#11132: fix(telegram): guard command menu overflow and doctor warnings
docs
channel: telegram
commands
agents
stale
Cluster:
Telegram Command Fixes
## Summary
- add Telegram native command registration guardrail to cap menu registration at 100 commands, preserving deterministic priority order and emitting a clear warning when trimming occurs
- add proactive security audit/doctor findings for Telegram command menu near-limit (90+) and limit-exceeded (>100) conditions
- document the `BOT_COMMANDS_TOO_MUCH` behavior and mitigation knobs in Telegram troubleshooting and slash command docs
## Validation
- `pnpm exec vitest run src/telegram/bot-native-commands.test.ts src/security/audit.test.ts`
- `pnpm build`
<!-- greptile_comment -->
<h2>Greptile Overview</h2>
<h3>Greptile Summary</h3>
This PR adds a guardrail for Telegram native command registration by capping the registered menu commands at Telegram’s 100-command limit, preserving priority order (native > plugin > custom) and emitting a warning when trimming occurs. It also adds `openclaw doctor`/security-audit findings to warn when the resolved Telegram command menu is near the limit (>=90) or over the limit (>100), and updates docs to describe the BOT_COMMANDS_TOO_MUCH behavior and configuration knobs for reducing command count.
The runtime cap is implemented in `src/telegram/bot-native-commands.ts`, while the preflight checks are implemented in `src/security/audit.ts` by recomputing the resolved native/plugin/custom command set and counting unique Telegram-valid entries.
<h3>Confidence Score: 4/5</h3>
- This PR is close to safe to merge, but the new doctor/audit messaging is inconsistent with the new runtime trimming behavior.
- Core behavior change (capping to 100 commands) is straightforward and covered by a unit test, but the security-audit/doctor finding text currently asserts that `setMyCommands` will fail when over 100 even though the code now trims to 100 before calling Telegram. Fixing that messaging (and optionally aligning warning wording) would reduce confusion and keep diagnostics accurate.
- src/security/audit.ts; src/telegram/bot-native-commands.ts
<!-- greptile_other_comments_section -->
<sub>(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!</sub>
<!-- /greptile_comment -->
Most Similar PRs
#6457: fix(telegram): register commands for group scope + preserve topic t...
by dae-sun · 2026-02-01
83.9%
#3186: fix(telegram): sanitize update offset + lock polling
by daxiong888 · 2026-01-28
81.4%
#14991: fix(telegram): deduplicate skill commands by skillName to prevent B...
by smartchainark · 2026-02-12
78.9%
#11240: Fix #10875: Clear Telegram commands before registering to prevent d...
by divol89 · 2026-02-07
78.5%
#6463: fix(telegram): improve timeout handling and prevent channel exits
by ai-fanatic · 2026-02-01
77.6%
#8166: fix(telegram): lifecycle fixes for duplicate messages and auto-reco...
by cheenu1092-oss · 2026-02-03
77.5%
#12936: fix(telegram): omit message_thread_id for private DM chats
by omair445 · 2026-02-09
77.2%
#16548: fix(telegram): enhance chat_id validation and diagnostics
by tanujbhaud · 2026-02-14
76.9%
#21029: Feature/telegram bot avatar clean
by aleonnet · 2026-02-19
76.8%
#19375: telegram: align tool-error summaries
by NorthyIE · 2026-02-17
76.5%