@goodandready/dsh-messenger-gateway 0.3.10 → 0.3.11

package/lib/adapters/telegram.js

@@ -69,8 +69,12 @@ export class TelegramAdapter {
   }
 
   async call(method, params = {}) {
+    const timeoutMs = (this.timeoutSeconds * 1000) + 15000
     const res = await fetch(`${API}/bot${this.token}/${method}`, {
-      method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(params),
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(params),
+      signal: AbortSignal.timeout(timeoutMs),
     })
     const json = await res.json().catch(() => ({}))
     if (!res.ok || json.ok === false) throw new Error(`telegram ${method}: ${json.description || res.status}`)
@@ -78,7 +82,12 @@ export class TelegramAdapter {
   }
 
   async callMultipart(method, form) {
-    const res = await fetch(`${API}/bot${this.token}/${method}`, { method: 'POST', body: form })
+    const timeoutMs = (this.timeoutSeconds * 1000) + 30000
+    const res = await fetch(`${API}/bot${this.token}/${method}`, {
+      method: 'POST',
+      body: form,
+      signal: AbortSignal.timeout(timeoutMs),
+    })
     const json = await res.json().catch(() => ({}))
     if (!res.ok || json.ok === false) throw new Error(`telegram ${method}: ${json.description || res.status}`)
     return json.result
@@ -105,7 +114,10 @@ export class TelegramAdapter {
   async getFile(fileId) { return this.call('getFile', { file_id: fileId }) }
 
   async downloadFile(filePath) {
-    const res = await fetch(`${API}/file/bot${this.token}/${filePath}`)
+    const timeoutMs = (this.timeoutSeconds * 1000) + 30000
+    const res = await fetch(`${API}/file/bot${this.token}/${filePath}`, {
+      signal: AbortSignal.timeout(timeoutMs),
+    })
     if (!res.ok) throw new Error(`telegram download HTTP ${res.status}`)
     return new Uint8Array(await res.arrayBuffer())
   }
@@ -203,6 +215,15 @@ export class TelegramAdapter {
 
   async dispatchUpdate(update) {
     if (update.callback_query) {
+      const fromId = update.callback_query.from?.id
+      if (fromId && !this.allowed(fromId)) {
+        await this.call('answerCallbackQuery', {
+          callback_query_id: update.callback_query.id,
+          text: 'Нет доступа',
+          show_alert: true,
+        }).catch(() => {})
+        return
+      }
       try { await this.onCallback?.(this.wrapCallback(update.callback_query)) } catch (e) {
         this.logger?.warn?.(`callback: ${e.message}`)
       }
@@ -489,7 +510,8 @@ export class TelegramAdapter {
     if (thread.message_thread_id) form.append('message_thread_id', String(thread.message_thread_id))
     const blob = new Blob([file.bytes])
     const name = safeName(file.name || 'file')
-    if (file.kind === 'photo') { form.append('photo', blob, name); return this.sendWithRetry('sendPhoto', form, { multipart: true }) }
+    const isSvg = file.mime === 'image/svg+xml' || (file.name && file.name.toLowerCase().endsWith('.svg'))
+    if (file.kind === 'photo' && !isSvg) { form.append('photo', blob, name); return this.sendWithRetry('sendPhoto', form, { multipart: true }) }
     if (file.kind === 'voice') { form.append('voice', blob, name); return this.sendWithRetry('sendVoice', form, { multipart: true }) }
     if (file.kind === 'audio') { form.append('audio', blob, name); return this.sendWithRetry('sendAudio', form, { multipart: true }) }
     if (file.kind === 'video') { form.append('video', blob, name); return this.sendWithRetry('sendVideo', form, { multipart: true }) }

package/lib/artifacts.js

@@ -102,7 +102,7 @@ export function processDiagramsAndTables(rawText, options = {}) {
         files.push({
           name: `diagram-${diagramIndex}.svg`,
           mime: 'image/svg+xml',
-          kind: 'photo',
+          kind: 'document',
           dataBase64: base64,
           bytes: Buffer.from(svgContent, 'utf-8'),
         })

package/lib/file-manager.js

@@ -1,5 +1,5 @@
 import { readdir, stat, readFile } from 'node:fs/promises'
-import { resolve, normalize, relative, join, extname } from 'node:path'
+import { resolve, normalize, relative, join, extname, isAbsolute } from 'node:path'
 
 export function formatFileSize(bytes) {
   if (!Number.isFinite(bytes) || bytes <= 0) return '0 B'
@@ -14,8 +14,9 @@ export function resolveSafePath(baseCwd, userPath = '.') {
   const cleanUser = String(userPath || '').trim() || '.'
   const target = resolve(base, cleanUser)
 
+  const isDrivePath = /^[a-zA-Z]:/.test(cleanUser)
   const rel = relative(base, target)
-  if (rel.startsWith('..') || (rel && resolve(base, rel) !== target)) {
+  if (isAbsolute(cleanUser) || isDrivePath || rel.startsWith('..') || isAbsolute(rel) || (rel && resolve(base, rel) !== target)) {
     const err = new Error('Access denied: path traversal out of workspace')
     err.code = 'ERR_PATH_TRAVERSAL'
     throw err

