virtualcode 1.9.2 → 2.0.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { tool } from "@opencode-ai/plugin/tool";
 import { Telegraf } from "telegraf";
-import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, renameSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 const LINK_FILE = join(homedir(), ".config", "opencode", "telegram-links.json");
@@ -8,51 +8,86 @@ const LINK_TMP = LINK_FILE + ".tmp";
 const TOKEN_FILE = join(homedir(), ".config", "opencode", "telegram-token.json");
 const TOKEN_TMP = TOKEN_FILE + ".tmp";
 const CONFIG_DIR = join(homedir(), ".config", "opencode");
-function loadLinks() {
+const TOKEN_REGEX = /^\d{8,12}:[\w-]{30,50}$/;
+const MAX_LRU_SIZE = 100;
+const PENDING_TIMEOUT_MS = 30_000;
+const RECONNECT_DELAYS = [5_000, 10_000, 20_000, 30_000];
+const MAX_TELEGRAM_INPUT = 4096;
+const MAX_TUI_TEXT = 400;
+const MIN_PREFIX_LEN = 4;
+const MAX_TOKENS_PER_CHUNK = 25;
+const MIN_HISTORY_LIMIT = 1;
+const FILE_MODE = 0o600;
+function safeChmod(p) {
     try {
-        if (existsSync(LINK_FILE)) {
-            return JSON.parse(readFileSync(LINK_FILE, "utf-8"));
-        }
+        chmodSync(p, FILE_MODE);
     }
     catch { }
-    return {};
 }
-function persistLinks(links) {
+function atomicWrite(path, tmp, data) {
     mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(LINK_TMP, JSON.stringify(links, null, 2));
+    writeFileSync(tmp, data);
+    safeChmod(tmp);
     try {
-        renameSync(LINK_TMP, LINK_FILE);
+        renameSync(tmp, path);
     }
     catch {
-        writeFileSync(LINK_FILE, JSON.stringify(links, null, 2));
+        writeFileSync(path, data);
     }
+    safeChmod(path);
+}
+function loadLinks() {
+    try {
+        if (existsSync(LINK_FILE)) {
+            const raw = readFileSync(LINK_FILE, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+    }
+    catch (err) {
+        debugLog("loadLinks failed:", userError(err));
+    }
+    return {};
+}
+function persistLinks(links) {
+    atomicWrite(LINK_FILE, LINK_TMP, JSON.stringify(links, null, 2));
 }
 function loadSavedToken() {
     try {
         if (existsSync(TOKEN_FILE)) {
             const data = JSON.parse(readFileSync(TOKEN_FILE, "utf-8"));
-            if (data?.token)
+            if (typeof data?.token === "string" && data.token.length > 0)
                 return data.token;
         }
     }
-    catch { }
+    catch (err) {
+        debugLog("loadSavedToken failed:", userError(err));
+    }
     return null;
 }
-function saveToken(token) {
-    mkdirSync(CONFIG_DIR, { recursive: true });
-    writeFileSync(TOKEN_TMP, JSON.stringify({ token }, null, 2));
+function clearSavedToken() {
     try {
-        renameSync(TOKEN_TMP, TOKEN_FILE);
-    }
-    catch {
-        writeFileSync(TOKEN_FILE, JSON.stringify({ token }, null, 2));
+        if (existsSync(TOKEN_FILE))
+            renameSync(TOKEN_FILE, TOKEN_FILE + ".bak");
     }
+    catch { }
+}
+function saveToken(token) {
+    atomicWrite(TOKEN_FILE, TOKEN_TMP, JSON.stringify({ token }, null, 2));
+}
+function isValidToken(token) {
+    if (typeof token !== "string")
+        return false;
+    if (token.length > 100)
+        return false;
+    return TOKEN_REGEX.test(token);
 }
 function userError(err) {
     if (!err)
         return "Unknown error";
     if (err instanceof Error) {
-        // Only first line — never include stack traces
         const first = err.message.split("\n")[0].trim();
         return first || "Unknown error";
     }
@@ -61,38 +96,41 @@ function userError(err) {
 }
 const DEBUG = !!process.env.DEBUG_TELEGRAM;
 function debugLog(...args) {
-    console.error("[telegram-plugin]", ...args);
     if (DEBUG) {
+        console.error("[telegram-plugin]", ...args);
         for (const a of args) {
             if (a instanceof Error)
-                console.error(a);
+                console.error(a.stack || a.message);
         }
     }
 }
 function sanitizeUI(text, maxLen = 200) {
     if (!text)
         return "";
-    // Remove stack trace lines ("  at ...")
