switchroom 0.16.23 → 0.16.27

package/telegram-plugin/html-sanitize.ts

@@ -1,244 +0,0 @@
-/**
- * Telegram-HTML sanitizer.
- *
- * Telegram's HTML parser is strict: it accepts only a small whitelist of
- * tags (b/strong, i/em, u/ins, s/strike/del, code, pre, a, tg-spoiler,
- * span class="tg-spoiler", tg-emoji, blockquote) and rejects the entire
- * message with `400 Bad Request: can't parse entities` when it encounters
- * an unknown tag, an unbalanced tag, or a stray `<` that doesn't open a
- * known tag.
- *
- * `markdownToHtml()` already produces well-formed HTML for content the
- * model wrote *as markdown*. This module is the second line of defence
- * for content the model wrote *as raw HTML* (or as a mix that produces
- * malformed HTML after rendering): we run the rendered string through a
- * pure-text scanner that:
- *
- *   1. Escapes any `<` / `>` that doesn't open or close a whitelisted
- *      tag (e.g. `<frobnicate>` → `&lt;frobnicate&gt;`,
- *      `1 < 2 < 3` → `1 &lt; 2 &lt; 3`).
- *   2. Escapes attributes that aren't on the small per-tag allowlist
- *      (only `<a href>`, `<code class>`, `<span class="tg-spoiler">`,
- *      `<tg-emoji emoji-id>`, `<blockquote expandable>` are accepted —
- *      everything else gets stripped from the tag).
- *   3. Auto-closes any tag opened but never closed (so an "unclosed
- *      `<b>` at end of message" doesn't trip Telegram's parser).
- *   4. Drops any unmatched closing tag (e.g. `</foo>` without an opener).
- *
- * The sanitizer is conservative: when in doubt, escape. The output is
- * guaranteed to round-trip through Telegram's HTML parser without a
- * `can't parse entities` 400 — at the cost of some false positives where
- * raw `<` characters inside model prose end up as `&lt;` (which is the
- * correct Telegram-HTML behaviour anyway).
- *
- * Idempotent: sanitize(sanitize(x)) === sanitize(x).
- */
-
-/** Telegram's parse_mode=HTML allowed tag names. */
-const ALLOWED_TAGS = new Set([
-  'b', 'strong',
-  'i', 'em',
-  'u', 'ins',
-  's', 'strike', 'del',
-  'a',
-  'code',
-  'pre',
-  'span',
-  'tg-spoiler',
-  'tg-emoji',
-  'blockquote',
-])
-
-/**
- * Per-tag attribute allowlist. Keys are tag names; values are the set of
- * attribute names that survive the sanitizer. Anything not listed is
- * silently dropped from the opening tag.
- */
-const ALLOWED_ATTRS: Record<string, Set<string>> = {
-  a: new Set(['href']),
-  code: new Set(['class']),
-  span: new Set(['class']),
-  'tg-emoji': new Set(['emoji-id']),
-  blockquote: new Set(['expandable']),
-  pre: new Set(['language']),
-}
-
-/** Allowed schemes for `<a href>` — block javascript:, data:, etc. */
-const ALLOWED_HREF_SCHEMES = /^(?:https?|mailto|tel|tg):/i
-
-/**
- * Strip every `<…>` from a string, escaping the `<` and `>`. Used as the
- * fallback when the input genuinely cannot be made HTML-safe.
- */
-export function escapeAllHtml(text: string): string {
-  return text
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-}
-
-/**
- * Sanitize a string of Telegram HTML so it cannot trip the
- * `can't parse entities` 400. See module docstring for the rules.
- *
- * @param input - the rendered HTML (post markdownToHtml).
- * @returns the sanitized HTML, guaranteed parse-mode=HTML safe.
- */
-export function sanitizeTelegramHtml(input: string): string {
-  // Walk the input character by character. When we see `<`, try to match
-  // a tag against our whitelist. If it matches, emit a normalized form;
-  // otherwise escape the `<` and continue.
