Enrich Jev moderation with bounded public Telegram previews (GEN-KANEO-40) #27

Merged

backmeupplz merged 5 commits from gen-kaneo-40-public-previews into main

2026-09-28 23:19:43 +00:00

backmeupplz commented

2026-09-28 21:56:35 +00:00

(Migrated from github.com)

Scope

GEN-KANEO-40 — Enrich Jev moderation with public Telegram link previews.

Current text/caption/UTF-16 URL and hidden-link discovery; canonical case-sensitive invites and username dedupe.
HTTPS t.me-only landing pages, DNS public-IP pinning, guarded redirects, streaming 64KiB cap, 1.5s deadline, 2 URLs/update and 4 underlying operations process-wide. No joining/auth/cookies/subresource fetching.
Bounded TTL/negative cache and in-flight dedupe; Retry-After/overload shed to ordinary moderation. Untrusted destination metadata remains distinct from reply/source/profile, preserving actor history and deletion boundaries.
Exact generic-page handling and entity decoding with Bun HTMLRewriter plus small entities dependency. Model jev-1.13.0 and .90 threshold unchanged.

Verification

Head 2121ef7602. Typecheck + 205 tests pass, 195 optional live/DB tests skipped, 0 fail; diff check clean. Real grammY fixtures and transport/DNS/SSRF/cache/deadline regressions included. Independent Astra review 3f5cd285-4b45-4b84-b4b6-ea68c71efee3: clean exact-head verdict. Prior review d90d8d43-92bf-468e-aa5a-1a26c208cc2a findings fixed. Fix helper 887cc8e3-aa1b-47b9-8d47-8efb823b9938 timed out; recovered and completed by parent.

Credentialed candidate-source pinned-model probes used full request builder/parser: raw token .59 keep → rich preview .95 delete; requested .77, warning .47, report .84, benign .39, revoked .44 and discussion .28 keep; repeated explicit promotion .98/link .98; unrelated reply .95 after one HTTP503 retry. Mixed history .86 keep/link [.73,.77] remains an explicit model limitation, not claimed campaign proof. These are candidate API results, not deployed behavior or Telegram deletion proof.

Source #21439 forwarded-video caption dedupes repeated links. Generic public preview is unavailable; candidate score .80 keep, preserving fallback. No speech/private joining inference or retroactive processing. Actual local public lookups verified rich available and generic unavailable after fixes.

Release handoff

Implementation phase only: no merge/deploy. Reviewer owns latest-main gate, CI incl PostgreSQL integration, merge and main CI, then managed Easypanel bots/jev-antispam-bot rollout with commit/source identity and public-lookup/message-only fallback checks. Preserve credentials/DB/state. Optional UI is not a General gate. Running app currently observed Bun 1.3.0; CI/Dockerfile use 1.4.0: verify managed build runtime and HTMLRewriter/entities availability during rollout.

Latest review rework (GEN-KANEO-40)

Escaped literal angle-bracket qualifications preserved in OG and visible preview data; br/block boundaries remain separate without splitting inline words. Actual script/style subtrees remain excluded. Local typecheck +211 pass/195 optional skips/0 fail; independent Astra/high exact-head review CLEAN, 33 adversarial probes passed (run e3f1c11a-0859-4654-82cf-91220adfe6b7). Prior two reviewer regressions pass. Exact-head GitHub CI pending; not merged/deployed in this fixer handoff.

## Scope GEN-KANEO-40 — Enrich Jev moderation with public Telegram link previews. - Current text/caption/UTF-16 URL and hidden-link discovery; canonical case-sensitive invites and username dedupe. - HTTPS t.me-only landing pages, DNS public-IP pinning, guarded redirects, streaming 64KiB cap, 1.5s deadline, 2 URLs/update and 4 underlying operations process-wide. No joining/auth/cookies/subresource fetching. - Bounded TTL/negative cache and in-flight dedupe; Retry-After/overload shed to ordinary moderation. Untrusted destination metadata remains distinct from reply/source/profile, preserving actor history and deletion boundaries. - Exact generic-page handling and entity decoding with Bun HTMLRewriter plus small entities dependency. Model jev-1.13.0 and .90 threshold unchanged. ## Verification Head 2121ef760214edc7b170b1935592f9c14fd3dea2. Typecheck + 205 tests pass, 195 optional live/DB tests skipped, 0 fail; diff check clean. Real grammY fixtures and transport/DNS/SSRF/cache/deadline regressions included. Independent Astra review 3f5cd285-4b45-4b84-b4b6-ea68c71efee3: clean exact-head verdict. Prior review d90d8d43-92bf-468e-aa5a-1a26c208cc2a findings fixed. Fix helper 887cc8e3-aa1b-47b9-8d47-8efb823b9938 timed out; recovered and completed by parent. Credentialed candidate-source pinned-model probes used full request builder/parser: raw token .59 keep → rich preview .95 delete; requested .77, warning .47, report .84, benign .39, revoked .44 and discussion .28 keep; repeated explicit promotion .98/link .98; unrelated reply .95 after one HTTP503 retry. Mixed history .86 keep/link [.73,.77] remains an explicit model limitation, not claimed campaign proof. These are candidate API results, not deployed behavior or Telegram deletion proof. Source #21439 forwarded-video caption dedupes repeated links. Generic public preview is unavailable; candidate score .80 keep, preserving fallback. No speech/private joining inference or retroactive processing. Actual local public lookups verified rich available and generic unavailable after fixes. ## Release handoff Implementation phase only: no merge/deploy. Reviewer owns latest-main gate, CI incl PostgreSQL integration, merge and main CI, then managed Easypanel bots/jev-antispam-bot rollout with commit/source identity and public-lookup/message-only fallback checks. Preserve credentials/DB/state. Optional UI is not a General gate. Running app currently observed Bun 1.3.0; CI/Dockerfile use 1.4.0: verify managed build runtime and HTMLRewriter/entities availability during rollout. ## Latest review rework (GEN-KANEO-40) Escaped literal angle-bracket qualifications preserved in OG and visible preview data; br/block boundaries remain separate without splitting inline words. Actual script/style subtrees remain excluded. Local typecheck +211 pass/195 optional skips/0 fail; independent Astra/high exact-head review CLEAN, 33 adversarial probes passed (run e3f1c11a-0859-4654-82cf-91220adfe6b7). Prior two reviewer regressions pass. Exact-head GitHub CI pending; not merged/deployed in this fixer handoff.

