{"record":{"id":"07489a51c243a26f","repo":"HKUDS/Vibe-Trading","slug":"webhook-secret-token-must-be-1-256-characters-usin","errorCode":null,"errorMessage":"webhook_secret_token must be 1-256 characters using only A-Z, a-z, 0-9, _ and -","messagePattern":"webhook_secret_token must be 1-256 characters using only A-Z, a-z, 0-9, _ and -","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"agent/src/channels/telegram.py","lineNumber":417,"sourceCode":"            raise ValueError('webhook_path must start with \"/\"')\n        return value\n\n    @model_validator(mode=\"after\")\n    def validate_webhook_config(self) -> \"TelegramConfig\":\n        if self.mode != \"webhook\":\n            return self\n\n        url = self.webhook_url.strip()\n        if not url:\n            raise ValueError(\"webhook_url is required when Telegram mode is webhook\")\n        parsed = urlparse(url)\n        if parsed.scheme != \"https\" or not parsed.netloc:\n            raise ValueError(\"webhook_url must be a public HTTPS URL\")\n        secret = self.webhook_secret_token.strip()\n        if not secret:\n            raise ValueError(\"webhook_secret_token is required when Telegram mode is webhook\")\n        if len(secret) > 256 or re.match(r\"^[A-Za-z0-9_-]+$\", secret) is None:\n            raise ValueError(\n                \"webhook_secret_token must be 1-256 characters using only A-Z, a-z, 0-9, _ and -\"\n            )\n        return self\n\n\nclass TelegramChannel(BaseChannel):\n    \"\"\"\n    Telegram channel using long polling or webhook mode.\n\n    Long polling is the default. Webhook mode requires a public HTTPS URL and a\n    Telegram secret token.\n    \"\"\"\n\n    name = \"telegram\"\n    display_name = \"Telegram\"\n\n    # Commands registered with Telegram's command menu\n    BOT_COMMANDS = [","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/HKUDS/Vibe-Trading/blob/80ffdda44c5c4db0dd84d70e051cca591cea67df/agent/src/channels/telegram.py#L399-L435","documentation":"Raised when the Telegram webhook secret token exceeds 256 characters or contains characters outside A-Z, a-z, 0-9, underscore and hyphen. Telegram's Bot API setWebhook only accepts secret_token values of 1-256 chars from this exact alphabet, so the config is rejected before an API call can fail.","triggerScenarios":"Setting webhook_secret_token to a value containing '=', '+', '/', '.', or other symbols (typical of base64 strings or full JWTs), or pasting a very long key. The validator applies re.match(r\"^[A-Za-z0-9_-]+$\", secret) after stripping whitespace.","commonSituations":"Using a base64-encoded secret (contains + / =) generated by a secret manager; pasting a JWT or an SSH key as the token; using hex-with-colons UUID strings; concatenating secrets with separators like ':'.","solutions":["Regenerate the secret as hex or urlsafe-base64 without padding: openssl rand -hex 32 or secrets.token_hex(32)","Strip or re-encode any base64 secret to hex before assigning it","Ensure the token is 1-256 characters after stripping whitespace"],"exampleFix":"# before\nwebhook_secret_token = base64.b64encode(os.urandom(32)).decode()  # may contain + / =\n# after\nwebhook_secret_token = secrets.token_hex(32)  # only 0-9a-f, always valid","handlingStrategy":"validation","validationCode":"import re\n\ndef valid_secret(s: str) -> bool:\n    s = s.strip()\n    return bool(s) and len(s) <= 256 and re.fullmatch(r\"[A-Za-z0-9_-]+\", s) is not None\n\nassert valid_secret(webhook_secret_token), \"secret must be 1-256 chars of [A-Za-z0-9_-]\"","typeGuard":"def is_valid_secret(s: str) -> bool:\n    return bool(re.fullmatch(r\"[A-Za-z0-9_-]{1,256}\", s.strip()))","tryCatchPattern":null,"preventionTips":["Always generate secrets with hex (token_hex) or urlsafe-base64 without padding","Never paste JWTs or raw base64 secrets into webhook_secret_token","Validate secrets in a pre-deploy config lint step"],"tags":["telegram","webhook","validation","secret-format"],"backgroundTag":"secret-token-format-invalid","analyzedSha":"80ffdda44c5c4db0dd84d70e051cca591cea67df","analyzedAt":"2026-08-28T12:46:38.989Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}