Feat/telegram

[leszek3737]

Type

• Agent template (TOML)
• Skill (Python/JS/Prompt)
• Channel adapter
• LLM provider
• Built-in tool
• Bug fix
• Feature (Rust)
• Documentation / Translation
• Refactor / Performance
• CI / Tooling
• Other

Summary

Changes

Attribution

• This PR preserves author attribution for any adapted prior work (Co-authored-by, commit preservation, or explicit credit in the PR body)

Testing

• cargo clippy --workspace --all-targets -- -D warnings passes
• cargo test --workspace passes
• Live integration tested (if applicable)

Security

• No new unsafe code
• No secrets or API keys in diff
• User input validated at boundaries

[sourcery-ai]

Sorry @leszek3737, you have reached your weekly rate limit of 2500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[gemini-code-assist]

Code Review

This pull request introduces comprehensive support for rich media and interactive features across the channel bridge and Telegram adapter, including audio, animations, stickers, media groups, and polls. It also implements bot command registration and interactive menus for agent and model selection. Feedback focuses on high-severity risks related to unsafe string slicing at byte boundaries, a potential memory leak in poll context management, and the need for improved validation for poll options and media group captions.

[gemini-code-assist]

Slicing a string by a byte index without verifying UTF-8 character boundaries can cause a panic if the index falls in the middle of a multi-byte character. Since agent_name can contain arbitrary Unicode characters, this is a high-risk operation. This pattern occurs in several other places in this file (lines 1898, 2002, 2044, 2287, 2328) and should be fixed globally.

Suggested change

	let safe_name = if agent_name.len() > max_name_bytes {
	&agent_name[..max_name_bytes]
	} else {
	&agent_name
	};
	let safe_name = if agent_name.len() > max_name_bytes {
	let mut end = max_name_bytes;
	while end > 0 && !agent_name.is_char_boundary(end) {
	end -= 1;
	}
	&agent_name[..end]
	} else {
	&agent_name
	};

[gemini-code-assist]

Similar to the issue in bridge.rs, slicing btn.action at a fixed byte length (64) without checking UTF-8 boundaries will cause a panic if the slice occurs inside a multi-byte character.

                            let action = if btn.action.len() > 64 {
                                let mut end = 64;
                                while end > 0 && !btn.action.is_char_boundary(end) {
                                    end -= 1;
                                }
                                btn.action[..end].to_string()
                            } else {
                                btn.action.clone()
                            };

[gemini-code-assist]

The poll_contexts map is populated every time a poll is sent, but entries are never removed. This will lead to a gradual memory leak in long-running bot instances. Consider implementing a cleanup mechanism, such as using a cache with a TTL or removing entries after a reasonable timeout.

[gemini-code-assist]

The current implementation restricts captions to only the first item in a media group. While Telegram often displays the first caption as the primary description for the album, it is technically valid to have captions on individual items. More importantly, if a caller provides captions for subsequent items, they are silently dropped here. This logic should be applied to videos as well (lines 707-713).

                    if let Some(cap) = caption {
                        v["caption"] = serde_json::Value::String(cap.clone());
                        v["parse_mode"] =
                            serde_json::Value::String(PARSE_MODE_HTML.to_string());
                    }

[gemini-code-assist]

Telegram polls are limited to a maximum of 10 options. Additionally, for quiz mode (is_quiz: true), the correct_option_id is mandatory and must be a valid index within the poll_options array. Adding these validations here ensures the agent receives a clear error message before the request fails at the API level.

        if poll_options.len() < 2 || poll_options.len() > 10 {
            return Err("poll_options must have between 2 and 10 options".to_string());
        }

        let is_quiz = input
            .get("poll_is_quiz")
            .and_then(|v| v.as_bool())
            .unwrap_or(false);
        let correct_option_id = input
            .get("poll_correct_option")
            .and_then(|v| v.as_u64())
            .map(|n| n as u8);

        if is_quiz {
            let Some(id) = correct_option_id else {
                return Err("poll_correct_option is required for quiz mode".to_string());
            };
            if id as usize >= poll_options.len() {
                return Err(format!(
                    "poll_correct_option index {id} is out of bounds (0-{})".to_string(),
                    poll_options.len() - 1
                ));
            }
        }