@aitne/daemon 0.1.7 → 0.1.9

package/dist/adapters/slack-adapter.js

@@ -2,7 +2,18 @@ import { Readable } from "node:stream";
 import { readFileSync } from "node:fs";
 import { EventPriority, createEvent } from "@aitne/shared";
 import { createLogger } from "../logging.js";
+import { splitOutboundText } from "./outbound-text.js";
 const SLACK_INBOUND_MAX_BYTES = 25 * 1024 * 1024; // practical cap: 25 MB
+// Slack's chat.postMessage rejects payloads above 40,000 characters
+// (`msg_too_long`); split outbound text into 40k-char chunks. Keep a
+// small safety margin so format markers ("*bold*", etc.) added by Slack
+// rendering don't push us over.
+const SLACK_OUTBOUND_MAX_CHARS = 39_000;
+// All outbound Slack file-IO operations (auth.test, upload PUT, download
+// GET) need a hard wall-clock cap. Without it a hung CDN / proxy stalls
+// the adapter's message handler indefinitely. 30s is generous enough for
+// 25 MB attachments over slow links while still bounded.
+const SLACK_HTTP_TIMEOUT_MS = 30_000;
 const logger = createLogger("slack-adapter");
 /**
  * SlackAdapter — @slack/bolt Socket Mode integration.
@@ -10,8 +21,8 @@ const logger = createLogger("slack-adapter");
  * Listens for DMs and @mentions via Slack's Socket Mode (WebSocket).
  * Converts Slack events to MessageEvents and pushes them into the EventBus.
  *
- * Phase 3 — challenge-based pairing: an inbound DM only promotes its
- * sender to owner if the daemon has registered a {@link SlackPairingChallenge}
+ * Pairing is challenge-based: an inbound DM only promotes its sender to
+ * owner if the daemon has registered a {@link SlackPairingChallenge}
  * AND the message text satisfies the matcher. Otherwise the strict
  * owner-id filter applies and the message is dropped.
  */
@@ -22,7 +33,6 @@ export class SlackAdapter {
     mutableOwnerId;
     onMessage;
     onOwnerDetected;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     app = null;
     botUserId = null;
     botInfo = null;
@@ -46,6 +56,24 @@ export class SlackAdapter {
     startPairing(challenge) {
         this.pairingChallenge = challenge;
         logger.info({ ttlMs: challenge.expiresAt - Date.now() }, "slack pairing challenge registered");
+        // Schedule the matcher closure for active cleanup at TTL. The
+        // matcher itself short-circuits past the TTL via `isPairingActive`
+        // (security intact), but without this timer the closure (and any
+        // captured magic-phrase normalization buffer) sticks around in memory
+        // forever when the pairing window simply expires with no inbound DM.
+        // `.unref()` so the timer never blocks daemon shutdown; the
+        // `pairingChallenge === challenge` guard means a successful pairing
+        // (which nulls the field) or an explicit `cancelPairing()` between
+        // now and TTL leaves the slot alone.