-    let cleaned = text
+    let cleaned = String(text)
         .split("\n")
         .filter((line) => !/^\s*at\s/.test(line))
         .join(" ")
         .trim();
-    // Collapse whitespace
     cleaned = cleaned.replace(/\s+/g, " ");
-    // Truncate
     if (cleaned.length > maxLen) {
-        cleaned = cleaned.slice(0, maxLen - 3).trim() + "...";
+        cleaned = cleaned.slice(0, Math.max(0, maxLen - 3)).trim() + "...";
     }
     return cleaned;
 }
+function sanitizeTUI(text, maxLen = MAX_TUI_TEXT) {
+    const s = sanitizeUI(text, maxLen);
+    if (!s)
+        return "";
+    return s.length > maxLen ? s.slice(0, maxLen - 3) + "..." : s;
+}
 const KNOWN_ERRORS = [
-    [/Expected a string starting with "ses"/, "❌ Invalid session ID."],
-    [/ECONNRESET/, "❌ Connection lost."],
-    [/(409|Conflict)/, "❌ Another bot instance running."],
-    [/(401|Unauthorized|invalid.*token)/i, "❌ Invalid token."],
-    [/(403|Forbidden)/, "❌ Bot blocked."],
-    [/(socket|timeout)/i, "❌ Connection timed out."],
+    [/Expected a string starting with "ses"/, "Invalid session ID."],
+    [/ECONNRESET/, "Connection lost."],
+    [/(409|Conflict)/, "Another bot instance running."],
+    [/(401|Unauthorized|invalid.*token)/i, "Invalid token."],
+    [/(403|Forbidden)/, "Bot blocked."],
+    [/(socket|timeout)/i, "Connection timed out."],
 ];
 function handlePluginError(err, context) {
     const msg = userError(err);
@@ -101,9 +139,11 @@ function handlePluginError(err, context) {
         if (pattern.test(msg))
             return friendly;
     }
-    return "❌ Something went wrong.";
+    return "Something went wrong.";
 }
 function chunkText(text, maxLen = 4000) {
+    if (!text)
+        return [""];
     if (text.length <= maxLen)
         return [text];
     const chunks = [];
@@ -113,8 +153,33 @@ function chunkText(text, maxLen = 4000) {
     return chunks;
 }
 function fmtId(id) {
+    if (typeof id !== "string")
+        return "(invalid)";
     return id.length > 12 ? id.slice(0, 12) + "..." : id;
 }
+function findSessionById(id, list) {
+    if (typeof id !== "string" || !Array.isArray(list))
+        return { status: "not_found" };
+    const exact = list.find((s) => s && typeof s.id === "string" && s.id === id);
+    if (exact)
+        return { status: "found", session: exact };
+    if (id.length < MIN_PREFIX_LEN)
+        return { status: "not_found" };
+    const prefix = list.filter((s) => s && typeof s.id === "string" && s.id.startsWith(id));
+    if (prefix.length === 1)
+        return { status: "found", session: prefix[0] };
+    if (prefix.length > 1)
+        return { status: "ambiguous" };
+    return { status: "not_found" };
+}
+function safeList(arr) {
+    if (!Array.isArray(arr))
+        return [];
+    return arr.filter((s) => s && typeof s === "object" && typeof s.id === "string");
+}
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
 const TelegramPlugin = async ({ client, directory }, options) => {
     const config = options;
     const allowedSet = config?.allowed_users?.length ? new Set(config.allowed_users) : null;
@@ -122,6 +187,10 @@ const TelegramPlugin = async ({ client, directory }, options) => {
     let bot = null;
     let botReady = false;
     let botStarting = false;
+    let userStopped = false;
+    let savedToken = null;
+    let reconnectTimer = null;
+    let reconnectAttempts = 0;
     const lastForwardedBySession = new Map();
     const pendingTelegram = new Map();
     const links = loadLinks();
@@ -167,44 +236,112 @@ const TelegramPlugin = async ({ client, directory }, options) => {
         }
         persistLinks(links);
     }
-    async function sendToChats(chats, text) {
-        if (!botReady)
+    function lruSet(map, key, value) {
+        if (map.has(key)) {
+            map.delete(key);
+        }
+        else if (map.size >= MAX_LRU_SIZE) {
+            const oldest = map.keys().next().value;
+            if (oldest !== undefined)
+                map.delete(oldest);
+        }
+        map.set(key, value);
+    }
+    function setPending(sessionId, chatId) {
+        const existing = pendingTelegram.get(sessionId);
+        if (existing)
+            clearTimeout(existing.timer);
+        const timer = setTimeout(() => {
+            pendingTelegram.delete(sessionId);
+        }, PENDING_TIMEOUT_MS);
+        pendingTelegram.set(sessionId, { chatId, timer });
+    }
+    function clearPending(sessionId) {
+        const entry = pendingTelegram.get(sessionId);
+        if (entry) {
+            clearTimeout(entry.timer);
+            pendingTelegram.delete(sessionId);
+        }
+    }
+    function scheduleReconnect() {
+        if (userStopped || !savedToken)
+            return;
+        if (reconnectTimer)
             return;
-        const chunks = chunkText(text);
+        if (reconnectAttempts >= 10) {
+            debugLog("reconnect attempts exhausted; giving up until next event");
+            return;
+        }
+        const delayMs = RECONNECT_DELAYS[Math.min(reconnectAttempts, RECONNECT_DELAYS.length - 1)];
+        reconnectAttempts++;
+        debugLog("scheduling reconnect in", delayMs, "ms (attempt", reconnectAttempts + ")");
+        reconnectTimer = setTimeout(async () => {
