polygram 0.12.0-rc.2 → 0.12.0-rc.21

package/lib/handlers/download.js

@@ -24,7 +24,7 @@
 const fs = require('fs');
 const path = require('path');
 const { redactBotToken } = require('../error/net');
-const { MAX_FILE_BYTES } = require('../attachments');
+const { MAX_FILE_BYTES, resolveFileCaps } = require('../attachments');
 
 const ATTACHMENT_DOWNLOAD_CONCURRENCY_DEFAULT = 6;
 
@@ -60,76 +60,119 @@ function createDownloadAttachments({
       } catch { /* fall through to refetch */ }
     }
     try {
+      // Inbound per-file cap is BACKEND-derived: 20 MB on cloud Telegram
+      // (Telegram's own getFile ceiling), 2 GB with the local Bot API server.
+      // rc.15: previously hardcoded to MAX_FILE_BYTES (20 MB), which rejected
+      // large lossless tracks even when the local server could handle them.
+      const cap = resolveFileCaps({ localApi: !!config.bot?.apiRoot }).inBytes;
+
       const fileInfo = await bot.api.getFile(att.file_id);
       if (!fileInfo?.file_path) throw new Error('no file_path from getFile');
-      const url = `https://api.telegram.org/file/bot${token}/${fileInfo.file_path}`;
-      const res = await fetchImpl(url);
-      if (!res.ok) throw new Error(`HTTP ${res.status}`);
-      // Three-layer size enforcement, in order of cheapness:
-      //   1. Content-Length header — fail-fast before reading body.
-      //   2. Streaming accumulator — abort the moment cumulative byte
-      //      count crosses the cap. Defends against attackers omitting
-      //      Content-Length: pre-cap the whole body could pin RSS.
-      //   3. Final post-buffer check — defense in depth.
-      const cl = parseInt(res.headers.get('content-length') || '0', 10);
-      if (cl > MAX_FILE_BYTES) {
-        throw new Error(`content-length ${cl} exceeds per-file cap ${MAX_FILE_BYTES}`);
-      }
-      let total = 0;
-      const chunks = [];
-      if (res.body && typeof res.body.getReader === 'function') {
-        const reader = res.body.getReader();
-        while (true) {
-          const { done, value } = await reader.read();
-          if (done) break;
-          total += value.byteLength;
-          if (total > MAX_FILE_BYTES) {
-            try { await reader.cancel(); } catch {}
-            throw new Error(`stream ${total}+ bytes exceeds per-file cap ${MAX_FILE_BYTES}`);
-          }
-          chunks.push(value);
-        }
-      } else {
-        // Fallback for runtimes without WHATWG streams (shouldn't fire
-        // on Node 22+).
-        const ab = await res.arrayBuffer();
-        if (ab.byteLength > MAX_FILE_BYTES) {
-          throw new Error(`body ${ab.byteLength} bytes exceeds per-file cap ${MAX_FILE_BYTES}`);
-        }
-        chunks.push(new Uint8Array(ab));
-        total = ab.byteLength;
-      }
-      const buf = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)));
-      if (buf.length > MAX_FILE_BYTES) {
-        throw new Error(`body ${buf.length} bytes exceeds per-file cap ${MAX_FILE_BYTES}`);
-      }
+
       const safeName = sanitizeFilename(att.name);
       // Embed file_unique_id so two attachments with the same msg_id+name
       // (album, resend) can't silently overwrite each other.
       const uniq = att.file_unique_id ? `-${att.file_unique_id}` : '';
       const localName = `${msg.message_id}${uniq}-${safeName}`;
       const localPath = path.join(chatDir, localName);
-      // Atomic write: temp file + rename. A crash mid-write leaves a
-      // .tmp.* file (swept later) rather than a truncated canonical
-      // file the EEXIST dedup branch would happily serve next time.
-      if (fs.existsSync(localPath)) {
-        logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (already on disk, reusing)`);
+
+      let size;
+
+      if (path.isAbsolute(fileInfo.file_path)) {
+        // ── Local Bot API server ────────────────────────────────────────
+        // rc.15: in `--local` mode getFile returns a LOCAL ABSOLUTE PATH —
+        // the server has already downloaded the file to its own disk. The
+        // previous code built a cloud URL (https://api.telegram.org/file/...)
+        // and HTTP-fetched it, which is nonsensical for a local path and
+        // failed every inbound file once apiRoot was set. Instead, link the
+        // file into the inbox directly (no HTTP, no buffering a 2 GB file
+        // through RAM). A hardlink is instant and shares the inode, so it
+        // survives the server pruning its own copy; fall back to a byte copy
+        // across filesystems.
+        const srcStat = fs.statSync(fileInfo.file_path);
+        if (srcStat.size > cap) {
