@diegoaltoworks/chatter 0.57.0 → 0.59.0

package/dist/channels/telegram/index.js

@@ -25,6 +25,9 @@ __export(index_exports, {
   TelegramApiError: () => TelegramApiError,
   createTelegramApi: () => createTelegramApi,
   createTelegramChannel: () => createTelegramChannel,
+  createTelegramSender: () => createTelegramSender,
+  createTelegramUpdateHandler: () => createTelegramUpdateHandler,
+  createTelegramWebhookRoute: () => createTelegramWebhookRoute,
   mentionsBot: () => mentionsBot,
   messageEntities: () => messageEntities,
   messageText: () => messageText,
@@ -188,6 +191,17 @@ function createTelegramApi(config) {
         message_id: messageId,
         reaction: [{ type: "emoji", emoji }]
       });
+    },
+    async setWebhook(url, options) {
+      await call("setWebhook", {
+        url,
+        // Only what this channel interprets — see the matching comment on getUpdates.
+        allowed_updates: ["message"],
+        ...options?.secretToken ? { secret_token: options.secretToken } : {}
+      });
+    },
+    async deleteWebhook() {
+      await call("deleteWebhook");
     }
   };
 }
@@ -208,56 +222,6 @@ function createConsoleLogger(level = "info") {
   };
 }
 
-// src/channels/gates.ts
-function matches(re, text) {
-  return new RegExp(re.source, re.flags.replace(/[gy]/g, "")).test(text);
-}
-function isBlockedByAllowlist(msg, config) {
-  return !msg.fromBot && msg.text.trim().length > 0 && !msg.isDirectMessage && config.allowedChats.length > 0 && !config.allowedChats.includes(msg.chatId);
-}
-function decideChannelAction(msg, config) {
-  if (msg.fromBot || !msg.text.trim()) return "ignore";
-  if (!msg.isDirectMessage) {
-    if (isBlockedByAllowlist(msg, config)) return "ignore";
-    if (config.muteRegex && matches(config.muteRegex, msg.text)) return "mute";
-    if (config.unmuteRegex && matches(config.unmuteRegex, msg.text)) return "unmute";
-    if (config.mutedChats.has(msg.chatId)) return "ignore";
-    return msg.mentionsBot || msg.isReplyToBot ? "reply" : "ignore";
-  }
-  return "reply";
-}
-function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
-  const log = /* @__PURE__ */ new Map();
-  let lastSweep = now();
-  function sweep(current) {
-    if (current - lastSweep < windowMs) return;
-    lastSweep = current;
-    const cutoff = current - windowMs;
-    for (const [key, entries] of log) {
-      if (!entries.some((t) => t > cutoff)) log.delete(key);
-    }
-  }
-  function allow(key) {
-    const current = now();
-    sweep(current);
-    const cutoff = current - windowMs;
-    const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
-    if (entries.length >= maxPerWindow) {
-      if (entries.length > 0) log.set(key, entries);
-      else log.delete(key);
-      return false;
-    }
-    entries.push(current);
-    log.set(key, entries);
-    return true;
-  }
-  allow.size = () => log.size;
-  return allow;
-}
-function underReplyRateLimit(msg, limiters) {
-  return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);
-}
-
 // src/core/guardrails.ts
 function detectLeakage(text) {
   const flags = [
@@ -429,6 +393,56 @@ ${ctx.join("\n\n")}`
   return { system, messages, context: ctx };
 }
 
+// src/channels/gates.ts
+function matches(re, text) {
+  return new RegExp(re.source, re.flags.replace(/[gy]/g, "")).test(text);
+}
+function isBlockedByAllowlist(msg, config) {
+  return !msg.fromBot && msg.text.trim().length > 0 && !msg.isDirectMessage && config.allowedChats.length > 0 && !config.allowedChats.includes(msg.chatId);
+}
+function decideChannelAction(msg, config) {
+  if (msg.fromBot || !msg.text.trim()) return "ignore";
+  if (!msg.isDirectMessage) {
+    if (isBlockedByAllowlist(msg, config)) return "ignore";
+    if (config.muteRegex && matches(config.muteRegex, msg.text)) return "mute";
+    if (config.unmuteRegex && matches(config.unmuteRegex, msg.text)) return "unmute";
+    if (config.mutedChats.has(msg.chatId)) return "ignore";
+    return msg.mentionsBot || msg.isReplyToBot ? "reply" : "ignore";