+            reconnectTimer = null;
+            if (savedToken && !userStopped) {
+                await startBot(savedToken);
+            }
+        }, delayMs);
+    }
+    async function sendToChats(chats, text) {
+        if (!botReady || !bot)
+            return false;
+        const safeText = sanitizeUI(text, 4000);
+        const chunks = chunkText(safeText, 4000);
+        let sentAny = false;
         for (const chatId of chats) {
             for (const chunk of chunks) {
-                try {
-                    await bot.telegram.sendMessage(chatId, chunk);
-                }
-                catch (err) {
-                    const msg = handlePluginError(err, "sendMessage");
-                    if (msg.includes("blocked") || msg.includes("invalid")) {
-                        botReady = false;
+                let attempt = 0;
+                while (attempt < 2) {
+                    try {
+                        await bot.telegram.sendMessage(chatId, chunk);
+                        sentAny = true;
+                        break;
                     }
+                    catch (err) {
+                        attempt++;
+                        const msg = handlePluginError(err, "sendMessage");
+                        if (msg.includes("blocked")) {
+                            removeLink(chatId);
+                            break;
+                        }
+                        if (msg.includes("Invalid token")) {
+                            botReady = false;
+                            scheduleReconnect();
+                            return sentAny;
+                        }
+                        if (attempt >= 2) {
+                            debugLog("sendMessage gave up for chat", chatId, ":", msg);
+                        }
+                        else {
+                            await delay(500);
+                        }
+                    }
+                }
+                if (chunks.length > MAX_TOKENS_PER_CHUNK) {
+                    await delay(50);
                 }
             }
         }
+        return sentAny;
     }
     async function sendToSession(sessionId, text) {
         const chats = sessionToChats.get(sessionId);
         if (!chats)
-            return;
-        await sendToChats(chats, text);
-    }
-    async function findSessionById(id, list) {
-        const exact = list.find((s) => s.id === id);
-        if (exact)
-            return exact;
-        const prefix = list.filter((s) => s.id.startsWith(id));
-        if (prefix.length === 1)
-            return prefix[0];
-        return null;
+            return false;
+        return await sendToChats(chats, text) ?? false;
     }
     async function startBot(token) {
         if (botStarting)
             return;
+        if (!isValidToken(token)) {
+            debugLog("startBot: invalid token format");
+            return;
+        }
         botStarting = true;
         botReady = false;
+        userStopped = false;
+        savedToken = token;
+        reconnectAttempts = 0;
         try {
             try {
                 bot?.stop();
@@ -214,144 +351,251 @@ const TelegramPlugin = async ({ client, directory }, options) => {
             bot.catch((err) => {
                 handlePluginError(err, "bot.catch");
             });
+            bot.command("start", async (ctx) => {
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
+                    return;
+                try {
+                    await ctx.reply("virtualcode - OpenCode Telegram bridge\n\n" +
+                        "Quick setup:\n" +
+                        "1. /ls - list your sessions\n" +
+                        "2. /link <ID> - bind this chat\n" +
+                        "3. Send any message to talk to OpenCode\n\n" +
+                        "Type /help for all commands.");
+                }
+                catch { }
+            });
             bot.command("link", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
-                const arg = ctx.payload.trim();
+                const arg = ctx.payload.trim().slice(0, 200);
                 if (!arg) {
-                    await ctx.reply("Usage: /link <sessionID>");
+                    try {
+                        await ctx.reply("Usage: /link <sessionID>");
+                    }
+                    catch { }
                     return;
                 }
                 try {
                     const list = await client.session.list();
                     if (list.error || !list.data) {
-                        await ctx.reply("❌ Could not load sessions.");
+                        try {
+                            await ctx.reply("Could not load sessions.");
+                        }
+                        catch { }
                         return;
                     }
-                    const found = await findSessionById(arg, list.data);
-                    if (!found) {
-                        await ctx.reply("❌ Session not found.");
+                    const sessions = safeList(list.data);
+                    const result = findSessionById(arg, sessions);
+                    if (result.status === "not_found") {
+                        try {
