@llblab/pi-telegram 0.24.6 → 0.24.8

package/lib/threads.ts

@@ -92,6 +92,9 @@ export interface TelegramThreadPendingProvision {
   leaderEpoch?: number | string;
 }
 
+export type TelegramThreadCleanupIntent =
+  ThreadReconciler.TelegramThreadCleanupIntent;
+
 type TelegramProvisionRecoveryFile = Record<
   string,
   {
@@ -160,6 +163,7 @@ export interface TelegramTopicTargetFile {
   identities?: TelegramThreadIdentityRecord[];
   reservations?: TelegramThreadReservation[];
   pendingProvisions?: TelegramThreadPendingProvision[];
+  pendingCleanups?: TelegramThreadCleanupIntent[];
   syncObservations?: TelegramTopicSyncObservation[];
 }
 
@@ -229,6 +233,7 @@ export interface TelegramTopicTargetStore {
   ) => { slot?: string; threadName?: string } | undefined;
   listReservations: () => TelegramThreadReservation[];
   listPendingProvisions: () => TelegramThreadPendingProvision[];
+  listPendingCleanups: () => TelegramThreadCleanupIntent[];
   listSyncObservations: () => TelegramTopicSyncObservation[];
   reserveThread: (reservation: TelegramThreadReservation) => void;
   upsertPendingProvision: (provision: TelegramThreadPendingProvision) => void;
@@ -237,6 +242,8 @@ export interface TelegramTopicTargetStore {
     target: TelegramTarget & { threadId: number },
   ) => Promise<boolean>;
   removePendingProvision: (id: string) => boolean;
+  upsertPendingCleanup: (intent: TelegramThreadCleanupIntent) => void;
+  removePendingCleanup: (id: string) => boolean;
   getBotState: () => TelegramBotStateSnapshot;
   setBotState: (state: Partial<TelegramBotStateSnapshot>) => void;
   setStatusSnapshot: (snapshot: {
@@ -876,6 +883,56 @@ function normalizePendingProvision(
   };
 }
 