+  }
+  return "reply";
+}
+function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
+  const log = /* @__PURE__ */ new Map();
+  let lastSweep = now();
+  function sweep(current) {
+    if (current - lastSweep < windowMs) return;
+    lastSweep = current;
+    const cutoff = current - windowMs;
+    for (const [key, entries] of log) {
+      if (!entries.some((t) => t > cutoff)) log.delete(key);
+    }
+  }
+  function allow(key) {
+    const current = now();
+    sweep(current);
+    const cutoff = current - windowMs;
+    const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
+    if (entries.length >= maxPerWindow) {
+      if (entries.length > 0) log.set(key, entries);
+      else log.delete(key);
+      return false;
+    }
+    entries.push(current);
+    log.set(key, entries);
+    return true;
+  }
+  allow.size = () => log.size;
+  return allow;
+}
+function underReplyRateLimit(msg, limiters) {
+  return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);
+}
+
 // src/channels/pipeline.ts
 var DEFAULT_HISTORY_LIMIT = 20;
 var DEFAULT_GROUP_RATE_LIMIT = { max: 30, windowMs: 60 * 60 * 1e3 };
@@ -441,6 +455,16 @@ async function resolvePersonaLayer(config, ctx) {
     return void 0;
   }
 }
+async function isHistoryEnabled(config, sender) {
+  const predicate = config.history?.historyEnabledFor;
+  if (!predicate) return true;
+  try {
+    return await predicate(sender);
+  } catch (error) {
+    config.logger?.error("historyEnabledFor threw; disabling history for this turn", error);
+    return false;
+  }
+}
 function createInboundPipeline(deps, config) {
   const mutedChats = /* @__PURE__ */ new Set();
   const now = config.now ?? Date.now;
@@ -480,12 +504,15 @@ function createInboundPipeline(deps, config) {
     }
     const personaLayer = await resolvePersonaLayer(config, { sender, text: msg.text });
     const buckets = await resolveBuckets({ mode, sender, bucketsFor: config.bucketsFor });
-    const priorTurns = config.history ? await config.history.store.load(
+    const historyEnabled = config.history ? await isHistoryEnabled(config, sender) : false;
+    const priorTurns = config.history && historyEnabled ? await config.history.store.load(
       conversationId,
       config.history.limit ?? DEFAULT_HISTORY_LIMIT
     ) : [];
     const messages = [...priorTurns, { role: "user", content: msg.text }];
-    await config.history?.store.append(conversationId, { role: "user", content: msg.text });
+    if (historyEnabled) {
+      await config.history?.store.append(conversationId, { role: "user", content: msg.text });
+    }
     const { system } = await prepareChat({
       store: deps.store,
       prompts: deps.prompts,
@@ -517,7 +544,9 @@ function createInboundPipeline(deps, config) {
     if (!content) {
       return { action: "ignore" };
     }
-    await config.history?.store.append(conversationId, { role: "assistant", content });
+    if (historyEnabled) {
+      await config.history?.store.append(conversationId, { role: "assistant", content });
+    }
     await turn.reply.sendAnswer(msg.chatId, content);
     return { action: "reply", content };
   };
@@ -566,6 +595,41 @@ function telegramSenderKey(senderId) {
   return `tg:${senderId}`;
 }
 
+// src/channels/telegram/handler.ts
+function createTelegramUpdateHandler(deps) {
+  const { api, me, pipeline, allowedChats, logger, label } = deps;
+  const loggedUnallowedChats = /* @__PURE__ */ new Set();
+  return async function handleUpdate(update) {
+    const message = update.message;
+    const msg = toChannelMessage(update, me);
+    if (!msg || !message) return;
+    if (isBlockedByAllowlist(msg, { allowedChats })) {
+      if (!loggedUnallowedChats.has(msg.chatId)) {
+        loggedUnallowedChats.add(msg.chatId);
+        logger.warn(`${label}: skipped chat ${msg.chatId} - not in allowedChats`);
+      }
+    }
+    const reply = {
+      // Threaded onto the incoming message: in a busy group an untethered
+      // answer reads as a non-sequitur.
