feat: scrub bot token from error messages in Telegram API

[gdhanush27]

• Implemented token scrubbing in TelegramApi to prevent token leakage in error messages.
• Added rejectClean method to handle rejections without exposing the token.
• Updated getMe and other API methods to use the new error handling.

test: add regression tests for TelegramApi token scrubbing

• Created tests to ensure bot tokens are redacted from error messages and stack traces.

test: add regression tests for agent tool scope checks

• Added tests to verify case-insensitive checks for tool names in agent definitions.

test: add regression tests for heartbeat clock parsing

• Implemented tests to ensure correct parsing of clock strings and handling of edge cases.

test: add path safety tests for workspace containment checks

• Added tests to validate path containment checks against symlinks and case sensitivity.

feat: enhance shared memory store with validation and sanitization

• Added key and run ID validation to prevent injection attacks.
• Implemented sanitization of values to neutralize harmful markdown markers.

test: add tests for shared memory store validation and sanitization

• Created tests to ensure proper validation of keys and run IDs.
• Added tests for sanitization functionality to prevent content injection.

fix: improve dynamic task spawning validation in orchestrator

• Updated spawnDynamicTask to validate inputs synchronously and prevent deadlocks.

test: add tests for dynamic task spawning validation

• Implemented tests to verify correct behavior of dynamic task spawning under various conditions.

feat: improve path safety checks in tools

• Refactored path checks in TelegramSendFileTool and WorkspaceContextTool to use shared path safety utilities.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 10ba4504d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate task IDs before using them as memory keys

When the planner returns a task id outside this new key allow-list (for example an id with a space or slash), parsePlan still accepts it and the orchestrator later writes the agent output under ${role}:${task.id}. This validation then throws after the agent has already completed its work, marking the task failed and causing dependents to be skipped; either reject/sanitize planner task ids before execution or encode the automatic shared-memory key separately from the raw task id.

Useful? React with 👍 / 👎.