizit
eleqtrizit self-requested a review June 9, 2026 19:22
@mmaps
mmaps force-pushed the telegram-history-context-controls branch from 8136c70 to ee1b297 Compare June 9, 2026 19:22
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. labels Jun 12, 2026
@eleqtrizit eleqtrizit self-assigned this Jun 15, 2026
@eleqtrizit
eleqtrizit force-pushed the telegram-history-context-controls branch from 83c2572 to de68d19 Compare June 15, 2026 17:39
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 15, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 15, 2026
@eleqtrizit
eleqtrizit merged commit 32af1c0 into openclaw:main Jun 15, 2026
181 of 188 checks passed
@github-actions github-actions Bot mentioned this pull request Jun 15, 2026
Open
This was referenced Jun 15, 2026
Closed
Open
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 16, 2026
@mmaps
Control Telegram group history context (openclaw#89547)
0989fbd 
* fix(telegram): control group history context

* fix(telegram): keep history mode type local

* fix(telegram): respect history mode during forum recovery
crh-code pushed a commit to crh-code/openclaw that referenced this pull request Jun 18, 2026
@mmaps @crh-code
Control Telegram group history context (openclaw#89547)
163b909 
* fix(telegram): control group history context

* fix(telegram): keep history mode type local

* fix(telegram): respect history mode during forum recovery
This was referenced Jun 18, 2026
Closed
Open
This was referenced Jul 2, 2026
Closed
Merged
@clawsweeper clawsweeper Bot mentioned this pull request Jul 7, 2026
Open
badgerbees pushed a commit to badgerbees/openclaw that referenced this pull request Jul 8, 2026
@mmaps @badgerbees
Control Telegram group history context (openclaw#89547)
35b316f 
* fix(telegram): control group history context

* fix(telegram): keep history mode type local

* fix(telegram): respect history mode during forum recovery
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eleqtrizit eleqtrizit Awaiting requested review from eleqtrizit

Assignees

@eleqtrizit eleqtrizit

Labels

channel: telegram Channel integration: telegram docs Improvements or additions to documentation mantis: telegram-visible-proof Mantis should capture Telegram visible proof. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. proof: 🎥 video Contributor real behavior proof includes video or recording evidence. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. size: M status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mmaps @eleqtrizit