mixdog 0.9.3 → 0.9.5

package/src/runtime/channels/backends/discord-gateway.mjs

@@ -0,0 +1,233 @@
+// Gateway connect / login / event-listener wiring extracted from discord.mjs.
+// Implemented as instance-method installers that operate on a DiscordBackend
+// `self`. Behavior is byte-identical to the originals; only the host object is
+// passed explicitly instead of via `this`.
+
+async function connect(self) {
+  // Re-entry guard: if a connect() is already in-flight or completed, return
+  // the same promise / no-op so concurrent ownership-timer fires cannot
+  // overwrite self.client, duplicate listeners, or trigger duplicate logins.
+  if (self._connectPromise) return self._connectPromise;
+  self._connectPromise = connectInner(self).catch((err) => {
+    self._connectPromise = null;
+    throw err;
+  });
+  return self._connectPromise;
+}
+
+async function connectInner(self) {
+  await buildClient(self);
+  applyStaticAccessOverride(self);
+  registerEventListeners(self);
+  registerSlashCommands(self);
+  registerShardListeners(self);
+  try {
+    await awaitLogin(self);
+  } catch (err) {
+    // Destroy the partial Client to free the listeners/handles it already
+    // attached. Without this, a ready-timeout retry leaks every listener
+    // set by registerEventListeners/registerSlashCommands/registerShardListeners.
+    try { self.client?.destroy?.(); } catch {}
+    self.client = null;
+    throw err;
+  }
+  self.persistAccessFromMainChannel();
+}
+
+async function buildClient(self) {
+  const { Client, GatewayIntentBits, Partials } = await self._ensureDiscord();
+  self.client = new Client({
+    intents: [
+      GatewayIntentBits.DirectMessages,
+      GatewayIntentBits.Guilds,
+      GatewayIntentBits.GuildMessages,
+      GatewayIntentBits.MessageContent
+    ],
+    partials: [Partials.Channel]
+  });
+}
+
+function applyStaticAccessOverride(self) {
+  if (self.isStatic) {
+    self.bootAccess = self.loadAccess();
+  }
+}
+
+function registerEventListeners(self) {
+  self.client.on("error", (err) => {
+    process.stderr.write(`mixdog discord: client error: ${err}
+`);
+  });
+  self.client.on("messageCreate", (msg) => {
+    if (msg.author.id === self.client.user?.id) {
+      return;
+    }
+    if (msg.author.bot) return;
+    self.handleInbound(msg, Date.now()).catch(
+      (e) => process.stderr.write(`mixdog discord: handleInbound failed: ${e}
+`)
+    );
+  });
+  self.client.on("interactionCreate", async (interaction) => {
+    try {
+      // Trust gate for interactions. Buttons / selects / modal submits used to
+      // reach onInteraction / onModalRequest without passing through the
+      // message gate(), so a configured allowFrom never applied to them
+      // (schedule/quiet/profile modals + perm approvals were openable by any
+      // user in the channel). Apply the same allowFrom decision here; an empty
+      // allowFrom stays open so current configs are unaffected.
