5dive

Telegram access/pairing for codex + grok agents (DIVE-4)

Telegram access-control commands were claude-only and hard-failed on type=codex/grok, forcing manual access.json edits to manage non-claude bot allowlists. All three types share the same access.json schema ({dmPolicy, allowFrom, groups}) and path layout (~/.<type>/channels/telegram/access.json), so the fix is per-type path resolution rather than new logic.

Changed

• agent telegram-access get/set — resolve path by agent type via a new _tg_access_state_dir helper.
• agent pair — code-roundtrip + auto-pair now accept codex/grok (path resolved as ~/.<type>/channels/<channel>/access.json); openclaw/hermes stay token-only.
• agent telegram-pending-ignore and agent telegram-resolve-handle — accept codex/grok instead of hard-failing.
• Inter-agent group mirror resolves the sending agent's access.json by type, so codex/grok agents mirror to the group too.

Validated against live codex (draft-codex) and grok (groktest) telegram agents.