@goodandready/dsh-messenger-gateway 0.4.9 → 0.4.11

package/lib/ask.js

@@ -56,7 +56,9 @@ export function buildInlineKeyboard(token, buttons) {
 
 export function normalizeAskOptions(options = []) {
   if (Array.isArray(options)) {
-    const flat = options.flat ? options.flat() : [].concat(...options)
+    const flat = typeof options.flat === 'function'
+      ? options.flat()
+      : options.reduce((acc, item) => acc.concat(item), [])
     return flat.map((opt, i) => {
       if (typeof opt === 'string') return { id: String(i + 1), text: opt, selected: false }
       const id = String(opt?.id ?? opt?.buttonId ?? i + 1).trim()

package/lib/documents.js

@@ -1,4 +1,4 @@
-import { readFile } from 'node:fs/promises'
+import { open } from 'node:fs/promises'
 import { extname } from 'node:path'
 import { inflateRawSync } from 'node:zlib'
 
@@ -132,7 +132,36 @@ export async function parseDocument(filePath, opts = {}) {
   const ext = extname(filePath).toLowerCase()
 
   try {
-    const rawBuffer = await readFile(filePath)
+    const handle = await open(filePath, 'r')
+    let rawBuffer
+    let truncated = false
+    let originalLength = 0
+
+    try {
+      const st = await handle.stat()
+      originalLength = st.size
+
+      if (TEXT_INJECT_EXTS.has(ext)) {
+        const toRead = Math.min(st.size, maxBytes)
+        const buf = Buffer.alloc(toRead)
+        const { bytesRead } = await handle.read(buf, 0, toRead, 0)
+        rawBuffer = buf.subarray(0, bytesRead)
+        truncated = st.size > toRead
+      } else if (ext === '.pdf' || ext === '.docx') {
+        const maxBinary = Math.max(maxBytes * 4, 10 * 1024 * 1024)
+        if (st.size > maxBinary) {
+          return { parsed: false, error: `File size (${st.size} bytes) exceeds safety parse limit` }
+        }
+        const buf = Buffer.alloc(st.size)
+        const { bytesRead } = await handle.read(buf, 0, st.size, 0)
+        rawBuffer = buf.subarray(0, bytesRead)
+      } else {
+        return { parsed: false, type: 'unsupported' }
+      }
+    } finally {
+      await handle.close()
+    }
+
     let text = ''
     let parsedType = 'text'
 
@@ -145,15 +174,11 @@ export async function parseDocument(filePath, opts = {}) {
     } else if (TEXT_INJECT_EXTS.has(ext)) {
       parsedType = ext.slice(1)
       text = rawBuffer.toString('utf8')
-    } else {
-      return { parsed: false, type: 'unsupported' }
     }
 
     text = text.trim()
     if (!text) return { parsed: false, type: parsedType }
 
-    const originalLength = text.length
-    let truncated = false
     if (text.length > maxBytes) {
       text = text.slice(0, maxBytes)
       truncated = true
@@ -164,9 +189,10 @@ export async function parseDocument(filePath, opts = {}) {
       type: parsedType,
       text,
       truncated,
-      originalLength,
+      originalLength: originalLength || text.length,
     }
   } catch (err) {
     return { parsed: false, error: err.message }
   }
 }
+

package/lib/file-manager.js

@@ -1,5 +1,6 @@
+import { realpathSync } from 'node:fs'
 import { readdir, stat, readFile } from 'node:fs/promises'
-import { resolve, normalize, relative, join, extname, isAbsolute } from 'node:path'
+import { resolve, normalize, relative, join, extname, isAbsolute, sep, dirname } from 'node:path'
 
 export function formatFileSize(bytes) {
   if (!Number.isFinite(bytes) || bytes <= 0) return '0 B'
@@ -9,6 +10,17 @@ export function formatFileSize(bytes) {
   return `${val} ${units[i]}`
 }
 