+      if (!self._interactionAllowed(interaction.channelId ?? "", interaction.user?.id, interaction)) {
+        try {
+          if (typeof interaction.reply === "function" && !interaction.replied && !interaction.deferred) {
+            await interaction.reply({ content: "⛔ Not authorized for this action.", ephemeral: true });
+          } else if (typeof interaction.deferUpdate === "function") {
+            await interaction.deferUpdate();
+          }
+        } catch {}
+        return;
+      }
+      if (interaction.isChatInputCommand() && interaction.commandName === "stop") {
+        await interaction.reply({ content: "\u23F9 Stopping...", ephemeral: true });
+        if (self.onInteraction) {
+          self.onInteraction({
+            type: "button",
+            customId: "stop_task",
+            userId: interaction.user.id,
+            channelId: interaction.channelId ?? ""
+          });
+        }
+        return;
+      }
+      if (interaction.isModalSubmit()) {
+        if (self.onInteraction) {
+          const fields = {};
+          for (const row of interaction.components) {
+            for (const comp of row.components ?? []) {
+              if (comp.customId && comp.value != null) fields[comp.customId] = String(comp.value);
+            }
+          }
+          self.onInteraction({
+            type: "modal",
+            customId: interaction.customId,
+            userId: interaction.user.id,
+            channelId: interaction.channelId ?? "",
+            fields,
+            message: interaction.message ? { id: interaction.message.id } : void 0
+          });
+        }
+        await interaction.deferUpdate().catch(() => {
+        });
+        return;
+      }
+      if (interaction.isButton() || interaction.isStringSelectMenu() || interaction.isRoleSelectMenu() || interaction.isUserSelectMenu() || interaction.isChannelSelectMenu()) {
+        const needsModal = interaction.isButton() && (interaction.customId === "sched_add_next" || interaction.customId === "sched_edit_next" || interaction.customId === "profile_edit");
+        if (needsModal) {
+          if (self.onModalRequest) {
+            await Promise.resolve(self.onModalRequest(interaction)).catch((err) => {
+              process.stderr.write(`mixdog discord: onModalRequest failed: ${err}\n`);
+            });
+          }
+          return;
+        }
+        await interaction.deferUpdate().catch(() => {
+        });
+        if (self.onInteraction) {
+          self.onInteraction({
+            type: interaction.isButton() ? "button" : "select",
+            customId: interaction.customId,
+            userId: interaction.user.id,
+            channelId: interaction.channelId,
+            values: interaction.isStringSelectMenu() ? interaction.values : void 0,
+            message: interaction.message ? { id: interaction.message.id } : void 0
+          });
+        }
+      }
+    } catch (err) {
+      process.stderr.write(`mixdog discord: interaction error: ${err}
+`);
+    }
+  });
+}
+
+function registerSlashCommands(self) {
+  self.client.on(self._discordEvents().ClientReady, async (c) => {
+    process.stderr.write(`mixdog discord: gateway connected as ${c.user.tag}
+`);
+    try {
+      // Plugin registers no global commands; clear the global slot so any
+      // pre-existing entry from prior installs is not surfaced to users.
+      await c.application?.commands.set([]);
+      process.stderr.write(`mixdog discord: global application commands cleared
+`);
+
+      // Replace each guild's command set with just /stop. set() overwrites,
+      // so the desired set is the only one that survives.
+      const desiredCommands = [
+        { name: "stop", description: "Stop the current Mixdog response" },
+      ];
+      for (const [guildId] of c.guilds.cache) {
+        await c.application?.commands.set(desiredCommands, guildId);
+      }
+      // Register /stop globally so it is available in DM bridge contexts
+      // where there is no guild scope.
+      try {
+        await c.application?.commands.set(desiredCommands);
+      } catch (e) {
+        process.stderr.write(`mixdog discord: global /stop register failed: ${e?.message}\n`);
+      }
+      process.stderr.write(`mixdog discord: /stop command registered (${c.guilds.cache.size} guild(s))
+`);
+    } catch (err) {
+      process.stderr.write(`mixdog discord: slash command registration failed: ${err}
+`);
+    }
+  });
+}
+
+function registerShardListeners(self) {
+  self.client.on("shardDisconnect", (ev, id) => {
+    process.stderr.write(`mixdog discord: shard ${id} disconnected (code ${ev.code}). Will auto-reconnect.
+`);
+  });
+  self.client.on("shardReconnecting", (id) => {
+    process.stderr.write(`mixdog discord: shard ${id} reconnecting...
