Fix pairing for Weixin and Telegram DMs

nanobot/channels/telegram.py

@@ -869,7 +869,9 @@ class TelegramChannel(BaseChannel):
             return
 
         user = update.effective_user
-        if not self.is_allowed(self._sender_id(user)):
+        sender_id = self._sender_id(user)
+        if not self.is_allowed(sender_id):
+            await self._send_pairing_code_if_private(sender_id, update.message, user)
             return
         await update.message.reply_text(
             f"👋 Hi {user.first_name}! I'm nanobot.\n\n"
@@ -881,7 +883,10 @@ class TelegramChannel(BaseChannel):
         """Handle /help command for allowed users only."""
         if not update.message or not update.effective_user:
             return
-        if not self.is_allowed(self._sender_id(update.effective_user)):
+        user = update.effective_user
+        sender_id = self._sender_id(user)
+        if not self.is_allowed(sender_id):
+            await self._send_pairing_code_if_private(sender_id, update.message, user)
             return
         await update.message.reply_text(build_help_text())
 
@@ -891,6 +896,17 @@ class TelegramChannel(BaseChannel):
         sid = str(user.id)
         return f"{sid}|{user.username}" if user.username else sid
 
+    async def _send_pairing_code_if_private(self, sender_id: str, message, user) -> None:
+        if message.chat.type != "private":
+            return
+        await self._handle_message(
+            sender_id=sender_id,
+            chat_id=str(message.chat_id),
+            content="",
+            metadata=self._build_message_metadata(message, user),
+            is_dm=True,
+        )
+
     @staticmethod
     def _derive_topic_session_key(message) -> str | None:
         """Derive topic-scoped session key for Telegram chats with threads."""
@@ -1149,6 +1165,7 @@ class TelegramChannel(BaseChannel):
         user = update.effective_user
         sender_id = self._sender_id(user)
         if not self.is_allowed(sender_id):
+            await self._send_pairing_code_if_private(sender_id, message, user)
             return
         self._remember_thread_context(message)
 
@@ -1186,6 +1203,7 @@ class TelegramChannel(BaseChannel):
         chat_id = message.chat_id
         sender_id = self._sender_id(user)
         if not self.is_allowed(sender_id):
+            await self._send_pairing_code_if_private(sender_id, message, user)
             return
         self._remember_thread_context(message)
 

nanobot/channels/weixin.py

@@ -609,9 +609,6 @@ class WeixinChannel(BaseChannel):
         if not from_user_id:
             return
 
-        if not self.is_allowed(from_user_id):
-            return
-
         # Deduplication by message_id
         if msg_id in self._processed_ids:
             return
@@ -619,8 +616,51 @@ class WeixinChannel(BaseChannel):
         while len(self._processed_ids) > 1000:
             self._processed_ids.popitem(last=False)
 
-        # Cache context_token (required for all replies — inbound.ts:23-27)
         ctx_token = msg.get("context_token", "")
+        if not self.is_allowed(from_user_id):
+            if from_user_id.endswith("@chatroom"):
+                await self._handle_message(
+                    sender_id=from_user_id,
+                    chat_id=from_user_id,
+                    content="",
+                    metadata={"message_id": msg_id},
+                    is_dm=False,
+                )
+                return
+
+            if not ctx_token:
+                self.logger.warning(
+                    "Access denied for sender {}; cannot send WeChat pairing code without context_token",
+                    from_user_id,
+                )
+                return
+
+            had_ctx_token = from_user_id in self._context_tokens
+            previous_ctx_token = self._context_tokens.get(from_user_id, "")
+            had_ctx_token_at = from_user_id in self._context_token_at
+            previous_ctx_token_at = self._context_token_at.get(from_user_id, 0.0)
+            self._context_tokens[from_user_id] = ctx_token
+            self._context_token_at[from_user_id] = time.time()
+            try:
+                await self._handle_message(
+                    sender_id=from_user_id,
+                    chat_id=from_user_id,
+                    content="",
+                    metadata={"message_id": msg_id},
+                    is_dm=True,
+                )
+            finally:
+                if had_ctx_token:
+                    self._context_tokens[from_user_id] = previous_ctx_token
+                else:
+                    self._context_tokens.pop(from_user_id, None)
+                if had_ctx_token_at:
+                    self._context_token_at[from_user_id] = previous_ctx_token_at
+                else:
+                    self._context_token_at.pop(from_user_id, None)
+            return
+
+        # Cache context_token (required for all replies — inbound.ts:23-27)
         if ctx_token:
             self._context_tokens[from_user_id] = ctx_token
             self._context_token_at[from_user_id] = time.time()