+function normalizePendingCleanup(
+  value: unknown,
+): TelegramThreadCleanupIntent | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return undefined;
+  const record = value as Record<string, unknown>;
+  const targetValue = record.target;
+  if (
+    !targetValue ||
+    typeof targetValue !== "object" ||
+    Array.isArray(targetValue)
+  ) {
+    return undefined;
+  }
+  const targetRecord = targetValue as Record<string, unknown>;
+  const owner = record.owner;
+  if (owner !== "leader" && owner !== "manual-follower") return undefined;
+  if (typeof record.id !== "string" || record.id.length === 0) return undefined;
+  if (typeof record.instanceId !== "string" || record.instanceId.length === 0)
+    return undefined;
+  if (
+    typeof record.runtimeGeneration !== "string" ||
+    record.runtimeGeneration.length === 0
+  ) {
+    return undefined;
+  }
+  if (
+    typeof targetRecord.chatId !== "number" ||
+    typeof targetRecord.threadId !== "number" ||
+    !Number.isInteger(targetRecord.threadId) ||
+    typeof record.requestedAtMs !== "number"
+  ) {
+    return undefined;
+  }
+  return {
+    id: record.id,
+    owner,
+    instanceId: record.instanceId,
+    runtimeGeneration: record.runtimeGeneration,
+    ...(typeof record.profileKey === "string"
+      ? { profileKey: record.profileKey }
+      : {}),
+    target: {
+      chatId: targetRecord.chatId,
+      threadId: targetRecord.threadId,
+    },
+    requestedAtMs: record.requestedAtMs,
+  };
+}
+
 function normalizeReservation(
   value: unknown,
 ): TelegramThreadReservation | undefined {
@@ -970,6 +1027,12 @@ function parseTopicTargetFile(value: unknown): TelegramTopicTargetFile {
           return normalized ? [normalized] : [];
         })
       : [],
+    pendingCleanups: Array.isArray(file.pendingCleanups)
+      ? file.pendingCleanups.flatMap((intent) => {
+          const normalized = normalizePendingCleanup(intent);
+          return normalized ? [normalized] : [];
+        })
+      : [],
     syncObservations: Array.isArray(file.syncObservations)
       ? file.syncObservations.flatMap((observation) => {
           const normalized = normalizeSyncObservation(observation);
@@ -1084,6 +1147,7 @@ export function createTelegramTopicTargetStore(
   let identities = new Map<string, TelegramThreadIdentityRecord>();
   let reservations: TelegramThreadReservation[] = [];
   let pendingProvisions: TelegramThreadPendingProvision[] = [];
+  let pendingCleanups: TelegramThreadCleanupIntent[] = [];
   let syncObservations: TelegramTopicSyncObservation[] = [];
   let followerRecoveryHints = new Map<
     string,
@@ -1140,6 +1204,7 @@ export function createTelegramTopicTargetStore(
     identities = new Map();
     reservations = [];
     pendingProvisions = [];
+    pendingCleanups = [];
     syncObservations = [];
     followerRecoveryHints = new Map();
     statusSnapshot = {};
@@ -1157,6 +1222,7 @@ export function createTelegramTopicTargetStore(
       identities = new Map();
       reservations = [];
       pendingProvisions = [];
+      pendingCleanups = [];
       syncObservations = [];
       followerRecoveryHints = new Map();
       loaded = true;
@@ -1207,6 +1273,10 @@ export function createTelegramTopicTargetStore(
               : {}),
         };
       });
+    pendingCleanups = (file.pendingCleanups ?? []).map((intent) => ({
+      ...intent,
+      target: { ...intent.target },
+    }));
     syncObservations = (file.syncObservations ?? []).map((observation) => ({
       ...observation,
       target: { ...observation.target },
@@ -1269,6 +1339,10 @@ export function createTelegramTopicTargetStore(
             ...provision,
             ...(provision.target ? { target: { ...provision.target } } : {}),
           })),
+          pendingCleanups: pendingCleanups.map((intent) => ({
+            ...intent,
+            target: { ...intent.target },
+          })),
           syncObservations: syncObservations.map((observation) => ({
             ...observation,
             target: { ...observation.target },
@@ -1355,6 +1429,12 @@ export function createTelegramTopicTargetStore(
           ...(provision.target ? { target: { ...provision.target } } : {}),
         }));
     },
+    listPendingCleanups() {
+      return pendingCleanups.map((intent) => ({
+        ...intent,
+        target: { ...intent.target },
+      }));
+    },
     listSyncObservations() {
       return syncObservations.map((observation) => ({
         ...observation,
@@ -1425,6 +1505,21 @@ export function createTelegramTopicTargetStore(
       if (changed) markDirty();
       return changed;
     },
+    upsertPendingCleanup(intent) {
+      const next = { ...intent, target: { ...intent.target } };
+      pendingCleanups = pendingCleanups.filter(
+        (existing) => existing.id !== next.id,
+      );
+      pendingCleanups.push(next);
+      markDirty();
+    },
+    removePendingCleanup(id) {
+      const before = pendingCleanups.length;
+      pendingCleanups = pendingCleanups.filter((intent) => intent.id !== id);
+      const changed = pendingCleanups.length !== before;
+      if (changed) markDirty();
+      return changed;
+    },
     getBotState() {
       return Object.fromEntries(
         Object.entries(botState).filter(([, value]) => value !== undefined),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@llblab/pi-telegram",
-  "version": "0.24.6",
+  "version": "0.24.8",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -30,7 +30,8 @@
     "test": "node --experimental-strip-types --test --test-reporter=dot tests/*.test.ts",
     "test:verbose": "node --experimental-strip-types --test --test-reporter=spec tests/*.test.ts",
     "typecheck": "tsc --noEmit",
-    "audit": "node --experimental-strip-types scripts/audit-dependencies.ts",
+    "audit": "npm audit --omit=peer",
+    "audit:host": "npm audit",
     "pack:check": "npm pack --dry-run",
     "validate": "npm run typecheck && npm test && npm run audit && npm run pack:check"
   },
@@ -74,29 +75,5 @@
   "devDependencies": {
     "@types/node": "latest",
     "typescript": "latest"
-  },
-  "overrides": {
-    "brace-expansion": "5.0.7",
-    "protobufjs": "7.6.5",
-    "undici": "8.5.0",
-    "ws": "8.21.0",
-    "@earendil-works/pi-coding-agent": {
-      "brace-expansion": "5.0.7",
-      "protobufjs": "7.6.5",
-      "undici": "8.5.0",
-      "ws": "8.21.0",
-      "@google/genai": {
-        "protobufjs": "7.6.5",
-        "ws": "8.21.0"
-      },
-      "@earendil-works/pi-ai": {
-        "protobufjs": "7.6.5",
-        "ws": "8.21.0",
-        "@google/genai": {
-          "protobufjs": "7.6.5",
-          "ws": "8.21.0"
-        }
-      }
-    }
   }
 }