-  //
-  // Tag regex: opening tag name, optional attributes (anything up to
-  // the next `>` that isn't inside a quoted string), and the closing
-  // `>`. We use a small hand-rolled parser rather than a generic regex
-  // because we need to validate attributes per-tag.
-  const out: string[] = []
-  const stack: string[] = [] // names of open tags, oldest-first
-  let i = 0
-  const len = input.length
-
-  while (i < len) {
-    const ch = input[i]
-
-    if (ch === '&') {
-      // Pass through known entities verbatim; escape bare `&`.
-      // A "known entity" is `&` followed by [a-z]+; or `&#` followed by digits;
-      // both terminated by `;` within ~10 chars.
-      const m = /^&(?:#\d+|#x[0-9a-f]+|[a-z]+);/i.exec(input.slice(i, i + 12))
-      if (m) {
-        out.push(m[0])
-        i += m[0].length
-      } else {
-        out.push('&amp;')
-        i++
-      }
-      continue
-    }
-
-    if (ch !== '<') {
-      out.push(ch)
-      i++
-      continue
-    }
-
-    // We're at a `<`. Try to parse a tag.
-    const tagMatch = /^<\s*(\/?)\s*([a-zA-Z][a-zA-Z0-9-]*)\b([^>]*)>/.exec(input.slice(i))
-    if (!tagMatch) {
-      // Stray `<` — escape it.
-      out.push('&lt;')
-      i++
-      continue
-    }
-    const isClose = tagMatch[1] === '/'
-    const tagName = tagMatch[2].toLowerCase()
-    const attrText = tagMatch[3]
-
-    if (!ALLOWED_TAGS.has(tagName)) {
-      // Unknown tag — escape the whole `<…>` literal.
-      out.push(escapeAllHtml(tagMatch[0]))
-      i += tagMatch[0].length
-      continue
-    }
-
-    if (isClose) {
-      // Closing tag: only emit if it matches the most recently opened
-      // tag of the same name. If the stack contains a matching opener
-      // earlier, close out everything above it (auto-close any
-      // unbalanced inner tags). If there's no matching opener at all,
-      // drop the closing tag silently.
-      const idx = stack.lastIndexOf(tagName)
-      if (idx === -1) {
-        // No matching opener — drop the close tag.
-        i += tagMatch[0].length
-        continue
-      }
-      // Auto-close anything above the matching opener.
-      while (stack.length > idx + 1) {
-        const top = stack.pop()!
-        out.push(`</${top}>`)
-      }
-      stack.pop()
-      out.push(`</${tagName}>`)
-      i += tagMatch[0].length
-      continue
-    }
-
-    // Opening tag: filter attributes.
-    const cleanAttrs = sanitizeAttrs(tagName, attrText)
-    out.push(`<${tagName}${cleanAttrs}>`)
-    // Self-closing void tags? Telegram has none — every allowed tag is
-    // a container. Push onto stack so we can auto-close later.
-    stack.push(tagName)
-    i += tagMatch[0].length
-  }
-
-  // Auto-close any unclosed tags so the output is balanced.
-  while (stack.length > 0) {
-    const top = stack.pop()!
-    out.push(`</${top}>`)
-  }
-
-  return out.join('')
-}
-
-/**
- * Filter the attribute string of an opening tag against the per-tag
- * allowlist. Returns the cleaned attribute string with a leading space
- * (or empty string when no attributes survive).
- */
-function sanitizeAttrs(tagName: string, attrText: string): string {
-  const allowed = ALLOWED_ATTRS[tagName]
-  if (!allowed || allowed.size === 0) return ''
-
-  // Match attribute name=value or bare name. Value may be double-quoted,
-  // single-quoted, or unquoted.
