Upstream backport: 2026-06-15 intake (Phase 1 + Phase 2, 172 commits) - #23
Merged
DavidOsipov merged 229 commits intoJun 25, 2026
Merged
Conversation
(cherry picked from commit abc964d)
(cherry picked from commit 0160f50)
(cherry picked from commit efcb810)
(cherry picked from commit 4ae93d6) Conflicts (fork has 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted construction sites, including the get_user_default_permissions auth guard (fail-closed; verified non-empty). Conflicts (fork 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted sites incl. get_user_default_permissions auth guard (fail-closed, non-empty). Conflicts (fork 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted sites incl. get_user_default_permissions auth guard (fail-closed, non-empty).
(cherry picked from commit a762fc6) Conflict: CMakeLists.txt source list diverged in fork; kept fork list and added td/telegram/files/FileUploadId.cpp.
(cherry picked from commit 0fb2fa8)
(cherry picked from commit e546d37) Conflict: kept fork's fail-closed settings.resolve_added_input_users (propagates errors) in BotInfoManager instead of upstream's error-dropping get_input_users_force; the new helper is still added and used by BusinessRecipients/UserPrivacySettingRule.
(cherry picked from commit 1980109) Conflict: kept fork CMakeLists source list, added td/telegram/UserId.cpp.
(cherry picked from commit b228505) Conflict: kept fork's fail-closed validation (get_user_id + invalid->error/clear/return, then on_get_user to register); upstream's on_get_user-returns-UserId signature change still applies via UserManager. Taking upstream here would use-after-move. [build-fix] BotAccessSettings: use on_get_user (now returns UserId; get_user_id became private) keeping fork fail-closed validation.
(cherry picked from commit 994207e)
(cherry picked from commit 013c3f2)
(cherry picked from commit 2d88343)
(cherry picked from commit d3ffc1c)
(cherry picked from commit c42606c) Conflict: kept fork CMakeLists, added td/telegram/FormattedDate.cpp.
(cherry picked from commit f73ea29) Conflict: adopted upstream get_min_message_senders_object helper but PRESERVED fork's W3-P fail-closed voter-visibility clear (recent_voters.clear() when !can_get_voters && !is_bot).
(cherry picked from commit b4846bb)
(cherry picked from commit 6b40e30)
(cherry picked from commit c5dfef6)
(cherry picked from commit 32aaf29)
(cherry picked from commit 92d8146)
(cherry picked from commit 1d6decf)
Fork W5-AI caller of ConfigManager config-reload was missed by upstream rename 7a6bde6 ("Improve names of functions for config reload"). Caught by Linux build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 5aec5b1) Conflict (telegram_api.tl): union + dedup (removed 4 already-present ctors: updateAiComposeTones/stats.pollStats/bots.accessSettings/messages.setBotGuestChatResult). Layer-227 schema; fork tracks layers (223/224 in history).
(cherry picked from commit bed7093)
(cherry picked from commit b01741c)
(cherry picked from commit 6c67c54)
(cherry picked from commit 9b4bbc6)
(cherry picked from commit b6993b4)
(cherry picked from commit 855da94)
(cherry picked from commit f17f550)
(cherry picked from commit e65c04f)
(cherry picked from commit aa2d317)
(cherry picked from commit c1ca762)
(cherry picked from commit d730220)
(cherry picked from commit 9f0f70f)
(cherry picked from commit a74c276)
(cherry picked from commit d68320c)
(cherry picked from commit ac0c191)
(cherry picked from commit 726b159)
(cherry picked from commit 8139027)
(cherry picked from commit 691dc32)
(cherry picked from commit 1eff7c4)
(cherry picked from commit bd9a93f)
(cherry picked from commit 45b4098)
(cherry picked from commit 39d6b80)
(cherry picked from commit fbe572d)
(cherry picked from commit bf8b079)
(cherry picked from commit 3271d27)
(cherry picked from commit e6245bd)
(cherry picked from commit 499c227)
(cherry picked from commit ad25dc7)
(cherry picked from commit 01b0cec)
(cherry picked from commit b629bd3)
(cherry picked from commit 1f55d80)
(cherry picked from commit 5e21b56)
(cherry picked from commit 2cf217f)
DavidOsipov
added a commit
that referenced
this pull request
Jun 26, 2026
* feat(stealth): adaptive runtime profile rotation + iOS release-grade lane Implements docs/Plans/ADAPTIVE_RUNTIME_PROFILE_ROTATION_PLAN_2026-06-12.md. - Close the iOS/default release-grade gap: new verified browser-capture AppleIosTls lane (TlsOnly + release_gating + Verified), iOS-share weight carve so it has non-zero effective weight and IOS14 is no longer the only Unknown-confidence iOS lane; loader + validation updates. - Bounded, failure-driven runtime profile rotation (in-memory, opt-in, default-off): RuntimeProfileRotationPolicy + strict `profile_rotation` loader schema; quarantine keyed by (normalized destination, BrowserProfile, hello_uses_ech); conservative typed failure attribution (only wire-shape rejections; never wrong-regime / response-hash-mismatch / pre-hello); fail-closed all-blocked path; counters. - TlsInit wire-path single selection via pick_runtime_profile_adaptive (one snapshot, ECH computed once) with per-wire-variant failure/success accounting and operator-facing log fields; explicit-profile StealthConfig construction path. - Compile-time alignment guard (static_assert) tying the BrowserProfile enum to the positional PROFILE_SPECS / PROFILE_FIXTURES / ALL_PROFILES arrays, plus a profile_index bounds check. - Tests: new contract/positive/negative/edge/adversarial/stress/fuzz suites for rotation; updated existing iOS-Unknown tests for the new AppleIosTls lane. - Audit findings doc (HIGH..LOW); M1 resolved, H1 deferred. Known follow-up before enabling rotation in prod: the cross-actor single-selection handoff (ConnectionCreator -> create_transport) so the transport-shaping config and the emitted ClientHello share one profile. Not built/run on this macOS host (pre-existing zlib / tl-parser / libc++ portability gaps unrelated to this change); verify on the Linux CI. