fix(e2e): require active Telegram configuration

[deepujain]

Summary

Make the Telegram add/remove E2E baseline distinguish an active channel from a disabled channel bundled in the managed image. The predicate now requires both the Telegram channel and its plugin entry to be explicitly enabled.

Related Issue

Fixes #9361

Changes

• Treat channels.telegram.enabled: false as inactive instead of relying on object presence.
• Require the matching plugins.entries.telegram.enabled state before reporting Telegram as configured.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: the live channels-add-remove target requires a reviewed E2E runner and was not dispatched locally.
• Applicable broad gate passed — npm run build:cli; npm run typecheck:cli; npm run lint
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Telegram sandbox detection now recognizes Telegram only when both the channel and its plugin are explicitly enabled.
  • Prevents inactive Telegram configurations from being treated as active.

• Documentation

  • Added guidance explaining Telegram activation requirements.
  • Documented sandbox-state assertions and policy-preset detection.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c0dcde14-0f76-45c3-8e8a-25fe7aab19b7

📥 Commits

Reviewing files that changed from the base of the PR and between 4a17961 and 8499a20.

📒 Files selected for processing (1)

• test/e2e/live/channels-add-remove.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/e2e/live/channels-add-remove.test.ts

Included review availability: Your plan includes up to 12 reviews per rolling hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The Telegram E2E baseline probe reports Telegram as configured only when both the channel and plugin entries are enabled. The test also documents sandbox-state and policy-preset checks.

Changes

Telegram detection

Layer / File(s)	Summary
Active Telegram configuration probe test/e2e/live/channels-add-remove.test.ts	The probe checks channels.telegram.enabled and plugins.entries.telegram.enabled before reporting Telegram as present. The test documents the activation gates, sandbox-state assertion, and policy-preset detection.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8499a

This localized test change distinguishes active Telegram configuration from disabled configuration, and no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• NVIDIA/NemoClaw#9296: Both changes address Telegram activation detection and policy handling.

Suggested labels: bug-fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the E2E fix: requiring active Telegram configuration.
Linked Issues check	✅ Passed	The change updates the baseline predicate to require enabled Telegram channel and plugin entries, matching issue #9361.
Out of Scope Changes check	✅ Passed	The changes are limited to the Telegram E2E baseline predicate and related documentation, with no unrelated scope.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 2 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized terminology decisions differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 2 more warnings, the same number of suggestions.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• onboard-policy-preset-sequencing: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• messaging-providers: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• network-policy: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — activation state at test/e2e/live/channels-add-remove.test.ts:285: Keep `activation state`; it distinguishes enabled configuration from object presence.
• established — active policy preset at test/e2e/live/channels-add-remove.test.ts:318: Keep `active policy preset`; it distinguishes applied presets from unapplied presets.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: cloud-onboard, security-posture, channels-add-remove, cloud-inference
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[deepujain]

Added the missing probe docstring. The live selector is manual-only, so the PR keeps the change limited to its baseline predicate.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[jyaunches]

LOC Reduction / Codebase Simplicity Review

Why this blocks

• Lines 285-339 add a two-mode probe, dynamically generated predicate, and two assertion wrappers for three phase checks.
• That abstraction hides the Telegram contract and already omits one required fact: the active predicate checks only channel and plugin flags, while the manifest renders an enabled default account and the production parser treats a channel as configured only when an account is enabled.
• Extending the predicate again would leave another local definition of active configuration.

Refactor direction

• Replace the active | present mode and both wrappers with one sandbox probe that emits small structured, non-secret Telegram state: entry presence, channel enabled, plugin enabled, and whether any account is enabled.
• Assert the expected fields directly at the baseline, add, and removal call sites.
• Follow the structured-config pattern in test/e2e/live/messaging-providers-helpers.ts:492-525 and the direct assertions in test/e2e/live/messaging-providers.test.ts:449-489.

Expected result

The account gap is fixed without growing a predicate mini-language, each phase states the contract it proves, and the mode dispatch plus wrapper layer disappears, reducing the change by about 10-15 lines.

[jyaunches]

LOC Reduction / Codebase Simplicity Review

Why this blocks

• The latest update extends the existing predicate string instead of removing the local state machine.
• test/e2e/live/channels-add-remove.test.ts:285-294 still defines an active | present mode, and lines 300-309 interpolate its two predicates into Python.
• The account requirement was appended to the active branch while both wrappers remain at lines 325-340.
• The three phase assertions still collapse distinct configuration facts into booleans. In particular, the baseline passes both for the expected bundled-but-disabled entry and for a missing or malformed entry.

Refactor direction

• Replace the mode and predicate interpolation with one sandbox probe that emits small, non-secret JSON state: channel entry present, channel enabled, plugin entry present, plugin enabled, and any account enabled.
• Parse that state once per phase and assert the exact baseline, added, and removed fields at the call sites.
• Delete openClawTelegramMatches(), expectOpenClawTelegram(), and expectOpenClawTelegramRemoved() rather than adding another clause to the local definition of active configuration.

Expected result

Each phase proves the state named by issue #9361, the account requirement remains covered, and the probe-mode dispatch plus wrapper layer disappears, reducing the change by roughly 10-15 lines with clearer failure evidence.

[deepujain]

Reworked the probe in 5bfbe62/c1ce269f3. It now emits non-secret structured state for channel/plugin presence, enabled flags, and enabled accounts; each lifecycle phase asserts those fields directly. Aaron’s account/removal commits are preserved.

[jyaunches]

LOC Reduction / Codebase Simplicity Review

Re-reviewed exact commit c1ce269f366b7ad1796ab418da5a3c2080b9ec4b.

The prior predicate-state-machine blocker is resolved. readOpenClawTelegramState() now emits one non-secret structured state, and the baseline, active, and removed phases assert the exact channel, plugin, and account facts at their call sites. The active | present dispatch, interpolated predicate, and assertion wrappers are gone.

I found no new blocking LOC-reduction or codebase-simplicity finding at this commit. This is a scope-limited follow-up, not an approval or a correctness, security, or CI review.

Resolved by c1ce269: one structured Telegram-state probe now owns all phase assertions. See the current scope-limited simplicity follow-up.

[prekshivyas]

Reviewed exact commit c1ce269f366b7ad1796ab418da5a3c2080b9ec4b.

Security review:

1. Secrets and credentials — PASS: the sandbox probe emits boolean activation state, not token values.
2. Input validation — PASS: baseline, active, and removed phases assert exact channel, plugin, and account facts.
3. Authentication and authorization — PASS: no access-control changes.
4. Dependencies and supply chain — PASS: no dependency changes.
5. Error handling and logging — PASS: malformed or unexpected config output fails the E2E assertion.
6. Cryptography — PASS: no cryptographic changes.
7. Policy and network isolation — PASS: the existing active-preset assertion remains in place.
8. Testing and regression safety — PASS: the three lifecycle phases distinguish bundled-disabled, enabled, and removed state.
9. System security — PASS: this tightens E2E evidence without changing production behavior.