-  const attrRe = /([a-zA-Z_][a-zA-Z0-9_-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g
-  const kept: string[] = []
-  let m: RegExpExecArray | null
-  while ((m = attrRe.exec(attrText)) != null) {
-    const name = m[1].toLowerCase()
-    if (!allowed.has(name)) continue
-    const rawValue = m[2] ?? m[3] ?? m[4] ?? ''
-
-    // Per-attribute value sanitization.
-    if (tagName === 'a' && name === 'href') {
-      const trimmed = rawValue.trim()
-      if (!ALLOWED_HREF_SCHEMES.test(trimmed)) continue
-      kept.push(`href="${escapeAttrValue(trimmed)}"`)
-      continue
-    }
-    if (rawValue.length === 0) {
-      // Bare attribute like `<blockquote expandable>`.
-      kept.push(name)
-      continue
-    }
-    kept.push(`${name}="${escapeAttrValue(rawValue)}"`)
-  }
-  return kept.length > 0 ? ' ' + kept.join(' ') : ''
-}
-
-function escapeAttrValue(v: string): string {
-  return v
-    .replace(/&/g, '&amp;')
-    .replace(/"/g, '&quot;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-}
-
-/**
- * Convert a rendered HTML body to a plain-text fallback. Used when
- * Telegram still rejects the (presumably-already-sanitized) HTML — we
- * strip every tag and unescape entities so the message lands as text
- * instead of disappearing.
- */
-export function htmlToPlainText(html: string): string {
-  return html
-    // Drop tags entirely.
-    .replace(/<\/?[a-zA-Z][a-zA-Z0-9-]*\b[^>]*>/g, '')
-    // Unescape the four entities the encoder produces.
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"')
-    .replace(/&amp;/g, '&')
-}

package/telegram-plugin/tests/html-sanitize.test.ts

@@ -1,146 +0,0 @@
-/**
- * Unit tests for the Telegram-HTML sanitizer (issue #657).
- *
- * The sanitizer is the pre-validation layer that runs after
- * markdownToHtml() and before bot.api.sendMessage. Its job is to
- * guarantee that whatever HTML it emits, Telegram will accept under
- * parse_mode=HTML — closing the `400 Bad Request: can't parse entities`
- * loophole that produced the duplicate-message symptom in #657.
- */
-
-import { describe, it, expect } from 'vitest'
-import {
-  sanitizeTelegramHtml,
-  htmlToPlainText,
-  escapeAllHtml,
-} from '../html-sanitize.js'
-
-describe('sanitizeTelegramHtml', () => {
-  it('passes whitelisted tags through unchanged', () => {
-    expect(sanitizeTelegramHtml('<b>bold</b>')).toBe('<b>bold</b>')
-    expect(sanitizeTelegramHtml('<i>italic</i>')).toBe('<i>italic</i>')
-    expect(sanitizeTelegramHtml('<code>x</code>')).toBe('<code>x</code>')
-    expect(sanitizeTelegramHtml('<pre>block</pre>')).toBe('<pre>block</pre>')
-    expect(sanitizeTelegramHtml('<blockquote>q</blockquote>')).toBe('<blockquote>q</blockquote>')
-  })
-
-  it('escapes unknown tags', () => {
-    expect(sanitizeTelegramHtml('<frobnicate>x</frobnicate>')).toBe(
-      '&lt;frobnicate&gt;x&lt;/frobnicate&gt;',
-    )
-    expect(sanitizeTelegramHtml('<div>hi</div>')).toBe('&lt;div&gt;hi&lt;/div&gt;')
-  })
-
-  it('escapes stray < that does not open a tag', () => {
-    expect(sanitizeTelegramHtml('1 < 2 < 3')).toBe('1 &lt; 2 &lt; 3')