+      sendAnswer: (chatId, text) => api.sendMessage(chatId, text, { replyToMessageId: message.message_id }),
+      sendGateReply: (chatId, text) => api.sendMessage(chatId, text)
+    };
+    await pipeline(msg, {
+      reply,
+      conversationId: msg.chatId,
+      sender: telegramSenderKey(msg.senderId)
+    });
+  };
+}
+function createTelegramSender(api) {
+  return {
+    sendText: (chatId, text) => api.sendMessage(chatId, text),
+    sendMedia: (chatId, payload) => api.sendMedia(chatId, payload),
+    sendReaction: (chatId, messageRef, emoji) => api.setMessageReaction(chatId, Number(messageRef), emoji)
+  };
+}
+
 // src/channels/telegram/poll.ts
 var BASE_DELAY_MS = 1e3;
 var MAX_DELAY_MS = 6e4;
@@ -636,12 +700,7 @@ function createTelegramChannel(config) {
       });
       const me = await api.getMe();
       const label = `Telegram[${me.username ?? me.id}]`;
-      const sender = {
-        sendText: (chatId, text) => api.sendMessage(chatId, text),
-        sendMedia: (chatId, payload) => api.sendMedia(chatId, payload),
-        sendReaction: (chatId, messageRef, emoji) => api.setMessageReaction(chatId, Number(messageRef), emoji)
-      };
-      deps.senders.register(channelName, sender);
+      deps.senders.register(channelName, createTelegramSender(api));
       senders = deps.senders;
       registered = true;
       const pipeline = createInboundPipeline(
@@ -668,29 +727,14 @@ function createTelegramChannel(config) {
           logger: log
         }
       );
-      const loggedUnallowedChats = /* @__PURE__ */ new Set();
-      async function handleUpdate(update) {
-        const message = update.message;
-        const msg = toChannelMessage(update, me);
-        if (!msg || !message) return;
-        if (isBlockedByAllowlist(msg, { allowedChats })) {
-          if (!loggedUnallowedChats.has(msg.chatId)) {
-            loggedUnallowedChats.add(msg.chatId);
-            log.warn(`${label}: skipped chat ${msg.chatId} - not in allowedChats`);
-          }
-        }
-        const reply = {
-          // Threaded onto the incoming message: in a busy group an untethered
-          // answer reads as a non-sequitur.
-          sendAnswer: (chatId, text) => api.sendMessage(chatId, text, { replyToMessageId: message.message_id }),
-          sendGateReply: (chatId, text) => api.sendMessage(chatId, text)
-        };
-        await pipeline(msg, {
-          reply,
-          conversationId: msg.chatId,
-          sender: telegramSenderKey(msg.senderId)
-        });
-      }
+      const handleUpdate = createTelegramUpdateHandler({
+        api,
+        me,
+        pipeline,
+        allowedChats,
+        logger: log,
+        label
+      });
       abort = new AbortController();
       const signal = abort.signal;
       void runLongPoll({
@@ -715,6 +759,196 @@ function createTelegramChannel(config) {
     }
   };
 }
+
+// src/channels/telegram/webhook.ts
+var import_node_crypto = require("node:crypto");
+
+// node_modules/hono/dist/http-exception.js
+var HTTPException = class extends Error {
+  res;
+  status;
+  /**
+   * Creates an instance of `HTTPException`.
+   * @param status - HTTP status code for the exception. Defaults to 500.
+   * @param options - Additional options for the exception.
+   */
+  constructor(status = 500, options) {
+    super(options?.message, { cause: options?.cause });
+    this.res = options?.res;
+    this.status = status;
+  }
+  /**
+   * Returns the response object associated with the exception.
+   * If a response object is not provided, a new response is created with the error message and status code.
+   * @returns The response object.
