Codex review: needs maintainer review before merge. Reviewed July 1, 2026, 2:46 PM ET / 18:46 UTC.

Summary
The PR updates plugin interactive registration and dispatch so Telegram callback data matching a live registry-owned plugin namespace routes to that plugin handler before the raw callback text fallback.

Reproducibility: yes. Current-main source can miss registry-backed plugin handlers and fall through to callback_data: text; the PR adds focused tests and has redacted Telegram Desktop/TDLib proof for the fixed path.

Review metrics: 2 noteworthy metrics.

• Current-main merge result: 12 files affected. The raw 200-file PR list is stale-base noisy; the simulated current-main merge result is the useful reviewer surface.
• Executable callback registry state: 1 registry-backed collection added. Interactive handler ownership changes, so rollback and stale-registry behavior matter before merge.

Stored data model
Persistent data-model change detected: persistent cache schema: docs/reference/prompt-caching.md, persistent cache schema: docs/reference/token-use.md, unknown-truncated-pull-files, vector/embedding metadata: docs/reference/token-use.md, vector/embedding metadata: ui/src/ui/controllers/cron.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P2] Merging changes Telegram callback precedence: registered plugin namespaces consume matching callback data before the generic raw callback_data: text fallback.
• [P1] Exact current-head or current-main merge checks should be green before landing; some live check rollup entries were still in progress when inspected.

Maintainer options:

1. Accept callback precedence after green checks (recommended)
   Land the current-main merge result if maintainers agree registered Telegram plugin callbacks should preempt raw fallback text and the refreshed checks pass.
2. Pause for callback-boundary redesign
   Pause this PR if maintainers want plugin-looking callback payloads to keep reaching the generic text lane instead of plugin handlers.

Next step before merge

• [P2] The remaining action is maintainer acceptance of the message-delivery precedence change plus refreshed current checks, not an automated repair.

Security
Cleared: No concrete security or supply-chain regression was found in the current-main merge-result callback/registry changes.

@openclaw-mantis telegram desktop proof: verify code-agent Telegram callback buttons route to the plugin handler, clear buttons, and do not send fallback callback_data text.

Local Telegram Desktop proof for PR #97174 is complete. Sensitive Telegram identifiers are intentionally redacted from this public comment.

Environment:

• Branch/commit used for proof: agent/fix-telegram-code-agent-callback-routing-main @ 8a2de26b56a
• Runner: local Crabbox local-container, Debian 13 desktop, Telegram Desktop, real production Telegram supergroup
• SUT gateway: disposable local gateway on this PR branch, loaded plugins telegram + telegram-code-agent-proof
• QA actor: real Telegram user, redacted
• QA group: real Telegram supergroup, redacted
• SUT bot: redacted

What was verified:

• A real Telegram Desktop user clicked an inline callback button whose callback data used the plugin-owned namespace code-agent:*.
• TDLib getCallbackQueryAnswer returned ok for the click.
• The PR branch routed the callback to the registered plugin handler instead of falling through to synthetic chat text.
• The plugin handler completed clearButtons and reply through the Telegram response context.
• TDLib search found the plugin proof replies and found no callback_data: fallback messages.

Final click artifact summary, redacted:

{
  "chatId": "<redacted-supergroup-id>",
  "messageId": "<redacted-tdlib-message-id>",
  "button": {
    "text": "Approve",
    "data": "<base64 callback data for code-agent:instrumented-proof-97174>"
  },
  "answer": {
    "@type": "callbackQueryAnswer",
    "show_alert": false,
    "text": "",
    "url": ""
  },
  "ok": true
}

Plugin handler marker for the same callback, redacted:

{"stage":"received","callbackId":"<redacted>","chatId":"<redacted-supergroup-id>","messageId":"<redacted-bot-message-id>","namespace":"code-agent","payload":"instrumented-proof-97174","senderId":"<redacted-qa-user-id>"}
{"stage":"clearButtons:ok","callbackId":"<redacted>","chatId":"<redacted-supergroup-id>","messageId":"<redacted-bot-message-id>","namespace":"code-agent","payload":"instrumented-proof-97174","senderId":"<redacted-qa-user-id>"}
{"stage":"reply:ok","callbackId":"<redacted>","chatId":"<redacted-supergroup-id>","messageId":"<redacted-bot-message-id>","namespace":"code-agent","payload":"instrumented-proof-97174","senderId":"<redacted-qa-user-id>"}
{"stage":"return","callbackId":"<redacted>","chatId":"<redacted-supergroup-id>","messageId":"<redacted-bot-message-id>","namespace":"code-agent","payload":"instrumented-proof-97174","senderId":"<redacted-qa-user-id>"}

