feat: add Telegram Bot community plugin

[Finley-Agent-Zhuazhua]

Summary

• add telegramBot community plugin as a submodule
• toolset includes sendMessage, getUpdates, and getChat
• source commit: f0cb4a4a758d923fbf3f8193c175d2c13a9a88d7

Verification

Plugin source (/home/openclaw/projects/fastgpt-plugin-telegramBot):

• pnpm install --ignore-workspace
• pnpm run type-check
• pnpm test (7 tests passed)
• pnpm build
• pnpm check
• pnpm run pack

Registry (/home/openclaw/projects/fastgpt-community-plugins):

• pnpm validate
• pnpm test (34 tests passed)
• pnpm type-check
• git submodule status --recursive

Remote dev debug

Skipped: no live Telegram bot token is available in this scheduled automation run; unit tests mock Telegram Bot API responses and verify the fixed api.telegram.org endpoint.

[FinleyGe]

Plugin Review: telegramBot@0.1.0

Verdict: fail
Source: https://github.com/Finley-Agent-Zhuazhua/fastgpt-plugin-telegramBot@c45f820168e6b89704a89d980a9ccca14cf83c7d
Plugin root: packages/tools/telegramBot/.

Findings

• [P1] packages/tools/telegramBot/package.json:12 - pnpm test exits 1 when this plugin is validated as a submodule in the registry checkout. The repository has tests at index.test.ts, src/client.test.ts, and src/schemas.test.ts, but no plugin-local Vitest config, so Vitest walks up to the parent registry config and reports No test files found for tests/**/*.test.ts. Add a plugin-local Vitest config or update the test script so the checked-in tests run from packages/tools/telegramBot.

Evidence

• registry/submodule: pnpm run validate -- --base origin/main --head HEAD passed with changedPluginIds: ["telegramBot"]; .gitmodules points at the source repo; submodule HEAD matched registry commit c45f820168e6b89704a89d980a9ccca14cf83c7d; source repo is public MIT.
• install/build/check/pack: pnpm install --frozen-lockfile --ignore-workspace passed; pnpm test failed with No test files found, exiting with code 1; pnpm type-check, pnpm build, pnpm check, and pnpm run pack passed.
• policy scan: no hardcoded private keys/tokens, child_process, shell command construction, or destructive filesystem removal found. Network access uses the fixed Telegram Bot API endpoint https://api.telegram.org with bot-token secrets and no endpoint override.
• package sha256: telegramBot.pkg fe59c00e10209cf87aa4e47e11a84cfec35d8b31c33c7f8e8c46965a7cf47099

Publish Decision

Blocked

Scheduled Merge Gate

Blocked. Not merged in scheduled run 20260708T061907Z because the plugin-review verdict is fail. GitHub reports the PR as non-draft, mergeable, and current status checks are successful; this blocker is inside the plugin test configuration/script and is not eligible for metadata-only conflict remediation.

[Finley-Agent-Zhuazhua]

Fixed the plugin-local test blocker reported in the review.

Changes:

• Added a plugin-local vitest.config.ts so pnpm test uses the checked-in **/*.test.ts files instead of inheriting the registry root tests/**/*.test.ts include pattern.
• Updated the registry submodule gitlink and plugins.json.commit to source commit f0cb4a4a758d923fbf3f8193c175d2c13a9a88d7.

Verification run:

• In packages/tools/telegramBot: pnpm install --ignore-workspace, pnpm run type-check, pnpm test, pnpm build, pnpm check, pnpm run pack all passed.
• In the registry PR branch: pnpm validate, pnpm test, pnpm type-check, and git submodule status --recursive all passed.

Commits:

• Source: f0cb4a4a758d923fbf3f8193c175d2c13a9a88d7
• Registry branch: 4ef85c6

[FinleyGe]

Plugin Review: telegramBot@0.1.0

Verdict: pass
Source: https://github.com/Finley-Agent-Zhuazhua/fastgpt-plugin-telegramBot@f0cb4a4a758d923fbf3f8193c175d2c13a9a88d7
Plugin root: packages/tools/telegramBot/.

Findings

• No blocking findings.

Evidence

• registry/submodule: reviewed PR head f70850d31037936a4b17fc8297ce626fcd432c99; pnpm run validate -- --base origin/main --head HEAD passed with changedPluginIds: ["telegramBot"]; submodule HEAD matched registry commit f0cb4a4a758d923fbf3f8193c175d2c13a9a88d7; root pnpm test passed 8 test files / 34 tests and pnpm run type-check passed.
• install/build/check/pack: plugin-local pnpm install --frozen-lockfile --ignore-workspace, pnpm test (3 test files / 7 tests), pnpm run type-check, pnpm run build, pnpm run check, and pnpm run pack all passed.
• policy scan: no hardcoded private keys/tokens, child_process, shell command construction, or destructive filesystem removal found; MIT license present; no catalog: or workspace: dependency specifiers. Network access uses the fixed Telegram Bot API endpoint; bot token input is normalized, URL encoded, and rejected when it contains whitespace or path/query characters.
• metadata remediation: resolved mechanical conflicts caused by prior plugin PRs and publish metadata landing first; conflict resolution touched .gitmodules, plugins.json, generated event metadata from main, and submodule metadata only relative to current origin/main; plugin implementation code was unchanged. Contributor action was not needed for that conflict.
• package sha256: telegramBot.pkg 9a0f39941fe7540d1453c0e688a9c71acfe7ce4b44a4b2eed5b0ea5cfda85f63

Publish Decision

Proceed

Scheduled Merge Gate

Merged in scheduled run 20260708T084158Z. Squash merge used reviewed head f70850d31037936a4b17fc8297ce626fcd432c99 and produced merge commit e505f914633e3521725fc8df8f10871c0022afc8 at 2026-07-08T09:12:53Z; post-merge publish metadata was observed on origin/main at 7d5955a.