@miphamai/cli 0.50.0 → 0.52.0

package/src/core/credential-masker/search.ts

@@ -0,0 +1,73 @@
+import type { CredentialMaskingConfig } from '../../shared/index.ts'
+import { matchCredentialFile } from './matcher'
+import { CREDENTIAL_SENTINEL } from './types'
+
+/**
+ * Mask grep/search output: any match line that belongs to a credential file
+ * (e.g. `.env`, `.aws/credentials`) has its content replaced with the
+ * credential sentinel, so Grep can't leak secrets that Read would mask.
+ *
+ * `format` disambiguates the two shapes the Grep tool emits — each invocation
+ * produces exactly one, so there is no cross-format ambiguity to guess at:
+ *   - 'heading'  (ripgrep `--heading`): file path on its own line, then `N:content` lines
+ *   - 'filename' (plain grep `-rn`):    `path:N:content` on a single line
+ *
+ * NOTE: the sensitive file's *path* stays visible — only its match content is
+ * masked. That's intentional for grep (a targeted search where the model already
+ * named the path); the secret is the content, not the location. Contrast
+ * `maskGlobOutput`, which hides the path entirely (enumeration's leak is existence).
+ */
+export function maskSearchOutput(
+  stdout: string,
+  config?: CredentialMaskingConfig,
+  format: 'heading' | 'filename' = 'heading',
+): string {
+  if (!config?.enabled) return stdout
+  const out: string[] = []
+  let currentMasked = false
+
+  for (const line of stdout.split('\n')) {
+    if (format === 'filename') {
+      const m = line.match(/^(.+?):(\d+):(.*)$/)
+      if (m) {
+        out.push(
+          matchCredentialFile(m[1]!, config) ? `${m[1]}:${m[2]}:${CREDENTIAL_SENTINEL}` : line,
+        )
+      } else {
+        out.push(line)
+      }
+      continue
+    }
+
+    // 'heading' format: match lines are `N:content`; everything non-empty else is a file heading.
+    const m = line.match(/^(\d+):(.*)$/)
+    if (m) {
+      out.push(currentMasked ? `${m[1]}:${CREDENTIAL_SENTINEL}` : line)
+      continue
+    }
+    if (line.trim() === '') {
+      out.push(line) // blank separator — pass through, keep current file
+      continue
+    }
+    currentMasked = !!matchCredentialFile(line, config)
+    out.push(line)
+  }
+
+  return out.join('\n')
+}
+
+/**
+ * Mask a glob file listing: sensitive file paths are replaced with the
+ * credential sentinel so file enumeration can't reveal their existence.
+ *
+ * NOTE: unlike `maskSearchOutput` (which keeps the searched path visible and
+ * masks only content), glob hides the whole path — here the leak is the file's
+ * *existence*, not its content.
+ */
+export function maskGlobOutput(paths: string, config?: CredentialMaskingConfig): string {
+  if (!config?.enabled) return paths
+  return paths
+    .split('\n')
+    .map((p) => (matchCredentialFile(p, config) ? CREDENTIAL_SENTINEL : p))
+    .join('\n')
+}

package/src/core/credential-masker.ts

@@ -13,6 +13,7 @@ export { matchCredentialFile } from './credential-masker/matcher'
 export { maskContent } from './credential-masker/pipeline'
 export { maskOutput } from './credential-masker/output-scrub'
 export { filterEnv } from './credential-masker/env-filter'
+export { maskSearchOutput, maskGlobOutput } from './credential-masker/search'
 
 import { CREDENTIAL_SENTINEL } from './credential-masker/types'
 

package/src/core/crsi-sandbox.ts

@@ -84,7 +84,6 @@ export interface CrsiSessionReport {
 // ── Constants ──
 
 const WORKTREE_PREFIX = 'crsi-sandbox-'
-const MAX_WORKTREE_AGE_MS = 30 * 60 * 1000 // 30 minutes
 const TEST_TIMEOUT_MS = 120_000 // 2 minutes
 const REPORT_DIR = join(homedir(), '.mipham', 'crsi-sandbox')
 

package/src/core/dream-engine.ts

@@ -469,7 +469,6 @@ export class DreamEngine {
       const lines = match[1]!.split('\n')
       const fm: Record<string, unknown> = {}
       let currentNested: Record<string, unknown> | null = null
-      let nestedKey = ''
       for (const line of lines) {
         // Handle nested YAML (e.g. "metadata:\n  type: feedback")
         const nested = line.match(/^  (\w[\w\s]*?):\s*(.+)$/)
@@ -485,7 +484,6 @@ export class DreamEngine {
           if (val === '') {
             // Empty value → start nested block
             currentNested = {}
-            nestedKey = key
             fm[key] = currentNested
           } else {
             currentNested = null

package/src/core/instructions.ts

@@ -20,9 +20,37 @@ function parseFrontmatter(raw: string): FrontmatterResult {
   }
 }
 