+                            await ctx.reply(arg.length < MIN_PREFIX_LEN ? "Prefix too short (min 4 chars)." : "Session not found.");
+                        }
+                        catch { }
+                        return;
+                    }
+                    if (result.status === "ambiguous") {
+                        try {
+                            await ctx.reply("Multiple sessions match. Use the full ID from /ls.");
+                        }
+                        catch { }
                         return;
                     }
                     const old = links[ctx.chat.id];
-                    addLink(ctx.chat.id, found.id);
+                    addLink(ctx.chat.id, result.session.id);
                     if (old) {
-                        await ctx.reply("Switched to " + fmtId(found.id) + " (from " + fmtId(old) + ")");
+                        try {
+                            await ctx.reply("Switched to " + fmtId(result.session.id) + " (from " + fmtId(old) + ")");
+                        }
+                        catch { }
                     }
                     else {
-                        await ctx.reply("Linked to " + (found.title || fmtId(found.id)));
+                        try {
+                            await ctx.reply("Linked to " + (result.session.title || fmtId(result.session.id)));
+                        }
+                        catch { }
                     }
                 }
                 catch (err) {
                     const msg = handlePluginError(err, "/link");
-                    await ctx.reply(sanitizeUI(msg));
+                    try {
+                        await ctx.reply(sanitizeUI(msg));
+                    }
+                    catch { }
                 }
             });
             bot.command("unlink", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
                 if (!links[ctx.chat.id]) {
-                    await ctx.reply("Not linked.");
+                    try {
+                        await ctx.reply("Not linked.");
+                    }
+                    catch { }
                     return;
                 }
                 removeLink(ctx.chat.id);
-                await ctx.reply("Unlinked.");
+                try {
+                    await ctx.reply("Unlinked.");
+                }
+                catch { }
             });
             bot.command("status", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
                 const sessionId = links[ctx.chat.id];
                 if (!sessionId) {
-                    await ctx.reply("Not linked. Use /link <ID>");
+                    try {
+                        await ctx.reply("Not linked. Use /link <ID>");
+                    }
+                    catch { }
                     return;
                 }
-                await ctx.reply("Connected | Session: " + fmtId(sessionId) + " | Project: " + (directory || "none"));
+                try {
+                    await ctx.reply("Connected | Session: " + fmtId(sessionId) + " | Project: " + (directory || "none"));
+                }
+                catch { }
             });
             bot.command(["ls", "sessions"], async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
                 try {
                     const res = await client.session.list();
                     if (res.error || !res.data) {
-                        await ctx.reply("❌ Could not load sessions.");
+                        try {
+                            await ctx.reply("Could not load sessions.");
+                        }
+                        catch { }
                         return;
                     }
                     const current = links[ctx.chat.id];
-                    const lines = res.data.slice(-20).map((s, i, arr) => {
-                        const num = arr.length - i;
-                        const marker = s.id === current ? " \u2705" : "";
-                        const label = s.title || s.id.slice(0, 16);
-                        return `${num}. ${label} — ${s.id}${marker}`;
+                    const sessions = safeList(res.data);
+                    const recent = sessions.slice(-20);
+                    const lines = recent.map((s, i) => {
+                        const num = recent.length - i;
+                        const marker = s.id === current ? " *" : "";
+                        const label = (s.title || s.id.slice(0, 16)).slice(0, 60);
+                        return num + ". " + label + " -- " + s.id + marker;
                     });
-                    await ctx.reply("Sessions:\n" + (lines.length ? lines.join("\n") : "None"));
+                    try {
+                        await ctx.reply("Sessions:\n" + (lines.length ? lines.join("\n") : "None"));
+                    }
+                    catch { }
                 }
                 catch (err) {
                     const msg = handlePluginError(err, "/ls");
-                    await ctx.reply(sanitizeUI(msg));
+                    try {
+                        await ctx.reply(sanitizeUI(msg));
+                    }
+                    catch { }
                 }
             });
             bot.command("use", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