+function isSubpath(parent, child) {
+  const normParent = normalize(parent)
+  const normChild = normalize(child)
+  if (process.platform === 'win32') {
+    const p = normParent.toLowerCase()
+    const c = normChild.toLowerCase()
+    return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep)
+  }
+  return normChild === normParent || normChild.startsWith(normParent.endsWith(sep) ? normParent : normParent + sep)
+}
+
 export function resolveSafePath(baseCwd, userPath = '.') {
   const base = resolve(normalize(baseCwd || process.cwd()))
   const cleanUser = String(userPath || '').trim() || '.'
@@ -21,6 +33,46 @@ export function resolveSafePath(baseCwd, userPath = '.') {
     err.code = 'ERR_PATH_TRAVERSAL'
     throw err
   }
+
+  try {
+    const realBase = realpathSync(base)
+    try {
+      const realTarget = realpathSync(target)
+      if (!isSubpath(realBase, realTarget)) {
+        const err = new Error('Access denied: symlink resolves out of workspace')
+        err.code = 'ERR_PATH_TRAVERSAL'
+        throw err
+      }
+    } catch (targetErr) {
+      if (targetErr?.code === 'ERR_PATH_TRAVERSAL') throw targetErr
+      if (targetErr?.code === 'ENOENT') {
+        let curr = dirname(target)
+        while (curr === base || isSubpath(base, curr)) {
+          try {
+            const realCurr = realpathSync(curr)
+            if (!isSubpath(realBase, realCurr)) {
+              const err = new Error('Access denied: symlink ancestor resolves out of workspace')
+              err.code = 'ERR_PATH_TRAVERSAL'
+              throw err
+            }
+            break
+          } catch (ancestorErr) {
+            if (ancestorErr?.code === 'ERR_PATH_TRAVERSAL') throw ancestorErr
+            if (ancestorErr?.code === 'ENOENT') {
+              const parent = dirname(curr)
+              if (parent === curr) break
+              curr = parent
+              continue
+            }
+            break
+          }
+        }
+      }
+    }
+  } catch (baseErr) {
+    if (baseErr?.code === 'ERR_PATH_TRAVERSAL') throw baseErr
+  }
+
   return { base, target, relativePath: rel || '.' }
 }
 

package/lib/http.js

@@ -36,7 +36,7 @@ export function isLoopback(value) {
     || address.startsWith('::ffff:127.')
 }
 
-export function isTrustedSettingsRequest(req) {
+export function isTrustedSettingsRequest(req, expectedSecret) {
   const remote = req?.socket?.remoteAddress
   const host = String(req?.headers?.host || '')
   if (!host) return false
@@ -44,6 +44,21 @@ export function isTrustedSettingsRequest(req) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
+  const secret = String(expectedSecret || '').trim()
+  if (secret) {
+    const authHeader = req?.headers?.authorization || ''
+    const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''
+    const tokenHeader = req?.headers?.['x-webhook-secret'] || ''
+    const provided = bearer || tokenHeader
+    if (provided && timingSafeCompare(provided, secret)) {
+      return true
+    }
+  }
+
+  if (remote !== undefined && !isLoopback(remote)) {
+    return false
+  }
+
   const origin = String(req?.headers?.origin || '')
   if (origin) {
     try {
@@ -67,7 +82,6 @@ export function isTrustedSettingsRequest(req) {
   }
 
   if (site === 'same-origin') {
-    if (remote !== undefined && !isLoopback(remote)) return false
     return true
   }
 
@@ -78,10 +92,9 @@ export function isAuthorizedMessengerRequest(req, webhooksConfig) {
   const site = String(req?.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (site === 'cross-site') return false
 
-  if (isTrustedSettingsRequest(req)) return true
-  if (isLoopback(req?.socket?.remoteAddress)) return true
-
   const secret = String(webhooksConfig?.secret || '').trim()
+  if (isTrustedSettingsRequest(req, secret)) return true
+  if (isLoopback(req?.socket?.remoteAddress)) return true
   if (secret) {
     const authHeader = req?.headers?.authorization || ''
     const bearer = authHeader.startsWith('Bearer ') ? authHeader.slice(7).trim() : ''

package/lib/index.js

@@ -380,7 +380,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -457,7 +457,7 @@ export function apply(ctx, config) {
     handler: async (req, res) => {
       if (req.method === 'GET') return writeJson(res, 200, { ok: true, config: publicConfig(source()) })
       if (req.method !== 'PUT') return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       if (!settingsApi?.isReady?.()) return writeJson(res, 503, { ok: false, error: 'settings not ready' })
       const parsedConfig = await readJsonSafe(req, res, 1_048_576)
       if (!parsedConfig.ok) return
@@ -499,7 +499,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       writeJson(res, 200, {
@@ -514,7 +514,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/approve',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)
@@ -528,7 +528,7 @@ export function apply(ctx, config) {
     kind: 'exact', path: '/dsh-messenger-gateway/pairing/reject',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+      if (!isTrustedSettingsRequest(req, source().webhooks?.secret)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
       const gw = getGw()
       if (!gw) return writeJson(res, 503, { ok: false, error: 'gateway not running' })
       const parsed = await readJsonSafe(req, res, 65536)

package/lib/locales/index.js

@@ -9,11 +9,20 @@ export function getLocaleDictionary(locale = 'en') {
   return en
 }
 
