2 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	aefffb2fd9	feat: add a photo to the album from the chat, tagged, stripped and verified ... Send a photo captioned "!add_photo alfa wakacje" in one of the album's own groups and it lands in the pack tagged with both, retrievable through !alfa and the new !losowe immediately -- no restart, and no tagger session on the PC. A label matching nobody becomes a custom tag, and !losowe is the only door to one, which is what keeps a live swap a *data* swap: it can never register a trigger or widen a command's groups. No typed label travels. Labels become pseudonym keys in a new registry arg_resolver, at the dispatcher, before the line that logs the command name -- so no handler, journal entry, command_uses row or reply body ever holds a word somebody typed. The reply is counts and pseudonyms: "dodano · p1: 4 · t1: 1". Stripping is exiftool with a *positive* check on the output, never an exit code. ffmpeg was tried first and fails silently on photos: given a JPEG with a real APP1 Exif segment it returned a byte-identical file, GPS intact, exit 0. The surviving-tag allowlist is per tag *name* rather than per group, because measurement showed a group-level "must be empty" rule rejects every format except JPEG -- a valid PNG always reports its IHDR, an MP4 some fifty QuickTime tags that are the container itself. Codec configuration (CompressorName, VendorID, the HEVC parameter set) is on the list by decision: CompressorName lives in the avc1 sample description and exiftool cannot write it at all, so the alternative was refusing every video and every iPhone HEIC. Location and identity tags are still refused, and the e2e run re-reads the stored files to prove a QuickTime geotag did not survive. .webm and .svg stay on the format allowlist and are stored *unstripped*: exiftool 13.55 can write neither, and its SVG reader does not even surface <metadata>. That is a deliberate, documented hole, not an oversight. Two things this had to defuse along the way: - personal_data_sources now reads custom.json, so "!add_photo kot <photo>" would have outlawed the word "kot" and refused every future commit, fixable only by hand-editing an album the committer cannot see. Minting now refuses a word that is already a command, and the gate subtracts the repo's own alias vocabulary from custom labels only -- curated people.json names are never excused. - signal_bot/external.py is now the single subprocess site in the repository, so ruff's S603 needs exactly one scoped per-file-ignore instead of one per module that shells out. A test asserts nothing else imports subprocess. A failed add changes nothing: media and the three manifests are written, the album is reloaded, and only a load that succeeds is published; a load that fails rolls all four back and keeps serving the pack that was already working, without raising -- Restart=always would turn a ConfigError into a loop. 977 tests, 100% branch coverage, no omits and no suppressions. scripts/e2e.sh gains 8 scenarios driven against the real exiftool on media generated at run time, and asserts the invariants a reply cannot: that a refused upload is not stored, that a message with no attachment leaves custom.json byte-identical, and that signal-cli's own copy of every ingested attachment is gone. Closes TODO-add-photo.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JqqE22jp94B1ypwxppdr1o	2026-08-31 11:20:00 +02:00
Krzysztof kuhy Rudnicki	6bde3493a4	feat: rewrite the bot so it runs, and gate it like the other repos ... The bot did not work. `run.sh` started a FastAPI app whose `@app.on_event("startup")` awaited `asyncio.gather()` on two infinite tasks, so uvicorn never finished starting up and no HTTP was ever served; the readme's `python main.py` was a no-op with no `__main__` block and no `uvicorn.run()` call. All three CI workflows were red, one referencing an `environment.yml` that does not exist. Rewritten as a package behind an injectable transport seam, which is what makes the offline environment possible. Bugs fixed: - startup deadlock: lifespan spawns the loops instead of awaiting them - sticker filter read dataMessage.sticker even on syncMessage envelopes, so the account's own stickers were never filtered (e038772, 53028cc, 07fa90d, 2416cef all fought this symptom) - no websocket reconnect: a container restart killed the bot silently - blocking `requests` inside async functions stalled the event loop - every counted message DMed the whole tally to the bot itself - images were written to CWD under a filename taken from the remote URL - one global 10s cooldown shared across all users and commands - dead code: RECEIVE_URL, get_attachments (no call site), USER_MESSAGE_COUNT - .env.sample declared PRIMARY/SECONDARY_PHONE_NUMBER and MODE, none read Scoping is now an enforced invariant. A linked device receives every DM and every group on the account; GROUP_ID was the only thing narrowing that and defaulted to "". Config refuses to start unscoped, direct messages are dropped explicitly rather than by a falsy check, and a scenario asserts that DMs and other groups produce zero outbound messages. Offline environment: fake_signal/ serves the real protocol surface, so the unmodified bot connects to it by pointing API_BASE_URL at it. scripts/e2e.sh boots both, replays 7 scenarios and exits non-zero on mismatch. A local Signal server is not achievable (signal-cli compiles its endpoints and trust store in; Signal-Server needs FoundationDB), so faking this boundary is the only way to test every feature without an account. Transport pinned to bbernhard/signal-cli-rest-api:0.100 with MODE=json-rpc-native. The readme pinned 0.167-dev; the dev tag series counts separately, so that was older than 0.100, not newer. /v1/receive is only a WebSocket in a json-rpc mode, so the mode is verified at startup. Repo standards: ruff select=ALL, mypy --strict, 189 tests at 100% branch coverage, 250-line cap, exact pins at newest stable, shared gates delegated to ~/utils, one CI workflow replacing three red ones. No noqa, no type: ignore, no coverage omits anywhere. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yaBT45KhHqxTKVCTA87iy	2026-08-29 13:05:42 +02:00