← Back to PRs

#11132: fix(telegram): guard command menu overflow and doctor warnings

by kiminbean open 2026-02-07 12:48 View on GitHub →
docs channel: telegram commands agents stale
## Summary - add Telegram native command registration guardrail to cap menu registration at 100 commands, preserving deterministic priority order and emitting a clear warning when trimming occurs - add proactive security audit/doctor findings for Telegram command menu near-limit (90+) and limit-exceeded (>100) conditions - document the `BOT_COMMANDS_TOO_MUCH` behavior and mitigation knobs in Telegram troubleshooting and slash command docs ## Validation - `pnpm exec vitest run src/telegram/bot-native-commands.test.ts src/security/audit.test.ts` - `pnpm build` <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR adds a guardrail for Telegram native command registration by capping the registered menu commands at Telegram’s 100-command limit, preserving priority order (native > plugin > custom) and emitting a warning when trimming occurs. It also adds `openclaw doctor`/security-audit findings to warn when the resolved Telegram command menu is near the limit (>=90) or over the limit (>100), and updates docs to describe the BOT_COMMANDS_TOO_MUCH behavior and configuration knobs for reducing command count. The runtime cap is implemented in `src/telegram/bot-native-commands.ts`, while the preflight checks are implemented in `src/security/audit.ts` by recomputing the resolved native/plugin/custom command set and counting unique Telegram-valid entries. <h3>Confidence Score: 4/5</h3> - This PR is close to safe to merge, but the new doctor/audit messaging is inconsistent with the new runtime trimming behavior. - Core behavior change (capping to 100 commands) is straightforward and covered by a unit test, but the security-audit/doctor finding text currently asserts that `setMyCommands` will fail when over 100 even though the code now trims to 100 before calling Telegram. Fixing that messaging (and optionally aligning warning wording) would reduce confusion and keep diagnostics accurate. - src/security/audit.ts; src/telegram/bot-native-commands.ts <!-- greptile_other_comments_section --> <sub>(3/5) Reply to the agent's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!</sub> <!-- /greptile_comment -->

Most Similar PRs