+`);
+  });
+  self.client.on("shardResume", (id, replayedEvents) => {
+    process.stderr.write(`mixdog discord: shard ${id} resumed (replayed ${replayedEvents} events)
+`);
+  });
+  self.client.on("warn", (msg) => {
+    process.stderr.write(`mixdog discord: warn: ${msg}
+`);
+  });
+}
+
+async function awaitLogin(self) {
+  let readyTimeout;
+  const readyPromise = new Promise((resolve, reject) => {
+    readyTimeout = setTimeout(() => reject(new Error("discord ready timeout (30s)")), 3e4);
+    self.client.once(self._discordEvents().ClientReady, () => {
+      clearTimeout(readyTimeout);
+      resolve();
+    });
+  });
+  try {
+    await self.client.login(self.token);
+  } catch (err) {
+    clearTimeout(readyTimeout);
+    throw err;
+  }
+  await readyPromise;
+}
+
+export {
+  connect,
+  connectInner,
+  buildClient,
+  applyStaticAccessOverride,
+  registerEventListeners,
+  registerSlashCommands,
+  registerShardListeners,
+  awaitLogin
+};

package/src/runtime/channels/backends/discord.mjs

@@ -10,7 +10,6 @@ async function ensureDiscord() {
   return _discord;
 }
 import {
-  writeFileSync,
   mkdirSync,
   statSync,
   realpathSync
@@ -20,37 +19,11 @@ import { createHash } from "crypto";
 import { chunk, formatForDiscord, MAX_DISCORD_MESSAGE } from "../lib/format.mjs";
 import { withConfigLock } from "../lib/config-lock.mjs";
 import { readSection, updateSection } from "../../shared/config.mjs";
+import { normalizeAccess, safeAttName } from "./discord-access.mjs";
+import { MAX_ATTACHMENT_BYTES, downloadSingleAttachment } from "./discord-attachments.mjs";
+import * as gateway from "./discord-gateway.mjs";
 const MAX_CHUNK_LIMIT = MAX_DISCORD_MESSAGE;
-const MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
 const RECENT_SENT_CAP = 200;
-function defaultAccess() {
-  return {
-    dmPolicy: "allowlist",
-    allowFrom: [],
-    channels: {}
-  };
-}
-function normalizeAccess(parsed) {
-  const defaults = defaultAccess();
-  return {
-    // Legacy "pairing" policy was removed (its approval flow was never
-    // completable); normalize it to "allowlist" on load.
-    dmPolicy: parsed?.dmPolicy === "pairing" ? "allowlist" : (parsed?.dmPolicy ?? defaults.dmPolicy),
-    allowFrom: parsed?.allowFrom ?? defaults.allowFrom,
-    channels: parsed?.channels ?? defaults.channels,
-    mentionPatterns: parsed?.mentionPatterns,
-    // Setup UI historically saved a boolean toggle; runtime needs an emoji
-    // string for msg.react(). true → default emoji, non-string → off.
-    ackReaction: parsed?.ackReaction === true
-      ? "✅"
-      : (typeof parsed?.ackReaction === "string" && parsed.ackReaction ? parsed.ackReaction : undefined),
-    replyToMode: parsed?.replyToMode,
-    textChunkLimit: parsed?.textChunkLimit,
-  };
-}
-function safeAttName(att) {
-  return (att.name ?? att.id).replace(/[\[\]\r\n;]/g, "_");
-}
 class DiscordBackend {
   name = "discord";
   MAX_MESSAGE_LENGTH = MAX_DISCORD_MESSAGE;
@@ -82,216 +55,16 @@ class DiscordBackend {
   formatOutgoing(text) {
     return formatForDiscord(text);
   }
-  // ── Lifecycle ──────────────────────────────────────────────────────
-  async connect() {
-    // Re-entry guard: if a connect() is already in-flight or completed, return
-    // the same promise / no-op so concurrent ownership-timer fires cannot
-    // overwrite this.client, duplicate listeners, or trigger duplicate logins.
