From 8d1ae4f8459ed95d62c824c84e054f3dfec777c4 Mon Sep 17 00:00:00 2001
From: Gustavo Madeira Santana <gumadeiras@gmail.com>
Date: Wed, 1 Apr 2026 10:20:59 -0400
Subject: [PATCH] fix: preserve Telegram approval agent fallback

---
 CHANGELOG.md                                  |  4 ++++
 .../telegram/src/exec-approvals.test.ts       | 24 +++++++++++++++++++
 extensions/telegram/src/exec-approvals.ts     |  1 +
 3 files changed, 29 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9df539bf48..6d485feb33e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -86,6 +86,10 @@ Docs: https://docs.openclaw.ai
 - Discord/gateway: hand reconnect ownership back to Carbon, keep runtime status aligned with close/reconnect state, and force-stop sockets that open without reaching READY so Discord monitors recover promptly instead of waiting on stale health timeouts. (#59019) Thanks @obviyus
 - Config/Telegram: migrate removed `channels.telegram.groupMentionsOnly` into `channels.telegram.groups["*"].requireMention` on load so legacy configs no longer crash at startup. (#55336) thanks @jameslcowan.
 
+### Fixes
+
+- Telegram/exec approvals: preserve `agentFilter` matching when the agent is only encoded in `sessionKey`, so Telegram approval requests keep reaching configured approvers after the shared approval-capability refactor. (#58634) thanks @gumadeiras
+
 ## 2026.3.31
 
 ### Breaking
diff --git a/extensions/telegram/src/exec-approvals.test.ts b/extensions/telegram/src/exec-approvals.test.ts
index 64951ded1a8..d807ab58f0c 100644
--- a/extensions/telegram/src/exec-approvals.test.ts
+++ b/extensions/telegram/src/exec-approvals.test.ts
@@ -7,6 +7,7 @@ import {
   isTelegramExecApprovalClientEnabled,
   isTelegramExecApprovalTargetRecipient,
   resolveTelegramExecApprovalTarget,
+  shouldHandleTelegramExecApprovalRequest,
   shouldEnableTelegramExecApprovalButtons,
   shouldInjectTelegramExecApprovalButtons,
 } from "./exec-approvals.js";
@@ -73,6 +74,29 @@ describe("telegram exec approvals", () => {
     ).toBe("dm");
   });
 
+  it("matches agent filters from the Telegram session key when request.agentId is absent", () => {
+    const cfg = buildConfig({
+      enabled: true,
+      approvers: ["123"],
+      agentFilter: ["ops"],
+    });
+
+    expect(
+      shouldHandleTelegramExecApprovalRequest({
+        cfg,
+        request: {
+          id: "req-1",
+          request: {
+            command: "echo hi",
+            sessionKey: "agent:ops:telegram:direct:123:tail",
+          },
+          createdAtMs: 0,
+          expiresAtMs: 1000,
+        },
+      }),
+    ).toBe(true);
+  });
+
   it("only injects approval buttons on eligible telegram targets", () => {
     const dmCfg = buildConfig({ enabled: true, approvers: ["123"], target: "dm" });
     const channelCfg = buildConfig({ enabled: true, approvers: ["123"], target: "channel" });
diff --git a/extensions/telegram/src/exec-approvals.ts b/extensions/telegram/src/exec-approvals.ts
index 4ecec572892..5499ad79dc8 100644
--- a/extensions/telegram/src/exec-approvals.ts
+++ b/extensions/telegram/src/exec-approvals.ts
@@ -80,6 +80,7 @@ const telegramExecApprovalProfile = createChannelExecApprovalProfile({
       normalizeAccountId(boundAccountId) === normalizeAccountId(accountId)
     );
   },
+  fallbackAgentIdFromSessionKey: true,
   requireClientEnabledForLocalPromptSuppression: false,
 });