7e49e98f79
fix(telegram): validate webhook secret before reading request body
...
Refs: GHSA-jq3f-vjww-8rq7
2026-03-13 23:21:48 +01:00
158d970e2b
[codex] Polish sidebar status, agent skills, and chat rendering ( #45451 )
...
* style: update chat layout and spacing for improved UI consistency
- Adjusted margin and padding for .chat-thread and .content--chat to enhance layout.
- Consolidated CSS selectors for better readability and maintainability.
- Introduced new test for log parsing functionality to ensure accurate message extraction.
* UI: polish agent skills, chat images, and sidebar status
* test: stabilize vitest helper export types
* UI: address review feedback on agents refresh and chat styles
* test: update outbound gateway client fixture values
* test: narrow shared ip fixtures to IPv4
2026-03-13 16:53:40 -05:00
b84c7037de
fix: repair ci audit and type drift
2026-03-13 21:02:19 +00:00
8473a29da7
refactor: share exec approval session target routing
2026-03-13 20:19:39 +00:00
f201bad372
refactor: share telegram dispatch failure harness
2026-03-13 20:19:39 +00:00
2cd1a4b8dd
refactor: share telegram named account dm fixtures
2026-03-13 20:19:39 +00:00
94e748086c
refactor: share auth overview and fetch test helpers
2026-03-13 20:19:38 +00:00
60dc46ad10
refactor: share telegram native command auth harness
2026-03-13 20:19:38 +00:00
9780e999e9
refactor: share lane delivery test flows
2026-03-13 20:19:38 +00:00
60d308cff0
test: fix CI type regressions
2026-03-13 19:53:40 +00:00
05a1b0c3ae
refactor: share telegram network test helpers
2026-03-13 18:38:12 +00:00
3e8d9bc6ea
test: refine telegram token coverage
2026-03-13 18:19:27 +00:00
4ed3b62f01
test: refine telegram network and install source coverage
2026-03-13 18:08:48 +00:00
8f4e77e72f
test: tighten channel auth and network coverage
2026-03-13 18:06:39 +00:00
8023f4c701
fix(telegram): thread media transport policy into SSRF ( #44639 )
...
* fix(telegram): preserve media download transport policy
* refactor(telegram): thread media transport policy
* fix(telegram): sync fallback media policy
* fix: note telegram media transport fix (#44639 )
2026-03-13 10:11:43 +05:30
61d219cb39
feat: show status reaction during context compaction ( #35474 )
...
Merged via squash.
Prepared head SHA: 145a7b7c4e
2026-03-12 21:06:15 -07:00
ddeb423944
fix: quiet Telegram command overflow retry logs
2026-03-13 01:45:56 +00:00
4ca84acf24
fix(runtime): duplicate messages, share singleton state across bundled chunks ( #43683 )
...
* Tests: add fresh module import helper
* Process: share command queue runtime state
* Agents: share embedded run runtime state
* Reply: share followup queue runtime state
* Reply: share followup drain callback state
* Reply: share queued message dedupe state
* Reply: share inbound dedupe state
* Tests: cover shared command queue runtime state
* Tests: cover shared embedded run runtime state
* Tests: cover shared followup queue runtime state
* Tests: cover shared inbound dedupe state
* Tests: cover shared Slack thread participation state
* Slack: share sent thread participation state
* Tests: document fresh import helper
* Telegram: share draft stream runtime state
* Tests: cover shared Telegram draft stream state
* Telegram: share sent message cache state
* Tests: cover shared Telegram sent message cache
* Telegram: share thread binding runtime state
* Tests: cover shared Telegram thread binding state
* Tests: avoid duplicate shared queue reset
* refactor(runtime): centralize global singleton access
* refactor(runtime): preserve undefined global singleton values
* test(runtime): cover undefined global singleton values
---------
Co-authored-by: Nimrod Gutman <nimrod.gutman@gmail.com>
2026-03-12 14:59:27 -04:00
3fa91cd69d
feat: add sessions_yield tool for cooperative turn-ending ( #36537 )
...
Merged via squash.
Prepared head SHA: 75d9204c86
2026-03-12 08:46:47 -07:00
f2e28fc30f
fix(telegram): allow fallback models in /model validation ( #40105 )
...
Merged via squash.
Prepared head SHA: de07585e03
2026-03-12 13:55:51 +01:00
ed0ec57a7b
fix: scope telegram polling restart to telegram errors ( #43799 )
...
* fix: scope telegram polling restart to telegram errors
* fix: make telegram error tagging best-effort
* fix: scope telegram polling restart to telegram errors (#43799 )
2026-03-12 13:14:17 +05:30
fbc1bd6f8e
fix: clear telegram polling cleanup timers
2026-03-12 09:36:04 +05:30
70abee69e9
fix(telegram): avoid polling restart hang after stall detection
2026-03-12 09:36:04 +05:30
daf8afc954
fix(telegram): clear stale retain before transient final fallback ( #41763 )
...
Merged via squash.
Prepared head SHA: c0940838bc
2026-03-11 21:36:43 +05:30
87876a3e36
Fix env proxy bootstrap for model traffic ( #43248 )
...
* Fix env proxy bootstrap for model traffic
* Address proxy dispatcher review followups
* Fix proxy env precedence for empty lowercase vars
2026-03-11 10:21:35 -05:00
a2e30824e6
fix(telegram): fall back on ambiguous first preview sends
2026-03-11 11:23:10 +05:30
e37e1ed24e
fix(telegram): prevent duplicate messages with slow LLM providers ( #41932 )
...