+/** Strip the named sections (by heading title) from a markdown document. */
+export function stripSections(content: string, excluded: string[]): string {
+  if (excluded.length === 0) return content
+  const lines = content.split('\n')
+  const out: string[] = []
+  let skipLevel = 0
+  for (const line of lines) {
+    const m = line.match(/^(#{1,3})\s+(.+?)\s*$/)
+    if (m) {
+      const level = m[1]!.length
+      const title = m[2]!.trim()
+      if (excluded.includes(title)) {
+        skipLevel = level
+      } else if (skipLevel > 0 && level <= skipLevel) {
+        skipLevel = 0
+      }
+    }
+    if (skipLevel === 0) out.push(line)
+  }
+  return out.join('\n')
+}
+
+/** Normalize a `prompt-exclude` frontmatter value (YAML list or single string). */
+export function parsePromptExclude(value: unknown): string[] {
+  if (Array.isArray(value)) return value.map((v) => String(v))
+  if (typeof value === 'string') return [value]
+  return []
+}
+
 export class InstructionsLoader {
   private instructions: InstructionFile[] = []
-  private skillsReminder = ''
 
   loadAll(cwd: string): void {
     this.instructions = []
@@ -59,7 +87,13 @@ export class InstructionsLoader {
         directory: 'Directory Rules',
         user: 'User Preferences',
       }
-      parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${inst.content}`)
+      // Strip doc-only sections declared via `prompt-exclude` frontmatter
+      // (changelog/roadmap/catalog are human-facing, not machine rules).
+      const content = stripSections(
+        inst.content,
+        parsePromptExclude(inst.frontmatter['prompt-exclude']),
+      )
+      parts.push(`<!-- ${levelLabel[inst.level] || inst.level} (${inst.path}) -->\n${content}`)
     }
 
     // P2-2: Inject current permission mode so the model knows its constraints
@@ -67,11 +101,6 @@ export class InstructionsLoader {
       parts.push(this.buildPermissionContext(permissionMode))
     }
 
-    // Append skills reminder after all instructions
-    if (this.skillsReminder) {
-      parts.push(this.skillsReminder)
-    }
-
     // Inject critical thinking self-check layer (for analysis/comparison tasks)
     parts.push(`## Critical Thinking Self-Check
 
@@ -177,11 +206,6 @@ Never omit it or present the work as purely human-authored.`)
     return parts.join('\n\n---\n\n')
   }
 
-  /** Set the skills system-reminder block to inject into the system prompt. */
-  setSkillsReminder(reminder: string): void {
-    this.skillsReminder = reminder
-  }
-
   /**
    * P2-2: Build a permission-mode context block for the system prompt.
    * Tells the model its current permission level and what to expect.

package/src/core/memory/memory-loader.ts

@@ -1,7 +1,9 @@
+import { join } from 'node:path'
+import { homedir } from 'node:os'
 import { MemoryManager } from './memory-manager'
 import type { MemoryManager as MemoryManagerType } from './memory-manager'
 
-const MEMORY_DIR = `${process.env.HOME || '~'}/.mipham/memory`
+const MEMORY_DIR = join(homedir(), '.mipham', 'memory')
 
 let instance: MemoryManagerType | null = null
 

package/src/core/permission-rules.ts

@@ -1,14 +1,16 @@
 import type { PermissionRuleEntry } from '../shared/index.ts'
+import { matchPath } from './credential-masker/matcher'
 
