admin/orchestrator
1
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

fix(notifications): escape all card data fields at the render boundary (ORCH-095)

Browse Source 
render_task_tracker sends/edits the live card with parse_mode=HTML. _fmt_minutes
returns the literal "<1м" for a sub-minute stage; interpolated raw into HTML text
Telegram parsed "<1м" as an opening tag -> editMessageText 400 can't parse
entities -> edit_telegram EDIT_FAILED -> update_task_tracker early return
(anti-duplicate ORCH-087) -> the card froze (incident ORCH-093, message_id 18854).

Close the whole "unescaped data in HTML text" class per ADR-001: a module-local
_esc(x)=html.escape(str(x)) (never-raise) wraps every DATA slot (durations, status
label, model, effort, token/cost metrics) exactly once at the render boundary in
render_task_tracker/_stage_line. Source functions stay HTML-agnostic (_fmt_minutes
still returns "<1м"; escape on the boundary renders it visually identical as
&lt;1м, so the visible format is unchanged). Intentional MARKUP slots (num_html /
link_for / _done_link / already-escaped esc_title) are NOT escaped, so the issue
number stays a clickable <a> tag and nothing is double-escaped.

A previously-frozen card auto-recovers on the next stage transition (a new safe
render edits in place, 200) — no new code, no touch to edit_telegram /
update_task_tracker / the orphan ledger, so the ORCH-087 anti-duplicate invariant
is preserved (a transient edit failure still does not spawn a new card).

STAGE_TRANSITIONS / QG_CHECKS / check_* / notification transport / DB schema are
untouched. New tests/test_tracker_html_escape.py (TC-01..TC-11); full suite green.

Refs: ORCH-095

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
claude-bot
2026-06-10 00:07:17 +03:00
committed by orchestrator-deployer
parent 6b14b07f40
commit b38cc16041
3 changed files with 406 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
src/notifications.py
View File