-    expect(sanitizeTelegramHtml('a < b')).toBe('a &lt; b')
-  })
-
-  it('auto-closes unclosed whitelisted tags', () => {
-    expect(sanitizeTelegramHtml('<b>unfinished')).toBe('<b>unfinished</b>')
-    expect(sanitizeTelegramHtml('<b><i>nested')).toBe('<b><i>nested</i></b>')
-  })
-
-  it('drops unmatched closing tags', () => {
-    expect(sanitizeTelegramHtml('hello</b>')).toBe('hello')
-    expect(sanitizeTelegramHtml('</i>plain')).toBe('plain')
-  })
-
-  it('auto-closes inner tags when an outer is closed early', () => {
-    // <b><i>x</b>  →  <b><i>x</i></b>
-    const out = sanitizeTelegramHtml('<b><i>x</b>')
-    expect(out).toBe('<b><i>x</i></b>')
-  })
-
-  it('strips disallowed attributes', () => {
-    expect(sanitizeTelegramHtml('<b class="evil" onclick="x()">x</b>')).toBe('<b>x</b>')
-    // <code class> is allowed
-    expect(sanitizeTelegramHtml('<code class="language-ts">x</code>')).toBe(
-      '<code class="language-ts">x</code>',
-    )
-  })
-
-  it('blocks dangerous href schemes', () => {
-    expect(sanitizeTelegramHtml('<a href="javascript:alert(1)">x</a>')).toBe('<a>x</a>')
-    expect(sanitizeTelegramHtml('<a href="data:text/html,x">x</a>')).toBe('<a>x</a>')
-    expect(sanitizeTelegramHtml('<a href="https://example.com">x</a>')).toBe(
-      '<a href="https://example.com">x</a>',
-    )
-  })
-
-  it('escapes naked ampersands but preserves entities', () => {
-    expect(sanitizeTelegramHtml('a & b')).toBe('a &amp; b')
-    expect(sanitizeTelegramHtml('a &amp; b')).toBe('a &amp; b')
-    expect(sanitizeTelegramHtml('a &lt;b&gt;')).toBe('a &lt;b&gt;')
-    expect(sanitizeTelegramHtml('a &#123;')).toBe('a &#123;')
-  })
-
-  it('is idempotent', () => {
-    const fixtures = [
-      '<b>x</b>',
-      '<b><i>nested</i></b>',
-      '<b>unclosed',
-      '<frobnicate>x</frobnicate>',
-      '1 < 2',
-      '<b><i>x</b>',
-      'a & b & c',
-    ]
-    for (const f of fixtures) {
-      const once = sanitizeTelegramHtml(f)
-      const twice = sanitizeTelegramHtml(once)
-      expect(twice).toBe(once)
-    }
-  })
-
-  it('handles the #657 repro fixture (1799-char "Where I route" message shape)', () => {
-    // Reconstruct the structural shape of the body that tripped Telegram.
-    // The exact text isn't checked into the repo; what matters is the
-    // pattern: nested <code> inside <b> inside <pre>, plus a stray `<`
-    // in the middle of the prose, plus an unclosed tag near the end.
-    const fixture = [
-      '<b>Where I route:</b>',
-      '',
-      '<pre><b><code>switchroom &lt;cmd&gt;</code></b></pre>',
-      '',
-      'When the user types `cmd <args>` in the bridge, the gateway forwards…',
-      '',
-      '<b>Some unclosed bold here',
-      '<frobnicate>not a real tag</frobnicate>',
-    ].join('\n')
-
-    const out = sanitizeTelegramHtml(fixture)
-
-    // Must not contain any unknown tag literally.
-    expect(out).not.toMatch(/<frobnicate/)
-    // Stray < (in `cmd <args>`) is escaped.
-    expect(out).toContain('&lt;args&gt;')
-    // The unclosed <b> at end has been auto-closed.
