signal-bot/signal_bot/envelope_shape.py
Krzysztof kuhy Rudnicki 50f6a587c2 feat: the bot can describe an envelope without quoting anybody
DOCS-signal-envelopes.md exists because this wire format is not obvious
and guessing at it has cost real bugs -- the sticker read off the wrong
nesting level, and 0.0.3's !gekon shipping green on an assumption nobody
had checked against the live API. The recurring cost is that answering
"what does a frame with an attachment actually look like?" needed a code
change, a restart, and somebody sending one at the right moment.

So at DEBUG the dispatcher now logs each frame's *shape*: keys and value
types, never values. Two fields keep their values because they are wire
format rather than anything a person said -- a MIME type and a groupInfo
type. A message body, a name, a number, a uuid, quoted text and a
sticker id all come out as "str". An album collapses to one element and
a count instead of printing the same dict twenty times.

Verified against a live frame: the body, the quoted text, the uuid and
the phone number do not survive, and contentType does.

This also had to fix DEBUG being unusable. LOG_LEVEL=DEBUG set the root
logger, which turns on httpx, httpcore and asyncio; the bot polls a
group listing every 30 seconds, so the one interesting line arrived
buried and journald started dropping. Libraries are now held at WARNING
whatever the bot is set to -- at INFO httpx was already emitting an
"HTTP Request: GET ... 200 OK" line every thirty seconds, forever.
Measured on the running unit: 17 library lines per minute down to 2.

Two bugs in that setup found by its own tests rather than by review:
basicConfig is a documented no-op once the root logger has a handler, so
the level silently did not apply under pytest; and the floor belongs at
INFO too, not only below it.

A self-send does not produce a capturable attachment envelope, by the
way -- signal-cli emits no syncMessage for a send made over the same
connection. Two probe images returned HTTP 201 and no frame came back,
so the inbound shape still needs a human to post one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015d48t4qsQLBJnDwDeo2Nom
2026-08-30 19:29:06 +02:00

61 lines
2.2 KiB
Python

# Copyright (c) 2026 Krzysztof Rudnicki. MIT licence.
"""Describing an envelope's *shape* without logging what anybody wrote.
`DOCS-signal-envelopes.md` exists because the wire format is not obvious and
guessing at it has cost this repo real bugs -- the sticker read off the wrong
nesting level, and 0.0.3's `!gekon` shipping green on an assumption nobody had
checked against the live API. The recurring problem is that answering "what
does a frame with an attachment actually look like?" needed a code change, a
restart, and somebody sending one at the right moment.
So the bot can now say it itself, at DEBUG. What it emits is keys and value
*types*, never values -- with a small allowlist for the handful of fields that
are format, not content: a MIME type and a groupInfo type say nothing about
anybody. Message bodies, names, numbers, uuids, quoted text and sticker ids
are all reduced to their type.
LOG_LEVEL=DEBUG, then: journalctl --user -u signal-bot | grep 'envelope shape'
"""
from __future__ import annotations
import json
from typing import Final
# Fields whose value is a wire-format fact rather than anything a person said.
SAFE_VALUES: Final = frozenset({"contentType", "type"})
def _describe(value: object, key: str = "") -> str:
"""Render one value as its shape."""
if isinstance(value, dict):
inner = ", ".join(f"{k}: {_describe(v, k)}" for k, v in sorted(value.items()))
return "{" + inner + "}"
if isinstance(value, list):
if not value:
return "[]"
# One entry is enough to show the element shape; a photo album would
# otherwise print the same dict twenty times.
return f"[{_describe(value[0])} x{len(value)}]"
if key in SAFE_VALUES and isinstance(value, str):
return repr(value)
if value is None:
return "null"
return type(value).__name__
def shape_of(raw: str | bytes) -> str:
"""Describe a raw frame as keys and types, or say why it could not be.
Args:
raw: The JSON frame exactly as received.
Returns:
A one-line description safe to write to a log.
"""
try:
decoded = json.loads(raw)
except json.JSONDecodeError, UnicodeDecodeError:
return "<unparseable>"
return _describe(decoded)