← Back to PRs

#17894: fix(telegram): add missing poll action gate with input validation

by PlayerGhost open 2026-02-16 08:40 View on GitHub →
channel: slack channel: telegram commands agents stale size: L
## Summary Add missing `poll` action gate in the Telegram provider's action handler, with full input validation. **Issue:** #17528 ## Change Type - [x] Bug fix (non-breaking change which fixes an issue) ## Scope - **Files changed:** `src/telegram/telegram.ts`, `src/telegram/types.telegram.ts` - **Risk:** Low — additive change, no existing behavior modified ## Security Impact - Input validation added: 2-10 non-empty options, safe duration conversion (NaN/negative filtered), pollMulti string coercion ## Steps to Reproduce 1. Configure Telegram channel with actions enabled 2. Agent calls message tool with `action: "poll"` 3. **Before fix:** Action silently ignored (no poll gate) 4. **After fix:** Poll is created with validated inputs ## Evidence - `pnpm build` ✅ - `pnpm check` (lint+format) ✅ - Targeted tests: 442 tests passed (37 files, telegram bot, send, security) on Windows host ✅ - Full baseline: 542 tests passed ✅ ## Human Verification - [x] Code reviewed by human contributor ## Compatibility - Backward compatible — only adds new action gate - No API changes, no config changes ## Failure & Recovery - If poll creation fails, Telegram API error is propagated normally - No state changes on failure ## Risks - None identified — purely additive --- 🤖 AI-assisted (Opus 4.6 implementation, reviewed by Opus 4.6 + GPT 5.3 Codex with thinking high) <!-- greptile_comment --> <h3>Greptile Summary</h3> Adds the missing `poll` action gate and handler to the Telegram provider's action adapter, along with a `sendPoll` config type and a `TELEGRAM_MAX_POLL_OPTIONS` constant extraction. The implementation includes defense-in-depth gate checking, input validation for poll options and duration, and direct `sendPollTelegram` integration (bypassing `handleTelegramAction`, which has no poll support). - Adds `sendPoll` boolean to `TelegramActionConfig` (defaults to `true` when omitted, consistent with other gates) - Extracts magic number `10` to `TELEGRAM_MAX_POLL_OPTIONS` constant in `send.ts` - Adds poll action handler with question/option validation, duration conversion, and multi-select support - **Bug:** `pollDurationHours` is read with `{ integer: true }`, which truncates fractional hours (the only values that map to Telegram's 5–600 second `open_period` range), making the duration parameter non-functional <h3>Confidence Score: 3/5</h3> - Largely additive and safe, but the `pollDurationHours` integer constraint makes the poll duration feature non-functional. - The core poll gating and option validation logic is correct. The type change and constant extraction are clean. However, `{ integer: true }` on `pollDurationHours` is a real bug: fractional hours (the only valid inputs for Telegram's 5-600 second open_period) are truncated to 0, and any integer >= 1 exceeds the API limit. This makes the duration feature silently broken. - `src/channels/plugins/actions/telegram.ts` — the `pollDurationHours` parameter constraint needs fixing. <sub>Last reviewed commit: 429e249</sub> <!-- greptile_other_comments_section --> <sub>(5/5) You can turn off certain types of comments like style [here](https://app.greptile.com/review/github)!</sub> <!-- /greptile_comment -->

Most Similar PRs