fix: keep telegram plugin fallback explicit (#45911) (thanks @suboss87)

src/auto-reply/reply/commands-approve.ts

@@ -132,6 +132,7 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm
   const isPluginId = parsed.id.startsWith("plugin:");
   let discordExecApprovalDeniedReply: { shouldContinue: false; reply: { text: string } } | null =
     null;
+  let isTelegramExplicitApprover = false;
 
   if (params.command.channel === "telegram") {
     const telegramApproverContext = {
@@ -139,6 +140,7 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm
       accountId: params.ctx.AccountId,
       senderId: params.command.senderId,
     };
+    isTelegramExplicitApprover = isTelegramExecApprovalApprover(telegramApproverContext);
 
     if (!isPluginId && !isTelegramExecApprovalAuthorizedSender(telegramApproverContext)) {
       return {
@@ -147,7 +149,7 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm
       };
     }
 
-    if (isPluginId && !isTelegramExecApprovalApprover(telegramApproverContext)) {
+    if (isPluginId && !isTelegramExplicitApprover) {
       return {
         shouldContinue: false,
         reply: { text: "❌ You are not authorized to approve plugin requests on Telegram." },
@@ -248,6 +250,12 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm
       await callApprovalMethod("exec.approval.resolve");
     } catch (err) {
       if (isApprovalNotFoundError(err)) {
+        if (params.command.channel === "telegram" && !isTelegramExplicitApprover) {
+          return {
+            shouldContinue: false,
+            reply: { text: `❌ Failed to submit approval: ${String(err)}` },
+          };
+        }
         try {
           await callApprovalMethod("plugin.approval.resolve");
         } catch (pluginErr) {

src/auto-reply/reply/commands.test.ts

@@ -742,6 +742,30 @@ describe("/approve command", () => {
     expect(callGatewayMock).toHaveBeenCalledTimes(0);
   });
 
+  it("does not fall back to legacy plugin approvals for Telegram target recipients", async () => {
+    const cfg = createTelegramTargetApproveCfg();
+    const params = buildParams("/approve legacy-plugin-123 allow-once", cfg, {
+      Provider: "telegram",
+      Surface: "telegram",
+      SenderId: "123",
+    });
+
+    callGatewayMock.mockRejectedValueOnce(
+      gatewayError("unknown or expired approval id", "APPROVAL_NOT_FOUND"),
+    );
+
+    const result = await handleCommands(params);
+    expect(result.shouldContinue).toBe(false);
+    expect(result.reply?.text).toContain("unknown or expired approval id");
+    expect(callGatewayMock).toHaveBeenCalledTimes(1);
+    expect(callGatewayMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: "exec.approval.resolve",
+        params: { id: "legacy-plugin-123", decision: "allow-once" },
+      }),
+    );
+  });
+
   it("enforces gateway approval scopes", async () => {
     const cfg = {
       commands: { text: true },