+        const ttlMs = Math.max(0, challenge.expiresAt - Date.now());
+        const sweep = setTimeout(() => {
+            if (this.pairingChallenge === challenge) {
+                this.pairingChallenge = null;
+                logger.debug("slack pairing challenge expired (TTL sweep)");
+            }
+        }, ttlMs);
+        if (typeof sweep.unref === "function")
+            sweep.unref();
     }
     cancelPairing() {
         this.pairingChallenge = null;
@@ -69,6 +97,7 @@ export class SlackAdapter {
                 Authorization: `Bearer ${botToken}`,
                 "Content-Type": "application/x-www-form-urlencoded",
             },
+            signal: AbortSignal.timeout(SLACK_HTTP_TIMEOUT_MS),
         });
         if (!res.ok) {
             throw new Error(`Slack auth.test HTTP error: ${res.status}`);
@@ -86,10 +115,9 @@ export class SlackAdapter {
     }
     async start() {
         // Dynamic import — @slack/bolt is an optional dependency
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         let bolt;
         try {
-            bolt = await import("@slack/bolt");
+            bolt = (await import("@slack/bolt"));
         }
         catch {
             throw new Error("@slack/bolt not installed. Run: pnpm --filter @aitne/daemon add @slack/bolt");
@@ -109,11 +137,14 @@ export class SlackAdapter {
             const authResult = await this.app.client.auth.test({ token: this.botToken });
             this.botUserId = authResult.user_id ?? null;
         }
-        // Listen for all messages (filter in handler)
-        this.app.message(
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        async ({ message, say: _say }) => {
-            this.handleMessage(message);
+        // Listen for all messages (filter in handler). `handleMessage` is
+        // async because the pairing branch must await `onOwnerDetected` so the
+        // env/DB write completes before we acknowledge the pairing — see
+        // captureOwner. Bolt's `app.message` handler accepts async callbacks
+        // and surfaces unhandled rejections; awaiting here also lets Bolt's
+        // own error middleware see exceptions thrown downstream.
+        this.app.message(async ({ message }) => {
+            await this.handleMessage(message);
         });
         await this.app.start();
         logger.info({ botUserId: this.botUserId }, "Slack adapter connected (Socket Mode)");
@@ -139,15 +170,22 @@ export class SlackAdapter {
             throw new Error("Slack app not started");
         }
         if (!params.attachments?.length) {
-            // Text only — existing behaviour.
+            // Text only — split into 40k-char chunks so Slack doesn't reject the
+            // payload with `msg_too_long`. The vast majority of replies fit in
+            // a single chunk; the loop is a no-op then.
+            const chunks = splitOutboundText(params.text, SLACK_OUTBOUND_MAX_CHARS);
+            let lastTs;
             try {
-                const result = await this.app.client.chat.postMessage({
-                    token: this.botToken,
-                    channel: params.channel,
-                    text: params.text,
-                    thread_ts: params.threadId ?? undefined,
-                });
-                return { messageId: result.ts ?? undefined };
+                for (const chunk of chunks) {
+                    const result = await this.app.client.chat.postMessage({
+                        token: this.botToken,
+                        channel: params.channel,
+                        text: chunk,
+                        thread_ts: params.threadId ?? undefined,
+                    });
+                    lastTs = result.ts ?? lastTs;
+                }
+                return { messageId: lastTs };
             }
             catch (err) {
                 logger.error({ err, channel: params.channel }, "Failed to send Slack message");
@@ -180,6 +218,7 @@ export class SlackAdapter {
                     method: "PUT",
                     body: buf,
                     headers: { "Content-Type": att.mimeType },
+                    signal: AbortSignal.timeout(SLACK_HTTP_TIMEOUT_MS),
                 });
                 // Step 3: Complete (send to channel)
                 const completeResp = await this.app.client.files.completeUploadExternal({
@@ -200,11 +239,22 @@ export class SlackAdapter {
         }
         return { messageId: lastTs };
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    handleMessage(message) {
+    async handleMessage(message) {
         // Ignore bot messages and message_changed/deleted subtypes
         if (message.bot_id || message.subtype)
             return;
+        // Reject multi-person IMs (mpim) outright — CLAUDE.md single-owner
+        // invariant: group chats and multi-user channels are out of scope by
+        // design. The earlier `isDm` check passed only "im", but a bot
+        // @-mention inside an "mpim" would have leaked through the
+        // `isMention` branch and emitted agent replies into a channel
+        // visible to non-owners. `channel_type` for mpim is "mpim"; private
+        // channels are "group"; public channels are "channel" — none of
+        // which are a single-owner DM. Only "im" is.
+        if (message.channel_type === "mpim") {
+            logger.debug({ channel: message.channel }, "slack message dropped: multi-person IM rejected");
+            return;
+        }
         const isDm = message.channel_type === "im";
         const isMention = !isDm &&
             this.botUserId !== null &&
@@ -218,17 +268,47 @@ export class SlackAdapter {
         // ownership, and only if the text satisfies the registered matcher.