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(stealth): wire single-selection handoff (H1) + iOS share floor (M2) Closes the deferred audit findings so failure-driven profile rotation can be safely enabled. See docs/Plans/ADAPTIVE_RUNTIME_PROFILE_ROTATION_DEFERRED_FIXES_PLAN_2026-06-12.md. H1 (split-profile wire incoherence) — single-selection cross-actor handoff: - TransportType gains an optional `selected_profile`. - ConnectionCreator computes one pick_runtime_profile_adaptive per emulate_tls attempt and stamps it onto the transport_type before the connection promise copies it, across all three connection paths (client, request-by-ip, ping). - TlsInit accepts the pre-selected profile and uses it for the emitted ClientHello (still computing ECH and recording per-wire-variant accounting at send time) instead of running a second independent selection. - create_transport uses the explicit-profile make_transport_stealth_config overload when the profile is set, so the transport-shaping config and the ClientHello carry one profile. No split profile state when rotation is enabled. M2 (tiny ios14 policy zeros the verified iOS lanes) — validate_runtime_profile_ selection_policy now requires policy.mobile.ios14 == 0 || >= 7, so the integer carve cannot truncate both verified iOS lanes to 0. Flat profile_weights configs are unaffected. M3 / M4 — documented decisions (no code change): a prior-success gate for transport-reject quarantine would forbid rotating away from a fingerprint blocked from the first attempt (the common DPI case), so the existing fail-safe bound + failure_threshold knob is kept; the rotation order is kept deterministic for anti-churn and H1 coherence, with per-install salt as the population-level de-correlation. Tests: test_runtime_profile_rotation_handoff.cpp pins the explicit-profile StealthConfig coherence and the M2 policy floor. All touched sources verified via clang -fsyntax-only. The connection-path changes still need a Linux-CI integration run before profile_rotation.enabled is flipped on. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * 1. Installed beads as issue tracker for AI agents 2. Patched issues with PR 22 3. Fixed muptiple issues in stealth subsystem * feat(backport): selective upstream intake cycle 2026-06-15 (Wave A inventory + Wave B fixes) Baseline e0943d0 (tdlib 1.8.64) -> upstream/master a17f87c; 247-commit delta inventoried and classified. All downstream-status 'missing'; gate tally: 207 defer_pending_context (product epics), 28 reject_not_relevant, 8 accept_with_repair, 4 local_equivalent_adaptation. No stealth-transport (td/mtproto, tdnet, TlsInit) commit in the delta. W11-AI2 stays deferred. Wave B minimal correctness backports (TDD-first, contract tests before fix): - 84f21a1 (exact): add_message_content_dependencies resolves bot_user_id for ManagedBotCreated. - a74cc9a (local-equivalent): persisted-draft parse clears same-chat yet-unsent OR local replies, preserving the fork's is_valid_scheduled() guard. - dc73b3c (local-equivalent): DB-loaded dialog repair re-fetches unresolved messages and reloads full dialog info on failed resolve, keeping caller-source provenance. Prereq-coupled poll/instant-view fixes and the product epics remain deferred (not cherry-picked). Full build/ctest/sanitizer matrix runs on Linux CI. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(backport): Wave B-2 — 2 safe standalone fixes from feasibility sweep Dry-run cherry-pick sweep of all 244 remaining upstream commits (isolated worktree, zero commits to branch): 55 apply cleanly, 189 conflict. Of the 55 clean, 23 are td_api.tl public-API changes and most others are coupled product-epic fragments that apply textually but do not compile standalone. Only 2 are genuinely safe + fork-applicable: - c3759d5 (exact): pending-call notification via send_closure_later (reentrancy/ordering hardening). - e95e1fd (local-equivalent): DialogAction::operator== also compares random_id_ and text_; the upstream RichMessage message_ field is dropped (feature absent in fork; guard test enforces it). Both files were pristine upstream Boost headers -> converted to dual SPDX per policy. Contract tests added + registered; RED-on-revert verified. Remaining ~239 commits stay deferred: product epics (rich-message/instant-view/WebBrowser/PollMedia/chat-join/live-location) needing td_api.tl + new files + layer-227, which would violate fork policy 'No bulk sync'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(changelog): add explicit backported-commits table for 2026-06-15 cycle Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(backport): 1a8d241 — repair video properties from alternative videos get_video_object derives missing duration/thumbnail from alternative (HLS) videos when the main video's own values are absent. The new alternative_file_ids parameter carries a default ({}) in the header so the fork's other 13 callers are unaffected (faithful local-equivalent of the upstream signature change). Contract test added + registered; dual SPDX headers applied to the two previously-pristine Boost files. Brings the cycle to 6 landed backports; resolves 5 of the 8 Wave-A accept_with_repair candidates (39ea84d already-present; d78ceef/4e59e82d0 deferred/dropped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fixed issues in 4 latest commits * Upstream backport: 2026-06-15 intake (Phase 1 + Phase 2, 172 commits) (#23) * Improve error messages. (cherry