fix(telegram): relay-in startup age-gate + dead-letter quarantine (DIVE-1514)#9
Merged
Conversation
…VE-1514) drainRelayIn dedups only in-memory and has no age check, so a relay-in file left across a bot restart/roll is replayed by the fresh process (the DIVE-1506 leak class; fixture->human leg already closed CLI-side, PR #70). Defense-in-depth: at startup, before the drain interval arms, quarantine any relay-in/*.json older than a short TTL (env TELEGRAM_RELAY_IN_TTL_MS, default 5m) into a sibling relay-dead/ dir and LOG the drop. Never silent-delete: a stale legit send vanishing is the availability twin. - new pure helper hooks/lib/relay-quarantine.ts (clock injected, quiet on fs errors) - 4 unit tests; full telegram suite + fork parity green - plugin 0.5.25 -> 0.5.26 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
lodar
force-pushed
the
dive-1514-relay-quarantine
branch
from
July 24, 2026 11:53
ddcba23 to
310afe1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Defense-in-depth for the DIVE-1506 relay-in leak class in the SEND_ONLY team-bot inbound path.
drainRelayIndedups only with an in-memory `seen` Set and has no age check, so a `relay-in/*.json` drop left across a bot restart/roll (the v0.5.22 roll was the trigger) is replayed by the fresh process. The fixture->human leg is already closed CLI-side (PR #70/v0.11.23); this closes the plugin half.How
On startup, before the drain interval arms, quarantine any `relay-in/*.json` older than a short TTL (`TELEGRAM_RELAY_IN_TTL_MS`, default 5m) into a sibling `relay-dead/` dir and log the drop. Never silent-delete — a stale-but-legit send vanishing is the availability-direction twin, so the operator keeps a trail.
Test
Roll ordering (per task)
Land in the same version rolled; sweep stale relay-in across all bot homes + re-verify zero-pending at roll time.
🤖 Generated with Claude Code