package/scripts/audit-dependencies.ts

@@ -1,78 +0,0 @@
-/**
- * Dependency audit command adapter
- * Runs raw npm audit, prints its output, and applies the fail-closed repository policy
- */
-
-import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import path from "node:path";
-
-import {
-  evaluateDependencyAudit,
-  type AuditReport,
-} from "./dependency-audit-policy.ts";
-
-function readInstalledPackageVersion(root: string, nodePath: string): string {
-  if (
-    path.isAbsolute(nodePath) ||
-    nodePath.includes("..") ||
-    !nodePath.startsWith("node_modules/")
-  ) {
-    throw new Error(`unsafe installed package path: ${nodePath}`);
-  }
-  const packageJsonPath = path.join(root, nodePath, "package.json");
-  const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8")) as {
-    version?: unknown;
-  };
-  if (typeof parsed.version !== "string") {
-    throw new Error(`installed package has no valid version: ${nodePath}`);
-  }
-  return parsed.version;
-}
-
-function run(): void {
-  const result = spawnSync("npm", ["audit", "--json"], {
-    cwd: process.cwd(),
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  if (result.stdout) process.stdout.write(result.stdout);
-  if (result.stderr) process.stderr.write(result.stderr);
-  if (result.error) throw result.error;
-  if (result.signal || (result.status !== 0 && result.status !== 1)) {
-    throw new Error(
-      `npm audit command failed: status=${String(result.status)} signal=${String(result.signal)}`,
-    );
-  }
-
-  let report: AuditReport;
-  try {
-    report = JSON.parse(result.stdout) as AuditReport;
-  } catch (error) {
-    throw new Error(`could not parse npm audit JSON: ${String(error)}`);
-  }
-  const evaluation = evaluateDependencyAudit(
-    report,
-    (nodePath) => readInstalledPackageVersion(process.cwd(), nodePath),
-  );
-  const expectedStatus = evaluation.vulnerabilityCount === 0 ? 0 : 1;
-  if (result.status !== expectedStatus) {
-    throw new Error(
-      `npm audit exit status mismatch: expected ${expectedStatus}, got ${String(result.status)}`,
-    );
-  }
-  if (evaluation.vulnerabilityCount === 0) {
-    console.log("Dependency audit passed with zero vulnerabilities.");
-    return;
-  }
-  console.warn(
-    `Accepted ${evaluation.vulnerabilityCount} audit graph entries rooted only in approved sources ${evaluation.acceptedAdvisorySources.join(", ")}; exception expires after 2026-08-21 UTC.`,
-  );
-}
-
-try {
-  run();
-} catch (error) {
-  console.error(error instanceof Error ? error.message : String(error));
-  process.exitCode = 1;
-}