-/**
- * Match a Bash(command_pattern) rule against an actual tool call.
- *
- * Pattern formats:
- *   "Bash"              → matches any Bash call
- *   "Bash(git:*)"       → matches "git status", "git diff --cached", etc.
- *   "Bash(npm test:*)"  → matches "npm test -- --coverage"
- *   "Write(/etc/*)"     → matches Write to /etc/passwd, /etc/hosts, etc.
- */
+// Match a tool(parameter) rule against an actual tool call.
+//
+// Pattern formats:
+//   "Bash"              → matches any Bash call
+//   "Bash(git:*)"       → matches "git status", "git diff --cached", etc.
+//   "Bash(npm test:*)"  → matches "npm test -- --coverage"
+//   "Write(/etc/*)"     → matches Write to /etc/passwd, /etc/hosts, etc.
+//   "Read(**/.ssh/*)"   → matches Read of any path under .ssh
+//   "Grep(**/vendor)"   → matches Grep rooted under a vendor directory
+//   "Glob(**/.ssh)"     → matches Glob rooted under a .ssh directory
 export function matchBashRule(
   pattern: string,
   toolName: string,
@@ -31,10 +33,19 @@ export function matchBashRule(
     return wildcardMatch(subPattern!, cmd.trim())
   }
 
-  // For Write/Edit: match against the file_path
-  if (baseTool === 'Write' || baseTool === 'Edit') {
+  // For Write/Edit/Read: match against the file_path with path-glob semantics.
+  // Use matchPath (NOT wildcardMatch): wildcardMatch is tuned for Bash commands
+  // (`:` → colon-or-whitespace, `*` → `.*`), which is wrong for filesystem
+  // paths — `*` would cross `/` and Windows drive letters like `C:\` get mangled.
+  if (baseTool === 'Write' || baseTool === 'Edit' || baseTool === 'Read') {
     const path = String(toolInput.file_path || '')
-    return wildcardMatch(subPattern!, path)
+    return matchPath(path, subPattern!)
+  }
+
+  // For Grep/Glob: match against the base search path (a directory)
+  if (baseTool === 'Grep' || baseTool === 'Glob') {
+    const path = String(toolInput.path || '')
+    return matchPath(path, subPattern!)
   }
 
   return false

package/src/core/rules-loader.ts

@@ -19,6 +19,7 @@
 
 import { readdirSync, readFileSync, existsSync } from 'node:fs'
 import { join } from 'node:path'
+import { globToRegexSource } from './credential-masker/matcher'
 
 interface RuleFile {
   name: string
@@ -117,18 +118,15 @@ export class RulesLoader {
   }
 
   /**
-   * Simple glob matching. Supports **, *, and exact file matching.
-   * Returns true if file matches pattern.
+   * Glob matching for path-scoped rules. Reuses the shared path-glob core
+   * (globToRegexSource) so `*`/`**`/`?` semantics match credential-file
+   * matching. Anchoring differs: rules match by *suffix* (a rule `*.ts`
+   * applies to any file ending in `.ts`), not full path.
    */
   private matchPath(file: string, pattern: string): boolean {
-    // Convert glob pattern to regex
-    let regexStr = pattern
-      .replace(/\./g, '\\.')
-      .replace(/\*\*/g, '<<GLOBSTAR>>')
-      .replace(/\*/g, '[^/]*')
-      .replace(/<<GLOBSTAR>>/g, '.*')
-
-    // If pattern doesn't start with ** or *, anchor to be a suffix match
+    let regexStr = globToRegexSource(pattern)
+
+    // If pattern doesn't start with ** or *, anchor to a suffix match
     if (!pattern.startsWith('**') && !pattern.startsWith('*')) {
       regexStr = regexStr + '$'
     }

package/src/daemon/database.ts

@@ -289,7 +289,6 @@ export class DaemonDatabase {
     }
 
     vals.push(id)
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     this.db.run(`UPDATE goals SET ${sets.join(', ')} WHERE id = ?`, vals as any)
   }
 

package/src/daemon/feishu/adapter.ts

@@ -28,7 +28,8 @@ export function createFeishuAdapter(config: FeishuConfig, deps: FeishuAdapterDep
       if (!allowed.has(msg.openId)) return
       if (!deps.rateLimiter.check(`feishu:${msg.openId}`).allowed) return
 
-      const session = deps.sm.getOrCreateByFeishuOpenId(
+      const session = deps.sm.getOrCreateByExternalUser(
+        'feishu',
         msg.openId,
         deps.cwd,
         deps.provider,

package/src/daemon/index.ts

@@ -25,6 +25,8 @@ import type { DaemonStatus } from './types'
 import { logger } from './logger'
 import { parseFeishuEnv } from './feishu/env.js'
 import type { FeishuConfig } from './feishu/types.js'
+import { parseTelegramEnv } from './telegram/env.js'
+import type { TelegramConfig } from './telegram/types.js'
 import { loadConfig } from '../config/loader'
 
 const HOME = homedir()
@@ -40,8 +42,6 @@ const DEFAULT_PORT = 45671
 let activeServer: Server<unknown> | null = null
 let activeDb: DaemonDatabase | null = null
 let activePool: WorkerPool | null = null
-let activeAgentManager: AgentManager | null = null
-let activeMessageBus: MessageBus | null = null
 let activeScheduleManager: ScheduleManager | null = null
 let activeRateLimiter: RateLimiter | null = null
 
