personal-agent-os/memory-systems/agent-os/04_projects/hermes-telegram-picker/status.md

Hermes Telegram Picker — Audit

Deep-dive findings from a focused code audit of the Telegram inline-keyboard picker. Component: hermes-agent/plugins/platforms/telegram/adapter.py (gateway run.py orchestrates). Audit date: 2026-08-29.

Scope

• Model picker (send_model_picker → _handle_model_picker_callback; callbacks mp:/mpg:/mpv:/mm:/mc:/mb/mx/mg:)
• Choice picker (send_choice_picker → _handle_choice_picker_callback; callback cp:)
• Shared pagination core _format_choice_page in gateway/platforms/base.py (~line 4333)

Finding (broken / inconsistent)

• [BUG — auth gap] _handle_model_picker_callback performs NO _is_callback_user_authorized gate. Every other state-flipping inline-button path in the same adapter gates:
  • choice picker (_handle_choice_picker_callback, line ~6673) — gated
  • approval buttons (ea:, lines ~7238 / ~7418) — gated
  • slash-confirm (sc:, ~7318) — gated
  • clarify (offer_job / scan, ~7531 / ~7602) — gated
  • Only the model picker is ungated.
• Consequence: in a shared group/supergroup/forum, any user who can reach the picker message can tap buttons and switch the session's active model (global-ish config flip) without being an allowed user. The choice-picker comment explicitly states the intent: "unauthorized users in a shared group must not flip session/config state via someone else's picker message" — the model picker violates exactly that rule, for the highest-impact state.
• Severity: medium (needs a group context + picker message reachable; DMs are single-user so only group/forum/channel contexts are exposed). A security inconsistency, not an outage.

Non-issues confirmed (looked, OK)

• Callback prefix routing ("mp:","mpg:","mpv:","mm:","mc:","mb","mx","mg:") — ordering safe; mpg: does not collide with mp: (different 2nd char), mc: present, no prefix collision.
• _format_choice_page pagination math (clamp, slice, (N–M of T) suffix) is correct.
• _build_model_keyboard uses global abs_idx = start + i so mm: maps correctly across pages.
• mx:noop page-counter button handled by the catch-all branch.
• Choice-picker button indices cp:{i} use the flat local enumerate — correct for a single level.

Recommended fix

Add the same _is_callback_user_authorized gate at the top of _handle_model_picker_callback (mirror the choice-picker gate at line ~6673). Gate before mutating _model_picker_state.

Owner / status

• ✅ FIXED (2026-08-29) — committed 38622dc to local hermes-agent checkout. Fix is structural / regression-proof: moved the auth gate to the single dispatch point in _handle_callback_query (telegram adapter.py ~7199), covering ALL picker callback prefixes (mp:/mpg:/mpv:/mm:/mc:/mb/mx/mg:/cp:) in one place. Any future picker callback prefix added there is auto-protected. py_compile OK.
• Activation pending: running gateway PID 22864 loaded pre-patch code; will pick up the fix on its next (supervisor) restart. Do NOT force-kill mid-conversation.