feat: implement Telegram proxy support for Hugging Face Spaces

- add NewProxiedHTTPClient() with TELEGRAM_PROXY_URL, HTTPS_PROXY, HTTP_PROXY support
- add IsProxyOrNetworkError() helper to detect network/proxy failures
- implement proxy-first with IPv4 fallback strategy
- test connectivity with both proxy and direct connection
- recreate bot with appropriate client based on connectivity test
- log connection method (proxy vs direct) for observability

Fixes: Telegram blocked by Hugging Face network policy - now works with proxy

Closes: #telegram-proxy

pkg/channels/telegram.go

@@ -11,10 +11,9 @@ import (
 	"sync"
 	"time"
 
-	th "github.com/mymmrac/telego/telegohandler"
-
 	"github.com/mymmrac/telego"
 	"github.com/mymmrac/telego/telegohandler"
+	th "github.com/mymmrac/telego/telegohandler"
 	tu "github.com/mymmrac/telego/telegoutil"
 
 	"github.com/sipeed/picoclaw/pkg/bus"
@@ -51,12 +50,15 @@ func (c *thinkingCancel) Cancel() {
 
 // testConnectivity checks if we can reach Telegram API (bypasses network policy blocks)
 func (c *TelegramChannel) testConnectivity() error {
+	return c.testConnectivityWithClient(utils.NewProxiedHTTPClient())
+}
+
+// testConnectivityWithClient tests connectivity using a specific HTTP client
+func (c *TelegramChannel) testConnectivityWithClient(client *http.Client) error {
 	// Quick test: try to get bot info (lightweight endpoint)
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 
-	// Use our own HTTP client (same as bot uses)
-	client := utils.NewIPv4OnlyHTTPClient()
 	url := "https://api.telegram.org/bot" + c.bot.Token() + "/getMe"
 
 	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
@@ -77,15 +79,16 @@ func (c *TelegramChannel) testConnectivity() error {
 	return nil
 }
 
-// NewTelegramChannel creates a Telegram channel with connectivity check
+// NewTelegramChannel creates a Telegram channel with connectivity check and proxy support
 func NewTelegramChannel(cfg *config.Config, bus *bus.MessageBus) (*TelegramChannel, error) {
-	var opts []telego.BotOption
 	telegramCfg := cfg.Channels.Telegram
 
-	// Use IPv4-only HTTP client to avoid IPv6 connectivity issues
-	opts = append(opts, telego.WithHTTPClient(utils.NewIPv4OnlyHTTPClient()))
+	// Create both client types: with proxy (if configured) and IPv4-only fallback
+	proxiedClient := utils.NewProxiedHTTPClient()
+	directClient := utils.NewIPv4OnlyHTTPClient()
 
-	bot, err := telego.NewBot(telegramCfg.Token, opts...)
+	// Try with proxy first if configured
+	bot, err := telego.NewBot(telegramCfg.Token, telego.WithHTTPClient(proxiedClient))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create telegram bot: %w", err)
 	}
@@ -105,23 +108,35 @@ func NewTelegramChannel(cfg *config.Config, bus *bus.MessageBus) (*TelegramChann
 		webhookCancel: nil,
 	}
 