-export function t(key, params = {}, locale = 'en') {
+export function escapeHtml(text) {
+  return String(text ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+}
+
+export function t(key, params = {}, locale = 'en', options = {}) {
   const dict = getLocaleDictionary(locale)
   let template = dict[key] || en[key] || key
+  const escape = options.escape !== false
   for (const [k, v] of Object.entries(params)) {
-    template = template.replaceAll(`{${k}}`, String(v))
+    const val = escape ? escapeHtml(v) : String(v)
+    template = template.replaceAll(`{${k}}`, val)
   }
   return template
 }

package/lib/messenger-api.js

@@ -110,7 +110,29 @@ export function normalizeFiles(files) {
       err.status = 400
       throw err
     }
-    if (file.bytes) return file
+    if (file.bytes !== undefined) {
+      let buf = null
+      if (Buffer.isBuffer(file.bytes) || file.bytes instanceof Uint8Array) {
+        buf = Buffer.from(file.bytes)
+      } else if (Array.isArray(file.bytes)) {
+        buf = Buffer.from(file.bytes)
+      } else if (file.bytes && typeof file.bytes === 'object' && file.bytes.type === 'Buffer' && Array.isArray(file.bytes.data)) {
+        buf = Buffer.from(file.bytes.data)
+      } else if (typeof file.bytes === 'string') {
+        buf = Buffer.from(file.bytes, 'utf8')
+      }
+      if (!buf) {
+        const err = new Error(`files[${i}].bytes must be a Buffer, Uint8Array, or array of bytes`)
+        err.status = 400
+        throw err
+      }
+      return {
+        bytes: buf,
+        mime: file.mime || 'application/octet-stream',
+        kind: file.kind || 'document',
+        name: file.name || 'file',
+      }
+    }
     if (typeof file.dataBase64 === 'string') {
       return {
         bytes: Buffer.from(file.dataBase64, 'base64'),

package/lib/outbound.js

@@ -72,12 +72,54 @@ export async function readAttachmentBytes(ctx, ref) {
   }
 }
 
-export async function fetchInternalImage(baseUrl, path, signal) {
+export async function fetchInternalImage(baseUrl, path, signal, opts = {}) {
+  const { timeoutMs = 15_000, maxBytes = 20 * 1024 * 1024 } = opts
+  const timeoutSignal = AbortSignal.timeout(timeoutMs)
+  const effectiveSignal = signal
+    ? (typeof AbortSignal.any === 'function' ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal)
+    : timeoutSignal
+
   const url = new URL(path, baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`)
-  const res = await fetch(url, { signal })
+  const res = await fetch(url, { signal: effectiveSignal })
   if (!res.ok) throw new Error(`image fetch HTTP ${res.status}`)
-  const bytes = new Uint8Array(await res.arrayBuffer())
-  const mime = res.headers.get('content-type') || 'image/png'
+
+  const clHeader = res.headers?.get?.('content-length')
+  const cl = Number(clHeader)
+  if (Number.isFinite(cl) && cl > maxBytes) {
+    throw new Error(`image size (${cl} bytes) exceeds limit of ${maxBytes} bytes`)
+  }
+
+  let bytes
+  if (res.body && typeof res.body.getReader === 'function') {
+    const reader = res.body.getReader()
+    const chunks = []
+    let total = 0
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      total += value.length
+      if (total > maxBytes) {
+        reader.cancel().catch(() => {})
+        throw new Error(`image size exceeds limit of ${maxBytes} bytes`)
+      }
+      chunks.push(value)
+    }
+    const combined = new Uint8Array(total)
+    let offset = 0
+    for (const chunk of chunks) {
+      combined.set(chunk, offset)
+      offset += chunk.length
+    }
+    bytes = combined
+  } else {
+    const ab = await res.arrayBuffer()
+    if (ab.byteLength > maxBytes) {
+      throw new Error(`image size exceeds limit of ${maxBytes} bytes`)
+    }
+    bytes = new Uint8Array(ab)
+  }
+
+  const mime = res.headers?.get?.('content-type') || 'image/png'
   const fromQuery = url.searchParams.get('id') || url.searchParams.get('name')
   const name = fromQuery ? `image-${fromQuery.slice(0, 32)}.png` : 'image.png'
   return { bytes, mime, kind: 'photo', name }
@@ -87,7 +129,7 @@ const DEFAULT_MAX_OUTBOUND_FILES = 10
 