Merged via squash.
Prepared head SHA: 2f50c51d5a
2026-03-11 11:19:55 +05:30
68c674d37c
refactor(security): simplify system.run approval model
2026-03-11 01:43:06 +00:00
201420a7ee
fix: harden secret-file readers
2026-03-10 23:40:10 +00:00
208fb1aa35
test: share runtime group policy fallback cases
2026-03-10 22:20:19 +00:00
1df78202b9
refactor: share approval gateway client setup
2026-03-10 22:18:04 +00:00
0ff184397d
docs(telegram): clarify group and sender allowlists ( #42451 )
...
Merged via squash.
Prepared head SHA: f30cacafb3
2026-03-10 21:56:30 +03:00
0687e04760
fix: thread runtime config through Discord/Telegram sends ( #42352 ) (thanks @joshavant) ( #42352 )
2026-03-10 13:30:57 -05:00
3b582f1d54
fix(telegram): chunk long html outbound messages ( #42240 )
...
Merged via squash.
Prepared head SHA: 4d79c41ddf
2026-03-10 22:53:04 +05:30
45b74fb56c
fix(telegram): move network fallback to resolver-scoped dispatchers ( #40740 )
...
Merged via squash.
Prepared head SHA: a4456d48b4
2026-03-10 11:28:51 +05:30
da4fec6641
fix(telegram): prevent duplicate messages when preview edit times out ( #41662 )
...
Merged via squash.
Prepared head SHA: 2780e62d07
2026-03-10 10:17:39 +05:30
de49a8b72c
Telegram: exec approvals for OpenCode/Codex ( #37233 )
...
Merged via squash.
Prepared head SHA: f243379094
2026-03-09 23:04:35 -04:00
7b88249c9e
fix(telegram): bridge direct delivery to internal message:sent hooks ( #40185 )
...
* telegram: bridge direct delivery message hooks
* telegram: align sent hooks with command session
2026-03-09 11:21:19 -07:00
1d301f74a6
refactor: extract telegram polling session
2026-03-09 06:18:07 +00:00
2d5e70f3e7
fix: abort telegram getupdates on shutdown ( #23950 ) (thanks @Gkinthecodeland)
2026-03-09 06:03:46 +00:00
6186f620d2
fix(telegram): use manual signal forwarding to avoid cross-realm AbortSignal
...
AbortSignal.any() fails in Node.js when signals come from different module
contexts (grammY's internal signal vs local AbortController), producing:
"The signals[0] argument must be an instance of AbortSignal. Received an
instance of AbortSignal".
Replace with manual event forwarding that works across all realms.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 06:03:46 +00:00
2767907abf
fix(telegram): abort in-flight getUpdates fetch on shutdown
...
When the gateway receives SIGTERM, runner.stop() stops the grammY polling
loop but does not abort the in-flight getUpdates HTTP request. That request
hangs for up to 30 seconds (the Telegram API timeout). If a new gateway
instance starts polling during that window, Telegram returns a 409 Conflict
error, causing message loss and requiring exponential backoff recovery.
This is especially problematic with service managers (launchd, systemd)
that restart the process immediately after SIGTERM.
Wire an AbortController into the fetch layer so every Telegram API request
(especially the long-polling getUpdates) aborts immediately on shutdown:
- bot.ts: Accept optional fetchAbortSignal in TelegramBotOptions; wrap
the grammY fetch with AbortSignal.any() to merge the shutdown signal.
- monitor.ts: Create a per-iteration AbortController, pass its signal to
createTelegramBot, and abort it from the SIGTERM handler, force-restart
path, and finally block.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-09 06:03:46 +00:00
4d501e4ccf
fix(telegram): add download timeout to prevent polling loop hang ( #40098 )
...
Merged via squash.
Prepared head SHA: abdfa1a35f
2026-03-09 08:29:21 +05:30
d4ab731746
fix(telegram): use message previews in DMs
2026-03-08 21:59:43 +05:30
e45fcc57ed
fix(telegram): restore DM draft streaming
2026-03-08 08:23:25 +05:30
9d7d961db8
fix: restore Telegram webhook-mode health after restarts
...
Landed from contributor PR #39313 by @fellanH.
Co-authored-by: Felix Hellström <30758862+fellanH@users.noreply.github.com>
2026-03-08 02:27:18 +00:00
c2e1ae68a9
refactor(telegram): split bot message context helpers
2026-03-08 02:16:03 +00:00
e7056272bc
refactor(telegram): centralize text parsing helpers
2026-03-08 02:16:03 +00:00
6a8081a7f3
refactor(routing): centralize inbound last-route policy
2026-03-08 02:16:03 +00:00
c22a4450ee
fix(telegram): honor commands.allowFrom in native command auth ( #39310 )
...
* telegram: honor commands.allowFrom in native auth
* test(telegram): cover native commands.allowFrom precedence
* changelog: note telegram native commands allowFrom fix
* Update CHANGELOG.md
* telegram: preserve group policy in native command auth
* test(telegram): keep commands.allowFrom under group gating
2026-03-07 17:28:47 -08:00
Robin Waslander
Val Alexander
Peter Steinberger
Ayaan Zaidi
Cypherm
Vincent Koc
Jacob Riff
avirweb
Ayaan Zaidi
Huang X
Tak Hoffman
Wayne
Altay
Josh Avant
Eugene
Harold Hunt
George Kalogirou
Tyson Cung