-	// Test connectivity before fully initializing
-	if err := channel.testConnectivity(); err != nil {
-		// Check if it's a network policy block
-		if strings.Contains(err.Error(), "operation not permitted") ||
-		   strings.Contains(err.Error(), "permission denied") ||
-		   strings.Contains(err.Error(), "network is unreachable") {
-			logger.ErrorCF("telegram", "Telegram API blocked by network policy", map[string]interface{}{
-				"error":    err.Error(),
-				"solution": "Hugging Face Spaces blocks Telegram IP ranges. Telegram channel disabled.",
+	// Test connectivity with proxy first; if fails, try direct connection
+	if err := channel.testConnectivityWithClient(proxiedClient); err != nil {
+		if utils.IsProxyOrNetworkError(err) {
+			// Proxy failed, try direct connection as fallback
+			logger.WarnCF("telegram", "Proxy connection failed, falling back to direct", map[string]interface{}{
+				"proxy_error": err.Error(),
+			})
+			if err := channel.testConnectivityWithClient(directClient); err != nil {
+				// Both proxy and direct failed
+				return nil, fmt.Errorf("telegram connectivity failed (proxy: %v, direct: %v)", err, err)
+			}
+			// Direct connection works, recreate bot with direct client
+			bot2, err2 := telego.NewBot(telegramCfg.Token, telego.WithHTTPClient(directClient))
+			if err2 != nil {
+				return nil, fmt.Errorf("failed to recreate bot with direct client: %w", err2)
+			}
+			channel.bot = bot2
+			logger.InfoCF("telegram", "Using direct IPv4 connection (proxy configured but unreachable)", nil)
+		} else {
+			// Non-network error (invalid token, etc.)
+			return nil, fmt.Errorf("telegram connectivity failed: %w", err)
+		}
+	} else {
+		// Proxy connection succeeded
+		if proxyURL := os.Getenv("TELEGRAM_PROXY_URL"); proxyURL != "" {
+			logger.InfoCF("telegram", "Using proxy connection", map[string]interface{}{
+				"proxy": proxyURL,
 			})
-			// Return error but with clear message - main will handle gracefully
-			return nil, fmt.Errorf("telegram connectivity failed: %w (Hugging Face network policy blocks Telegram API)", err)
 		}
-		// Other errors - still log but continue (might recover)
-		logger.WarnCF("telegram", "Connectivity test warning", map[string]interface{}{
-			"error": err.Error(),
-		})
 	}
 
 	return channel, nil

pkg/utils/http.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"net"
 	"net/http"
+	"net/url"
+	"os"
 	"strings"
 	"time"
 )
@@ -88,3 +90,67 @@ func NewIPv4OnlyHTTPClient() *http.Client {
 		Transport: transport,
 	}
 }
+
+// NewProxiedHTTPClient creates an HTTP client that uses a proxy if configured
+// It respects standard proxy environment variables and adds proxy support for HTTPS
+func NewProxiedHTTPClient() *http.Client {
+	// Check for proxy configuration
+	proxyURL := os.Getenv("TELEGRAM_PROXY_URL")
+	if proxyURL == "" {
+		proxyURL = os.Getenv("HTTPS_PROXY")
+		if proxyURL == "" {
+			proxyURL = os.Getenv("HTTP_PROXY")
+		}
+	}
+
+	transport := &http.Transport{
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          100,
+		IdleConnTimeout:       90 * time.Second,
+		TLSHandshakeTimeout:   10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
+
+	// If proxy is configured, set it up
+	if proxyURL != "" {
+		u, err := url.Parse(proxyURL)
+		if err != nil {
+			// If proxy URL is invalid, log and continue without proxy
+			// In production, we'd use a logger but this is a low-level utils function
+			// So we'll just proceed without proxy
+		} else {
+			transport.Proxy = http.ProxyURL(u)
+		}
+	}
+
+	return &http.Client{
+		Transport: transport,
+	}
+}
+
+// IsProxyOrNetworkError checks if an error indicates proxy or network policy block
+func IsProxyOrNetworkError(err error) bool {
+	if err == nil {
+		return false
+	}
+	errStr := err.Error()
+	// Common network/block indicators
+	indicators := []string{
+		"operation not permitted",
+		"permission denied",
+		"network is unreachable",
+		"connection refused",
+		"timeout",
+		"no route to host",
+		"i/o timeout",
+		"dial tcp",
+		"connect:",
+		"proxy",
+	}
+	for _, indicator := range indicators {
+		if strings.Contains(strings.ToLower(errStr), indicator) {
+			return true
+		}
+	}
+	return false
+}