+   */
+  getResponse() {
+    if (this.res) {
+      const newResponse = new Response(this.res.body, {
+        status: this.status,
+        headers: this.res.headers
+      });
+      return newResponse;
+    }
+    return new Response(this.message, {
+      status: this.status
+    });
+  }
+};
+
+// node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, {
+      status: 413
+    });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) {
+      return next();
+    }
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    const hasContentLength = c.req.raw.headers.has("content-length");
+    if (hasContentLength && !hasTransferEncoding) {
+      const contentLength = parseInt(c.req.raw.headers.get("content-length") || "0", 10);
+      return contentLength > maxSize ? onError(c) : next();
+    }
+    let size = 0;
+    const chunks = [];
+    const rawReader = c.req.raw.body.getReader();
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) {
+        break;
+      }
+      size += value.length;
+      if (size > maxSize) {
+        return onError(c);
+      }
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({
+        start(controller) {
+          for (const chunk of chunks) {
+            controller.enqueue(chunk);
+          }
+          controller.close();
+        }
+      }),
+      duplex: "half"
+    };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    return next();
+  };
+};
+
+// src/middleware/bodyLimit.ts
+var DEFAULT_MAX_REQUEST_BYTES = 262144;
+function chatBodyLimit(maxSize = DEFAULT_MAX_REQUEST_BYTES, toError = (message) => ({ error: message })) {
+  return bodyLimit({
+    maxSize,
+    onError: (c) => c.json(toError("Request body too large"), 413)
+  });
+}
+
+// src/channels/telegram/webhook.ts
+var SECRET_TOKEN_HEADER = "x-telegram-bot-api-secret-token";
+function secureCompare(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  return bufA.length === bufB.length && (0, import_node_crypto.timingSafeEqual)(bufA, bufB);
+}
+var SECRET_TOKEN_PATTERN = /^[A-Za-z0-9_-]{1,256}$/;
+function createTelegramWebhookRoute(config) {
+  const webhookSecret = config.webhookSecret;
+  if (!webhookSecret?.trim()) {
+    throw new Error("Telegram webhook requires webhookSecret (it fails closed without one)");
+  }
+  if (!SECRET_TOKEN_PATTERN.test(webhookSecret)) {
+    throw new Error(
+      "Telegram webhookSecret must match /^[A-Za-z0-9_-]{1,256}$/ (Telegram's own secret_token charset)"
+    );
+  }
+  const channelName = config.name ?? "telegram";
+  const allowedChats = config.allowedChats ?? [];
+  const path = config.path ?? "/webhooks/telegram";
+  return async (app, deps) => {
+    const log = config.logger ?? deps.logger ?? createConsoleLogger();
+    const api = config.api ?? createTelegramApi({
+      botToken: config.botToken,
+      fetch: config.fetch,
+      baseUrl: config.apiBaseUrl
+    });
+    const me = await api.getMe();
+    const label = `Telegram[${me.username ?? me.id}] (webhook)`;
+    deps.senders.register(channelName, createTelegramSender(api));
+    const pipeline = createInboundPipeline(
+      { client: deps.client, store: deps.store, prompts: deps.prompts },
+      {
+        channel: channelName,
+        answerFn: config.answerFn ?? deps.config.answerFn,
+        bucketsFor: config.bucketsFor ?? deps.config.bucketsFor,
+        rewriteQuery: config.rewriteQuery ?? deps.config.rewriteQuery,
+        rerankContext: config.rerankContext ?? deps.config.rerankContext,
+        transformReply: config.transformReply ?? deps.config.transformReply,
+        model: config.model,
+        channelHint: config.channelHint ?? "Channel: Telegram.",
+        personaResolver: config.personaResolver,
+        history: config.history,
+        allowedChats,
+        muteRegex: config.muteRegex,
+        unmuteRegex: config.unmuteRegex,
+        muteReply: config.muteReply,
+        unmuteReply: config.unmuteReply,
+        dmRateLimit: config.dmRateLimit,
+        groupRateLimit: config.groupRateLimit,
+        now: config.now,
+        logger: log
+      }
+    );
+    const handleUpdate = createTelegramUpdateHandler({
+      api,
+      me,
+      pipeline,
+      allowedChats,
+      logger: log,
+      label
+    });
+    app.post(
+      path,
+      chatBodyLimit(deps.config.server?.maxRequestBytes),
+      // Reject oversized bodies first
+      async (c) => {
+        const provided = c.req.header(SECRET_TOKEN_HEADER);
+        if (!provided || !secureCompare(provided, webhookSecret)) {
+          log.warn(`${label}: rejected webhook POST - missing or invalid secret token`);
+          return c.text("", 403);
+        }
+        let body;
+        try {
+          body = await c.req.json();
+        } catch {
+          return c.text("", 400);
+        }
+        if (typeof body !== "object" || body === null) {
+          return c.text("", 400);
+        }
+        const update = body;
+        try {
+          await handleUpdate(update);
+        } catch (error) {
+          log.warn(`${label}: update handling failed:`, error);
+        }
+        return c.text("", 200);
+      }
+    );
+    log.info(`${label}: webhook mounted at ${path} as @${me.username ?? me.id}`);
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   TELEGRAM_API_BASE,
@@ -722,6 +956,9 @@ function createTelegramChannel(config) {
   TelegramApiError,
   createTelegramApi,
   createTelegramChannel,
+  createTelegramSender,
+  createTelegramUpdateHandler,
+  createTelegramWebhookRoute,
   mentionsBot,
   messageEntities,
   messageText,