+          throw new Error(`file ${srcStat.size} exceeds per-file cap ${cap}`);
+        }
+        if (fs.existsSync(localPath)) {
+          logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (already on disk, reusing)`);
+        } else {
+          try {
+            fs.linkSync(fileInfo.file_path, localPath);
+          } catch (e) {
+            if (e.code === 'EEXIST') {
+              logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (race: already on disk)`);
+            } else if (e.code === 'EXDEV') {
+              fs.copyFileSync(fileInfo.file_path, localPath);   // cross-device fallback
+            } else {
+              throw e;
+            }
+          }
+        }
+        size = srcStat.size;
+        logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (${size} bytes, local-api) → ${localPath}`);
       } else {
-        const tmpPath = `${localPath}.tmp.${process.pid}.${Date.now()}`;
-        try {
-          fs.writeFileSync(tmpPath, buf, { flag: 'wx' });
-          fs.renameSync(tmpPath, localPath);
-        } catch (e) {
-          try { fs.unlinkSync(tmpPath); } catch {}
-          if (e.code !== 'EEXIST') throw e;
-          logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (race: already on disk)`);
+        // ── Cloud Telegram ──────────────────────────────────────────────
+        // getFile returns a RELATIVE path; download it over HTTPS with the
+        // three-layer size guard (header → streaming accumulator → final).
+        const url = `https://api.telegram.org/file/bot${token}/${fileInfo.file_path}`;
+        const res = await fetchImpl(url);
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        const cl = parseInt(res.headers.get('content-length') || '0', 10);
+        if (cl > cap) {
+          throw new Error(`content-length ${cl} exceeds per-file cap ${cap}`);
         }
+        let total = 0;
+        const chunks = [];
+        if (res.body && typeof res.body.getReader === 'function') {
+          const reader = res.body.getReader();
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            total += value.byteLength;
+            if (total > cap) {
+              try { await reader.cancel(); } catch {}
+              throw new Error(`stream ${total}+ bytes exceeds per-file cap ${cap}`);
+            }
+            chunks.push(value);
+          }
+        } else {
+          // Fallback for runtimes without WHATWG streams (shouldn't fire
+          // on Node 22+).
+          const ab = await res.arrayBuffer();
+          if (ab.byteLength > cap) {
+            throw new Error(`body ${ab.byteLength} bytes exceeds per-file cap ${cap}`);
+          }
+          chunks.push(new Uint8Array(ab));
+          total = ab.byteLength;
+        }
+        const buf = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)));
+        if (buf.length > cap) {
+          throw new Error(`body ${buf.length} bytes exceeds per-file cap ${cap}`);
+        }
+        // Atomic write: temp file + rename. A crash mid-write leaves a
+        // .tmp.* file (swept later) rather than a truncated canonical
+        // file the EEXIST dedup branch would happily serve next time.
+        if (fs.existsSync(localPath)) {
+          logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (already on disk, reusing)`);
+        } else {
+          const tmpPath = `${localPath}.tmp.${process.pid}.${Date.now()}`;
+          try {
+            fs.writeFileSync(tmpPath, buf, { flag: 'wx' });
+            fs.renameSync(tmpPath, localPath);
+          } catch (e) {
+            try { fs.unlinkSync(tmpPath); } catch {}
+            if (e.code !== 'EEXIST') throw e;
+            logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (race: already on disk)`);
+          }
+        }
+        size = buf.length;
+        logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (${size} bytes) → ${localPath}`);
       }
-      logger.log?.(`[attach] ${chatId} ← ${att.kind} ${safeName} (${buf.length} bytes) → ${localPath}`);
+
       dbWrite(() => db.markAttachmentDownloaded(att.id, {
-        local_path: localPath, size_bytes: att.size_bytes || buf.length,
+        local_path: localPath, size_bytes: att.size_bytes || size,
       }), `markAttachmentDownloaded ${att.id}`);
-      return { ...att, path: localPath, size: att.size_bytes || buf.length, error: null };
+      return { ...att, path: localPath, size: att.size_bytes || size, error: null };
     } catch (err) {
       // Don't drop the attachment silently — push it through with the
       // failure noted. buildAttachmentTags renders this as