@@ -150,9 +150,7 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
 
   // Create agent manager and message bus (Phase 3)
   const agentManager = new AgentManager(db)
-  activeAgentManager = agentManager
   const messageBus = new MessageBus()
-  activeMessageBus = messageBus
 
   // Create goal manager and schedule manager (Phase 4)
   const goalManager = new GoalManager(db)
@@ -181,6 +179,21 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     }
   }
 
+  // Telegram remote-control adapter（env 未配置时跳过；配置则解析 session 默认 provider/model）
+  const telegramConfig = parseTelegramEnv()
+  let telegram: { config: TelegramConfig; cwd: string; provider: string; model: string } | undefined
+  if (telegramConfig) {
+    const cfg = loadConfig()
+    // 取第一个非 upcoming（即非「待上线」）的 provider 及其首个 model
+    const provider = cfg.providers.find((p) => p.status !== 'upcoming') ?? cfg.providers[0]
+    telegram = {
+      config: telegramConfig,
+      cwd: process.env.TELEGRAM_CWD || process.cwd(),
+      provider: provider?.id ?? 'anthropic',
+      model: provider?.models?.[0]?.id ?? 'claude-sonnet-5',
+    }
+  }
+
   // Start HTTP server (Bun.serve starts listening immediately)
   const server = createServer({
     db,
@@ -196,6 +209,7 @@ export async function startDaemon(): Promise<{ port: number; token: string }> {
     scheduleManager,
     rateLimiter,
     feishu,
+    telegram,
   })
   activeServer = server
 
@@ -250,10 +264,6 @@ export async function stopDaemon(force: boolean = false): Promise<void> {
     activeRateLimiter = null
   }
 
-  // Clean up agent manager and message bus (Phase 3)
-  activeAgentManager = null
-  activeMessageBus = null
-
   // Close database (commits any pending WAL)
   if (activeDb) {
     activeDb.close()

package/src/daemon/server.ts

@@ -26,6 +26,9 @@ import type { ToolDefinition, PermissionMode, PermissionRestrictions } from '../
 import { createFeishuAdapter } from './feishu/adapter.js'
 import { createFeishuApi } from './feishu/api.js'
 import type { FeishuConfig } from './feishu/types.js'
+import { createTelegramAdapter } from './telegram/adapter.js'
+import { createTelegramApi } from './telegram/api.js'
+import type { TelegramConfig } from './telegram/types.js'
 import { startHeartbeat } from './heartbeat'
 
 interface ServerConfig {
@@ -42,6 +45,7 @@ interface ServerConfig {
   scheduleManager: ScheduleManager
   rateLimiter: RateLimiter
   feishu?: { config: FeishuConfig; cwd: string; provider: string; model: string }
+  telegram?: { config: TelegramConfig; cwd: string; provider: string; model: string }
 }
 
 interface WsData {
@@ -71,13 +75,20 @@ function resolveDaemonPermission(): PermissionMode {
 
 /**
  * Build the daemon's PermissionSystem, honoring org-level restrictions
- * (permissionRestrictions). setRestrictions re-clamps the env-derived mode,
- * so a `MIPHAM_DAEMON_PERMISSION=bypassPermissions` is downgraded when the
- * config forbids it — mirroring the CLI's fail-closed behavior.
+ * (permissionRestrictions) and user-defined allow/deny rules. setRestrictions
+ * re-clamps the env-derived mode, so a `MIPHAM_DAEMON_PERMISSION=bypassPermissions`
+ * is downgraded when the config forbids it — mirroring the CLI's fail-closed behavior.
  */
-export function buildDaemonPermission(restrictions?: PermissionRestrictions): PermissionSystem {
+export function buildDaemonPermission(
+  restrictions?: PermissionRestrictions,
+  rules?: { allow?: string[]; deny?: string[] },
+): PermissionSystem {
   const permission = new PermissionSystem(resolveDaemonPermission())
   if (restrictions) permission.setRestrictions(restrictions)
+  if (rules) {
+    for (const rule of rules.allow ?? []) permission.allow(rule)
+    for (const rule of rules.deny ?? []) permission.deny(rule)
+  }
   return permission
 }
 