-    const opens = (out.match(/<b\b[^>]*>/g) ?? []).length
-    const closes = (out.match(/<\/b>/g) ?? []).length
-    expect(opens).toBe(closes)
-  })
-
-  it('treats an attribute on a void/unknown tag like any unknown tag', () => {
-    expect(sanitizeTelegramHtml('<img src="x">')).toBe('&lt;img src="x"&gt;')
-  })
-
-  it('preserves blockquote expandable bare attribute', () => {
-    expect(sanitizeTelegramHtml('<blockquote expandable>x</blockquote>')).toBe(
-      '<blockquote expandable>x</blockquote>',
-    )
-  })
-})
-
-describe('htmlToPlainText', () => {
-  it('strips tags and unescapes entities', () => {
-    expect(htmlToPlainText('<b>hi</b>')).toBe('hi')
-    expect(htmlToPlainText('<b>a</b> &lt;b&gt; c')).toBe('a <b> c')
-    expect(htmlToPlainText('a &amp; b')).toBe('a & b')
-  })
-})
-
-describe('escapeAllHtml', () => {
-  it('escapes all three HTML metachars', () => {
-    expect(escapeAllHtml('<b>&hi</b>')).toBe('&lt;b&gt;&amp;hi&lt;/b&gt;')
-  })
-})

package/telegram-plugin/tests/parse-mode-rotation.test.ts

@@ -1,162 +0,0 @@
-/**
- * Integration tests for stream-reply parseMode rotation.
- *
- * Covers the specific bug-1 scenario in stream-reply-handler.ts: when
- * two stream_reply calls land on the same chat+thread+lane but with
- * different parseMode (e.g. PTY-tail auto-stream creates a text-mode
- * stream, then an explicit stream_reply with format:'html' reuses it),
- * the stale controller must be finalized + discarded and a fresh one
- * created with the new mode.
- *
- * Without that, the second call inherits the wrong parseMode and sends
- * literal markdown, or edits the wrong baked-in format into Telegram.
- */
-
-import { describe, it, expect, beforeEach, afterEach } from 'vitest'
-import { handleStreamReply, type StreamReplyDeps, type StreamReplyState } from '../stream-reply-handler.js'
-import type { DraftStreamHandle } from '../draft-stream.js'
-import { markdownToHtml as realMarkdownToHtml } from '../format.js'
-import { createFakeBotApi, type FakeBot } from './fake-bot-api.js'
-
-function makeState(): StreamReplyState {
-  return {
-    activeDraftStreams: new Map<string, DraftStreamHandle>(),
-    activeDraftParseModes: new Map<string, 'HTML' | 'MarkdownV2' | undefined>(),
-  }
-}
-
-function makeDeps(bot: FakeBot, overrides?: Partial<StreamReplyDeps>): StreamReplyDeps {
-  return {
-    bot: bot as unknown as StreamReplyDeps['bot'],
-    markdownToHtml: (t) => realMarkdownToHtml(t),
-    escapeMarkdownV2: (t) => `ESC(${t})`,
-    repairEscapedWhitespace: (t) => t,
-    assertAllowedChat: () => {},
-    resolveThreadId: (_, explicit) => (explicit != null ? Number(explicit) : undefined),
-    disableLinkPreview: true,
-    defaultFormat: 'html',
-    logStreamingEvent: () => {},
-    historyEnabled: false,
-    recordOutbound: () => {},
-    writeError: () => {},
-    throttleMs: 0,
-    ...overrides,
-  }
-}
-
-describe('stream-reply parseMode rotation', () => {
-  let bot: FakeBot
-
-  beforeEach(() => {
-    bot = createFakeBotApi({ startMessageId: 500 })
-  })
-
-  it('same format → stream is reused (no rotation)', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot)
-
-    await handleStreamReply({ chat_id: 'c', text: 'v1', format: 'html' }, state, deps)
-    const streamBefore = state.activeDraftStreams.get('c:_')
-    await handleStreamReply({ chat_id: 'c', text: 'v2', format: 'html' }, state, deps)
-    const streamAfter = state.activeDraftStreams.get('c:_')
-
-    expect(streamBefore).toBe(streamAfter) // identity preserved
-    expect(bot.state.sent).toHaveLength(1)
-    expect(bot.api.editMessageText).toHaveBeenCalled()
-  })
-
-  it('html → markdownv2 rotation: old stream finalized, new one created', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot)
-
-    await handleStreamReply({ chat_id: 'c', text: 'hello', format: 'html' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBe('HTML')
-    const firstStreamHandle = state.activeDraftStreams.get('c:_')
-
-    // Now call with a different parse mode.