package/lib/ipc/file-validator.js

@@ -50,7 +50,14 @@ function validateIpcFileParam(method, params = {}) {
   const fileParam = FILE_PARAM_BY_METHOD[method];
   if (!fileParam) return null;
   const val = params[fileParam];
-  if (typeof val !== 'string') return null;       // envelope/Buffer/etc — pass through
+  // { source: '/abs/path' } envelope — now coerced to a grammy InputFile in
+  // tg() (coerceFileParams). Validate it has a usable absolute source, else
+  // pass through (Buffer / stream / InputFile shapes).
+  if (val && typeof val === 'object' && typeof val.source === 'string') {
+    if (val.source.length === 0) return `polygram IPC: ${fileParam}.source is empty`;
+    return null;
+  }
+  if (typeof val !== 'string') return null;       // Buffer/InputFile/etc — pass through
   if (val.length === 0) return `polygram IPC: ${fileParam} is empty`;
 
   const looksUrl = /^(https?|ftp):\/\//i.test(val);

package/lib/process/channels-tool-dispatcher.js

@@ -125,7 +125,7 @@ function createChannelsToolDispatcher({
     || require('../telegram/process-agent-reply').processAndDeliverAgentText;
 
   return async function channelsToolDispatcher(call) {
-    const { sessionKey, chatId, threadId, toolName, text, files, sourceMsgId } = call;
+    const { sessionKey, chatId, threadId, toolName, text, files, sourceMsgId, maxOutboundFileBytes } = call;
 
     if (toolName !== 'reply') {
       // 0.11.0 Phase 1 ships `reply` only — react and edit_message are
@@ -196,6 +196,21 @@ function createChannelsToolDispatcher({
             failedAttachments.push({ path: filePath, error: check.error });
             continue;
           }
+          // Backend/chat-derived upload cap. Reject oversize BEFORE upload with
+          // a clear error (vs Telegram's cryptic 413/"file is too big") so
+          // claude can convert/compress and retry. maxOutboundFileBytes is
+          // undefined for non-channels callers → no cap (Telegram still gates).
+          if (typeof maxOutboundFileBytes === 'number' && maxOutboundFileBytes > 0) {
+            let size = 0;
+            try { size = fs.statSync(check.resolved).size; } catch {}
+            if (size > maxOutboundFileBytes) {
+              const mb = (n) => (n / (1024 * 1024)).toFixed(1);
+              const err = `file too large to send: ${mb(size)}MB > ${mb(maxOutboundFileBytes)}MB limit`;
+              logger.warn?.(`[channels-tool-dispatcher] ${err} (${check.resolved})`);
+              failedAttachments.push({ path: filePath, error: err });
+              continue;
+            }
+          }
           try {
             const ext = path.extname(check.resolved).toLowerCase();
             const isImage = ['.jpg', '.jpeg', '.png', '.gif', '.webp'].includes(ext);
@@ -203,7 +218,10 @@ function createChannelsToolDispatcher({
             const fieldName = isImage ? 'photo' : 'document';
             const params = {
               chat_id: chatId,
-              [fieldName]: { source: check.resolved },
+              // { source } envelope → grammy InputFile in tg()'s coerceFileParams.
+              // Pre-fix this bare object reached grammy unrecognized and every
+              // upload 400'd with "Wrong port number" (file-send never worked).
+              [fieldName]: { source: check.resolved, filename: path.basename(check.resolved) },
             };
             if (threadId) params.message_thread_id = threadId;
             await send(bot, method, params, { source: 'channels-tool-dispatcher', sessionKey });