package/scripts/dependency-audit-policy.ts

@@ -1,300 +0,0 @@
-/**
- * Fail-closed dependency audit policy
- * Zones: repository validation, dependency security
- * Validates the exact expiring Pi-shrinkwrap exception and installed package evidence
- */
-
-const EXCEPTION_EXPIRES_AT = Date.parse("2026-08-22T00:00:00Z");
-
-interface AuditAdvisory {
-  source: number;
-  name: string;
-  url: string;
-  severity: string;
-}
-
-interface AuditVulnerability {
-  name: string;
-  severity: string;
-  via: Array<string | AuditAdvisory>;
-  nodes: string[];
-}
-
-export interface AuditReport {
-  error?: unknown;
-  metadata?: {
-    vulnerabilities?: {
-      info?: number;
-      low?: number;
-      moderate?: number;
-      high?: number;
-      critical?: number;
-      total?: number;
-    };
-  };
-  vulnerabilities?: Record<string, AuditVulnerability>;
-}
-
-interface AllowedAdvisory {
-  source: number;
-  packageName: string;
-  version: string;
-  severity: string;
-  url: string;
-  nodes: readonly string[];
-}
-
-const ALLOWED_ADVISORIES = new Map<number, AllowedAdvisory>([
-  [
-    1123898,
-    {
-      source: 1123898,
-      packageName: "brace-expansion",
-      version: "5.0.6",
-      severity: "high",
-      url: "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
-      nodes: [
-        "node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion",
-      ],
-    },
-  ],
-  [
-    1123964,
-    {
-      source: 1123964,
-      packageName: "protobufjs",
-      version: "7.6.4",
-      severity: "moderate",
-      url: "https://github.com/advisories/GHSA-j3f2-48v5-ccww",
-      nodes: [
-        "node_modules/@earendil-works/pi-coding-agent/node_modules/protobufjs",
-      ],
-    },
-  ],
-]);
-
-const ALLOWED_GRAPH: Readonly<Record<string, readonly string[]>> = {
-  "brace-expansion": [],
-  protobufjs: [],
-  "@google/genai": ["protobufjs"],
-  "@earendil-works/pi-ai": ["@google/genai"],
-  "@earendil-works/pi-agent-core": ["@earendil-works/pi-ai"],
-  "@earendil-works/pi-coding-agent": [
-    "@earendil-works/pi-agent-core",
-    "@earendil-works/pi-ai",
-  ],
-};
-
-const ALLOWED_GRAPH_SEVERITIES: Readonly<Record<string, string>> = {
-  "brace-expansion": "high",
-  protobufjs: "moderate",
-  "@google/genai": "moderate",
-  "@earendil-works/pi-ai": "moderate",
-  "@earendil-works/pi-agent-core": "moderate",
-  "@earendil-works/pi-coding-agent": "moderate",
-};
-
-const ALLOWED_GRAPH_NODES: Readonly<Record<string, readonly string[]>> = {
-  "brace-expansion": [
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion",
-  ],
-  protobufjs: [
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/protobufjs",
-  ],
-  "@google/genai": [
-    "node_modules/@google/genai",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@google/genai",
-  ],
-  "@earendil-works/pi-ai": [
-    "node_modules/@earendil-works/pi-ai",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-ai",
-  ],
-  "@earendil-works/pi-agent-core": [
-    "node_modules/@earendil-works/pi-agent-core",
-    "node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-agent-core",
-  ],
-  "@earendil-works/pi-coding-agent": [
-    "node_modules/@earendil-works/pi-coding-agent",
-  ],
-};
-
-export interface AuditEvaluation {
-  acceptedAdvisorySources: number[];
-  vulnerabilityCount: number;
-}
-
-function hasExactMembers(actual: readonly string[], expected: readonly string[]): boolean {
-  return (
-    actual.length === expected.length &&
-    new Set(actual).size === actual.length &&
-    expected.every((value) => actual.includes(value))
-  );
-}
-
-export function evaluateDependencyAudit(
-  report: AuditReport,
-  readInstalledVersion: (nodePath: string) => string,
-  nowMs = Date.now(),
-): AuditEvaluation {
-  if (report.error !== undefined) {
-    throw new Error("npm audit returned an error payload");
-  }
-  const vulnerabilities = report.vulnerabilities;
-  if (!vulnerabilities || typeof vulnerabilities !== "object") {
-    throw new Error("npm audit output is missing vulnerabilities");
-  }
-
-  const entries = Object.entries(vulnerabilities);
-  const counts = report.metadata?.vulnerabilities;
-  if (!counts) {
-    throw new Error("npm audit output is missing vulnerability metadata");
-  }
-  const countKeys = [
-    "info",
-    "low",
-    "moderate",
-    "high",
-    "critical",
-    "total",
-  ] as const;
-  for (const key of countKeys) {
-    if (!Number.isInteger(counts[key]) || (counts[key] ?? -1) < 0) {
-      throw new Error(`npm audit metadata has invalid ${key} count`);
-    }
-  }
-  const severityTotal =
-    (counts.info ?? 0) +
-    (counts.low ?? 0) +
-    (counts.moderate ?? 0) +
-    (counts.high ?? 0) +
-    (counts.critical ?? 0);
-  if (severityTotal !== counts.total || counts.total !== entries.length) {
-    throw new Error(