         // No "first DM wins" fallback — without an active challenge, an
         // unrecognised sender is dropped.
-        if (isDm
-            && this.isPairingActive()
-            && this.pairingChallenge.match(text)) {
-            logger.info({ senderId }, "slack pairing challenge matched");
-            this.captureOwner(senderId);
-            this.cancelPairing();
-            // Do NOT fall through — the captured payload IS the magic phrase,
-            // not a real user message. recordDetectedOwner sends the welcome
-            // DM; emitting this to the EventBus would burn an agent inference
-            // on the phrase itself.
-            return;
+        if (isDm && this.isPairingActive()) {
+            const challenge = this.pairingChallenge;
+            if (challenge.match(text)) {
+                logger.info({ senderId }, "slack pairing challenge matched");
+                // Await `captureOwner` so the env/DB write inside
+                // `onOwnerDetected` completes before we acknowledge pairing.
+                // `cancelPairing()` only fires on success — if the callback
+                // throws (e.g. .env unwritable), the matcher stays armed so the
+                // user can retry by resending the phrase.
+                const ok = await this.captureOwner(senderId);
+                if (ok) {
+                    this.cancelPairing();
+                }
+                // Do NOT fall through — the captured payload IS the magic phrase,
+                // not a real user message. recordDetectedOwner sends the welcome
+                // DM; emitting this to the EventBus would burn an agent inference
+                // on the phrase itself.
+                return;
+            }
+            // Matcher rejected but the input may be a wrapped magic
+            // phrase. Send a hint so the legitimate user can correct rather
+            // than getting silence indistinguishable from an attacker's wrong
+            // guess. Best-effort: a send failure is logged but never bubbles.
+            const hint = challenge.hintReply?.(text);
+            if (hint) {
+                try {
+                    // `this.app` is guaranteed non-null here: Bolt only fires the
+                    // message handler after `await this.app.start()` returns. The `!`
+                    // preserves the original throw-and-log behaviour if invariants
+                    // ever change, rather than silently dropping the hint reply.
+                    await this.app.client.chat.postMessage({
+                        token: this.botToken,
+                        channel: message.channel ?? "",
+                        text: hint,
+                    });
+                }
+                catch (err) {
+                    logger.warn({ err, channel: message.channel }, "slack pairing hint reply failed");
+                }
+                return;
+            }
         }
         if (!this.mutableOwnerId || senderId !== this.mutableOwnerId) {
             logger.debug({ senderId, channel: message.channel }, "slack message dropped: unauthorized sender");
@@ -239,18 +319,12 @@ export class SlackAdapter {
         // is synchronous and returns immediately.
         const files = Array.isArray(message.files) ? message.files : [];
         if (files.length > 0 && this.attachmentStore) {
-            void this.downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, 
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            files).catch((err) => logger.error({ err }, "slack attachment handler threw"));
+            void this.downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, files).catch((err) => logger.error({ err }, "slack attachment handler threw"));
             return;
         }
         this.emitSlackEvent(message, senderId, text, isDm, isMention, []);
     }
-    async downloadAndEmitSlackMessage(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    message, senderId, text, isDm, isMention, 
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    files) {
+    async downloadAndEmitSlackMessage(message, senderId, text, isDm, isMention, files) {
         const attachmentRefs = [];
         for (const file of files) {
             if (!file || typeof file !== "object")
@@ -279,13 +353,13 @@ export class SlackAdapter {
                 continue;
             }
             // Prefer url_private_download (includes Content-Disposition header)
-            const downloadUrl = resolvedFile.url_private_download
-                ?? resolvedFile.url_private;
+            const downloadUrl = resolvedFile.url_private_download ?? resolvedFile.url_private;
             if (!downloadUrl)
                 continue;
             try {
                 const res = await fetch(downloadUrl, {
                     headers: { Authorization: `Bearer ${this.botToken}` },
+                    signal: AbortSignal.timeout(SLACK_HTTP_TIMEOUT_MS),
                 });
                 if (!res.ok) {
                     logger.warn({ status: res.status, filename: file.name }, "slack file download failed");
@@ -314,9 +388,7 @@ export class SlackAdapter {
         }
         this.emitSlackEvent(message, senderId, text, isDm, isMention, attachmentRefs);
     }
-    emitSlackEvent(
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    message, senderId, text, isDm, isMention, attachments) {
+    emitSlackEvent(message, senderId, text, isDm, isMention, attachments) {
         const event = createEvent({
             type: "message.received",
             source: "slack",
@@ -339,21 +411,37 @@ export class SlackAdapter {
         });
         this.onMessage(event);
     }
-    captureOwner(userId) {
+    /**
+     * Atomically promote a user ID to "owner" and notify the daemon.
