polygram 0.8.0-rc.67 → 0.8.0-rc.68

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "polygram",
-  "version": "0.8.0-rc.67",
+  "version": "0.8.0-rc.68",
   "description": "Telegram integration for Claude Code that preserves the OpenClaw per-chat session model. Migration target for OpenClaw users. Multi-bot, multi-chat, per-topic isolation; SQLite transcripts; inline-keyboard approvals. Bundles /polygram:status|logs|pair-code|approvals admin commands plus history (transcript queries) and polygram-send (out-of-turn IPC sends with file-upload validation) skills.",
   "keywords": [
     "telegram",

package/lib/attachments.js

@@ -6,6 +6,20 @@
  * No count cap: per-file (10 MB) and total-size (20 MB) bound resource
  * usage already; an additional count limit just produces "skipped: max
  * count" surprises on Telegram albums (up to 10 photos in one send).
+ *
+ * rc.68 — widened scope:
+ *   - archives (zip + alt zip MIME some Telegram clients send): containers
+ *     the agent unpacks via Bash + unzip when downstream tools are gated
+ *     in. Size caps remain the binding control.
+ *   - markup the agent reads natively but was silently being denied unless
+ *     the client happened to ship it as text/plain (markdown, html, yaml,
+ *     xml). Closes the consistency gap.
+ *   - extension-fallback path for missing/octet-stream MIME. Telegram's
+ *     server-side detection degrades to octet-stream (or omits MIME) for
+ *     extensions it doesn't sniff; the fallback trusts the filename when
+ *     extension is on the same well-known list. Defense-in-depth: explicit
+ *     denylisted MIME (e.g. application/x-msdownload) still wins over
+ *     extension — the fallback only kicks in when MIME is unhelpful.
  */
 
 const MAX_FILE_BYTES = 10 * 1024 * 1024;
@@ -16,12 +30,42 @@ const MIME_ALLOW = [
   /^application\/msword$/, /^application\/vnd\.openxmlformats-/,
   /^application\/vnd\.ms-excel$/, /^application\/json$/,
   /^text\/csv$/,
+  // rc.68: archives + markup formats Claude reads natively.
+  /^application\/zip$/, /^application\/x-zip-compressed$/,
+  /^text\/markdown$/,
+  /^text\/html$/,
+  /^text\/yaml$/, /^application\/yaml$/, /^application\/x-yaml$/,
+  /^application\/xml$/, /^text\/xml$/,
 ];
 
+// rc.68: extensions trusted when MIME is missing or generic
+// (application/octet-stream). Same set the explicit MIME list covers, so
+// the fallback is "trust the filename when MIME is unhelpful" — not "any
+// extension goes." A file named foo.exe with empty MIME stays rejected.
+const EXTENSION_ALLOW = new Set([
+  // archives
+  'zip',
+  // text / structured data
+  'txt', 'md', 'csv', 'json', 'yaml', 'yml', 'xml', 'html',
+  // documents
+  'pdf', 'doc', 'docx', 'xls', 'xlsx',
+]);
+// MIME values that mean "I have no idea what this is" — fall back to
+// extension match for these.
+const FALLBACK_MIMES = new Set(['', 'application/octet-stream']);
+
+function extensionOf(name) {
+  if (!name) return '';
+  const dot = String(name).lastIndexOf('.');
+  if (dot < 0 || dot === name.length - 1) return '';
+  return name.slice(dot + 1).toLowerCase();
+}
+
 function filterAttachments(attachments, opts = {}) {
   const maxFileBytes = opts.maxFileBytes ?? MAX_FILE_BYTES;
   const maxTotalBytes = opts.maxTotalBytes ?? MAX_TOTAL_BYTES;
   const mimeAllow = opts.mimeAllow ?? MIME_ALLOW;
+  const extensionAllow = opts.extensionAllow ?? EXTENSION_ALLOW;
 
   const accepted = [];
   const rejected = [];
@@ -29,7 +73,15 @@ function filterAttachments(attachments, opts = {}) {
 
   for (const a of attachments || []) {
     const mime = a.mime_type || '';
-    if (!mimeAllow.some((re) => re.test(mime))) {
+    const mimeOk = mimeAllow.some((re) => re.test(mime));
+    // rc.68: extension fallback only when MIME is unhelpful (empty or
+    // octet-stream). An explicit MIME — even one we don't allow — wins
+    // over the extension; that keeps malware.zip with mime
+    // application/x-msdownload from sneaking through via the .zip suffix.
+    const fallbackOk = !mimeOk
+      && FALLBACK_MIMES.has(mime)
+      && extensionAllow.has(extensionOf(a.name));
+    if (!mimeOk && !fallbackOk) {
       rejected.push({ att: a, reason: `mime not allowed (${mime || 'unknown'})` });
       continue;
     }
@@ -55,4 +107,11 @@ function filterAttachments(attachments, opts = {}) {
   return { accepted, rejected, totalBytes };
 }
 
-module.exports = { filterAttachments, MAX_FILE_BYTES, MAX_TOTAL_BYTES, MIME_ALLOW };
+module.exports = {
+  filterAttachments,
+  MAX_FILE_BYTES,
+  MAX_TOTAL_BYTES,
+  MIME_ALLOW,
+  EXTENSION_ALLOW,
+  FALLBACK_MIMES,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.8.0-rc.67",
+  "version": "0.8.0-rc.68",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc-client.js",
   "bin": {