package/lib/gateway.js

@@ -296,6 +296,10 @@ export class Gateway {
   }
 
   async handleCallback(cb) {
+    if (cb.userId && !this.isUserAllowed(cb.userId)) {
+      try { await cb.answer('Нет доступа.') } catch {}
+      return
+    }
     const indexed = this.callbackIndex.get(cb.data)
     const { token, buttonId } = parseCallbackData(cb.data)
     const askToken = indexed || token
@@ -368,7 +372,7 @@ export class Gateway {
       const sub = parts[1]
       // Step 2: Selected provider -> show its models (10 per page)
       if (sub === 'p') {
-        const providerId = parts[2]
+        const providerId = parts.slice(2).join(':')
         const current = this.resolveAgentModel()
         const catalog = await listModelCatalog(this.ctx, current)
         const models = catalog.modelsByProvider.get(providerId) || []
@@ -389,8 +393,8 @@ export class Gateway {
       }
       // Pagination for models
       if (sub === 'pg') {
-        const providerId = parts[2]
-        const page = parseInt(parts[3], 10) || 0
+        const page = parseInt(parts[parts.length - 1], 10) || 0
+        const providerId = parts.slice(2, -1).join(':')
         const current = this.resolveAgentModel()
         const catalog = await listModelCatalog(this.ctx, current)
         const models = catalog.modelsByProvider.get(providerId) || []
@@ -709,16 +713,6 @@ export class Gateway {
       }
       return reply({ text: `📄 Файл: <b>${res.name}</b> (${formatFileSize(res.size)})`, files: [file] })
     }
-    if (cmd === '/keyboard') {
-      const sub = String(parts[1] || 'status').toLowerCase()
-      const tgAdapter = this.getAdapter('telegram')
-      if (sub === 'on' || sub === 'off') {
-        if (tgAdapter) tgAdapter.quickActions = sub === 'on'
-        return reply(sub === 'on' ? 'Быстрая клавиатура: включена.' : 'Быстрая клавиатура: выключена.', sub === 'off' ? { replyMarkup: { remove_keyboard: true } } : undefined)
-      }
-      const cur = tgAdapter?.quickActions !== false
-      return reply(`Быстрая клавиатура: ${cur ? 'on' : 'off'}\nСмена: /keyboard on|off`)
-    }
     if (cmd === '/new') {
       const chat = this.chats.get(key)
       if (chat) {
@@ -1328,8 +1322,10 @@ export class Gateway {
     if (timeout <= 0) return
     const now = Date.now()
     for (const [key, chat] of this.chats) {
-      if (now - chat.lastUsed > timeout) {
-        this.sessionToChat.delete(String(chat.agent.session.id))
+      if (!chat.turnActive && now - chat.lastUsed > timeout) {
+        if (chat.agent?.session?.id) {
+          this.sessionToChat.delete(String(chat.agent.session.id))
+        }
         this.chats.delete(key)
         chat.dispose().catch(() => {})
       }

package/lib/models.js

@@ -39,16 +39,29 @@ export async function listModelCatalog(ctx, fallback = {}) {
 
 // In-memory registry for model picker callback tokens to avoid 64-byte Telegram limit
 const modelIndexStore = new Map()
+const modelToKeyMap = new Map()
 let modelIndexCounter = 0
 
 export function storeModelSelection(provider, model) {
+  const compositeKey = `${provider}::${model}`
+  const existingKey = modelToKeyMap.get(compositeKey)
+  if (existingKey && modelIndexStore.has(existingKey)) {
+    modelIndexStore.get(existingKey).time = Date.now()
+    return existingKey
+  }
+
   const key = String(++modelIndexCounter)
   modelIndexStore.set(key, { provider, model, time: Date.now() })
+  modelToKeyMap.set(compositeKey, key)
+
   // Cleanup entries older than 1 hour
   if (modelIndexStore.size > 200) {
     const cutoff = Date.now() - 3600000
     for (const [k, v] of modelIndexStore.entries()) {
-      if (v.time < cutoff) modelIndexStore.delete(k)
+      if (v.time < cutoff) {
+        modelIndexStore.delete(k)
+        modelToKeyMap.delete(`${v.provider}::${v.model}`)
+      }
     }
   }
   return key

package/lib/scheduler.js

@@ -46,8 +46,16 @@ export function createScheduler(filePath, onDue) {
     loaded = true
   }
 
+  const RETENTION_MS = 7 * 86400 * 1000
+
   async function save() {
     try {
+      const now = Date.now()
+      tasks = tasks.filter((t) => {
+        if (t.status === 'pending') return true
+        const finishTime = t.firedAt || t.createdAt || 0
+        return (now - finishTime) < RETENTION_MS
+      })
       await mkdir(dirname(filePath), { recursive: true })
       await writeFile(filePath, JSON.stringify(tasks, null, 2), 'utf8')
     } catch {}

package/lib/telegram-format.js

@@ -12,7 +12,7 @@ function renderInline(t) {
   let s = escapeHtml(t)
   s = s.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>')
-  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${escapeHtml(url)}">${label}</a>`)
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
   s = s.replace(/(^|[^*])\*([^*\n]+)\*(?!\*)/g, '$1<i>$2</i>')
   return s
 }
@@ -123,7 +123,7 @@ export function markdownToTelegramHtml(markdown) {
   text = convertDetails(text, stash)
   text = convertTaskLists(text, stash)
   text = escapeHtml(text)
-  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${escapeHtml(url)}">${label}</a>`)
+  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
   text = text.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   text = text.replace(/__([^_\n]+)__/g, '<b>$1</b>')
   text = text.replace(/~~([^~\n]+)~~/g, '<s>$1</s>')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-messenger-gateway",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "Telegram messenger bridge for DeepSeek Harness: sessions, steer, homes, inline asks, notify bridge, and optional TTS voice notes.",
   "license": "MIT",
   "type": "module",