+     *
+     * We set `mutableOwnerId` BEFORE awaiting the callback because
+     * `recordDetectedOwner` (in index.ts) immediately sends a "pairing
+     * successful" DM via `messageHub.sendToPlatform(platform, "user", ...)`,
+     * which resolves through `resolveUserChannel()` and reads
+     * `this.mutableOwnerId`. If we set it after the callback, the welcome
+     * DM would have no owner to address.
+     *
+     * If the callback throws (env-write failed, etc.) we ROLL BACK
+     * `mutableOwnerId` to its previous value so the adapter doesn't claim
+     * a pairing that didn't actually persist — otherwise the next daemon
+     * restart would lose the binding and the user would think the pair
+     * succeeded. Returns `true` on success so the caller can decide
+     * whether to `cancelPairing()` (success) or keep the matcher armed
+     * for retry (failure).
+     */
+    async captureOwner(userId) {
+        const previousOwnerId = this.mutableOwnerId;
         this.mutableOwnerId = userId;
-        if (this.onOwnerDetected) {
-            try {
-                const maybe = this.onOwnerDetected(userId);
-                if (maybe && typeof maybe.then === "function") {
-                    maybe.catch((err) => {
-                        logger.error({ err }, "slack onOwnerDetected callback failed");
-                    });
-                }
-            }
-            catch (err) {
-                logger.error({ err }, "slack onOwnerDetected callback threw");
-            }
+        if (!this.onOwnerDetected)
+            return true;
+        try {
+            await this.onOwnerDetected(userId);
+            return true;
+        }
+        catch (err) {
+            this.mutableOwnerId = previousOwnerId;
+            logger.error({ err, userId }, "slack onOwnerDetected callback failed; pairing rolled back");
+            return false;
         }
     }
 }
-//# sourceMappingURL=slack-adapter.js.map

package/dist/adapters/telegram-adapter.d.ts

@@ -15,8 +15,8 @@ export interface TelegramAdapterOptions {
      * applyConfigUpdates so the next restart still has the right owner.
      */
     onOwnerDetected?: (chatId: string) => void | Promise<void>;
-    /** Phase 2: canonical attachment store for inbound media download/ingest
-     *  and outbound file delivery. When absent, media is silently skipped. */
+    /** Canonical attachment store for inbound media download/ingest and
+     *  outbound file delivery. When absent, media is silently skipped. */
     attachmentStore?: AttachmentStore;
 }
 /**
@@ -43,10 +43,8 @@ export interface PairingChallenge {
  * Group / supergroup traffic is intentionally ignored. This adapter is for
  * owner DMs only; Telegram group mentions are out of scope.
  *
- * Phase 3 — challenge-based pairing only.
