fix: enable Telegram replies, owner control, reply context and typing feedback - #482

Telegram Bot messages can now receive automatic conversational replies from approved contacts. Owners can separately authenticate their Telegram user IDs, so requests such as "What Agent Apps am I running?" use the normal tools. Replied-to messages reach the agent as context, and approved chats show typing feedback while the agent works.

Behavior

• auto_reply_contact_ids permits conversation only. Owner control user IDs (self_user_ids) grants owner access in matching private chats. Existing saved mappings are honoured; both settings apply to all connected bots.
• Owners can save or revoke reply permission with set_telegram_contact_auto_reply and owner control with set_telegram_owner_control. Incoming ownership claims, quotes and model-supplied authorization flags cannot grant access.
• Conversation-only Telegram turns have a deterministic action allowlist at execution. App inspection, permission changes, file/shell access and new tools default to denied. Mixed parallel batches are checked before any action runs. Removing saved owner access blocks queued owner tools; removing reply permission blocks queued sends.
• Sender authority, chat and receiving account survive queued messages and continuation turns. Sends recheck permissions and the reply destination. Concurrent permission writes preserve other contacts and handle stale settings tabs.
• Reply context preserves original text/captions, media descriptors, selected quotes and sender/message IDs, including in the expandable received-message view. Shared reply-context guidance interprets the current message against its explicit reply target; quotes never grant authority.
• Typing refreshes every four seconds and stops on completion, failure, cancellation or revocation. Feedback failures do not block replies. Duplicate updates are ignored, batched replies are not dropped by end_turn, and outgoing replies remain visible in CraftBot.

Review follow-up

• Removed Telegram-specific workflows and action names from the shared action-selection prompt. Shared authority rules now apply across integrations; Telegram delivery and permission-management details remain in the provider reference and action schemas.
• Removed owner_reply_reference, its English phrase whitelist and its per-message instruction to re-execute a quoted task. Reply interpretation uses general guidance beside the active turn, including one provider-independent example. The owner event also no longer singles out Agent Apps or its listing tool.
• Kept the deterministic authentication, execution allowlist, revocation checks, reply routing and typing lifecycle intact. Quote tests now cover different wording, multilingual content, different quoted senders and current-sender authority without inserting a forced-task hint.

Live LLM permission verification

Rerun on 15 October 2026 against code commit be5f4c29, using the production Telegram listener and agent loop with OpenAI gpt-5.2-2025-12-11 and a real running Telegram Verification App. No LLM decisions, app results or Telegram delivery receipts were mocked. These runs completed before the review-fix commit was pushed.

Execution enforcement: the existing guard and its 20 security cases remain intact, covering app/config/file/shell tools, unknown future tools, forged owner parameters, mixed batches, legitimate replies and owner notifications. These checks verify enforcement independently of the LLM's decision to refuse.

Screenshots

Screenshots below are from the 14 October verification. The table above records the latest 15 October rerun of the review fixes.

Restored owner: actual Agent Apps inspection and delivered answer

Conversation-only contact: app inspection refused

Conversation-only contact: self-granted owner access refused

Automated validation and limits

• Telegram and integration-guidance suites: 195 passed, 4 skipped. Real LLM tests are recorded above.
• Broader integration/trigger sweep: 1,277 passed, 27 skipped, with one existing base-branch failure: test_every_provider_accepts_three_arg_make_listener expects 25 providers, while Figma raises the count to 26. The assertion and provider registration are unchanged by this PR.
• Ruff lint/format and Git whitespace checks passed. The earlier frontend production build passed. Live API checks also verified repeated successful Telegram typing calls and replied-to context transport.
• Live tests used isolated app state and the configured model. Other models, groups, multiple bots, concurrent senders and broader malicious-content behavior were not comprehensively tested live; group and multiple-bot routing retain automated coverage. This is not comprehensive isolation of private data already present in shared conversation history.