-    if (this._connectPromise) return this._connectPromise;
-    this._connectPromise = this._connectInner().catch((err) => {
-      this._connectPromise = null;
-      throw err;
-    });
-    return this._connectPromise;
-  }
-  async _connectInner() {
-    await this._buildClient();
-    this._applyStaticAccessOverride();
-    this._registerEventListeners();
-    this._registerSlashCommands();
-    this._registerShardListeners();
-    try {
-      await this._awaitLogin();
-    } catch (err) {
-      // Destroy the partial Client to free the listeners/handles it already
-      // attached. Without this, a ready-timeout retry leaks every listener
-      // set by _registerEventListeners/_registerSlashCommands/_registerShardListeners.
-      try { this.client?.destroy?.(); } catch {}
-      this.client = null;
-      throw err;
-    }
-    this.persistAccessFromChannelsConfig();
-  }
-  async _buildClient() {
-    const { Client, GatewayIntentBits, Partials } = await ensureDiscord();
-    this.client = new Client({
-      intents: [
-        GatewayIntentBits.DirectMessages,
-        GatewayIntentBits.Guilds,
-        GatewayIntentBits.GuildMessages,
-        GatewayIntentBits.MessageContent
-      ],
-      partials: [Partials.Channel]
-    });
-  }
-  _applyStaticAccessOverride() {
-    if (this.isStatic) {
-      this.bootAccess = this.loadAccess();
-    }
-  }
-  _registerEventListeners() {
-    this.client.on("error", (err) => {
-      process.stderr.write(`mixdog discord: client error: ${err}
-`);
-    });
-    this.client.on("messageCreate", (msg) => {
-      if (msg.author.id === this.client.user?.id) {
-        return;
-      }
-      if (msg.author.bot) return;
-      this.handleInbound(msg, Date.now()).catch(
-        (e) => process.stderr.write(`mixdog discord: handleInbound failed: ${e}
-`)
-      );
-    });
-    this.client.on("interactionCreate", async (interaction) => {
-      try {
-        // Trust gate for interactions. Buttons / selects / modal submits used to
-        // reach onInteraction / onModalRequest without passing through the
-        // message gate(), so a configured allowFrom never applied to them
-        // (schedule/quiet/profile modals + perm approvals were openable by any
-        // user in the channel). Apply the same allowFrom decision here; an empty
-        // allowFrom stays open so current configs are unaffected.
-        if (!this._interactionAllowed(interaction.channelId ?? "", interaction.user?.id, interaction)) {
-          try {
-            if (typeof interaction.reply === "function" && !interaction.replied && !interaction.deferred) {
-              await interaction.reply({ content: "⛔ Not authorized for this action.", ephemeral: true });
-            } else if (typeof interaction.deferUpdate === "function") {
-              await interaction.deferUpdate();
-            }
-          } catch {}
-          return;
-        }
-        if (interaction.isChatInputCommand() && interaction.commandName === "stop") {
-          await interaction.reply({ content: "\u23F9 Stopping...", ephemeral: true });
-          if (this.onInteraction) {
-            this.onInteraction({
-              type: "button",
-              customId: "stop_task",
-              userId: interaction.user.id,
-              channelId: interaction.channelId ?? ""
-            });
-          }
-          return;
-        }
-        if (interaction.isModalSubmit()) {
-          if (this.onInteraction) {
-            const fields = {};
-            for (const row of interaction.components) {
-              for (const comp of row.components ?? []) {
-                if (comp.customId && comp.value != null) fields[comp.customId] = String(comp.value);
-              }
-            }
-            this.onInteraction({
