DM pairing + Telegram channel improvements (nearai#17)

* feat: Implement DM pairing for channels

- Introduced a new pairing system to manage direct messages from unknown senders.
- Added `PairingStore` to handle pending requests and allowlist management.
- Implemented CLI commands for listing and approving pairing requests.
- Updated Telegram channel to utilize the new pairing logic, including workspace paths for storing pairing data.
- Enhanced WASM channel integration to support pairing functionality.

This feature enhances security by requiring approval for unknown senders before they can interact with the agent.

* Enhance Telegram channel support with media captioning and DM pairing features

- Added support for media captions in Telegram messages, allowing for richer content handling.
- Updated message processing to utilize either text or caption, improving message flexibility.
- Enhanced DM pairing functionality to include approval and listing capabilities for direct messages.
- Updated feature parity documentation to reflect new capabilities and improvements in Telegram integration.

* Update README and BUILDING_CHANNELS documentation for Telegram channel integration

- Enhanced README with instructions for building and running the Telegram channel, including a note on running `./scripts/build-all.sh` for full releases.
- Added detailed steps in BUILDING_CHANNELS.md for building and deploying the Telegram channel, emphasizing the need to run `./channels-src/telegram/build.sh` before building the main crate to ensure updated WASM is included.
- Updated CLI module to expose a new command for pairing with store functionality.

* Implement build script for Telegram channel WASM and enhance pairing error handling

- Added a new `build.rs` script to automate the compilation of the Telegram channel's WASM binary from source, ensuring reproducible builds and emphasizing supply chain security by preventing committed binaries.
- Updated `BUILDING_CHANNELS.md` to reflect the new build process and the importance of not committing compiled binaries.
- Enhanced error handling in the pairing approval process to include rate limiting for failed attempts, improving security and user feedback.

* Remove Telegram channel WASM binary file as part of the build process cleanup, ensuring no committed binaries are present in the repository.

Author: nightfullstar

Cargo.lock

@@ -67,6 +67,7 @@ aho-corasick = "1"
 
 # Filesystem paths
 dirs = "6"
+fs4 = "0.6"
 
 # Secrecy for sensitive values
 secrecy = { version = "0.10", features = ["serde"] }

Cargo.toml

@@ -59,7 +59,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | REPL (simple) | ✅ | ✅ | - | For testing |
 | WASM channels | ❌ | ✅ | - | IronClaw innovation |
 | WhatsApp | ✅ | ❌ | P1 | Baileys (Web) |
-| Telegram | ✅ | ✅ | - | WASM tool (MTProto) |
+| Telegram | ✅ | ✅ | - | WASM channel(MTProto), DM pairing, caption, /start, bot_username |
 | Discord | ✅ | ❌ | P2 | discord.js |
 | Signal | ✅ | ❌ | P2 | signal-cli |
 | Slack | ✅ | ✅ | - | WASM tool |
@@ -79,13 +79,13 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 
 | Feature | OpenClaw | IronClaw | Notes |
 |---------|----------|----------|-------|
-| DM pairing codes | ✅ | ❌ | Verification for unknown senders |
-| Allowlist/blocklist | ✅ | ❌ | Per-channel access control |
+| DM pairing codes | ✅ | ✅ | `ironclaw pairing list/approve`, host APIs |
+| Allowlist/blocklist | ✅ | 🚧 | allow_from + pairing store |
 | Self-message bypass | ✅ | ❌ | Own messages skip pairing |
-| Mention-based activation | ✅ | ❌ | Configurable patterns |
+| Mention-based activation | ✅ | ✅ | bot_username + respond_to_all_group_messages |
 | Per-group tool policies | ✅ | ❌ | Allow/deny specific tools |
 | Thread isolation | ✅ | ✅ | Separate sessions per thread |
-| Per-channel media limits | ✅ | ❌ | |
+| Per-channel media limits | ✅ | 🚧 | Caption support for media; no size limits |
 | Typing indicators | ✅ | 🚧 | TUI shows status |
 
 ### Owner: _Unassigned_
@@ -109,7 +109,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | `sessions` | ✅ | ❌ | P3 | Session listing |
 | `memory` | ✅ | ✅ | - | Memory search CLI |
 | `skills` | ✅ | ❌ | P3 | Agent skills |
-| `pairing` | ✅ | ❌ | P3 | Node pairing |
+| `pairing` | ✅ | ✅ | - | list/approve for channel DM pairing |
 | `nodes` | ✅ | ❌ | P3 | Device management |
 | `plugins` | ✅ | ❌ | P3 | Plugin management |
 | `hooks` | ✅ | ❌ | P2 | Lifecycle hooks |
@@ -350,8 +350,8 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 | Device pairing | ✅ | ❌ | |
 | Tailscale identity | ✅ | ❌ | |
 | OAuth flows | ✅ | 🚧 | NEAR AI OAuth |
-| DM pairing verification | ✅ | ❌ | |
-| Allowlist/blocklist | ✅ | ❌ | |
+| DM pairing verification | ✅ | ✅ | ironclaw pairing approve, host APIs |
+| Allowlist/blocklist | ✅ | 🚧 | allow_from + pairing store |
 | Per-group tool policies | ✅ | ❌ | |
 | Exec approvals | ✅ | ✅ | TUI overlay |
 | TLS 1.3 minimum | ✅ | ✅ | reqwest rustls |
@@ -397,6 +397,7 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 ### P0 - Core (Already Done)
 - ✅ TUI channel with approval overlays
 - ✅ HTTP webhook channel
+- ✅ DM pairing (ironclaw pairing list/approve, host APIs)
 - ✅ WASM tool sandbox
 - ✅ Workspace/memory with hybrid search
 - ✅ Prompt injection defense
@@ -415,12 +416,18 @@ This document tracks feature parity between IronClaw (Rust implementation) and O
 - ✅ Gateway token auth
 
 ### P1 - High Priority
+- ❌ Slack channel (real implementation)
+- ✅ Telegram channel (WASM, DM pairing, caption, /start)
 - ❌ WhatsApp channel
 - ❌ Multi-provider failover
 - ❌ Hooks system (beforeInbound, beforeToolCall, etc.)
 