-                const arg = ctx.payload.trim();
+                const arg = ctx.payload.trim().slice(0, 200);
                 if (!arg) {
-                    await ctx.reply("Usage: /use <number|ID>");
+                    try {
+                        await ctx.reply("Usage: /use <number|ID>");
+                    }
+                    catch { }
                     return;
                 }
                 try {
                     const res = await client.session.list();
                     if (res.error || !res.data) {
-                        await ctx.reply("❌ Could not load sessions.");
+                        try {
+                            await ctx.reply("Could not load sessions.");
+                        }
+                        catch { }
                         return;
                     }
+                    const sessions = safeList(res.data);
                     const num = parseInt(arg);
+                    if (!isNaN(num) && num > 0 && num <= sessions.length) {
+                        const s = sessions[sessions.length - num];
+                        addLink(ctx.chat.id, s.id);
+                        try {
+                            await ctx.reply("Switched to " + (s.title || fmtId(s.id)));
+                        }
+                        catch { }
+                        return;
+                    }
                     if (!isNaN(num) && num > 0) {
-                        if (num > res.data.length) {
-                            await ctx.reply("❌ Only " + res.data.length + " sessions available.");
-                            return;
+                        try {
+                            await ctx.reply("Only " + sessions.length + " sessions available.");
                         }
-                        const s = res.data[res.data.length - num];
-                        if (!s)
-                            return;
-                        addLink(ctx.chat.id, s.id);
-                        await ctx.reply("Switched to " + (s.title || fmtId(s.id)));
+                        catch { }
                         return;
                     }
-                    const found = await findSessionById(arg, res.data);
-                    if (!found) {
-                        await ctx.reply("❌ Session not found.");
+                    const result = findSessionById(arg, sessions);
+                    if (result.status === "not_found") {
+                        try {
+                            await ctx.reply(arg.length < MIN_PREFIX_LEN ? "Prefix too short (min 4 chars)." : "Session not found.");
+                        }
+                        catch { }
                         return;
                     }
-                    addLink(ctx.chat.id, found.id);
-                    await ctx.reply("Switched to " + (found.title || fmtId(found.id)));
+                    if (result.status === "ambiguous") {
+                        try {
+                            await ctx.reply("Multiple sessions match. Use the full ID from /ls.");
+                        }
+                        catch { }
+                        return;
+                    }
+                    addLink(ctx.chat.id, result.session.id);
+                    try {
+                        await ctx.reply("Switched to " + (result.session.title || fmtId(result.session.id)));
+                    }
+                    catch { }
                 }
                 catch (err) {
                     const msg = handlePluginError(err, "/use");
-                    await ctx.reply(sanitizeUI(msg));
+                    try {
+                        await ctx.reply(sanitizeUI(msg));
+                    }
+                    catch { }
                 }
             });
             bot.command("history", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
                 const sessionId = links[ctx.chat.id];
                 if (!sessionId) {
-                    await ctx.reply("Not linked. Use /link <ID>");
+                    try {
+                        await ctx.reply("Not linked. Use /link <ID>");
+                    }
+                    catch { }
                     return;
                 }
                 try {
-                    const limitText = ctx.payload.trim();
-                    const limit = limitText ? Math.min(parseInt(limitText) || 20, 100) : 20;
+                    const limitText = ctx.payload.trim().slice(0, 10);
+                    let limit = MIN_HISTORY_LIMIT;
+                    if (limitText) {
+                        const parsed = parseInt(limitText);
+                        if (!isNaN(parsed) && parsed > 0) {
+                            limit = Math.min(parsed, 100);
+                        }
+                    }
+                    else {
+                        limit = 20;
+                    }
                     const res = await client.session.messages({ path: { id: sessionId }, query: { directory, limit } });
                     if (res.error || !res.data || res.data.length === 0) {
-                        await ctx.reply("No messages found.");
+                        try {
+                            await ctx.reply("No messages found.");
+                        }