@@ -112,6 +123,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
     scheduleManager,
     rateLimiter,
     feishu,
+    telegram,
   } = config
 
   const wsClients = new Map<string, Set<ServerWebSocket<WsData>>>()
@@ -199,7 +211,11 @@ export function createServer(config: ServerConfig): Server<WsData> {
       }
     }
 
-    const permission = buildDaemonPermission(loadConfig(cwd).permissionRestrictions)
+    const daemonConfig = loadConfig(cwd)
+    const permission = buildDaemonPermission(
+      daemonConfig.permissionRestrictions,
+      daemonConfig.permissionRules,
+    )
     const engine = new QueryEngine(sharedRegistry, context, sharedTools, permission)
     engine.setSessionId(sessionId)
     engineCache.set(sessionId, engine)
@@ -208,7 +224,7 @@ export function createServer(config: ServerConfig): Server<WsData> {
 
   function getOrCreateWorker(
     sessionId: string,
-    ws?: ServerWebSocket<WsData>,
+    _ws?: ServerWebSocket<WsData>,
   ): SessionWorker | null {
     try {
       const session = db.getSession(sessionId)
@@ -245,14 +261,28 @@ export function createServer(config: ServerConfig): Server<WsData> {
       })
     : undefined
 
+  // ── Telegram remote-control adapter（长轮询，无需 webhook 路由）──
+  const telegramAdapter = telegram
+    ? createTelegramAdapter(telegram.config, createTelegramApi(telegram.config), {
+        sm,
+        getOrCreateWorker,
+        rateLimiter,
+        cwd: telegram.cwd,
+        provider: telegram.provider,
+        model: telegram.model,
+      })
+    : undefined
+  telegramAdapter?.start()
+
   // ── 心跳式通知：定时扫 pending（goal/schedule），只通知、不自主行动 ──
+  const heartbeatSource = {
+    listGoals: () => sm.listSessions().flatMap((s) => goalManager.getGoals(s.id)),
+    listSchedules: () => sm.listSessions().flatMap((s) => scheduleManager.getSchedules(s.id)),
+  }
   if (feishu) {
     const feishuApi = createFeishuApi(feishu.config)
     startHeartbeat({
-      source: {
-        listGoals: () => sm.listSessions().flatMap((s) => goalManager.getGoals(s.id)),
-        listSchedules: () => sm.listSessions().flatMap((s) => scheduleManager.getSchedules(s.id)),
-      },
+      source: heartbeatSource,
       push: (message) => {
         for (const openId of feishu.config.allowedOpenIds) {
           void feishuApi.sendText(openId, message).catch(() => {
@@ -262,6 +292,19 @@ export function createServer(config: ServerConfig): Server<WsData> {
       },
     })
   }
+  if (telegram) {
+    const telegramApi = createTelegramApi(telegram.config)
+    startHeartbeat({
+      source: heartbeatSource,
+      push: (message) => {
+        for (const chatId of telegram.config.allowedChatIds) {
+          void telegramApi.sendText(chatId, message).catch(() => {
+            /* 推送失败静默，不打断心跳 */
+          })
+        }
+      },
+    })
+  }
 
   const server = Bun.serve<WsData>({
     port,

package/src/daemon/session-manager.ts

@@ -1,5 +1,5 @@
 import type { DaemonDatabase } from './database'
-import type { DaemonSession, SessionStatus } from './types'
+import type { DaemonSession } from './types'
 
 type SessionCloseCallback = (sessionId: string) => void
 
@@ -23,13 +23,14 @@ export class SessionManager {
     return this.db.listSessions(status)
   }
 
-  getOrCreateByFeishuOpenId(
-    openId: string,
+  getOrCreateByExternalUser(
+    channel: string,
+    userId: string,
     cwd: string,
     provider: string,
     model: string,
   ): DaemonSession {
-    const name = `feishu-${openId}`
+    const name = `${channel}-${userId}`
     const existing = this.db.listSessions().find((s) => s.name === name && s.status !== 'closed')
     if (existing) return existing
     return this.db.createSession({ name, cwd, provider, model })

