🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

const maxBacktickRun = Math.max(
  0,
  ...Array.from(clipped.matchAll(/`+/g), (match) => match[0].length),
);
const fence = "`".repeat(Math.min(maxBacktickRun + 1, MAX_PROGRESS_MARKDOWN_FENCE_CHARS));
return `${fence}${clipped}${fence}`;

const fence = "`".repeat(maxBacktickRun + 1);
return `${fence}${clipped}${fence}`;

import { escapeHtml } from "./format"; // or a local helper

function formatProgressAsHtmlCode(text: string): string {
  const clipped = clipProgressMarkdownText(text);
  return `<code>${escapeHtml(clipped)}</code>`;
}

const sanitized = clipped.replace(/`/g, "ˋ");
return `\`${sanitized}\``;

Analyzed PR: #71351 at commit ee6927a

_{Last updated on: 2026-04-25T02:27:29Z}

Greptile Summary

This PR changes Telegram's tool-progress behavior from opt-out to opt-in by passing false as the default to resolveChannelStreamingPreviewToolProgress and unconditionally setting suppressDefaultToolProgressMessages: true so tool lifecycle events are never delivered as separate chat messages unless the user explicitly enables streaming.preview.toolProgress. Documentation, config UI hints, and changelog are updated consistently, and two new regression tests cover both the default-suppressed and the explicit-opt-in paths.

Confidence Score: 5/5

Safe to merge — the change is Telegram-scoped, well-tested, and does not affect other channels or delivery paths.

No logical, security, or correctness issues found. The default override is correctly threaded through the function call, suppressDefaultToolProgressMessages is correctly made unconditional, tests cover both the off (default) and on (opt-in) paths, and all documentation is aligned.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(telegram): hide tool progress by def..." | Re-trigger Greptile}

Addressed the review findings in follow-up commit 2edd0dd4fd.

What changed:

• Kept Telegram quiet by default, but clarified and tested that runtime-enforced safety/control payloads are not hidden by generic progress suppression. In particular, execApproval tool payloads still deliver when suppressDefaultToolProgressMessages is active; media-only tool payloads and error payloads remain covered by the existing dispatcher exceptions.
• Hardened the explicit opt-in Telegram progress preview path. Tool/progress entries are now inserted as Markdown code spans before Telegram markdown-to-HTML rendering, so attacker-shaped progress strings like [label](tg://user?id=123) stay literal and do not become links or mentions in the live preview.
• Extended the Telegram dispatch regression test to cover the default-suppressed path, explicit opt-in progress rendering, and the no-anchor rendering behavior.

Why the behavior is still safe:

• The fix does not depend on prompt wording. Telegram suppresses default progress through the dispatch runtime, and opt-in preview progress is still gated by channels.telegram.streaming.preview.toolProgress=true.
• Final assistant responses, block streaming, reasoning streaming, status reactions, media tool payloads, approval payloads, and error delivery continue to use the existing runtime delivery paths.

Validation:

• pnpm test extensions/telegram/src/bot-message-dispatch.test.ts src/auto-reply/reply/dispatch-from-config.test.ts
• pnpm test:extension telegram
• pnpm config:docs:check
• git diff --check

Known unrelated validation note:

• pnpm check:changed still fails before reaching the changed tests due to existing extension-wide duplicate nested @mariozechner/pi-ai / pi-agent-core type identity errors in other extensions, as noted in the PR body.

@codex /review

Deep-reviewed and pushed a maintainer fixup on top of this PR.

Review findings:

• Root cause checks out: Telegram was using the shared preview tool-progress default, so tool/item lifecycle events could become visible Working… draft/progress text.
• Runtime suppression is in the right layer: suppressDefaultToolProgressMessages still allows media, error, and exec-approval payloads through the core dispatcher.
• The remaining issue was the explicit opt-in preview formatter: long backtick runs in tool progress could force unbounded Markdown fence allocation and oversized preview text.

What I changed:

• Rebased onto current main and resolved the changelog conflict.
• Added bounded progress preview formatting: max 300 progress chars and max 10 Markdown fence chars.
• Added a regression with a long backtick/link payload proving the preview remains bounded and does not render a Telegram HTML link.

Local verification:

• pnpm test extensions/telegram/src/bot-message-dispatch.test.ts src/auto-reply/reply/dispatch-from-config.test.ts
• pnpm config:docs:check
• pnpm check:changed

Thanks @neeravmakwana.

Landed via rebase onto main.

• Source head: ee6927a
• Merge commit: f29e15c
• Local gates: pnpm test extensions/telegram/src/bot-message-dispatch.test.ts src/auto-reply/reply/dispatch-from-config.test.ts; pnpm config:docs:check; pnpm check:changed

Thanks @neeravmakwana.