v1.5.0 - Telegram File Attachment Support

What's New

Added

• Telegram file attachment support — the bot now processes images, PDFs, documents, audio, voice messages, video, and stickers instead of silently ignoring them
  • Two-step Telegram API download (getFile → binary fetch) with 20 MB cap pre- and post-download
  • Attachments forwarded to the upstream LLM as OpenAI multimodal content blocks (image_url, input_audio, file)
  • Captions on media messages are treated as the message text
  • download_file() and build_attachments() methods on TelegramRelay; individual download failures are skipped gracefully
  • AttachmentType enum and Attachment dataclass in src/webhook/models.py
  • WEBHOOK_FILE_DOWNLOAD audit event type for per-file download telemetry

Fixed

• Attachment filename prompt injection (P1) — filenames from the Telegram payload are now sanitized through PromptSanitizer before entering conversation history; injected filenames fall back to their generic type label
• Silent drop on all-download-failure (P2) — when all attachment downloads fail on a file-only message, the bot now sends the user an actionable error instead of silently returning HTTP 200
• Body size check accuracy — size limit now uses exact base64-encoded byte count (n + 2) // 3 * 4 (was ~33% under-counted)
• Dead code removed — _attachment_summary() module-level function deleted

Stats

• 10 files changed, +976 lines
• 570 tests passing