picked from commit abc964d) * Improve Document::is_empty() name. (cherry picked from commit 0160f50) * Add get_thumbnail_object overload for animated thumbnails. (cherry picked from commit efcb810) * Add and use RestrictedRights::restrict_all(). (cherry picked from commit 4ae93d6) Conflicts (fork has 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted construction sites, including the get_user_default_permissions auth guard (fail-closed; verified non-empty). Conflicts (fork 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted sites incl. get_user_default_permissions auth guard (fail-closed, non-empty). Conflicts (fork 18 RestrictedRights vs upstream 19): took upstream restrict_all() at all conflicted sites incl. get_user_default_permissions auth guard (fail-closed, non-empty). * Add and use FileUploadId::get_file_upload_ids. (cherry picked from commit a762fc6) Conflict: CMakeLists.txt source list diverged in fork; kept fork list and added td/telegram/files/FileUploadId.cpp. * Add and use UserManager::get_input_users. (cherry picked from commit 0fb2fa8) * Add and use UserManager::get_input_users_force. (cherry picked from commit e546d37) Conflict: kept fork's fail-closed settings.resolve_added_input_users (propagates errors) in BotInfoManager instead of upstream's error-dropping get_input_users_force; the new helper is still added and used by BusinessRecipients/UserPrivacySettingRule. * Add UserId.cpp. (cherry picked from commit 1980109) Conflict: kept fork CMakeLists source list, added td/telegram/UserId.cpp. * Return UserId from on_get_user. (cherry picked from commit b228505) Conflict: kept fork's fail-closed validation (get_user_id + invalid->error/clear/return, then on_get_user to register); upstream's on_get_user-returns-UserId signature change still applies via UserManager. Taking upstream here would use-after-move. [build-fix] BotAccessSettings: use on_get_user (now returns UserId; get_user_id became private) keeping fork fail-closed validation. * Use get_dialog_id in get_dialog_ids. (cherry picked from commit 994207e) * Use ChatManager::get_dialog_id when processing invite links. (cherry picked from commit 013c3f2) * Keep only short comments. (cherry picked from commit 2d88343) * Make get_chat_id and get_channel_id private. (cherry picked from commit d3ffc1c) * Add class FormattedDate. (cherry picked from commit c42606c) Conflict: kept fork CMakeLists, added td/telegram/FormattedDate.cpp. * Add and use get_min_message_senders_object. (cherry picked from commit f73ea29) Conflict: adopted upstream get_min_message_senders_object helper but PRESERVED fork's W3-P fail-closed voter-visibility clear (recent_voters.clear() when !can_get_voters && !is_bot). * Add and use get_message_content_has_bot_commands. (cherry picked from commit b4846bb) * Reuse is_game in fix_forwarded_message. (cherry picked from commit 6b40e30) * Remove unused variable. (cherry picked from commit c5dfef6) * Remove special handling for polls. (cherry picked from commit 32aaf29) * Improve names of functions for config reload. (cherry picked from commit 92d8146) * Add find_authentication_codes and move it to misc.cpp. (cherry picked from commit 1d6decf) * [build-fix] TranslationManager: reget_app_config -> reload_app_config Fork W5-AI caller of ConfigManager config-reload was missed by upstream rename 7a6bde6 ("Improve names of functions for config reload"). Caught by Linux build. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Update layer to 227. (cherry picked from commit 5aec5b1) Conflict (telegram_api.tl): union + dedup (removed 4 already-present ctors: updateAiComposeTones/stats.pollStats/bots.accessSettings/messages.setBotGuestChatResult). Layer-227 schema; fork tracks layers (223/224 in history). * Improve getActiveSessions and terminateAllOtherSessions documentation. (cherry picked from commit bed7093) * Add more information about connected business bot. (cherry picked from commit b01741c) * Remove UnconfirmedAuthorization::get_hash(). (cherry picked from commit 6c67c54) * Rename SessionType to SessionDeviceType. (cherry picked from commit 9b4bbc6) * Support business bot conniections in updateUnconfirmedSession. (cherry picked from commit b6993b4) * Remove unconfirmed session when removing the business bot. (cherry picked from commit 855da94) * Add td_api::confirmBusinessConnectedBot. (cherry picked from commit f17f550) * Add separate td_api::messageLiveLocation. (cherry picked from commit ff3f4d4) * Add td_api::webDomainException. (cherry picked from commit 9903855) Conflict: kept fork CMakeLists, added td/telegram/WebDomainException.cpp. * Add WebDomainException::get_web_domain_exceptions. (cherry picked from commit fa5adae) * Add WebDomainException::get_web_domain_exceptions_object. (cherry picked from commit c88895f) * Add td_api::webBrowserSettings. (cherry picked from commit e1142ec) Conflict: kept fork CMakeLists, added td/telegram/WebBrowserSettings.cpp. * Improve title of webDomainException. (cherry picked from commit 69a62cb) * Add userTypeBot.is_guard. (cherry picked from commit 73035e4) Conflict: td_api.tl doc — took upstream (adds is_guard doc; userTypeBot definition auto-merged with fork supports_guest_queries). * Add supergroupFullInfo.guard_bot_user_id. (cherry picked from commit 10e9b54) * Add mainWebApp.require_same_origin. (cherry picked from commit 245bbb6) * Add webAppInfo.require_same_origin. (cherry picked from commit 3d62739) * Return webAppUrl from getWebAppLinkUrl and getWebAppUrl. (cherry picked from commit 4b8cc57) * Use webAppUrl in webAppInfo and mainWebApp. (cherry picked from commit 9721173) * Add updateNewChatJoinRequest.query_id. (cherry picked from commit 56ba59d) * Add