Skip to content

fix(telegram): accept html document uploads - #40584

Closed
jackroofan wants to merge 1 commit into
NousResearch:mainfrom
jackroofan:fix/telegram-html-document-uploads
Closed

fix(telegram): accept html document uploads#40584
jackroofan wants to merge 1 commit into
NousResearch:mainfrom
jackroofan:fix/telegram-html-document-uploads

Conversation

@jackroofan

@jackroofan jackroofan commented Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • Add .html and .htm to the shared inbound document allowlist with text/html MIME type.
  • Inline small HTML uploads into the Telegram message text like existing .txt / .md uploads.
  • Sanitize injected HTML by removing script, style, noscript, head, comments, and DOCTYPE boilerplate while preserving visible body content.
  • Add Telegram regression tests for HTML acceptance and non-content block stripping.

Why

Telegram currently rejects .html uploads before the agent can inspect them:

[Telegram] Unsupported document type: .html
Unsupported document type '.html'. Supported types: ...

This is inconsistent with Hermes' outbound/media delivery allowlist, which already treats .html/.htm as deliverable document/web output extensions. For inbound Telegram uploads, the file should be cached and made visible to the agent instead of rejected at the adapter layer.

Small HTML uploads are text-like enough to inline, but raw HTML often includes DOCTYPE, head, CSS, JavaScript, and comments that waste context and can confuse the model. This patch strips those non-content blocks before injection and keeps the uploaded file cached as the original document.

Test plan

  • python -m pytest tests/gateway/test_telegram_documents.py::TestDocumentDownloadBlock::test_supported_html_injects_content tests/gateway/test_telegram_documents.py::TestDocumentDownloadBlock::test_supported_html_injection_strips_non_content_blocks -o 'addopts=' -q
    • 2 passed
  • python -m pytest tests/gateway/test_telegram_documents.py tests/gateway/test_document_cache.py -o 'addopts=' -q
    • 72 passed
  • python -m py_compile gateway/platforms/base.py gateway/platforms/telegram.py

@alt-glitch alt-glitch added type/feature New feature or request P2 Medium — degraded but workaround exists comp/gateway Gateway runner, session dispatch, delivery platform/telegram Telegram bot adapter labels Jun 6, 2026
@Morad37

Morad37 commented Jun 6, 2026

Copy link
Copy Markdown
Contributor

Adding HTML/HTM files to the text injection path is a natural extension, but there's an important difference from .md/.txt files: HTML documents can contain DOCTYPE declarations, <script> tags, <style> blocks, and other non-text elements that get injected verbatim into event.text and fed to the language model. While this isn't a code-execution risk (the LLM only sees the text), it adds noise to the conversation context that .md and .txt files don't typically have. For example, injecting <!DOCTYPE html><html><head>...</head><body> around every HTML document's actual content wastes context window space. More importantly, <script> tag contents (JavaScript) would be injected as if they were text content, which the model might misinterpret or even attempt to execute via a code tool. Consider stripping <script>...</script> and <style>...</style> blocks before injection (or at minimum, rejecting injected text over a certain script-to-content ratio).

@jackroofan
jackroofan force-pushed the fix/telegram-html-document-uploads branch from 327edd2 to f7bd3fa Compare June 6, 2026 16:09
@jackroofan

jackroofan commented Jun 6, 2026

Copy link
Copy Markdown
Author

Good point — I agree raw HTML is noisier than .txt/.md and should not be injected verbatim.

I updated the branch to sanitize HTML before inline injection:

  • strips script, style, and noscript blocks
  • strips head, comments, and DOCTYPE boilerplate
  • if a <body> is present, injects the body content rather than the full document wrapper
  • still caches the original uploaded .html / .htm file as a document

I also added a regression test covering a page.htm upload with DOCTYPE, head, script, and style content to make sure those blocks are not injected while visible body content is preserved.

Updated test plan:

2 passed
python -m pytest tests/gateway/test_telegram_documents.py::TestDocumentDownloadBlock::test_supported_html_injects_content tests/gateway/test_telegram_documents.py::TestDocumentDownloadBlock::test_supported_html_injection_strips_non_content_blocks -o 'addopts=' -q

72 passed
python -m pytest tests/gateway/test_telegram_documents.py tests/gateway/test_document_cache.py -o 'addopts=' -q

python -m py_compile gateway/platforms/base.py gateway/platforms/telegram.py

@alt-glitch alt-glitch mentioned this pull request Jun 24, 2026
Open
@teknium1

teknium1 commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Thanks for addressing the HTML-noise concern raised in the discussion.

Problems

  • Current main already handles the PR's primary acceptance path: 4314d451 made authorized inbound files generic, and Telegram caches/inlines text-like documents at plugins/platforms/telegram/adapter.py:7994-8023; .html/.htm are in the shared text set at gateway/platforms/base.py:1393-1406.
  • The remaining sanitizer is a cross-platform concern. Discord and Slack also raw-inline content using that shared set (plugins/platforms/discord/adapter.py:6433-6447, plugins/platforms/slack/adapter.py:3116-3128), so a Telegram-only implementation would be inconsistent.

Suggested changes

  • Re-scope the salvage to a shared HTML injection-cleanup path, with cross-adapter regression coverage, rather than reviving the obsolete gateway/platforms/telegram.py implementation.

Automated hermes-sweeper review.

@alt-glitch alt-glitch added the needs-decision Awaiting maintainer decision before any implementation label Jul 14, 2026
@teknium1 teknium1 added sweeper:risk-message-delivery Sweeper risk: may drop, duplicate, misroute, or suppress messages sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform labels Jul 14, 2026
@jackroofan

jackroofan commented Jul 14, 2026

Copy link
Copy Markdown
Author

Closing as superseded in its current form. Current main already accepts and inlines .html/.htm uploads through the shared text-document path. The remaining sanitizer concern is cross-platform (Telegram/Discord/Slack), not a Telegram-specific patch against the obsolete adapter path. If pursued, it should be a fresh shared-injection change with cross-adapter coverage. Thanks for the review.

@jackroofan jackroofan closed this Jul 14, 2026
@GottZ GottZ mentioned this pull request Jul 28, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

comp/gateway Gateway runner, session dispatch, delivery needs-decision Awaiting maintainer decision before any implementation P2 Medium — degraded but workaround exists platform/telegram Telegram bot adapter sweeper:blast-moderate Sweeper blast radius: moderate — a subsystem or single platform sweeper:risk-compatibility Sweeper risk: may break existing users, config, migrations, defaults, or upgrades sweeper:risk-message-delivery Sweeper risk: may drop, duplicate, misroute, or suppress messages type/feature New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@jackroofan @Morad37 @teknium1 @alt-glitch