- *
- * The adapter no longer has a "first DM wins" discovery mode. Pairing now
- * requires that the daemon register a {@link PairingChallenge} via
+ * Pairing is challenge-based: the daemon must register a
+ * {@link PairingChallenge} via
  * `startPairing()`; only inbound messages whose text passes the matcher
  * (e.g. `/start <random-token>` for QR pairing) capture the owner. This
  * closes the race where any unrelated DM during a 5-minute window could
@@ -101,7 +99,12 @@ export declare class TelegramAdapter implements MessageAdapter {
     private emitTextEvent;
     private pickLargestPhoto;
     private photoSizeBytes;
-    /** Atomically promote a chat ID to "owner" and notify the daemon. */
+    /**
+     * Atomically promote a chat ID to "owner" and notify the daemon. See
+     * slack-adapter.captureOwner for the full rationale — the env/DB
+     * write must complete before we acknowledge pairing, and
+     * mutableOwnerId rolls back if the callback throws so a daemon restart
+     * doesn't silently lose the binding.
+     */
     private captureOwner;
 }
-//# sourceMappingURL=telegram-adapter.d.ts.map

package/dist/adapters/telegram-adapter.js

@@ -8,6 +8,11 @@ const TELEGRAM_INBOUND_MAX_BYTES = 20 * 1024 * 1024; // 20 MB Telegram bot downl
 const TELEGRAM_CAPTION_MAX_CHARS = 1024;
 const TELEGRAM_MESSAGE_MAX_CHARS = 4096;
 const MEDIA_GROUP_DEBOUNCE_MS = 400;
+// Hard wall-clock cap on Telegram REST fetches (getMe, file download).
+// Without it a hung CDN stalls the inbound message handler forever and
+// the media-group flush timer never fires. 30s is generous for 20 MB
+// attachments over slow links.
+const TELEGRAM_HTTP_TIMEOUT_MS = 30_000;
 /**
  * TelegramAdapter — telegraf Long Polling integration.
  *
@@ -16,10 +21,8 @@ const MEDIA_GROUP_DEBOUNCE_MS = 400;
  * Group / supergroup traffic is intentionally ignored. This adapter is for
  * owner DMs only; Telegram group mentions are out of scope.
  *
- * Phase 3 — challenge-based pairing only.
- *
- * The adapter no longer has a "first DM wins" discovery mode. Pairing now
- * requires that the daemon register a {@link PairingChallenge} via
+ * Pairing is challenge-based: the daemon must register a
+ * {@link PairingChallenge} via
  * `startPairing()`; only inbound messages whose text passes the matcher
  * (e.g. `/start <random-token>` for QR pairing) capture the owner. This
  * closes the race where any unrelated DM during a 5-minute window could
@@ -32,7 +35,6 @@ export class TelegramAdapter {
     onMessage;
     onOwnerDetected;
     attachmentStore;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     bot = null;
     botInfo = null;
     /** Active pairing challenge (null when pairing isn't in progress). */
@@ -61,6 +63,16 @@ export class TelegramAdapter {
     startPairing(challenge) {
         this.pairingChallenge = challenge;
         logger.info({ ttlMs: challenge.expiresAt - Date.now() }, "telegram pairing challenge registered");
+        // TTL sweep — see SlackAdapter.startPairing for rationale.