@@ -290,6 +290,27 @@ def _fmt_minutes(seconds) -> str:
return f"{seconds // 60}\u043c"
def _esc(x) -> str:
"""ORCH-095: escape a DATA value for the parse_mode=HTML card text (never-raise).
Every dynamic *data* value interpolated into ``render_task_tracker``'s HTML text
(durations, status label, model, effort, token/cost metrics) is wrapped here
exactly once at the render boundary (ADR-001, category D). This closes the class
"unescaped data in HTML text": a literal like ``<1м`` from ``_fmt_minutes`` (or any
future ``< > &`` from a data source) can no longer be parsed by Telegram as an
opening tag (``400 can't parse entities`` -> EDIT_FAILED -> frozen card, ORCH-093).
Intentional markup slots (``num_html``/``link_for``/``_done_link``/already-escaped
``esc_title`` — category M) are NOT passed through ``_esc`` so they stay valid,
clickable HTML and are never double-escaped. On any error ``str()``/escape degrades
to '' rather than raising (FR-5 never-raise).
"""
try:
return html.escape(str(x))
except Exception:
return ""
def _parse_sql_ts(ts):
"""Parse a SQLite 'YYYY-MM-DD HH:MM:SS' UTC timestamp -> aware datetime/None."""
if not ts:
@@ -445,7 +466,9 @@ def render_task_tracker(task_id: int) -> str:
)
except Exception:
status_label = _DEFAULT_STATUS_LABEL
status_line = f"\U0001f4cd {status_label}"
# ORCH-095 (ADR-001 D3): status label is a DATA slot (offline core + live
# overlay) -> escaped at interpolation; intentional markup is never built here.
status_line = f"\U0001f4cd {_esc(status_label)}"
lines = [header, status_line, bar]
# ORCH-026 (B-4): waiting-line for a task blocked by an unfinished declared
@@ -487,19 +510,23 @@ def render_task_tracker(task_id: int) -> str:
d = _duration_seconds(run["started_at"], run["finished_at"])
if d is not None:
dur_sum += d
in_tok = fmt_tokens(in_sum)
out_tok = fmt_tokens(out_sum)
cost = fmt_cost(cost_sum)
dur = _fmt_minutes(dur_sum)
# ORCH-095 (ADR-001 D1/D3): every interpolated DATA value (category D) is
# escaped here at the render boundary so a literal like '<1м' from
# _fmt_minutes can no longer break parse_mode=HTML; defence-in-depth for the
# token/cost/model/effort fields too (currently safe, structurally guarded).
in_tok = _esc(fmt_tokens(in_sum))
out_tok = _esc(fmt_tokens(out_sum))
cost = _esc(fmt_cost(cost_sum))
dur = _esc(_fmt_minutes(dur_sum))
# Model/effort/"\u043f\u043e\u043f\u044b\u0442\u043a\u0430 N" come from the LAST run (agent_runs are id ASC).
last = stage_runs[-1] if stage_runs else None
model = short_model_name(last["model"]) if last is not None else ""
model = _esc(short_model_name(last["model"])) if last is not None else ""
model_suffix = f" \u00b7 {model}" if model else ""
# ORCH-087 (BR-EFF): render the resolved --effort next to the model
# ("\u00b7 opus-4-8 \u00b7 xhigh"). Stamped at launch in agent_runs.effort; empty /
# missing -> suffix omitted (like the model suffix). Historical rows with
# NULL effort fall back to the config-resolved effort for the agent.
effort = _run_effort(last) if last is not None else ""
effort = _esc(_run_effort(last)) if last is not None else ""
effort_suffix = f" \u00b7 {effort}" if effort else ""
return (
f"\u2705 {label:<13} {dur} \u00b7 "
@@ -564,7 +591,7 @@ def render_task_tracker(task_id: int) -> str:
if review_seconds is not None:
# ORCH-042 (BR-10): approve-gate passed -> \u2705 (was \u23f8\ufe0f). The
# still-waiting branch below keeps \u23f8\ufe0f + \u23f3 unchanged.
dur = _fmt_minutes(review_seconds)
dur = _esc(_fmt_minutes(review_seconds)) # ORCH-095: D-slot
lines.append(
f"\u2705 {brd_label} {dur} \u00b7 \u0442\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f"
)
@@ -577,21 +604,21 @@ def render_task_tracker(task_id: int) -> str:
waited = int(
(datetime.now(timezone.utc) - start_dt).total_seconds()
)
dur = _fmt_minutes(waited) if waited is not None else "\u2026"
dur = _esc(_fmt_minutes(waited)) if waited is not None else "\u2026" # ORCH-095: D-slot
lines.append(
f"\u23f8\ufe0f {brd_label} {dur} \u00b7 \u0442\u0432\u043e\u0451 \u0432\u0440\u0435\u043c\u044f \u23f3"
)
lines.append(bar)
lines.append(
f"\U0001f4b0 {fmt_tokens(total_in)}\u2193 / {fmt_tokens(total_out)}\u2191 \u00b7 "
f"{fmt_cost(total_cost)}"
f"\U0001f4b0 {_esc(fmt_tokens(total_in))}\u2193 / {_esc(fmt_tokens(total_out))}\u2191 \u00b7 "
f"{_esc(fmt_cost(total_cost))}"
)
if done:
wall = _duration_seconds(task["created_at"], task["updated_at"])
wall_str = _fmt_minutes(wall) if wall is not None else "?"
review_str = _capped_review_str(review_seconds)
wall_str = _esc(_fmt_minutes(wall)) if wall is not None else "?" # ORCH-095: D-slot
review_str = _esc(_capped_review_str(review_seconds)) # ORCH-095: D-slot
# ORCH-087 (BR-G5): three INDEPENDENT, explicitly-labelled metrics. None is
# presented as the sum of the others \u2014 queue/wait pauses are not logged, so
# wall != agents + review; the old "\u0412\u0441\u0435\u0433\u043e {wall}" read like a (wrong) sum.
@@ -599,7 +626,7 @@ def render_task_tracker(task_id: int) -> str:
# \u0442\u0432\u043e\u0451 = human BRD-review, capped to drop anomalous stalls (T-2)
# \u043e\u0431\u0449\u0435\u0435 \u0441 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0435\u043c = wall-clock incl. queue/wait, NOT work time (T-3)
lines.append(
f"\u23f1\ufe0f \u0410\u0433\u0435\u043d\u0442\u044b {_fmt_minutes(agent_seconds)} \u00b7 "
f"\u23f1\ufe0f \u0410\u0433\u0435\u043d\u0442\u044b {_esc(_fmt_minutes(agent_seconds))} \u00b7 "
f"\u0442\u0432\u043e\u0451 {review_str} \u00b7 "
f"\u043e\u0431\u0449\u0435\u0435 \u0441 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0435\u043c {wall_str}"
)