From 33d760d31213edf8af992026d3a7e3da33bca52f Mon Sep 17 00:00:00 2001 From: Nikolas de Hor Date: Wed, 18 Feb 2026 21:27:13 -0300 Subject: [PATCH 1/2] fix: handle /help command directly in Telegram, bypassing ACL check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The /help command was routed through _forward_command → _handle_message → is_allowed(), which denied access to users not in the allowFrom list. Since /help is purely informational, it should be accessible to all users — similar to how /start already works with its own handler. Add a dedicated _on_help handler that replies directly without going through the message bus access control. Closes #687 --- nanobot/channels/telegram.py | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/nanobot/channels/telegram.py b/nanobot/channels/telegram.py index 39924b3..fa48fef 100644 --- a/nanobot/channels/telegram.py +++ b/nanobot/channels/telegram.py @@ -146,7 +146,7 @@ class TelegramChannel(BaseChannel): # Add command handlers self._app.add_handler(CommandHandler("start", self._on_start)) self._app.add_handler(CommandHandler("new", self._forward_command)) - self._app.add_handler(CommandHandler("help", self._forward_command)) + self._app.add_handler(CommandHandler("help", self._on_help)) # Add message handler for text, photos, voice, documents self._app.add_handler( @@ -258,14 +258,28 @@ class TelegramChannel(BaseChannel): """Handle /start command.""" if not update.message or not update.effective_user: return - + user = update.effective_user await update.message.reply_text( f"👋 Hi {user.first_name}! I'm nanobot.\n\n" "Send me a message and I'll respond!\n" "Type /help to see available commands." ) - + + async def _on_help(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None: + """Handle /help command directly, bypassing access control. + + /help is informational and should be accessible to all users, + even those not in the allowFrom list. + """ + if not update.message: + return + await update.message.reply_text( + "🐈 nanobot commands:\n" + "/new — Start a new conversation\n" + "/help — Show available commands" + ) + @staticmethod def _sender_id(user) -> str: """Build sender_id with username for allowlist matching.""" From 2f315ec567ab2432ab32332e3fa671a1bdc44dc6 Mon Sep 17 00:00:00 2001 From: Re-bin Date: Fri, 20 Feb 2026 08:39:26 +0000 Subject: [PATCH 2/2] style: trim _on_help docstring --- nanobot/channels/telegram.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/nanobot/channels/telegram.py b/nanobot/channels/telegram.py index af161d4..768e565 100644 --- a/nanobot/channels/telegram.py +++ b/nanobot/channels/telegram.py @@ -267,11 +267,7 @@ class TelegramChannel(BaseChannel): ) async def _on_help(self, update: Update, context: ContextTypes.DEFAULT_TYPE) -> None: - """Handle /help command directly, bypassing access control. - - /help is informational and should be accessible to all users, - even those not in the allowFrom list. - """ + """Handle /help command, bypassing ACL so all users can access it.""" if not update.message: return await update.message.reply_text(