 ### P2 - Medium Priority
-- ❌ Media handling (images, PDFs)
+- ❌ Cron job scheduling
+- ❌ Web Control UI
+- ❌ WebChat channel
+- 🚧 Media handling (caption support; no image/PDF processing)
+- ❌ CLI subcommands (config, status, memory, doctor)
 - ❌ Ollama/local model support
 - ❌ Configuration hot-reload
 - ❌ Webhook trigger endpoint in web gateway

FEATURE_PARITY.md

@@ -85,6 +85,8 @@ cargo build --release
 cargo test
 ```
 
+For **full release** (after modifying channel sources), run `./scripts/build-all.sh` to rebuild channels first.
+
 ### Database Setup
 
 ```bash
@@ -228,6 +230,9 @@ cargo test
 cargo test test_name
 ```
 
+- **Telegram channel**: See [docs/TELEGRAM_SETUP.md](docs/TELEGRAM_SETUP.md) for setup and DM pairing.
+- **Changing channel sources**: Run `./channels-src/telegram/build.sh` before `cargo build` so the updated WASM is bundled.
+
 ## OpenClaw Heritage
 
 IronClaw is a Rust reimplementation inspired by [OpenClaw](https://github.com/openclaw/openclaw). See [FEATURE_PARITY.md](FEATURE_PARITY.md) for the complete tracking matrix.

README.md

@@ -0,0 +1,105 @@
+//! Build script: compile Telegram channel WASM from source.
+//!
+//! Do not commit compiled WASM binaries — they are a supply chain risk.
+//! This script builds telegram.wasm from channels-src/telegram before the main crate compiles.
+//!
+//! Reproducible build:
+//!   cargo build --release
+//! (build.rs invokes the channel build automatically)
+//!
+//! Prerequisites: rustup target add wasm32-wasip2, cargo install wasm-tools
+
+use std::env;
+use std::path::PathBuf;
+use std::process::Command;
+
+fn main() {
+    let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
+    let root = PathBuf::from(&manifest_dir);
+    let channel_dir = root.join("channels-src/telegram");
+    let wasm_out = channel_dir.join("telegram.wasm");
+
+    // Rerun when channel source or build script changes
+    println!("cargo:rerun-if-changed=channels-src/telegram/src");
+    println!("cargo:rerun-if-changed=channels-src/telegram/Cargo.toml");
+    println!("cargo:rerun-if-changed=wit/channel.wit");
+
+    if !channel_dir.is_dir() {
+        return;
+    }
+
+    // Build WASM module
+    let status = match Command::new("cargo")
+        .args([
+            "build",
+            "--release",
+            "--target",
+            "wasm32-wasip2",
+            "--manifest-path",
+            channel_dir.join("Cargo.toml").to_str().unwrap(),
+        ])
+        .current_dir(&root)
+        .status()
+    {
+        Ok(s) => s,
+        Err(_) => {
+            eprintln!(
+                "cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
+            );
+            return;
+        }
+    };
+
+    if !status.success() {
+        eprintln!(
+            "cargo:warning=Telegram channel build failed. Run: ./channels-src/telegram/build.sh"
+        );
+        return;
+    }
+
+    let raw_wasm = channel_dir.join("target/wasm32-wasip2/release/telegram_channel.wasm");
+    if !raw_wasm.exists() {
+        eprintln!(
+            "cargo:warning=Telegram WASM output not found at {:?}",
+            raw_wasm
+        );
+        return;
+    }
+
+    // Convert to component and strip (wasm-tools)
+    let component_ok = Command::new("wasm-tools")
+        .args([
+            "component",
+            "new",
+            raw_wasm.to_str().unwrap(),
+            "-o",
+            wasm_out.to_str().unwrap(),
+        ])
+        .current_dir(&root)
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false);
+
+    if !component_ok
+    {
+        // Fallback: copy raw module if wasm-tools unavailable
+        if std::fs::copy(&raw_wasm, &wasm_out).is_err() {
+            eprintln!(
+                "cargo:warning=wasm-tools not found. Run: cargo install wasm-tools"
+            );
+        }
+    } else {
+        // Strip debug info (use temp file to avoid clobbering)
+        let stripped = wasm_out.with_extension("wasm.stripped");
+        let strip_ok = Command::new("wasm-tools")
+            .args(["strip", wasm_out.to_str().unwrap(), "-o", stripped.to_str().unwrap()])
+            .current_dir(&root)
+            .status()
+            .map(|s| s.success())
+            .unwrap_or(false);
+        if strip_ok
+        {
+            let _ = std::fs::rename(&stripped, &wasm_out);
+        }
+    }
+}