fix: lazy bot init and thread ID validation (review feedback)

- bot.ts: Replace eager module-scope singleton with lazy
  getContentAgentBot() so Vercel build does not crash when
  content-agent env vars are not yet configured
- getThread.ts: Add regex validation for adapter:channel:thread
  format, throw descriptive error on malformed IDs
- registerHandlers.ts: Convert side-effect import to explicit
  ensureHandlersRegistered() call with idempotency guard
- Route files updated to use getContentAgentBot() and
  ensureHandlersRegistered()

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: CTO Agent

app/api/content-agent/[platform]/route.ts

@@ -1,8 +1,8 @@
 import type { NextRequest } from "next/server";
 import { after } from "next/server";
-import { contentAgentBot } from "@/lib/content-agent/bot";
+import { getContentAgentBot } from "@/lib/content-agent/bot";
 import { handleUrlVerification } from "@/lib/slack/handleUrlVerification";
-import "@/lib/content-agent/handlers/registerHandlers";
+import { ensureHandlersRegistered } from "@/lib/content-agent/handlers/registerHandlers";
 
 /**
  * GET /api/content-agent/[platform]
@@ -19,8 +19,10 @@ export async function GET(
   { params }: { params: Promise<{ platform: string }> },
 ) {
   const { platform } = await params;
+  ensureHandlersRegistered();
+  const bot = getContentAgentBot();
 
-  const handler = contentAgentBot.webhooks[platform as keyof typeof contentAgentBot.webhooks];
+  const handler = bot.webhooks[platform as keyof typeof bot.webhooks];
 
   if (!handler) {
     return new Response("Unknown platform", { status: 404 });
@@ -51,9 +53,11 @@ export async function POST(
     if (verification) return verification;
   }
 
-  await contentAgentBot.initialize();
+  ensureHandlersRegistered();
+  const bot = getContentAgentBot();
+  await bot.initialize();
 
-  const handler = contentAgentBot.webhooks[platform as keyof typeof contentAgentBot.webhooks];
+  const handler = bot.webhooks[platform as keyof typeof bot.webhooks];
 
   if (!handler) {
     return new Response("Unknown platform", { status: 404 });

app/api/content-agent/callback/route.ts

@@ -1,5 +1,5 @@
 import type { NextRequest } from "next/server";
-import { contentAgentBot } from "@/lib/content-agent/bot";
+import { getContentAgentBot } from "@/lib/content-agent/bot";
 import { handleContentAgentCallback } from "@/lib/content-agent/handleContentAgentCallback";
 
 /**
@@ -12,6 +12,6 @@ import { handleContentAgentCallback } from "@/lib/content-agent/handleContentAge
  * @returns The callback response
  */
 export async function POST(request: NextRequest) {
-  await contentAgentBot.initialize();
+  await getContentAgentBot().initialize();
   return handleContentAgentCallback(request);
 }

lib/content-agent/bot.ts

@@ -47,8 +47,18 @@ export function createContentAgentBot() {
 
 export type ContentAgentBot = ReturnType<typeof createContentAgentBot>;
 
+let _bot: ContentAgentBot | null = null;
+
 /**
- * Singleton bot instance. Registers as the Chat SDK singleton
- * so ThreadImpl can resolve adapters lazily from thread IDs.
+ * Returns the lazily-initialized content agent bot singleton.
+ * Defers creation until first call so the Vercel build does not
+ * crash when content-agent env vars are not yet configured.
+ *
+ * @returns The content agent bot singleton
  */
-export const contentAgentBot = createContentAgentBot().registerSingleton();
+export function getContentAgentBot(): ContentAgentBot {
+  if (!_bot) {
+    _bot = createContentAgentBot().registerSingleton();
+  }
+  return _bot;
+}

lib/content-agent/getThread.ts

@@ -1,15 +1,26 @@
 import { ThreadImpl } from "chat";
 import type { ContentAgentThreadState } from "./types";
 
+const THREAD_ID_PATTERN = /^[^:]+:[^:]+:[^:]+$/;
+
 /**
  * Reconstructs a Thread from a stored thread ID using the Chat SDK singleton.
  *
  * @param threadId - The stored thread identifier (format: adapter:channel:thread)
  * @returns The reconstructed Thread instance
+ * @throws If threadId does not match the expected adapter:channel:thread format
  */
 export function getThread(threadId: string) {
-  const adapterName = threadId.split(":")[0];
-  const channelId = `${adapterName}:${threadId.split(":")[1]}`;
+  if (!THREAD_ID_PATTERN.test(threadId)) {
+    throw new Error(
+      `[content-agent] Invalid threadId format: expected "adapter:channel:thread", got "${threadId}"`,
+    );
+  }
+
+  const parts = threadId.split(":");
+  const adapterName = parts[0];
+  const channelId = `${adapterName}:${parts[1]}`;
+
   return new ThreadImpl<ContentAgentThreadState>({
     adapterName,
     id: threadId,

lib/content-agent/handlers/registerHandlers.ts

@@ -1,10 +1,18 @@
-import { contentAgentBot } from "../bot";
+import { getContentAgentBot } from "../bot";
 import { registerOnNewMention } from "./handleContentAgentMention";
 import { registerOnSubscribedMessage } from "./registerOnSubscribedMessage";
 
+let registered = false;
+
 /**
  * Registers all content agent event handlers on the bot singleton.
- * Import this file once to attach handlers to the bot.
+ * Safe to call multiple times — handlers are only attached once.
  */
-registerOnNewMention(contentAgentBot);
-registerOnSubscribedMessage(contentAgentBot);
+export function ensureHandlersRegistered(): void {
+  if (registered) return;
+  registered = true;
+
+  const bot = getContentAgentBot();
+  registerOnNewMention(bot);
+  registerOnSubscribedMessage(bot);
+}