+        const ttlMs = Math.max(0, challenge.expiresAt - Date.now());
+        const sweep = setTimeout(() => {
+            if (this.pairingChallenge === challenge) {
+                this.pairingChallenge = null;
+                logger.debug("telegram pairing challenge expired (TTL sweep)");
+            }
+        }, ttlMs);
+        if (typeof sweep.unref === "function")
+            sweep.unref();
     }
     cancelPairing() {
         this.pairingChallenge = null;
@@ -79,7 +91,9 @@ export class TelegramAdapter {
      */
     static async fetchBotInfo(botToken) {
         const url = `https://api.telegram.org/bot${botToken}/getMe`;
-        const res = await fetch(url);
+        const res = await fetch(url, {
+            signal: AbortSignal.timeout(TELEGRAM_HTTP_TIMEOUT_MS),
+        });
         if (!res.ok) {
             throw new Error(`Telegram getMe failed: ${res.status} ${res.statusText}`);
         }
@@ -96,16 +110,15 @@ export class TelegramAdapter {
     // ── Adapter lifecycle ──────────────────────────────────────────────────
     async start() {
         // Dynamic import — telegraf is an optional dependency
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        let Telegraf;
+        let TelegrafCtor;
         try {
-            const mod = await import("telegraf");
-            Telegraf = mod.Telegraf;
+            const mod = (await import("telegraf"));
+            TelegrafCtor = mod.Telegraf;
         }
         catch {
             throw new Error("telegraf not installed. Run: pnpm --filter @aitne/daemon add telegraf");
         }
-        this.bot = new Telegraf(this.botToken);
+        this.bot = new TelegrafCtor(this.botToken);
         // Validate token + cache bot identity for the dashboard's QR deep link.
         try {
             this.botInfo = await TelegramAdapter.fetchBotInfo(this.botToken);
@@ -113,11 +126,9 @@ export class TelegramAdapter {
         catch (err) {
             logger.warn({ err }, "telegram getMe failed during start");
         }
-        // Generic message handler — covers text, photo, document, audio, voice,
-        // video, etc. The Phase 1 text-only handler is replaced here so that
-        // media-with-caption messages (which do NOT fire the "text" event) are
-        // also captured.
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        // Subscribe to `message`, not `text` — media-with-caption messages
+        // don't fire `text` but do carry user content via `caption`, and a
+        // text-only handler would silently drop them.
         this.bot.on("message", async (ctx) => {
             await this.handleMessage(ctx).catch((err) => {
                 logger.error({ err }, "telegram message handler threw");
@@ -147,7 +158,9 @@ export class TelegramAdapter {
             throw new Error("Telegram bot not started");
         }
         const { channel, text, threadId, attachments } = params;
-        const replyOpts = threadId ? { reply_to_message_id: Number(threadId) } : {};
+        const replyOpts = threadId
+            ? { reply_parameters: { message_id: Number(threadId) } }
+            : {};
         if (!attachments?.length) {
             // Text only — existing behaviour.
             try {
@@ -185,7 +198,6 @@ export class TelegramAdapter {
             isFirst = false;
             try {
                 const buf = readFileSync(att.path);
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
                 let result;
                 if (att.mimeType.startsWith("image/")) {
                     result = await this.bot.telegram.sendPhoto(channel, { source: buf }, caption ? { caption, ...replyOpts } : replyOpts);
@@ -203,7 +215,6 @@ export class TelegramAdapter {
         return { messageId: lastMessageId };
     }
     // ── Inbound message handling ───────────────────────────────────────────
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     async handleMessage(ctx) {
         const msg = ctx.message;
         if (!msg)
@@ -224,8 +235,15 @@ export class TelegramAdapter {
         // `msg.text` is set only on text-only messages; `msg.photo` etc. use `caption`.
         if (msg.text && this.isPairingActive() && this.pairingChallenge.match(textContent)) {
             logger.info({ channelId }, "telegram pairing challenge matched");
-            this.captureOwner(channelId);
-            this.cancelPairing();
+            // Await captureOwner so the env/DB write inside onOwnerDetected
+            // completes before pairing is acknowledged. cancelPairing only
+            // fires on success — if the callback throws (e.g. .env unwritable)
+            // the matcher stays armed so the user can retry by resending the
+            // phrase.
+            const ok = await this.captureOwner(channelId);
+            if (ok) {
+                this.cancelPairing();
+            }
             return;
         }
         // Strict owner filter.
