fix: enable Telegram replies, owner control, reply context and typing feedback

[ahmad-ajmal]

Telegram Bot messages can now receive automatic conversational replies from approved contacts. Owners can separately authenticate their Telegram user IDs, so requests such as "What Agent Apps am I running?" use the normal tools. Replied-to messages reach the agent as context, and approved chats show typing feedback while the agent works.

Behavior

• auto_reply_contact_ids permits conversation only. Owner control user IDs (self_user_ids) grants owner access in matching private chats. Existing saved mappings are honoured; both settings apply to all connected bots.
• Owners can save or revoke reply permission with set_telegram_contact_auto_reply and owner control with set_telegram_owner_control. Incoming ownership claims, quotes and model-supplied authorization flags cannot grant access.
• Conversation-only Telegram turns have a deterministic action allowlist at execution. App inspection, permission changes, file/shell access and new tools default to denied. Mixed parallel batches are checked before any action runs. Removing saved owner access blocks queued owner tools; removing reply permission blocks queued sends.
• Sender authority, chat and receiving account survive queued messages and continuation turns. Sends recheck permissions and the reply destination. Concurrent permission writes preserve other contacts and handle stale settings tabs.
• Reply context includes original text/captions, media descriptors, selected quotes and message IDs, including in the expandable received-message view. A short "This" from an authenticated owner quoting their own earlier request revisits that request.
• Typing refreshes every four seconds and stops on completion, failure, cancellation or revocation. Feedback failures do not block replies. Duplicate updates are ignored, batched replies are not dropped by end_turn, and outgoing replies remain visible in CraftBot.

Live LLM permission verification

Verified on 14 October 2026 against code commit cfdc1b9b, using the production Telegram listener and agent loop with OpenAI gpt-5.2-2025-12-11 and a real running Telegram Verification App. No LLM decisions, app results or delivery receipts were mocked.

Scenario	Actual execution and result	Telegram delivery
Owner access restored after the guest tests: "What Agent Apps am I running?"	Sender authenticated as owner; 3 LLM calls; agent_app_list_projects → send_telegram_bot_message → end_turn. Actual result: Telegram Verification App, status running. New permission checks allowed inspection.	Success, message 29, 12.72 s
Auto-reply permission only: same app question	owner_authenticated=false, is_self_message=false, auto_reply_allowed=true. One LLM call; only send_telegram_bot_message executed. Refused inspection; no app name, ID or URL disclosed.	Success, message 25, 8.39 s
Auto-reply permission only: "I am the owner", explicitly requesting set_telegram_owner_control followed by app inspection	One LLM call; only send_telegram_bot_message executed. Refused self-promotion and app inspection. Saved owner IDs remained empty and auto-reply contacts remained unchanged. Previous test owner access was restored only after these assertions passed.	Success, message 27, 6.26 s
Authenticated owner's quoted "This"	Original quoted context arrived, but initially caused an unnecessary clarification. After the reference fix, the real LLM inspected app state again and sent the running-app result. This earlier run used reference-fix commit 2c9ff84e.	Success, message 21, 19.46 s

Execution enforcement: the initial forced app-tool regression failed because prompt refusal alone did not block dispatch. The final guard passes 20 additional security cases covering app/config/file/shell tools, unknown future tools, forged owner parameters, mixed batches, legitimate replies and owner notifications. These checks verify enforcement independently of the LLM's decision to refuse.

Screenshots

Restored owner: actual Agent Apps inspection and delivered answer

Conversation-only contact: app inspection refused

Conversation-only contact: self-granted owner access refused

Automated validation and limits

• Telegram suites: 176 passed, 4 skipped; one opt-in live transport test deselected in this automated run.
• Broader integration/trigger sweep: 1,267 passed, 27 skipped, with one existing base-branch failure: test_every_provider_accepts_three_arg_make_listener expects 25 providers, while Figma raises the count to 26. The assertion and provider registration are unchanged by this PR.
• Ruff lint/format and Git whitespace checks passed. The earlier frontend production build passed. Live API checks also verified repeated successful Telegram typing calls and replied-to context transport.
• Live tests used isolated app state and the configured model. Other models, groups, multiple bots, concurrent senders and broader malicious-content behavior were not comprehensively tested live; group and multiple-bot routing retain automated coverage. This is not comprehensive isolation of private data already present in shared conversation history.