-    await handleStreamReply({ chat_id: 'c', text: 'hello2', format: 'markdownv2' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBe('MarkdownV2')
-    const secondStreamHandle = state.activeDraftStreams.get('c:_')
-
-    // Stream instance should have been replaced.
-    expect(secondStreamHandle).not.toBe(firstStreamHandle)
-    // Two messages sent — one in html, one in markdownv2.
-    expect(bot.state.sent).toHaveLength(2)
-    expect(bot.state.sent[0].parse_mode).toBe('HTML')
-    expect(bot.state.sent[1].parse_mode).toBe('MarkdownV2')
-    // The second message's text ran through the MarkdownV2 escaper.
-    expect(bot.state.sent[1].text).toBe('ESC(hello2)')
-  })
-
-  it('undefined (text) → html rotation: old stream finalized, new one created', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot, { defaultFormat: 'text' })
-
-    // First call in text mode (no parse_mode).
-    await handleStreamReply({ chat_id: 'c', text: 'plain', format: 'text' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBeUndefined()
-    expect(bot.state.sent[0].parse_mode).toBeUndefined()
-
-    // Second call in html.
-    await handleStreamReply({ chat_id: 'c', text: 'rich', format: 'html' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBe('HTML')
-    expect(bot.state.sent).toHaveLength(2)
-    expect(bot.state.sent[1].parse_mode).toBe('HTML')
-  })
-
-  it('markdownv2 → undefined rotation', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot)
-
-    await handleStreamReply({ chat_id: 'c', text: 'a', format: 'markdownv2' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBe('MarkdownV2')
-
-    await handleStreamReply({ chat_id: 'c', text: 'b', format: 'text' }, state, deps)
-    expect(state.activeDraftParseModes.get('c:_')).toBeUndefined()
-    expect(bot.state.sent).toHaveLength(2)
-    expect(bot.state.sent[0].parse_mode).toBe('MarkdownV2')
-    expect(bot.state.sent[1].parse_mode).toBeUndefined()
-  })
-
-  it('rotation across two distinct lanes is independent', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot)
-
-    await handleStreamReply(
-      { chat_id: 'c', text: 'main', format: 'html', lane: 'main' },
-      state,
-      deps,
-    )
-    await handleStreamReply(
-      { chat_id: 'c', text: 'activity', format: 'text', lane: 'activity' },
-      state,
-      deps,
-    )
-
-    expect(state.activeDraftParseModes.get('c:_:main')).toBe('HTML')
-    expect(state.activeDraftParseModes.get('c:_:activity')).toBeUndefined()
-    // Two messages: different lanes, different modes, different streams.
-    expect(bot.state.sent).toHaveLength(2)
-  })
-
-  it('rotation across threads is independent', async () => {
-    const state = makeState()
-    const deps = makeDeps(bot)
-
-    await handleStreamReply(
-      { chat_id: 'c', text: 'thread-a', format: 'html', message_thread_id: '1' },
-      state,
-      deps,
-    )
-    await handleStreamReply(
-      { chat_id: 'c', text: 'thread-b', format: 'markdownv2', message_thread_id: '2' },
-      state,
-      deps,
-    )
-
-    expect(state.activeDraftStreams.size).toBe(2)
-    expect(state.activeDraftParseModes.get('c:1')).toBe('HTML')
-    expect(state.activeDraftParseModes.get('c:2')).toBe('MarkdownV2')
-    expect(bot.state.sent).toHaveLength(2)
-  })
-})