@0xmaxma/claude-gateway 1.3.7 → 1.3.9

package/mcp/tools/discord/module.ts

@@ -281,6 +281,42 @@ export class DiscordModule implements ChannelModule {
     this.client.on('interactionCreate', async (interaction: ButtonInteraction) => {
       try {
         if (!interaction.isButton?.()) return;
+
+        // Cancel button: send ESC sentinel to dismiss the pending menu cleanly.
+        if ((interaction.customId ?? '') === 'menu:cancel') {
+          const isDM = !interaction.guildId;
+          const isThread = interaction.channel?.isThread?.() ?? false;
+          const context: DiscordMessageContext = {
+            guildId: interaction.guildId ?? null,
+            channelId: interaction.channelId,
+            threadId: isThread ? interaction.channelId : null,
+            userId: interaction.user.id,
+            username: interaction.user.username,
+            messageId: interaction.message?.id ?? '',
+            isDM,
+            isThread,
+          };
+          const access = loadAccessFn();
+          const result = gate(access, context, saveAccessFn, () => randomBytes(3).toString('hex'));
+          if (result.action !== 'deliver') {
+            await interaction.reply({ content: 'Not authorized.', ephemeral: true }).catch(() => {});
+            return;
+          }
+          await interaction.update({ components: [] }).catch(() => {});
+          const inbound: InboundMessage = {
+            channel: 'discord',
+            accountId: interaction.client.user?.id ?? 'discord',
+            senderId: interaction.user.id,
+            chatId: interaction.channelId,
+            chatType: isDM ? 'direct' : 'group',
+            text: '__MENU_CANCEL__',
+            messageId: interaction.message?.id ?? '',
+            ts: Date.now(),
+          };
+          await handler(inbound);
+          return;
+        }
+
         const m = /^choice:(\d+)$/.exec(interaction.customId ?? '');
         if (!m) return;
 

package/mcp/tools/discord/outbound.ts

@@ -88,6 +88,11 @@ export function buildChoiceComponents(options: Array<{ label: string }>): unknow
     });
     rows.push({ type: 1, components: buttons }); // ActionRow
   }
+  // Always append a cancel button (Danger style) so the user can dismiss the
+  // menu cleanly. Sends ESC to the PTY without injecting text into Claude's context.
+  if (rows.length > 0 && rows.length < 5) {
+    rows.push({ type: 1, components: [{ type: 2, style: 4, label: '❌ Cancel', custom_id: 'menu:cancel' }] });
+  }
   return rows;
 }
 

package/mcp/tools/telegram/menu-parser.ts

@@ -33,5 +33,9 @@ export function parseMenuFileContent(raw: string): MenuMessage | null {
     text: `${i + 1}. ${label}`.slice(0, 60),
     callback_data: `choice:${i + 1}`,
   }]);
+  // Always append a cancel button so the user can dismiss the menu without
+  // sending a numbered reply. Tapping it sends ESC to the PTY, clearing
+  // pendingMenu cleanly without injecting spurious text into Claude's context.
+  inline_keyboard.push([{ text: '❌ Cancel', callback_data: 'menu:cancel' }]);
   return { text, inline_keyboard };
 }

package/mcp/tools/telegram/receiver-server.ts

@@ -1153,6 +1153,13 @@ bot.command('clear', async ctx => {
   ).catch(() => {})
 })
 
+// Shared auth check for all callback_query:data handlers.
+// Mirrors the text-reply path: sender must be in allowFrom.
+function isCallbackAuthorized(ctx: Context): boolean {
+  const access = loadAccess()
+  return access.allowFrom.includes(String(ctx.from?.id ?? ''))
+}
+
 // Inline-button handler for permission requests. Callback data is
 // `perm:allow:<id>`, `perm:deny:<id>`, or `perm:more:<id>`.
 // Security mirrors the text-reply path: allowFrom must contain the sender.
@@ -1165,8 +1172,7 @@ bot.on('callback_query:data', async ctx => {
   // text path: the tapper must be in allowFrom.
   const choiceMatch = /^choice:(\d+)$/.exec(data)
   if (choiceMatch) {
-    const access = loadAccess()
-    if (!access.allowFrom.includes(String(ctx.from.id))) {
+    if (!isCallbackAuthorized(ctx)) {
       await ctx.answerCallbackQuery({ text: 'Not authorized.' }).catch(() => {})
       return
     }
@@ -1198,11 +1204,42 @@ bot.on('callback_query:data', async ctx => {
     return
   }
 
+  // Handle interactive-menu cancel: dismiss the pending menu without sending
+  // any text to the session. Posts a special sentinel that the PTY wrapper
+  // translates to ESC, clearing pendingMenu cleanly.
+  if (data === 'menu:cancel') {
+    if (!isCallbackAuthorized(ctx)) {
+      await ctx.answerCallbackQuery({ text: 'Not authorized.' }).catch(() => {})
+      return
+    }
+    const chat_id = String(ctx.callbackQuery.message?.chat.id ?? ctx.from.id)
+    await ctx.editMessageReplyMarkup({ reply_markup: undefined }).catch(() => {})
+    await ctx.answerCallbackQuery({ text: '✓ Cancelled' }).catch(() => {})
+    const callbackUrl = process.env.CLAUDE_CHANNEL_CALLBACK
+    if (callbackUrl) {
+      fetch(callbackUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          content: '__MENU_CANCEL__',
+          meta: {
+            chat_id,
+            user: ctx.from.username ?? String(ctx.from.id),
+            user_id: String(ctx.from.id),
+            ts: new Date().toISOString(),
+          },
+        }),
+      }).catch(err => {
+        process.stderr.write(`telegram channel: menu cancel callback POST failed: ${err}\n`)
+      })
+    }
+    return
+  }
+
   // Handle model selection callback: model:<model_id>
   const modelMatch = /^model:(.+)$/.exec(data)
   if (modelMatch) {
-    const access = loadAccess()
-    if (!access.allowFrom.includes(String(ctx.from.id))) {
+    if (!isCallbackAuthorized(ctx)) {
       await ctx.answerCallbackQuery({ text: 'Not authorized.' }).catch(() => {})
       return
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xmaxma/claude-gateway",
-  "version": "1.3.7",
+  "version": "1.3.9",
   "description": "Multi-agent gateway for Claude",
   "repository": {
     "type": "git",