-              type: "modal",
-              customId: interaction.customId,
-              userId: interaction.user.id,
-              channelId: interaction.channelId ?? "",
-              fields,
-              message: interaction.message ? { id: interaction.message.id } : void 0
-            });
-          }
-          await interaction.deferUpdate().catch(() => {
-          });
-          return;
-        }
-        if (interaction.isButton() || interaction.isStringSelectMenu() || interaction.isRoleSelectMenu() || interaction.isUserSelectMenu() || interaction.isChannelSelectMenu()) {
-          const needsModal = interaction.isButton() && (interaction.customId === "sched_add_next" || interaction.customId === "sched_edit_next" || interaction.customId === "quiet_set_next" || interaction.customId === "activity_add_next" || interaction.customId === "profile_edit");
-          if (needsModal) {
-            if (this.onModalRequest) {
-              await Promise.resolve(this.onModalRequest(interaction)).catch((err) => {
-                process.stderr.write(`mixdog discord: onModalRequest failed: ${err}\n`);
-              });
-            }
-            return;
-          }
-          await interaction.deferUpdate().catch(() => {
-          });
-          if (this.onInteraction) {
-            this.onInteraction({
-              type: interaction.isButton() ? "button" : "select",
-              customId: interaction.customId,
-              userId: interaction.user.id,
-              channelId: interaction.channelId,
-              values: interaction.isStringSelectMenu() ? interaction.values : void 0,
-              message: interaction.message ? { id: interaction.message.id } : void 0
-            });
-          }
-        }
-      } catch (err) {
-        process.stderr.write(`mixdog discord: interaction error: ${err}
-`);
-      }
-    });
-  }
-  _registerSlashCommands() {
-    this.client.on(_discord.Events.ClientReady, async (c) => {
-      process.stderr.write(`mixdog discord: gateway connected as ${c.user.tag}
-`);
-      try {
-        // Plugin registers no global commands; clear the global slot so any
-        // pre-existing entry from prior installs is not surfaced to users.
-        await c.application?.commands.set([]);
-        process.stderr.write(`mixdog discord: global application commands cleared
-`);
-
-        // Replace each guild's command set with just /stop. set() overwrites,
-        // so the desired set is the only one that survives.
-        const desiredCommands = [
-          { name: "stop", description: "Stop the current Mixdog response" },
-        ];
-        for (const [guildId] of c.guilds.cache) {
-          await c.application?.commands.set(desiredCommands, guildId);
-        }
-        // Register /stop globally so it is available in DM bridge contexts
-        // where there is no guild scope.
-        try {
-          await c.application?.commands.set(desiredCommands);
-        } catch (e) {
-          process.stderr.write(`mixdog discord: global /stop register failed: ${e?.message}\n`);
-        }
-        process.stderr.write(`mixdog discord: /stop command registered (${c.guilds.cache.size} guild(s))
-`);
-      } catch (err) {
-        process.stderr.write(`mixdog discord: slash command registration failed: ${err}
-`);
-      }
-    });
+  // ── discord.js access bridges for extracted gateway module ─────────
+  _ensureDiscord() {
+    return ensureDiscord();
   }
-  _registerShardListeners() {
-    this.client.on("shardDisconnect", (ev, id) => {
-      process.stderr.write(`mixdog discord: shard ${id} disconnected (code ${ev.code}). Will auto-reconnect.
-`);
-    });
-    this.client.on("shardReconnecting", (id) => {
-      process.stderr.write(`mixdog discord: shard ${id} reconnecting...