on_update_channel_guard_bot_user_id. (cherry picked from commit 1f10692) * Add toggleSupergroupJoinByRequest.guard_bot_user_id. (cherry picked from commit 0bb980a) * Allow join requests in private supergroups. (cherry picked from commit fb67035) * Add toggleSupergroupJoinByRequest.apply_to_invite_links. (cherry picked from commit 077f71a) * Allow primary links whish support join requests. (cherry picked from commit 4026e71) * Return ChatJoinResult from joinChatByInviteLink. (cherry picked from commit 9bde7aa) * Add separate DialogParticipantManager::join_dialog. (cherry picked from commit 733abb8) * Make wrap_failed_to_add_members_promise private. (cherry picked from commit c9031f9) * Return ChatJoinResult for joinChat. (cherry picked from commit b64291c) * Add chatJoinResultGuardBotApprovalRequired. (cherry picked from commit 3c5f004) * Support chatJoinResultGuardBotApprovalRequired in joinChat. (cherry picked from commit 099039a) * Add td_api::ChatJoinRequestResult. (cherry picked from commit 63eb20e) Conflict: kept fork CMakeLists, added td/telegram/JoinChatBotResult.cpp. * Add td_api::answerChatJoinRequestQuery. (cherry picked from commit 9a5604f) * Handle JOIN_GUARD_TIMEOUT errors. (cherry picked from commit 1194f6a) * Add td_api::liveLocation. (cherry picked from commit 6802307) * Explicitly specify namespace in WebPageBlock. (cherry picked from commit 5bfa4b5) * Add td_api::richTextMathematicalExpression. (cherry picked from commit 84bd6e5) * Add td_api::richTextCustomEmoji. (cherry picked from commit b895a66) * Add td_api::richTextSpoiler. (cherry picked from commit 08768f6) * Add td_api::richTextMention. (cherry picked from commit 112a9c8) * Add td_api::richTextHashtag. (cherry picked from commit b44a060) * Add td_api::richTextCashtag. (cherry picked from commit ff5f74d) * Add td_api::richTextBotCommand. (cherry picked from commit 7687d6e) * Add td_api::richTextAutoUrl. (cherry picked from commit 4a385cd) * Add td_api::richTextAutoEmailAddress. (cherry picked from commit 47541c1) * Add td_api::richTextAutoPhoneNumber. (cherry picked from commit b7f63fb) * Add pageBlockPhoto.has_spoiler. (cherry picked from commit 00c75a8) * Add pageBlockVideo.has_spoiler. (cherry picked from commit 17b833f) * Add td_api::pageBlockSectionHeading. (cherry picked from commit f65a89d) * Add td_api::pageBlockMathematicalExpression. (cherry picked from commit e3d39cd) * Add td_api::pageBlockThinking. (cherry picked from commit 1a36c86) * Return blocks in pageBlockBlockQuote. (cherry picked from commit 1be7468) * Support pageBlockBlockquoteBlocks. (cherry picked from commit 61fd837) * Add pageBlockListItem.has_checkbox/is_checked. (cherry picked from commit 95d94ec) * Add pageBlockListItem.value/type. (cherry picked from commit 5a1290f) * Support new pageBlockOrderedList fields. (cherry picked from commit d26c34a) * Add td_api::richTextDateTime. (cherry picked from commit eb92c12) * Add td_api::richTextBankCardNumber. (cherry picked from commit ce0380e) * Add WebPageBlock::add_dependencies. (cherry picked from commit 876df01) * Load instant view dependencies. (cherry picked from commit 4ed5f85) * Add td_api::richTextMentionName. (cherry picked from commit dadf8b3) * Add DialogPhoto/ProfilePhoto comparison operators. (cherry picked from commit a45ac5b) * Add WebPageBlock comparison operators. (cherry picked from commit 0ce538b) * Add WebPageBlockList::Item methods. (cherry picked from commit 619eadb) * Add RelatedArticle::get_page_block_related_article_object. (cherry picked from commit 7bbdff0) * Add WebPageBlock::for_each_text. (cherry picked from commit 7bff585) * Add WebPageBlock::for_each_rich_text. (cherry picked from commit c42d9ba) Conflict: took upstream for_each_rich_text/page_blocks (aligns holdout class with the rest of WebPageBlock's already-landed rich-text refactor). * Add td_api::getCountry. (cherry picked from commit 49fdf01) * Improve pageBlockListItem.type handling. (cherry picked from commit 792ff5a) Conflict: took upstream pageBlockListItem.type handling (instant-view). * [build-fix] WebPageBlock: for_each_rich_text uses fork member 'blocks' (not upstream 'page_blocks') in WebPageBlockBlockQuoteBlocks c42d9ba take-incoming brought upstream's page_blocks member name; this fork class member is 'blocks'. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Support list item types. (cherry picked from commit 2c601fe) * Add td_api::premiumLimitTypeMessageTextLength. (cherry picked from commit a0dfea7) Conflict: took upstream (config CURRENT_VERSION 127; default options poll_country_count_max/message_text_length_max). * Replace updatePendingTextMessage with updatePendingMessage. (cherry picked from commit c152f9e) * Simplify TextDraftInfo. (cherry picked from commit 9e220de) * Add FormattedDate::get_input_text_date. (cherry picked from commit b167a22) * Add and use get_update_unconfirmed_session_object. (cherry picked from commit d86bb30) * Add updateUnconfirmedSession.unconfirmed_session_count. (cherry picked from commit 40e24dc) * Add td_api::DraftMessageContent. (cherry picked from commit 6727c04) * Add missing include. (cherry picked from commit e6b6c17) * Add and use DialogParticipantManager::get_chat_join_result_object. (cherry picked from commit edab0cb) * unset CMAKE_FIND_ROOT_PATH_MODE_PROGRAM (cherry picked from commit 9ae32a3) * [build-fix] DraftMessage: drop premature #include RichMessage.hpp (rich-message epic deferred to Phase 2) 80e6bed (Add missing include) added it for the unbackported rich-message feature; the include is unused here and RichMessage.hpp is absent. Re-added in Phase 2 with the rich-message epic. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(backport): Phase 1 closeout + Phase 2 deferred list (2026-06-16) Phase 1: 105 commits backported, GREEN on Linux. 