package/src/daemon/telegram/adapter.ts

@@ -0,0 +1,70 @@
+import type { TelegramApi } from './api.js'
+import type { TelegramConfig, TelegramMessage } from './types.js'
+import type { SessionManager } from '../session-manager'
+import type { SessionWorker } from '../session-worker'
+import type { RateLimiter } from '../rate-limiter'
+import { startTelegramPoller } from './poller.js'
+
+export interface TelegramAdapterDeps {
+  sm: SessionManager
+  getOrCreateWorker: (sessionId: string) => SessionWorker | null
+  rateLimiter: RateLimiter
+  cwd: string
+  provider: string
+  model: string
+}
+
+export interface TelegramAdapter {
+  start(): () => void
+  handleMessage(msg: TelegramMessage): Promise<void>
+  isAllowed(chatId: string): boolean
+}
+
+export function createTelegramAdapter(
+  config: TelegramConfig,
+  api: TelegramApi,
+  deps: TelegramAdapterDeps,
+): TelegramAdapter {
+  const allowed = new Set(config.allowedChatIds)
+  let stopPoller: (() => void) | null = null
+
+  async function handleMessage(msg: TelegramMessage): Promise<void> {
+    try {
+      if (!allowed.has(msg.chatId)) return
+      if (!deps.rateLimiter.check(`telegram:${msg.chatId}`).allowed) return
+
+      const session = deps.sm.getOrCreateByExternalUser(
+        'telegram',
+        msg.chatId,
+        deps.cwd,
+        deps.provider,
+        deps.model,
+      )
+      const worker = deps.getOrCreateWorker(session.id)
+      if (!worker) {
+        await api.sendText(msg.chatId, '（会话初始化失败，请稍后重试）')
+        return
+      }
+      await worker.processPrompt(msg.text)
+      const result = worker.getLastAssistantContent()
+      await api.sendText(msg.chatId, result ? result.slice(0, 4096) : '（无回复）')
+    } catch (err) {
+      console.error('[telegram] message handling failed:', err)
+      try {
+        await api.sendText(msg.chatId, '（处理失败，请稍后重试）')
+      } catch {
+        /* 忽略回送失败，不 rethrow */
+      }
+    }
+  }
+
+  return {
+    handleMessage,
+    isAllowed: (chatId) => allowed.has(chatId),
+    start() {
+      if (stopPoller) return stopPoller
+      stopPoller = startTelegramPoller(api, handleMessage)
+      return stopPoller
+    },
+  }
+}

package/src/daemon/telegram/api.ts

@@ -0,0 +1,45 @@
+import type { TelegramConfig } from './types.js'
+
+export interface TelegramApi {
+  getUpdates(
+    offset: number,
+    timeoutSeconds: number,
+  ): Promise<Array<{ update_id: number; message?: unknown }>>
+  sendText(chatId: string, text: string): Promise<void>
+}
+
+/** 裸 fetch 直连 Telegram Bot API，零依赖。 */
+export function createTelegramApi(config: TelegramConfig): TelegramApi {
+  const base = `https://api.telegram.org/bot${config.botToken}`
+  return {
+    async getUpdates(offset, timeoutSeconds) {
+      const url =
+        `${base}/getUpdates?offset=${offset}&timeout=${timeoutSeconds}` +
+        `&limit=100&allowed_updates=%5B%22message%22%5D`
+      const res = await fetch(url)
+      if (!res.ok) throw new Error(`getUpdates ${res.status}`)
+      const data = (await res.json()) as {
+        ok: boolean
+        result?: Array<{ update_id: number; message?: unknown }>
+        error_code?: number
+        description?: string
+      }
+      if (!data.ok) throw new Error(`getUpdates failed: ${data.error_code ?? res.status}`)
+      return data.result ?? []
+    },
+    async sendText(chatId, text) {
+      const res = await fetch(`${base}/sendMessage`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ chat_id: chatId, text }),
+      })
+      if (!res.ok) throw new Error(`sendMessage ${res.status}`)
+      const data = (await res.json()) as {
+        ok: boolean
+        error_code?: number
+        description?: string
+      }
+      if (!data.ok) throw new Error(`sendMessage failed: ${data.error_code ?? res.status}`)
+    },
+  }
+}

package/src/daemon/telegram/env.ts

@@ -0,0 +1,14 @@
+import type { TelegramConfig } from './types.js'
+
+/** fail-closed：缺 botToken → null（daemon 不启用 Telegram）。 */
+export function parseTelegramEnv(): TelegramConfig | null {
+  const botToken = process.env.TELEGRAM_BOT_TOKEN
+  if (!botToken) return null
+  return {
+    botToken,
+    allowedChatIds: (process.env.TELEGRAM_ALLOWED_CHAT_IDS || '')
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean),
+  }
+}