+                        catch { }
                         return;
                     }
                     const lines = [];
                     for (const msg of res.data) {
-                        const role = msg.info.role === "user" ? "\uD83D\uDC64" : "\uD83E\uDD16";
-                        const text = msg.parts
-                            .filter((p) => p.type === "text" && !p.synthetic)
-                            .map((p) => p.text)
+                        if (!msg || !msg.info)
+                            continue;
+                        const role = msg.info.role === "user" ? "[User]" : "[AI]";
+                        const parts = Array.isArray(msg.parts) ? msg.parts : [];
+                        const text = parts
+                            .filter((p) => p && p.type === "text" && !p.synthetic)
+                            .map((p) => String(p.text || ""))
                             .join("\n")
                             .trim();
                         if (!text)
@@ -360,41 +604,70 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                         lines.push(role + " " + truncated);
                     }
                     if (lines.length === 0) {
-                        await ctx.reply("No text messages found.");
+                        try {
+                            await ctx.reply("No text messages found.");
+                        }
+                        catch { }
                         return;
                     }
                     const text = lines.join("\n\n");
                     for (const chunk of chunkText(text)) {
-                        await ctx.reply(chunk);
+                        try {
+                            await ctx.reply(chunk);
+                        }
+                        catch { }
                     }
                 }
                 catch (err) {
                     const msg = handlePluginError(err, "/history");
-                    await ctx.reply(sanitizeUI(msg));
+                    try {
+                        await ctx.reply(sanitizeUI(msg));
+                    }
+                    catch { }
                 }
             });
             bot.command("help", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
-                await ctx.reply("/link <sessionId>     - Bind this chat to a session (use ID from /ls)\n" +
-                    "/unlink               - Remove binding\n" +
-                    "/status               - Show connection state\n" +
-                    "/ls                   - List recent sessions (shows number + title + ID)\n" +
-                    "/use <number|sessionId> - Switch active session (number from /ls)\n" +
-                    "/history [N]          - View last N messages\n" +
-                    "/help                 - Show this help\n\n" +
-                    "Any other message will be sent to the linked session.");
+                try {
+                    await ctx.reply("/link <sessionId>     - Bind this chat to a session\n" +
+                        "/unlink               - Remove binding\n" +
+                        "/status               - Show connection state\n" +
+                        "/ls                   - List recent sessions\n" +
+                        "/use <number|ID>      - Switch active session\n" +
+                        "/history [N]          - View last N messages\n" +
+                        "/help                 - Show this help\n\n" +
+                        "Any other message will be sent to the linked session.");
+                }
+                catch { }
+            });
+            bot.on(["photo", "sticker", "document", "video", "audio", "voice"], async (ctx) => {
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
+                    return;
+                try {
+                    await ctx.reply("Only text messages are supported.");
+                }
+                catch { }
             });
             bot.on("text", async (ctx) => {
-                if (allowedSet && !allowedSet.has(ctx.from.id))
+                if (allowedSet && (!ctx.from || !allowedSet.has(ctx.from.id)))
                     return;
                 const sessionId = links[ctx.chat.id];
                 if (!sessionId) {
-                    await ctx.reply("Not linked. Use /link <ID>");
+                    try {
+                        await ctx.reply("Not linked. Use /link <ID>");
+                    }
+                    catch { }
                     return;
                 }
-                const working = await ctx.reply("\u23F3 ...");
-                pendingTelegram.set(sessionId, ctx.chat.id);
+                let working = null;
+                try {
+                    working = await ctx.reply("...");
+                }
+                catch (err) {
+                    debugLog("working reply failed:", userError(err));
+                }
+                setPending(sessionId, ctx.chat.id);
                 try {
                     const res = await client.session.prompt({
                         path: { id: sessionId },
@@ -403,24 +676,32 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                         },