 /** Build Telegram-ready files from assistant image blocks and inline plugin URLs. */
 export async function buildOutboundFiles(ctx, baseUrl, collector, opts = {}) {
-  const { signal, logger, maxFiles = DEFAULT_MAX_OUTBOUND_FILES } = opts
+  const { signal, logger, maxFiles = DEFAULT_MAX_OUTBOUND_FILES, maxImageBytes, imageTimeoutMs } = opts
   const files = []
   const refs = dedupeAttachmentRefs(collector.images)
   for (const ref of refs) {
@@ -104,7 +146,10 @@ export async function buildOutboundFiles(ctx, baseUrl, collector, opts = {}) {
     if (files.length >= maxFiles) break
     if (signal?.aborted) break
     try {
-      files.push(await fetchInternalImage(baseUrl, path, signal))
+      files.push(await fetchInternalImage(baseUrl, path, signal, {
+        maxBytes: maxImageBytes,
+        timeoutMs: imageTimeoutMs,
+      }))
     } catch (e) {
       logger?.warn?.(`outbound url image: ${e.message}`)
     }

package/lib/personas.js

@@ -1,5 +1,5 @@
-import { readFileSync, writeFileSync, mkdirSync } from 'node:fs'
-import { dirname } from 'node:path'
+import { readFileSync } from 'node:fs'
+import { writeJsonAtomicSync } from './storage-atomic.js'
 
 export const BUILTIN_PERSONAS = {
   default: {
@@ -87,8 +87,7 @@ export function createPersonaStore(filePath, { logger } = {}) {
 
   function save() {
     try {
-      mkdirSync(dirname(filePath), { recursive: true })
-      writeFileSync(filePath, JSON.stringify(cache, null, 2), 'utf8')
+      writeJsonAtomicSync(filePath, cache)
     } catch (err) {
       logger?.warn?.('[dsh-messenger-gateway] personas save error:', err?.message || err)
     }

package/lib/scheduler.js

@@ -42,10 +42,16 @@ export function createScheduler(filePath, onDue, options = {}) {
   async function load() {
     try {
       const raw = await readFile(filePath, 'utf8')
-      tasks = JSON.parse(raw)
+      const parsed = JSON.parse(raw)
+      if (Array.isArray(parsed)) {
+        tasks = parsed
+      } else {
+        logger?.warn?.(`[dsh-messenger-gateway] scheduler invalid tasks payload in ${filePath}: expected array, got ${typeof parsed}; resetting to empty list`)
+        tasks = []
+      }
     } catch (err) {
       if (err?.code !== 'ENOENT') {
-        logger?.debug?.('[dsh-messenger-gateway] scheduler load error:', err?.message || err)
+        logger?.warn?.('[dsh-messenger-gateway] scheduler load error:', err?.message || err)
       }
       tasks = []
     }
@@ -56,6 +62,7 @@ export function createScheduler(filePath, onDue, options = {}) {
 
   async function save() {
     if (!filePath) return
+    if (!Array.isArray(tasks)) tasks = []
     try {
       const now = Date.now()
       tasks = tasks.filter((t) => {
@@ -71,6 +78,7 @@ export function createScheduler(filePath, onDue, options = {}) {
 
   async function checkDue() {
     if (!loaded) await load()
+    if (!Array.isArray(tasks)) tasks = []
     const now = Date.now()
     const due = tasks.filter((t) => t.status === 'pending' && t.dueAt <= now)
 
@@ -99,10 +107,10 @@ export function createScheduler(filePath, onDue, options = {}) {
   function start(intervalMs = 5000) {
     if (timer) clearInterval(timer)
     timer = setInterval(() => {
-      checkDue().catch((err) => { logger?.debug?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
+      checkDue().catch((err) => { logger?.warn?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
     }, intervalMs)
     timer.unref?.()
-    checkDue().catch((err) => { logger?.debug?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
+    checkDue().catch((err) => { logger?.warn?.('[dsh-messenger-gateway] scheduler checkDue error:', err?.message || err) })
   }
 
   function stop() {

package/lib/settings-bridge.js

@@ -78,7 +78,7 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
     source = () => currentConfig
 