-`);
-    });
-    this.client.on("shardResume", (id, replayedEvents) => {
-      process.stderr.write(`mixdog discord: shard ${id} resumed (replayed ${replayedEvents} events)
-`);
-    });
-    this.client.on("warn", (msg) => {
-      process.stderr.write(`mixdog discord: warn: ${msg}
-`);
-    });
+  _discordEvents() {
+    return _discord.Events;
   }
-  async _awaitLogin() {
-    let readyTimeout;
-    const readyPromise = new Promise((resolve, reject) => {
-      readyTimeout = setTimeout(() => reject(new Error("discord ready timeout (30s)")), 3e4);
-      this.client.once(_discord.Events.ClientReady, () => {
-        clearTimeout(readyTimeout);
-        resolve();
-      });
-    });
-    try {
-      await this.client.login(this.token);
-    } catch (err) {
-      clearTimeout(readyTimeout);
-      throw err;
-    }
-    await readyPromise;
+  // ── Lifecycle ──────────────────────────────────────────────────────
+  async connect() {
+    return gateway.connect(this);
   }
   async disconnect() {
     for (const interval of this.typingIntervals.values()) {
@@ -553,47 +326,37 @@ class DiscordBackend {
     try {
       const parsed = readSection("channels");
       const access = normalizeAccess(parsed.access ?? this.initialAccess);
-      if (parsed.channelsConfig) {
-        for (const entry of Object.values(parsed.channelsConfig)) {
-          if (typeof entry === "object" && entry !== null) {
-            const id = entry.channelId;
-            if (id && !(id in access.channels)) {
-              access.channels[id] = { requireMention: false, allowFrom: [] };
-            }
-          }
-        }
+      // Single main channel: auto-allow the configured channel id so channel
+      // adds apply without a restart (mirrors loadAccess()).
+      const id = this.mainChannelId;
+      if (id && !(id in access.channels)) {
+        access.channels[id] = { requireMention: false, allowFrom: [] };
       }
       return access;
     } catch {
       return this.initialAccess;
     }
   }
-  persistAccessFromChannelsConfig() {
+  persistAccessFromMainChannel() {
     if (this.isStatic || !this.configFile) return;
     try {
+      const id = this.mainChannelId;
+      if (!id) return;
       const parsed = readSection("channels");
-      if (!parsed.channelsConfig) return;
       const access = normalizeAccess(parsed.access);
-      let changed = false;
-      for (const entry of Object.values(parsed.channelsConfig)) {
-        if (typeof entry === "object" && entry !== null) {
-          const id = entry.channelId;
-          if (id && !(id in access.channels)) {
-            access.channels[id] = { requireMention: false, allowFrom: [] };
-            changed = true;
-          }
-        }
+      if (!(id in access.channels)) {
+        access.channels[id] = { requireMention: false, allowFrom: [] };
+        this.saveAccess(access);
       }
-      if (changed) this.saveAccess(access);
     } catch (err) {
-      process.stderr.write(`mixdog discord: persistAccessFromChannelsConfig failed: ${err}\n`);
+      process.stderr.write(`mixdog discord: persistAccessFromMainChannel failed: ${err}\n`);
     }
   }
   loadAccess() {
     const a = this.bootAccess ?? this.readConfigAccess();
     // Single-source channel setup: auto-allow the configured main channel so
     // both inbound (gate) and outbound (fetchAllowedChannel) accept it from a
-    // single channelsConfig.main.channelId — no separate access.channels entry.
+    // single channel.channelId — no separate access.channels entry.
     // An explicit entry for the same channel is preserved (not overwritten).
     if (this.mainChannelId && a && !(this.mainChannelId in (a.channels ?? {}))) {
       return { ...a, channels: { ...(a.channels ?? {}), [this.mainChannelId]: { allowFrom: [], requireMention: false } } };
@@ -743,9 +506,8 @@ class DiscordBackend {
     }
     if (this.onMessage) {
       // Thread messages were gated against the parent channel's policy (see
-      // gate() above), but routing also needs the parent id to find labels/
-      // modes in channelsConfig. Surface parentChatId so resolveInboundRoute
-      // can fall back to the parent when the thread id has no entry.
