openclaw / openclaw/openclaw

Beta.3 mutation guard breaks message(action=react) for DM reactions

Open
#129,018 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

impact:security P2
Dominant language
TypeScript
Stars
390k
Forks
82k
PR merge metrics
PR metrics pending

Description

Summary

resolveTelegramMessageMutationChatId() in action-runtime-BmXKtFG6.js rejects message(action=react) calls when the target chat doesn't match the session's conversation context. In DMs, the matchesChat check fails — likely a format mismatch between how the session identifies itself and how the target is addressed.

React calls are idempotent and low-risk. The mutation guard is appropriate for sends/deletes/edits but unnecessarily restrictive for reactions.

Reproduction

  1. Agent session bound to a Telegram DM conversation
  2. Call message(action=react) with the DM's chat_id and a valid messageId
  3. Result: "Reaction failed. Do not retry." — the catch block on the thrown TOPIC_BINDING_ERROR

Workaround

Patched dist locally to skip resolveTelegramMessageMutationChatId for react calls and use chatId directly. Sends/deletes/edits still go through the full guard.

Expected behavior

message(action=react) should succeed when actions.reactions: true and reactionLevel permits it, without requiring the mutation guard's chat-matching logic.

Version

OpenClaw 2026.8.1-beta.3

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in action-runtime-BmXKtFG6.js at resolveTelegramMessageMutationChatId() and trace the message(action=react) path, including the TOPIC_BINDING_ERROR catch. Reproduce with a Telegram DM chat_id and valid messageId. Done means permitted reactions succeed without the mutation guard while sends, deletes, and edits retain the guard.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.