     const persist = async (next) => {
-      const payload = Config(next)
+      const payload = resolveConfig(next)
       if (typeof service.replace === 'function') {
         await service.replace(namespace, payload, getRevision())
       } else if (typeof service.update === 'function') {
@@ -88,7 +88,7 @@ export function setupSettings(ctx, { namespace, Config, resolveConfig, baseConfi
       } else {
         throw new Error('settings service cannot persist configuration')
       }
-      currentConfig = resolveConfig(payload)
+      currentConfig = payload
       sync()
       for (const cb of watchers) {
         try { cb(currentConfig) } catch (err) { logger?.debug?.(`${namespace}: watcher error:`, err?.message || err) }

package/lib/storage-atomic.js

@@ -1,4 +1,5 @@
 import { writeFile, rename, mkdir, unlink } from 'node:fs/promises'
+import { writeFileSync, renameSync, mkdirSync, unlinkSync } from 'node:fs'
 import { dirname } from 'node:path'
 import { randomUUID } from 'node:crypto'
 
@@ -18,4 +19,20 @@ export async function writeJsonAtomic(filePath, data) {
     await unlink(tmpPath).catch(() => {})
     throw err
   }
+}
+
+/**
+ * Synchronous atomic JSON write via temporary file and rename.
+ */
+export function writeJsonAtomicSync(filePath, data) {
+  const dir = dirname(filePath)
+  mkdirSync(dir, { recursive: true })
+  const tmpPath = `${filePath}.${randomUUID().slice(0, 8)}.tmp`
+  try {
+    writeFileSync(tmpPath, JSON.stringify(data, null, 2), 'utf8')
+    renameSync(tmpPath, filePath)
+  } catch (err) {
+    try { unlinkSync(tmpPath) } catch { /* ignore */ }
+    throw err
+  }
 }

package/lib/telegram-format.js

@@ -7,12 +7,33 @@ export function escapeHtml(text) {
 
 const PH = '\uE000'
 
+const SAFE_SCHEMES = new Set(['https:', 'http:', 'tg:'])
+
+export function isSafeUrl(rawUrl) {
+  if (!rawUrl || typeof rawUrl !== 'string') return false
+  const clean = rawUrl.replace(/&/g, '&').trim()
+  try {
+    const parsed = new URL(clean)
+    return SAFE_SCHEMES.has(parsed.protocol.toLowerCase())
+  } catch {
+    if (/^tg:\/\//i.test(clean)) return true
+    return false
+  }
+}
+
+export function formatSafeLink(label, url) {
+  if (!isSafeUrl(url)) {
+    return `${label} (${url})`
+  }
+  return `<a href="${url.replace(/"/g, '%22')}">${label}</a>`
+}
+
 // Render inline markdown (bold/italic/code/links) inside already-HTML-escaped text.
 function renderInline(t) {
   let s = escapeHtml(t)
   s = s.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>')
-  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   s = s.replace(/(^|[^*])\*([^*\n]+)\*(?!\*)/g, '$1<i>$2</i>')
   return s
 }
@@ -123,7 +144,7 @@ export function markdownToTelegramHtml(markdown) {
   text = convertDetails(text, stash)
   text = convertTaskLists(text, stash)
   text = escapeHtml(text)
-  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => `<a href="${url.replace(/"/g, '%22')}">${label}</a>`)
+  text = text.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => formatSafeLink(label, url))
   text = text.replace(/\*\*([^*\n]+)\*\*/g, '<b>$1</b>')
   text = text.replace(/__([^_\n]+)__/g, '<b>$1</b>')
   text = text.replace(/~~([^~\n]+)~~/g, '<s>$1</s>')

package/lib/updater.js

@@ -181,15 +181,20 @@ export async function getUpdateStatus(options, target = runtime()) {
   }
 }
 
+export function buildUpdateArgs(target, packageSpec, options = {}) {
+  return [
+    target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+    packageSpec,
+    `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+  ]
+}
+
 export async function installExact(target, packageSpec, options = {}) {
   if (target.cliEntry === undefined) throw new Error('Automatic update CLI entry is unavailable in this runtime.')
   return new Promise((resolvePromise, reject) => {
-    const args = [
-      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
-      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
-    ]
-    const child = spawn(process.execPath, args, {
+    const args = buildUpdateArgs(target, packageSpec, options)
+    const spawnFn = options.spawn ?? spawn
+    const child = spawnFn(process.execPath, args, {
       cwd: target.profileDir,
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-messenger-gateway",
-  "version": "0.4.9",
+  "version": "0.4.11",
   "description": "Telegram messenger bridge for DeepSeek Harness: sessions, steer, homes, inline asks, notify bridge, and optional TTS voice notes.",
   "license": "MIT",
   "type": "module",