-      `npm audit vulnerability total mismatch: metadata=${String(counts.total)}, severities=${severityTotal}, graph=${entries.length}`,
-    );
-  }
-  if (entries.length === 0) {
-    return { acceptedAdvisorySources: [], vulnerabilityCount: 0 };
-  }
-  if (nowMs >= EXCEPTION_EXPIRES_AT) {
-    throw new Error(
-      "approved dependency audit exception expired at 2026-08-22T00:00:00Z",
-    );
-  }
-
-  const acceptedSources = new Set<number>();
-  for (const [name, vulnerability] of entries) {
-    if (vulnerability.name !== name) {
-      throw new Error(`npm audit graph key/name mismatch for ${name}`);
-    }
-    const allowedParents = ALLOWED_GRAPH[name];
-    const allowedNodes = ALLOWED_GRAPH_NODES[name];
-    const allowedSeverity = ALLOWED_GRAPH_SEVERITIES[name];
-    if (!allowedParents || !allowedNodes || !allowedSeverity) {
-      throw new Error(`unapproved vulnerable package: ${name}`);
-    }
-    if (vulnerability.severity !== allowedSeverity) {
-      throw new Error(
-        `unapproved severity for ${name}: expected ${allowedSeverity}, got ${vulnerability.severity}`,
-      );
-    }
-    if (!Array.isArray(vulnerability.via) || !Array.isArray(vulnerability.nodes)) {
-      throw new Error(`malformed npm audit graph entry for ${name}`);
-    }
-    if (!hasExactMembers(vulnerability.nodes, allowedNodes)) {
-      throw new Error(
-        `audit graph paths differ for ${name}: expected ${allowedNodes.join(",")}, got ${vulnerability.nodes.join(",")}`,
-      );
-    }
-
-    const parentEdges = vulnerability.via.filter(
-      (via): via is string => typeof via === "string",
-    );
-    const advisories = vulnerability.via.filter(
-      (via): via is AuditAdvisory => typeof via !== "string",
-    );
-    if (allowedParents.length > 0) {
-      if (advisories.length > 0 || !hasExactMembers(parentEdges, allowedParents)) {
-        throw new Error(
-          `audit graph edges differ for ${name}: expected ${allowedParents.join(",")}, got ${parentEdges.join(",")}`,
-        );
-      }
-      for (const parent of parentEdges) {
-        if (!vulnerabilities[parent]) {
-          throw new Error(`missing npm audit graph node: ${parent}`);
-        }
-      }
-      continue;
-    }
-    if (parentEdges.length > 0 || advisories.length !== 1) {
-      throw new Error(`audit leaf shape differs for ${name}`);
-    }
-    const advisory = advisories[0];
-    const allowed = ALLOWED_ADVISORIES.get(advisory.source);
-    if (
-      !allowed ||
-      advisory.name !== allowed.packageName ||
-      advisory.url !== allowed.url ||
-      advisory.severity !== allowed.severity ||
-      name !== allowed.packageName ||
-      vulnerability.severity !== allowed.severity
-    ) {
-      throw new Error(
-        `unapproved advisory for ${name}: source=${String(advisory.source)} url=${advisory.url}`,
-      );
-    }
-    acceptedSources.add(advisory.source);
-  }
-
-  const rootsByPackage = new Map<string, Set<number>>();
-  const resolveRoots = (name: string, stack: Set<string>): Set<number> => {
-    const cached = rootsByPackage.get(name);
-    if (cached) return cached;
-    if (stack.has(name)) throw new Error(`cycle in npm audit graph at ${name}`);
-    const vulnerability = vulnerabilities[name];
-    if (!vulnerability) throw new Error(`missing npm audit graph node: ${name}`);
-    const nextStack = new Set(stack).add(name);
-    const roots = new Set<number>();
-    for (const via of vulnerability.via) {
-      if (typeof via === "string") {
-        for (const source of resolveRoots(via, nextStack)) roots.add(source);
-      } else {
-        roots.add(via.source);
-      }
-    }
-    if (roots.size === 0) {
-      throw new Error(`npm audit graph node has no approved advisory root: ${name}`);
-    }
-    rootsByPackage.set(name, roots);
-    return roots;
-  };
-
-  for (const name of Object.keys(vulnerabilities)) resolveRoots(name, new Set());
-
-  for (const source of acceptedSources) {
-    const allowed = ALLOWED_ADVISORIES.get(source);
-    if (!allowed) throw new Error(`missing policy for advisory source ${source}`);
-    const vulnerability = vulnerabilities[allowed.packageName];
-    if (!vulnerability) {
-      throw new Error(`missing leaf package for advisory source ${source}`);
-    }
-    for (const nodePath of vulnerability.nodes) {
-      if (!allowed.nodes.includes(nodePath)) {
-        throw new Error(
-          `unapproved installed path for advisory source ${source}: ${nodePath}`,
-        );
-      }
-      const version = readInstalledVersion(nodePath);
-      if (version !== allowed.version) {
-        throw new Error(
-          `unapproved installed version at ${nodePath}: expected ${allowed.version}, got ${version}`,
-        );
-      }
-    }
-  }
-
-  return {
-    acceptedAdvisorySources: [...acceptedSources].sort((a, b) => a - b),
-    vulnerabilityCount: entries.length,
-  };
-}