145 deferred to Phase 2 (categorized). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(backport): Phase-1 fail-closed contract tests (per prompt adversarial-TDD rules) Pin the fork's security-critical contracts that the bulk conflict resolutions touched, so they cannot be silently broken ("contracts not похерены"): - RestrictedRights fail-closed auth guard (get_user_default_permissions returns restrict_all() for unknown/Replies/VerificationCodes; non-empty guard; ChatManager unknown-chat default restricted). - PollManager W3-P voter-visibility clear (recent_voters cleared when !can_get_voters && !is_bot). - BotAccessSettings fail-closed validation (invalid added user -> error+clear+return via on_get_user). Source-contract style (repo convention); needles self-verified against current tree. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add separate inputMessageLiveLocation. (cherry picked from commit b07e4b7) Conflict (td_api.tl): kept fork poll schema (no PollMedia media fields — that epic is separate) + fork PollVoteRestrictionReason; landed inputMessageLiveLocation (auto-merged). * Simplify inputMessageLiveLocation. (cherry picked from commit 8d72b20) * Add process_live_location. (cherry picked from commit fa95018) * Add InputMessageLocation::get_input_media_geo_live. (cherry picked from commit df1e8ff) * Use liveLocation in editMessageLiveLocation. (cherry picked from commit fb985db) * Use liveLocation in editInlineMessageLiveLocation. (cherry picked from commit e59e480) * Use liveLocation in editBusinessMessageLiveLocation. (cherry picked from commit c99307d) * Treat empty location in live location as empty live location. (cherry picked from commit 22c8206) * Improve live location documentation. (cherry picked from commit f63e43e) * docs(backport): Phase 2 resume checkpoint (live-location done; chat-join in progress) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add td_api::updateChatJoinResult. (cherry picked from commit b449204) * Improve guard_bot_user_id documentation. (cherry picked from commit 3e17b90) * Return webAppUrl in chatJoinResultGuardBotApprovalRequired. (cherry picked from commit 7a154de) * Improve updateChatJoinResult documentation. (cherry picked from commit e27fde4) * Add td_api::chatJoinResultRequestDeclined. (cherry picked from commit 434ef4b) * test(backport): Phase 2 chat-join/guard-bot epic contract guards Pins the fork contracts that the 5 trailing chat-join/guard-bot backports (b449204, 3e17b90, 7a154de, e27fde4, 434ef4b) must keep intact: - DeclinedErrorMapsToDeclinedResult: INVITE_REQUEST_DECLINED -> chatJoinResultDeclined (no silent fall-through to nullptr), RequestSent/timeout branch preserved. - GuardBotWebAppUrlPropagatesSameOrigin (security): the guard-bot Web App URL is wrapped in webAppUrl(url_, same_origin_) at both construction sites; the old bare form that dropped same_origin is gone (no origin-validation downgrade). - JoinChatWebViewDecisionForwardsUpdate: the handler forwards updateChatJoinResult via get_chat_join_request_result_object(), no longer an unsupported no-op. - JoinChatBotResultGetterRenamed: rename applied consistently, no dangling old name. - TlSchemaHasJoinResultTypes: updateChatJoinResult, chatJoinResultDeclined, and chatJoinResultGuardBotApprovalRequired url:webAppUrl present in td_api.tl. tdcore + run_all_tests build green on Linux; 5/5 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add enum DialogTypeFilter. (cherry picked from commit 316e934) * Add type_filter in searchPublicChats. (cherry picked from commit bdf910f) * Add searchChatsOnServer.type_filter. (cherry picked from commit e587790) * Add searchRecentlyFoundChats.type_filter. (cherry picked from commit 9ec11ab) * Move search_dialogs to DialogManager. (cherry picked from commit 21cbc0d) * Add searchChats,type_filter. (cherry picked from commit 26d8c6a) * test(backport): Phase 2 search-type-filter epic contract guards Pins the contracts for the 6-commit search-type-filter epic (316e934 DialogTypeFilter, bdf910f searchPublicChats.type_filter, e587790 searchChatsOnServer.type_filter, 9ec11ab searchRecentlyFoundChats.type_filter, 21cbc0d move search_dialogs to DialogManager, 26d8c6a searchChats.type_filter). - SearchDialogsRetainsBotExclusionGuardAfterMove (security/fail-closed): after the MessagesManager -> DialogManager move, DialogManager::search_dialogs still asserts CHECK(!is_bot()). A bot must never run dialog search; verifies the move did not drop the guard during conflict resolution. - SearchDialogsMovedOutOfMessagesManager: no stale/duplicate definition left behind. - DialogTypeFilterEnumAndPredicatePresent: enum {None,Bot,Broadcast} + classifier predicate. - TlSchemaThreadsTypeFilter: the four search methods carry type_filter:SearchChatTypeFilter. TDD: contract tests written first, confirmed RED against pre-epic HEAD (search_dialogs absent from DialogManager), then GREEN after the epic. Conflict resolution preserved the fork's .emplace negative-cache idiom on the reshaped found_public_dialogs_[3]/found_on_server_dialogs_[3]. tdcore + run_all_tests build green on Linux; 4/4 pass (chat-join 5/5 no regression). Also updates Phase 2 resume checkpoint (live-location + chat-join done; records the 15 chat-join commits confirmed exact_present in fork, recorded but not reimplemented). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add empty WebBrowserManager. (cherry picked from commit fad8f9a) * Add td_api::updateWebBrowserSettings. (cherry picked from commit 63196ba) * Support updateWebBrowserSettings in getCurrentState. (cherry picked from commit 03e80a1) * Save web browser settings between restarts. (cherry picked from commit 0ecf680) * Support updateWebBrowserSettings. (cherry picked from commit 8c0c853) * Support updateWebBrowserException. (cherry picked from commit a1b5ec5) * Add td_api::changeWebBrowserSettings. (cherry picked from commit 9deb0b7) * Add td_api::addWebBrowserSettingsException. (cherry picked from commit 2bce3ec) * Add td_api::removeWebBrowserSettingsException. (cherry picked from commit e3ef7dc) * Add td_api::removeAllWebBrowserSettingsExceptions. (cherry picked from commit 533ca51) * Add td_api::getLinkWebBrowserType. (cherry picked from commit 37fa274) * Check for bots in WebBrowserManager::on_authorization_success. (cherry picked from commit 6d0824e) * test(backport): Phase 2 in-app web browser epic fail-closed contracts Pins the fail-closed/bot-exclusion guards for the 12-commit web browser epic (fad8f9a..6d0824e), which adds the WebBrowserManager actor: - OnAuthorizationSuccessSkipsBots (6d0824e): on (re)authorization the manager must early-return for bot sessions before pushing/reloading web-browser settings. - LoadSettingsFailClosed: persistence load early-returns for unauthorized OR bot sessions. - GetCurrentStateFailClosed: getCurrentState emits no web-browser-settings update to an unauthorized or bot session. TDD: contract written first; confirmed RED against the 11-commit tree (on_authorization_success present but without the bot guard — the precise pre-6d0824e37 state), then GREEN after applying 6d0824e. tdcore + run_all_tests green on Linux; webbrowser 3/3, search-filter 4/4, chat-join 5/5 (no regression). Conflict resolution notes: CMakeLists took fork source-list + inserted WebBrowserManager.cpp alphabetically; UpdatesManager wired updateWebBrowserSettings/updateWebBrowserException handlers into the active section (real WebBrowserManager calls) and dropped the fork no-op stubs without duplicating the fork's existing updateAiComposeTones / updateJoinChatWebViewDecision handlers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add parameter recurse_text to for_each_rich_text. (cherry picked from commit 02e17a0) * Add and use RichText::get_full_text(). (cherry picked from commit 4d10e3a) * Add RichText.get_input_rich_text(). (cherry picked from commit ac0c191) * Remove richTextAutoUrl. (cherry picked from commit 99e233f) * Remove richTextAutoEmailAddress. (cherry picked from commit 0bca63e) * Remove richTextAutoPhoneNumber. (cherry picked from commit 5161b59) * Add richTextBankCardNumber.bank_card_number. (cherry picked from commit 65cd30a) * Add td_api::richTextReferenceLink. (cherry picked from commit d171257) * Improve WebPageBlock::for_each_text. (cherry picked from commit ca67bf7) * Simplify PageBlock field names. (cherry picked from commit 4f3676d) * Make pageBlockCaption nullable. (cherry picked from commit 8df09c1) * Make pageBlockCaption.credit nullable. (cherry picked from commit 39d1662) * Make pageBlockTable.caption nullable. (cherry picked from commit 108b33f) * test(backport): Phase 2 instant-view RichText/PageBlock render-side schema contracts Lands the safe, render-side slice of the instant-view cluster and pins its td_api schema end-state. Picked (render only, no send-path dependency): - RichText (8): 02e17a0 recurse_text, 4d10e3a RichText::get_full_text, ac0c191 get_input_rich_text, 99e233f/0bca63e05/5161b5958 remove auto-* rich-text types, 65cd30a richTextBankCardNumber.bank_card_number, d171257 richTextReferenceLink. - PageBlock render (5): ca67bf7 for_each_text, 4f3676d field-name simplification, 8df09c1/39d166296 nullable pageBlockCaption(+credit), 108b33f nullable table caption. Contracts (Phase2InstantViewSchemaContract): the three add-then-removed auto-* rich-text types are absent; richTextReferenceLink / redefined richTextReference / richTextBankCardNumber.bank_card_number are present. tdcore + run_all_tests green; instant-view 2/2 (no regression on prior suites). DEFERRED (fork-safety): the rich-message SEND/content cluster — 726b159 get_input_page_block needs WebPageBlock::clone() impls that originate from 48f727b "Implement RichMessage::clone()", part of the messageRichMessage content-type epic the fork lacks entirely. Forcing it makes all ~33 WebPageBlock subtypes abstract. Recorded in the Phase 2 resume checkpoint pending a maintainer decision; render-side parity is preserved meanwhile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add td_api::PollMedia. (cherry picked from commit d549c79) * Compare type of poll option media. (cherry picked from commit ef5759d) * test(backport): Phase 2 poll-media render refactor + fail-safe contract Lands the safe render slice of the poll-media cluster: - d549c79 Add td_api::PollMedia — migrates pollOption/pollTypeQuiz/messagePoll media from generic MessageContent to the dedicated td_api::PollMedia hierarchy (pollMediaAnimation/Audio/Document/ Location/Photo/Video). Conflict resolution MERGED the schema change with the fork's pre-existing fail-safe in get_message_content_object's MessagePoll branch: resolve poll_manager and return messageUnsupported when inaccessible (no null deref) — kept intact while switching to PollMedia. - ef5759d Compare type of poll option media — PollOption::operator== now compares media type. Contract Phase2PollMediaFailsafeContract pins the preserved fail-safe + PollMedia migration. W3-P fail-closed voter-visibility guard (recent_voters.clear()) verified unchanged: phase1_poll_voter _visibility 1/1, poll-failsafe 1/1, tdcore + run_all_tests green. DEFERRED (fork-safety): poll-media SEND/link sub-cluster (pollMediaLink, InputPollMedia, web-pages-in- polls get_poll_web_page_ids, can_see_results, merge_message_contents fix) — hard-depends on the deferred web-page / messageRichMessage infra the fork lacks. Recorded