                         query: { directory },
                     });
-                    if (res.error) {
+                    if (res?.error) {
                         const msg = handlePluginError(res.error, "prompt");
-                        await ctx.reply(sanitizeUI(msg));
+                        try {
+                            await ctx.reply(sanitizeUI(msg));
+                        }
+                        catch { }
                     }
                 }
                 catch (err) {
                     const msg = handlePluginError(err, "prompt");
-                    await ctx.reply(sanitizeUI(msg));
+                    try {
+                        await ctx.reply(sanitizeUI(msg));
+                    }
+                    catch { }
                 }
-                pendingTelegram.delete(sessionId);
-                try {
-                    await ctx.deleteMessage(working.message_id);
+                clearPending(sessionId);
+                if (working?.message_id) {
+                    try {
+                        await ctx.deleteMessage(working.message_id);
+                    }
+                    catch { }
                 }
-                catch { }
             });
             if (notifyOnReconnect) {
                 for (const chatId of Object.keys(links)) {
-                    bot.telegram.sendMessage(Number(chatId), "OpenCode Telegram bridge reconnected.").catch(() => { });
+                    bot.telegram.sendMessage(Number(chatId), "Telegram bridge reconnected.").catch(() => { });
                 }
             }
             try {
@@ -431,19 +712,26 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                 debugLog("startBot failed:", msg);
                 botStarting = false;
                 botReady = false;
+                scheduleReconnect();
                 return;
             }
             botReady = true;
             botStarting = false;
-            bot.launch().catch((err) => {
+            bot.launch().catch(async (err) => {
                 handlePluginError(err, "bot.launch");
                 botReady = false;
+                try {
+                    await bot?.stop();
+                }
+                catch { }
+                scheduleReconnect();
             });
         }
         catch (err) {
             handlePluginError(err, "startBot");
             botStarting = false;
             botReady = false;
+            scheduleReconnect();
         }
     }
     const configToken = config?.token;
@@ -470,7 +758,7 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                 if (event.type === "session.status" && event.properties.status.type === "idle") {
                     const sid = event.properties.sessionID;
                     const pending = pendingTelegram.get(sid);
-                    const chats = pending ? new Set([pending]) : sessionToChats.get(sid);
+                    const chats = pending ? new Set([pending.chatId]) : sessionToChats.get(sid);
                     if (!chats || chats.size === 0)
                         return;
                     let msgs;
@@ -485,7 +773,7 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                     const last = [...msgs.data].reverse().find((m) => m.info.role === "assistant");
                     if (!last || lastForwardedBySession.get(sid) === last.info.id)
                         return;
-                    lastForwardedBySession.set(sid, last.info.id);
+                    lruSet(lastForwardedBySession, sid, last.info.id);
                     const text = last.parts
                         .filter((p) => p.type === "text" && !p.synthetic)
                         .map((p) => p.text)
@@ -509,13 +797,24 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                         await startBot(saved);
                     }
                 }
+                if (!output || !Array.isArray(output.parts))
+                    return;
                 for (const part of output.parts) {
-                    if (part.type !== "text")
+                    if (!part || part.type !== "text" || typeof part.text !== "string")
                         continue;
-                    const text = part.text;
+                    let text = part.text;
+                    if (text.length > MAX_TELEGRAM_INPUT) {
+                        text = text.slice(0, MAX_TELEGRAM_INPUT);
+                    }
                     if (text.startsWith("/telegram")) {
-                        const args = text.slice("/telegram".length).trim().toLowerCase();
-                        if (args === "disconnect" || args === "stop") {
+                        const rawArgs = text.slice("/telegram".length).trim().slice(0, 200);
+                        const cmd = rawArgs.toLowerCase();
+                        if (cmd === "disconnect" || cmd === "stop") {
+                            userStopped = true;
+                            if (reconnectTimer) {
+                                clearTimeout(reconnectTimer);
+                                reconnectTimer = null;
+                            }
                             try {
                                 bot?.stop();
                             }