backmeupplz commented

2026-09-28 21:57:35 +00:00

(Migrated from github.com)

Independent exact-head Astra code review completed clean for a0c34461a9 (run 3f5cd285-4b45-4b84-b4b6-ea68c71efee3). Full diff reviewed against b03f93e; both prior findings fixed and independently verified: lingering DNS retains process-wide bounds, genuine promotional prefixes preserved. Typecheck and 205 tests pass, 195 optional tests skipped, 0 fail; diff check clean. This author-account audit comment is not a GitHub approval. CI, latest-main merge gate and managed deployment remain separate release gates.

Independent exact-head Astra code review completed clean for a0c34461a9a42d27ee3a0ba0be4346379ce94e4a (run 3f5cd285-4b45-4b84-b4b6-ea68c71efee3). Full diff reviewed against b03f93e; both prior findings fixed and independently verified: lingering DNS retains process-wide bounds, genuine promotional prefixes preserved. Typecheck and 205 tests pass, 195 optional tests skipped, 0 fail; diff check clean. This author-account audit comment is not a GitHub approval. CI, latest-main merge gate and managed deployment remain separate release gates.

backmeupplz commented

2026-09-28 22:03:40 +00:00

(Migrated from github.com)

Review verdict

Owner/session: agent:main:kaneo-worker-07279c59c5554174838755ce83b7b532
Head SHA: a0c34461a9
Changes requested for https://github.com/backmeupplz/jev_antispam_bot/pull/27.
P2 — src/telegram-preview.ts:104–117 publishes malformed/truncated preview HTML as available destination evidence. Cache-level HTTP200/text-html reproduction: <div class="tgme_page_title">Investment channel<div class="tgme_page_description">Guaranteed daily returns produces status available, title Investment channelGuaranteed daily returns, description Guaranteed daily returns. The forgiving HTMLRewriter silently repairs missing closures, contaminating title with description. This violates acceptance #3. Require completed, distinct preview fields/containers before publishing metadata; malformed/truncated preview structures must yield unavailable and normal classification fallback. Add a cache-level regression plus a valid nested-formatting control. Do not build a general HTML validator or reject legitimate Telegram formatting.
Independent Astra/high child a02c50f8-039f-4b5c-baf3-a5240968e400 (settled) found this issue; parent independently reproduced it. Child focused suites: 109 passed, 0 failed. Parent frozen install + bun run check: typecheck passed, 205 tests passed, 195 opt-in/live/DB skipped, 0 failed; diff check clean. Exact-head GitHub PostgreSQL-backed check SUCCESS: https://github.com/backmeupplz/jev_antispam_bot/actions/runs/36489372172/job/109153995302.
No other confirmed defect from this review. Existing reported model limitations/source #21439 remain explicit, not forced positives or optional-live gates. No merge or deployment occurred. Next dispatcher fixer addresses this single in-scope extraction issue on PR27, then returns for exact-head review.

## Review verdict Owner/session: `agent:main:kaneo-worker-07279c59c5554174838755ce83b7b532` Head SHA: a0c34461a9a42d27ee3a0ba0be4346379ce94e4a Changes requested for https://github.com/backmeupplz/jev_antispam_bot/pull/27. P2 — src/telegram-preview.ts:104–117 publishes malformed/truncated preview HTML as available destination evidence. Cache-level HTTP200/text-html reproduction: `<div class="tgme_page_title">Investment channel<div class="tgme_page_description">Guaranteed daily returns` produces status available, title `Investment channelGuaranteed daily returns`, description `Guaranteed daily returns`. The forgiving HTMLRewriter silently repairs missing closures, contaminating title with description. This violates acceptance #3. Require completed, distinct preview fields/containers before publishing metadata; malformed/truncated preview structures must yield unavailable and normal classification fallback. Add a cache-level regression plus a valid nested-formatting control. Do not build a general HTML validator or reject legitimate Telegram formatting. Independent Astra/high child a02c50f8-039f-4b5c-baf3-a5240968e400 (settled) found this issue; parent independently reproduced it. Child focused suites: 109 passed, 0 failed. Parent frozen install + bun run check: typecheck passed, 205 tests passed, 195 opt-in/live/DB skipped, 0 failed; diff check clean. Exact-head GitHub PostgreSQL-backed check SUCCESS: https://github.com/backmeupplz/jev_antispam_bot/actions/runs/36489372172/job/109153995302. No other confirmed defect from this review. Existing reported model limitations/source #21439 remain explicit, not forced positives or optional-live gates. No merge or deployment occurred. Next dispatcher fixer addresses this single in-scope extraction issue on PR27, then returns for exact-head review.