in the Phase 2 resume checkpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Simplify string option handling in app config. (cherry picked from commit 1ab1694) * Open tonsite:// links only in the internal browser. (cherry picked from commit a3349d3) * Add payload to automatic entities. (cherry picked from commit e21eab8) * Make credit and table caption nullable. (cherry picked from commit 6817f61) * Don't warn about invalid entities in old checklist tasks. (cherry picked from commit d78ceef) * Improve anchor handling. (cherry picked from commit 7445746) * Don't send automatic rich text to the server. (cherry picked from commit 2fe4156) * fix(backport): preserve fork forward-not-move invariant in d78ceef ToDoItem ctor d78ceef ("Don't warn about invalid entities in old checklist tasks") added a message_date argument to the ToDoItem/ToDoList constructors and, upstream, builds the item via std::move(item) inside the [](auto &&item) lambda. The fork enforces a SonarQube-driven invariant that forwarding-reference lambda parameters use std::forward<decltype(item)>(item), never std::move (pinned by SonarBlockerSourceContract.message_content_todo_append_tasks_lambda_uses_forward_not_move). The initial conflict resolution took the upstream std::move form verbatim, which the source-contract test caught. Restore the fork idiom while keeping the new message_date arg: ToDoItem(user_manager, std::forward<decltype(item)>(item), message_date) Also tracks the ctor-signature change in two tests (no semantic relaxation): - message_content_null_guard_runtime.cpp: ToDoList construction gains the message_date arg. - sonar_blocker_source_contract.cpp: the forward/move needles match the new 3-arg signature; the forward-not-move invariant itself is unchanged. tdcore + run_all_tests green; SonarBlocker todo 2/2, Phase2 15/15, W3-P 1/1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Add td_api::checkAuthenticationWebToken. (cherry picked from commit f46b589) * test(backport): Phase 2 checkAuthenticationWebToken fail-closed auth contract Lands upstream f46b589 ("Add td_api::checkAuthenticationWebToken") and pins its fail-closed guards. The method sends a caller-supplied web token to a caller-chosen DC over an unauthenticated net query (auth.importWebTokenAuthorization) and, on success, steers the client's main DC — so it must validate before any send/state-mutation. Hand-ported into the fork's refactored auth error handling: - added "case ImportWebTokenAuthorization" to should_ignore_background_error() (surface its error, do not silently ignore — matches the qr/passkey/getPassword siblings); - added the dispatch case (bare-label form, fork's `using enum NetQueryType` style) calling on_import_web_token_authorization_result; - preserved the fork's handle_expected_query_error() helper (took HEAD) into which f46b589's web_token_/was_web_token_login_request_ resets auto-merged; - kept upstream's was_web_token_login_request_ = false value verbatim (do not "fix" the asymmetry). Contract Phase2WebTokenAuthFailClosedContract pins the three guards before the send: legitimate pre-login state (WaitPhoneNumber/WaitQrCodeConfirmation), valid DC id, and mutual exclusion with the bot-token path (was_check_bot_token_). tdcore + run_all_tests green; web-token-auth 1/1, Phase2 16/16, Phase1 3/3. This is the last tractable functional backport; the remaining upstream delta is the two deferred high-risk non-mission SEND clusters (rich-message content + poll-media links) recorded in the Phase 2 resume checkpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(backport): Phase 2 closeout manifest + CHANGELOG record Record every Phase-2 backported commit (fork SHA -> upstream SHA, grouped by epic), the already-present/superseded set (recorded, not reimplemented), the two deferred SEND/content clusters with rationale, the non-functional skip list, verification results, and the added contract tests. - docs/Plans/UPSTREAM_BACKPORT_PHASE2_CLOSEOUT_2026-06-18.md — full manifest + provenance + GREEN verification (stealth 239/239, Sonar 51/51, Phase1 3/3, Phase2 16/16, W3-P 9/9, RestrictedRights 12/12). - CHANGELOG.md — Phase 1 + Phase 2 bulk-integration subsection under the 15 June 2026 intake cycle; supersedes the earlier "remaining ~239 deferred product epics" note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(backport): enumerate the 61 deferred hardest commits (ranked, per-commit) Full per-commit list of the deferred SEND/content clusters with the concrete reason each is hard, ranked by risk: Tier 1 messageRichMessage + WebPageBlock SEND (46), Tier 2 can_see_results (1, highest security risk), Tier 3 poll-media links / web-pages-in-polls (11), Tier 4 misc instant-view helpers (3). Companion to the Phase 2 closeout manifest. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fixed issues in 4 latest commits * test: tighten pr23 batch2 audit proof * chore: persist beads audit session * Created audit plan. Audited batch 1-5 deltas * Audit batch 8 auth and business backports * fixed issues with sanitizers - now sanitizers run without problems. 