@@ -369,9 +387,10 @@ export class TelegramAdapter {
             logger.warn({ fileId, fileSizeBytes, maxBytes }, "telegram file exceeds size cap, skipping");
             return null;
         }
+        if (!this.bot)
+            return null;
         let filePath;
         try {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             const fileInfo = await this.bot.telegram.getFile(fileId);
             filePath = fileInfo?.file_path;
         }
@@ -384,7 +403,9 @@ export class TelegramAdapter {
         const url = `https://api.telegram.org/file/bot${this.botToken}/${filePath}`;
         let buf;
         try {
-            const res = await fetch(url);
+            const res = await fetch(url, {
+                signal: AbortSignal.timeout(TELEGRAM_HTTP_TIMEOUT_MS),
+            });
             if (!res.ok)
                 throw new Error(`HTTP ${res.status} fetching telegram file`);
             buf = Buffer.from(await res.arrayBuffer());
@@ -440,38 +461,38 @@ export class TelegramAdapter {
         this.onMessage(event);
     }
     // ── Photo helpers ─────────────────────────────────────────────────────
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     pickLargestPhoto(photos) {
         if (!Array.isArray(photos) || photos.length === 0)
             return "";
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const largest = [...photos].sort((a, b) => (b.file_size ?? 0) - (a.file_size ?? 0))[0];
         return largest?.file_id ?? "";
     }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     photoSizeBytes(photos) {
         if (!Array.isArray(photos) || photos.length === 0)
             return 0;
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const largest = [...photos].sort((a, b) => (b.file_size ?? 0) - (a.file_size ?? 0))[0];
         return largest?.file_size ?? 0;
     }
-    /** Atomically promote a chat ID to "owner" and notify the daemon. */
-    captureOwner(chatId) {
+    /**
+     * Atomically promote a chat ID to "owner" and notify the daemon. See
+     * slack-adapter.captureOwner for the full rationale — the env/DB
+     * write must complete before we acknowledge pairing, and
+     * mutableOwnerId rolls back if the callback throws so a daemon restart
+     * doesn't silently lose the binding.
+     */
+    async captureOwner(chatId) {
+        const previousOwnerId = this.mutableOwnerId;
         this.mutableOwnerId = chatId;
-        if (this.onOwnerDetected) {
-            try {
-                const maybe = this.onOwnerDetected(chatId);
-                if (maybe && typeof maybe.then === "function") {
-                    maybe.catch((err) => {
-                        logger.error({ err }, "telegram onOwnerDetected callback failed");
-                    });
-                }
-            }
-            catch (err) {
-                logger.error({ err }, "telegram onOwnerDetected callback threw");
-            }
+        if (!this.onOwnerDetected)
+            return true;
+        try {
+            await this.onOwnerDetected(chatId);
+            return true;
+        }
+        catch (err) {
+            this.mutableOwnerId = previousOwnerId;
+            logger.error({ err, chatId }, "telegram onOwnerDetected callback failed; pairing rolled back");
+            return false;
         }
     }
 }
-//# sourceMappingURL=telegram-adapter.js.map

package/dist/adapters/types.d.ts

@@ -5,8 +5,8 @@ interface SendMessageResult {
 /**
  * Outbound attachment reference — handed to an adapter's `sendMessage` when
  * the agent has generated one or more files during the turn. Each platform
- * adapter translates this into its native upload flow. Phase 1 only wires
- * the Dashboard adapter; other adapters ignore the field until Phase 2.
+ * adapter translates this into its native upload flow. Adapters that have
+ * not yet implemented attachment delivery ignore this field.
  */
 export interface OutboundAttachmentRef {
     id: string;
@@ -61,7 +61,7 @@ export interface MessageAdapter {
         threadId?: string;
         /** Outbound files produced by the agent during this turn. Adapters
          *  that have not yet implemented attachment delivery ignore this
-         *  field; Phase 1 wires only the Dashboard adapter. */
+         *  field. */
         attachments?: OutboundAttachmentRef[];
     }): Promise<SendMessageResult | void>;
     /**
@@ -89,4 +89,3 @@ export interface MessageAdapter {
  */
 export type OnMessageCallback = (event: Event) => void;
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/adapters/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map