@@ -523,33 +822,41 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                             botReady = false;
                             bot = null;
                             botStarting = false;
-                            if (loadSavedToken())
-                                saveToken("");
+                            savedToken = null;
+                            clearSavedToken();
                             part.text = "Telegram bot disconnected and token removed.";
                             return;
                         }
-                        if (args === "status" || args === "") {
+                        if (cmd === "status" || cmd === "") {
                             if (botReady) {
                                 part.text =
                                     "Telegram bot is connected.\n" +
-                                        "• /telegram <new_token> — Change bot token\n" +
-                                        "• /telegram disconnect — Stop bot and remove token\n" +
-                                        "• /telegram — Open setup dialog (type /telegram in command palette)";
+                                        "- /telegram <new_token> - Change bot token\n" +
+                                        "- /telegram disconnect - Stop bot and remove token\n" +
+                                        "- /telegram - Open setup dialog (type /telegram in command palette)";
                             }
                             else {
                                 part.text =
                                     "Telegram bot is not connected.\n" +
-                                        "• /telegram <your_bot_token> — Connect with a token\n" +
-                                        "• /telegram — Open setup dialog (type /telegram in command palette)";
+                                        "- /telegram <your_bot_token> - Connect with a token\n" +
+                                        "- /telegram - Open setup dialog (type /telegram in command palette)";
                             }
+                            part.text = sanitizeTUI(part.text, MAX_TUI_TEXT);
+                            return;
+                        }
+                        const tokenMatch = rawArgs.match(/^\s*["'`]*([^\s"'`]+)["'`]*\s*$/);
+                        if (!tokenMatch) {
+                            part.text = sanitizeTUI("Invalid token.", MAX_TUI_TEXT);
+                            return;
+                        }
+                        const token = tokenMatch[1];
+                        if (!isValidToken(token)) {
+                            part.text = sanitizeTUI("Invalid token.", MAX_TUI_TEXT);
                             return;
                         }
-                        const token = args;
                         saveToken(token);
                         await startBot(token);
-                        part.text = botReady
-                            ? "\u2705 Connected."
-                            : "\u274c Invalid token.";
+                        part.text = sanitizeTUI(botReady ? "Connected." : "Invalid token.", MAX_TUI_TEXT);
                         return;
                     }
                 }
@@ -566,20 +873,44 @@ const TelegramPlugin = async ({ client, directory }, options) => {
                     sessionId: tool.schema.string().optional().describe("Target session ID (defaults to current)"),
                 },
                 async execute({ text, sessionId }, ctx) {
+                    if (typeof text !== "string" || text.length === 0) {
+                        return { output: "No text to send." };
+                    }
+                    if (!botReady) {
+                        return { output: "Telegram bot is not connected." };
+                    }
+                    if (!ctx?.sessionID && !sessionId) {
+                        return { output: "No session context." };
+                    }
                     const targetId = sessionId || ctx.sessionID;
-                    await sendToSession(targetId, text);
-                    return { output: "Message sent to Telegram" };
+                    if (typeof targetId !== "string") {
+                        return { output: "Invalid session ID." };
+                    }
+                    const safeText = text.length > 4000 ? text.slice(0, 4000) + "..." : text;
+                    const ok = await sendToSession(targetId, safeText);
+                    return { output: ok ? "Message sent to Telegram" : "No linked chats." };
                 },
             }),
         },
         async dispose() {
+            userStopped = true;
+            if (reconnectTimer) {
+                clearTimeout(reconnectTimer);
+                reconnectTimer = null;
+            }
+            for (const [, entry] of pendingTelegram) {
+                clearTimeout(entry.timer);
+            }
+            pendingTelegram.clear();
+            lastForwardedBySession.clear();
             try {
-                bot?.stop();
+                await bot?.stop();
             }
             catch { }
             botReady = false;
             botStarting = false;
             bot = null;
+            savedToken = null;
         },
     };
 };