0 issues found * Add td_api::richMessage. (cherry picked from commit e0f07c5) * Add td_api::messageRichMessage. (cherry picked from commit 1a3dcfe) * Implement RichMessage::clone(). (cherry picked from commit 48f727b) * Support RichMessage in get_message_content_min_user_ids(). (cherry picked from commit 033d7b1) * Support RichText in get_message_content_has_bot_commands. (cherry picked from commit 111c581) * Use skip_bot_commands in get_rich_message_object. (cherry picked from commit e3e6309) * Support messageRichText in update_used_hashtags. (cherry picked from commit f18e7df) * Support telegram_api::botInlineMessageRichMessage. (cherry picked from commit f79ba0d) * Support RichText in can_send_message_content, (cherry picked from commit f9ed7a8) * Allow copying of rich messages only for bots. (cherry picked from commit a31a034) * Add td_api::getFullRichMessage. (cherry picked from commit d44b6ca) * Support replies to rich messages in other chats. (cherry picked from commit 1eaeaf6) * Add td_api::inputMessageRichMessage. (cherry picked from commit 2ded57e) * Add option "rich_message_text_length_max". (cherry picked from commit b5bc424) * Add option "rich_message_block_count_max". (cherry picked from commit 0fd58b4) * Add option "rich_message_depth_max". (cherry picked from commit a5a345f) * Add option "rich_message_media_count_max". (cherry picked from commit 27d21d4) * Add option "rich_message_table_column_count_max". (cherry picked from commit 0e0c37d) * Add td_api::inputRichMessage. (cherry picked from commit 2d88e82) * Add sendRichMessageDraft. (cherry picked from commit 8d54e2a) * Support messageRichMessage in updatePendingMessage. (cherry picked from commit 79eaa8a) * Support inputMessageRichMessage in inline query results. (cherry picked from commit c710b04) * Support inputRichMessage. (cherry picked from commit ca9098c) * Document blocks specific to instant view. (cherry picked from commit e65c04f) * Add pageBlockAnimation.has_spoiler. (cherry picked from commit aa2d317) * Support rich messages in profile tabs. (cherry picked from commit c1ca762) * Add td_api::draftMessageContentRichMessage. (cherry picked from commit d730220) * Check can_send_messages in RichMessage::can_send. (cherry picked from commit 9f0f70f) * tg_cli: add InputRichMessage. (cherry picked from commit a74c276) * tg_cli: add and use as_input_message. (cherry picked from commit d68320c) * Add RichText.get_input_rich_text(). (cherry picked from commit ac0c191) * Add WebPageBlock.get_input_page_block. (cherry picked from commit 726b159) * Add get_web_page_blocks_index_mask. (cherry picked from commit 8139027) * tg_cli: allow to pass rich messages instead of text messages. (cherry picked from commit 691dc32) * Support rich messages in editMessageText. (cherry picked from commit 1eff7c4) * Support rich messages in editInlineMessageText. (cherry picked from commit bd9a93f) * Support rich messages in editBusinessMessageText. (cherry picked from commit 45b4098) * Support rich messages in editQuickReplyMessage. (cherry picked from commit 39d6b80) * Extract authentication codes from rich messages. (cherry picked from commit fbe572d) * Add td_api::inputAnimation. (cherry picked from commit bf8b079) * Add td_api::inputAudio. (cherry picked from commit 3271d27) * Add td_api::inputDocument. (cherry picked from commit e6245bd) * Add td_api::inputPhoto. (cherry picked from commit 499c227) * Add td_api::inputVideo. (cherry picked from commit ad25dc7) * Update pageBlockChatLink documentation. (cherry picked from commit 01b0cec) * Use get_message_content_rich_message if possible. (cherry picked from commit b629bd3) * Fix richTextMention documentation. (cherry picked from commit 1f55d80) * Support rich messages in move_message_content_sticker_set_to_top. (cherry picked from commit 5e21b56) * Improve pageBlockListItem.type documentation. (cherry picked from commit 2cf217f) * Fixed sanitizer issues --------- Co-authored-by: levlam <levlam@telegram.org> Co-authored-by: ichmagmaus <ichmagmaus@MacBook-Air-ichmagmaus.local> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Kylmakalle <iceman9831@gmail.com> Co-authored-by: David Osipov <personal@david-osipov.vision> --------- Signed-off-by: David Osipov <personal@david-osipov.vision> Co-authored-by: ichmagmaus <ichmagmaus@MacBook-Air-ichmagmaus.local> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: kuromiplayer <124445551+ichmagmaus111@users.noreply.github.com> Co-authored-by: levlam <levlam@telegram.org> Co-authored-by: Kylmakalle <iceman9831@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream backport — 2026-06-15 intake cycle (Phase 1 + Phase 2)
Selective, semantic backport of the post-baseline upstream delta
(
e0943d068ce9..a17f87c4cff7, tdlib 1.8.64 → tip, 247 upstream commits) onto a vendor/security fork.172 commits over
feat/adaptive-runtime-profile-rotation.Method (per fork policy — not a bulk sync)
Semantic per-commit status detection (missing / exact_present / superseded / reverted-net-absent), not
git ancestry. Epic-by-epic: recon → contract test → dependency-ordered
cherry-pick -Xno-renames→conflict resolution preserving fork form and fail-closed hardening → Docker Linux build (clean-regen
codegen) GREEN before the next epic.
Landed
additions, managed-bot, etc.).
checkAuthenticationWebToken(auth, fail-closed), tonsite→in-app-browser (stealth-positive)Verification (Linux, at tip)
tdcore+run_all_testscompile clean. Notd/mtprotostealth-transport file was modified by the intake.Preserved fork hardening (verified)
W3-P poll voter-visibility (
recent_voters.clear()), RestrictedRights fail-closed auth, poll-managernull fail-safe, WebBrowser bot-checks, SonarQube forward-not-move convention, web-token auth state/DC/bot
guards.
Deferred — fork-safety (NOT in this PR)
Two tightly-coupled, non-mission SEND/content clusters where the fork is structurally behind (forcing
them = new subsystem + wire-serialization risk): rich-message content (
messageRichMessage, 46) andpoll-media links / web-pages-in-polls (12). Full ranked enumeration:
docs/Plans/UPSTREAM_BACKPORT_HARDEST_DEFERRED.md.Records
docs/Plans/UPSTREAM_BACKPORT_PHASE1_CLOSEOUT_2026-06-16.mddocs/Plans/UPSTREAM_BACKPORT_PHASE2_CLOSEOUT_2026-06-18.md(full fork→upstream SHA manifest)CHANGELOG.md— Phase 1 + Phase 2 bulk-integration section🤖 Generated with Claude Code