TDLib search proof:

{
  "queries": [
    { "query": "PR #97174 proof handled", "count": 5 },
    { "query": "callback_data:", "count": 0 },
    { "query": "instrumented plugin handler", "count": 1 }
  ]
}

Validation run locally:

• node scripts/run-vitest.mjs extensions/telegram/src/bot.create-telegram-bot.test.ts -> 112 tests passed
• python3 -m py_compile scripts/e2e/telegram-user-driver.py -> passed
• pnpm exec oxfmt --check scripts/e2e/telegram-user-crabbox-proof.ts extensions/telegram/src/bot.create-telegram-bot.test.ts qa/convex-credential-broker/convex/http.ts qa/convex-credential-broker/convex/payloadValidation.ts scripts/e2e/fixtures/telegram-code-agent-proof-plugin/index.cjs scripts/e2e/fixtures/telegram-code-agent-proof-plugin/openclaw.plugin.json -> passed
• git diff --check -> passed

I also pushed follow-up coverage/tooling in 8a2de26b56a:

• regression test covering plugin callback routing with no fallback callback_data text
• TDLib click-callback support for real-user proof runs
• proof fixture plugin registering code-agent for local E2E proof
• local Crabbox/TDLib proof-run hardening discovered while setting up the zero-cost local-container path

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Land-ready after maintainer fixups.

• Root cause/fix: interactive handlers registered during scoped plugin loads could disappear from the process-global map while the live gateway registry still owned them. Dispatch now resolves registry-owned handlers through live registries, while preserving direct process-global SDK registrations (src/plugins/interactive.ts:37, src/plugins/interactive-registry.ts:96, src/plugins/registry.ts:2864).
• Lifecycle hardening: registry-owned handlers no longer survive registry retirement through the compatibility global map. The regression covers dispatch while live and no match after retirement (src/plugins/interactive.test.ts:652).
• Best-fix judgment: yes. Ownership stays with the plugin registry instead of copying live handlers back into global state; this keeps cache/rollback behavior while avoiding stale executable handlers.
• Scope cleanup: removed PR-only proof fixtures/driver changes, duplicate Telegram coverage, and unrelated QA/type edits from the landing diff.

Verification:

• node scripts/run-vitest.mjs src/plugins/interactive.test.ts src/plugins/loader.test.ts extensions/telegram/src/bot.create-telegram-bot.test.ts — 297 tests passed.
• pnpm docs:list — passed.
• pnpm build — passed locally.
• ../../node_modules/.bin/oxfmt --check docs/channels/telegram.md extensions/telegram/src/bot.create-telegram-bot.test.ts src/plugins/interactive-registry.ts src/plugins/interactive-shared.ts src/plugins/interactive-state.ts src/plugins/interactive.test.ts src/plugins/interactive.ts src/plugins/loader.test.ts src/plugins/loader.ts src/plugins/registry-empty.ts src/plugins/registry-types.ts src/plugins/registry.ts — passed.
• git diff --check origin/main...HEAD — passed.
• Fresh autoreview — clean, no accepted/actionable findings.
• Exact prepared head: 657b6cd64e2ab0d13be94841e8d400abcf38bd43.
• Exact-head hosted CI/Testbox: run 28539770964 — passed, including build, lint, production/test types, plugin/channel contracts, QA smoke, and all selected test shards.

The contributor's real Telegram Desktop proof on this PR remains the live user-path evidence. I did not repeat that external Telegram run after the lifecycle refactor; the focused retirement regression and exact-head hosted CI cover the maintainer changes.

Merged via squash.

• Prepared head SHA: 657b6cd64e2ab0d13be94841e8d400abcf38bd43
• Landed commit: 5db7c3797de3094259eb43fc47c6da3f2a6cea49