+      // gate() above). Surface parentChatId so downstream routing can fall
+      // back to the parent when the thread id needs it.
       const isThread = (() => { try { return !!msg.channel?.isThread?.(); } catch { return false; } })();
       const parentChatId = isThread ? (msg.channel.parentId ?? null) : null;
       this.onMessage({
@@ -810,60 +572,7 @@ class DiscordBackend {
     }
   }
   async downloadSingleAttachment(att) {
-    if (att.size > MAX_ATTACHMENT_BYTES) {
-      throw new Error(
-        `attachment too large: ${(att.size / 1024 / 1024).toFixed(1)}MB, max ${MAX_ATTACHMENT_BYTES / 1024 / 1024}MB`
-      );
-    }
-    const res = await fetch(att.url, { signal: AbortSignal.timeout(180_000) });
-    if (!res.ok) {
-      throw new Error(`attachment download failed: HTTP ${res.status}`);
-    }
-    if (!res.body) {
-      throw new Error(`attachment download returned empty body: ${att.name ?? att.id}`);
-    }
-    // Stream the response so an oversized payload is aborted before the
-    // full body lands in memory. Buffering via arrayBuffer() first would
-    // already exceed MAX_ATTACHMENT_BYTES by the time we checked length.
-    const reader = res.body.getReader();
-    const chunks = [];
-    let received = 0;
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        if (!value) continue;
-        received += value.byteLength;
-        if (received > MAX_ATTACHMENT_BYTES) {
-          try { await reader.cancel(); } catch {}
-          throw new Error(
-            `attachment payload too large: exceeded ${MAX_ATTACHMENT_BYTES / 1024 / 1024}MB while streaming (${att.name ?? att.id})`
-          );
-        }
-        chunks.push(value);
-      }
-    } finally {
-      try { reader.releaseLock(); } catch {}
-    }
-    if (received === 0) {
-      throw new Error(`attachment download returned empty buffer: ${att.name ?? att.id}`);
-    }
-    const buf = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)), received);
-    if (att.size > 0 && buf.length !== att.size) {
-      process.stderr.write(`mixdog discord: attachment size mismatch: expected ${att.size} got ${buf.length} (${att.name ?? att.id})\n`);
-    }
-    const name = att.name ?? `${att.id}`;
-    const rawExt = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1) : "bin";
-    const ext = rawExt.replace(/[^a-zA-Z0-9]/g, "") || "bin";
-    const safeId = String(att.id).replace(/[^a-zA-Z0-9_-]/g, "_");
-    mkdirSync(this.inboxDir, { recursive: true });
-    const candidate = join(this.inboxDir, `${Date.now()}-${safeId}.${ext}`);
-    const resolvedInbox = realpathSync(this.inboxDir);
-    if (!candidate.startsWith(resolvedInbox + sep)) {
-      throw new Error(`attachment path traversal rejected: ${candidate}`);
-    }
-    writeFileSync(candidate, buf);
-    return candidate;
+    return downloadSingleAttachment(att, this.inboxDir);
   }
 }
 export {

package/src/runtime/channels/backends/telegram.mjs

@@ -112,22 +112,18 @@ class TelegramBackend {
   formatOutgoing(text) {
     return text;
   }
-  // Fold every channelsConfig entry's channelId into access.channels, mirroring
-  // DiscordBackend.readConfigAccess(). Read live so same-backend channel adds
-  // apply without a restart. Falls back to initialAccess if the read throws.
+  // Fold the single configured main channel id into access.channels, mirroring
+  // DiscordBackend.readConfigAccess(). Read live so a channel change applies
+  // without a restart. Falls back to initialAccess if the read throws.
   readConfigAccess() {
     try {
       const parsed = readSection("channels");
       const access = normalizeAccess(parsed.access ?? this.initialAccess);
-      if (parsed.channelsConfig) {
-        for (const entry of Object.values(parsed.channelsConfig)) {
-          if (typeof entry === "object" && entry !== null) {
-            const id = entry.channelId;
-            if (id && !(id in access.channels)) {
-              access.channels[id] = { requireMention: false, allowFrom: [] };
-            }
-          }
-        }
+      // Single main channel: auto-allow the configured channel id so a channel
+      // change applies without a restart (mirrors loadAccess()).
+      const id = this.mainChannelId;
+      if (id && !(id in access.channels)) {
+        access.channels[id] = { requireMention: false, allowFrom: [] };
       }
       return access;
     } catch {