@spinabot/brigade 1.1.0 → 1.2.1

package/dist/agents/channels/telegram/allowed-updates.js

@@ -0,0 +1,52 @@
+/**
+ * Telegram `allowed_updates` resolver.
+ *
+ * Telegram's `getUpdates` / `setWebhook` take an `allowed_updates` allow-list:
+ * only the named update kinds are delivered. Brigade subscribes the MINIMAL set
+ * its central pipeline actually consumes — keeping the firehose narrow means a
+ * chatty group never floods the poller with update kinds Brigade ignores
+ * (business messages, channel posts, inline queries, shipping/checkout, …, all
+ * of which the reference upstream subscribes but Brigade has no consumer for).
+ *
+ * The base set is always:
+ *   - `message`        — the inbound text/media path (the core surface).
+ *   - `callback_query` — inline-button presses (interactive approvals). Without
+ *     this in the list, a button tap is silently never delivered and the
+ *     approval prompt hangs for its full timeout. Subscribed unconditionally so
+ *     a button rendered by `sendApprovalPrompt` is always answerable.
+ *
+ * Conditionally added:
+ *   - `message_reaction` — only when the channel opts into reaction inbound
+ *     handling (`opts.reactions`). Brigade does not route inbound reactions to a
+ *     turn today, so it is OFF by default; the flag exists so a future reaction-
+ *     trigger feature can switch it on without touching the poller wiring.
+ *   - `edited_message`   — only when `opts.editedMessages` (off by default;
+ *     Brigade treats an edit as a no-op rather than re-running the turn).
+ *
+ * Output is always a DEDUPED, STABLE-ORDER array of plain lowercase ASCII update
+ * names (no NUL / control bytes — these are fixed string literals).
+ */
+/**
+ * Resolve the `allowed_updates` list Brigade's Telegram poller/webhook should
+ * request. `message` + `callback_query` are always present; reactions / edited
+ * messages are added only when explicitly enabled. Deduped + stable order.
+ */
+export function resolveTelegramAllowedUpdates(opts = {}) {
+    const out = ["message", "callback_query"];
+    if (opts.reactions)
+        out.push("message_reaction");
+    if (opts.editedMessages)
+        out.push("edited_message");
+    // De-dupe defensively (the base list is already unique, but a future caller
+    // could pass overlapping flags) while preserving first-seen order.
+    const seen = new Set();
+    const deduped = [];
+    for (const u of out) {
+        if (seen.has(u))
+            continue;
+        seen.add(u);
+        deduped.push(u);
+    }
+    return deduped;
+}
+//# sourceMappingURL=allowed-updates.js.map

package/dist/agents/channels/telegram/allowed-updates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-updates.js","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/allowed-updates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAiBH;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC5C,OAA6C,EAAE;IAE/C,MAAM,GAAG,GAA4B,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,cAAc;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/agents/channels/telegram/approval-authorize.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Telegram inline-approval authorization.
+ *
+ * When an approval prompt is rendered as inline buttons, ANY member who can see
+ * the message could press a button. Brigade's central inbound pipeline already
+ * runs the access-control gate before a `callback_query` reaches the
+ * approval-callback path, so only an admitted (allow-listed / owner) peer gets
+ * here at all — but a SHARED group is the edge case: in a group the bot is in,
+ * an admitted member's button press should still be allowed only when that
+ * presser is an approved approver, not merely present in the room.
+ *
+ * This predicate is the channel's `approvalCapability.authorizeApprover`. It is
+ * invoked CENTRALLY by `tryConsumeChannelApprovalCallback` with the presser's
+ * `senderId`; returning `{ authorized: false, reason }` refuses the press
+ * without consuming the operator's pending approval (so the real operator can
+ * still answer). Policy:
+ *
+ *   - When the channel has an explicit allow-from list configured (the approved
+ *     senders), only those ids may approve.
+ *   - When NO allow-from list is configured, defer to the access gate that
+ *     already admitted the inbound and authorize the press (matches the text-
+ *     reply path, which has no extra approver gate).
+ *
+ * Pure + deterministic over its `cfg` + `senderId` inputs — no I/O.
+ */
+import type { BrigadeConfig } from "../../../config/io.js";
+/**
+ * Resolve whether `senderId` is allowed to answer a Telegram inline approval.
+ * Returns `{ authorized: true }` when no explicit allow-from gate applies (the
+ * central access gate already admitted the inbound), or when the presser is on
+ * the configured allow-from list. Otherwise refuses with a reason.
+ */
+export declare function resolveTelegramApprover(args: {
+    cfg: BrigadeConfig;
+    senderId?: string;
+    accountId?: string;
+}): {
+    authorized: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=approval-authorize.d.ts.map

package/dist/agents/channels/telegram/approval-authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-authorize.d.ts","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/approval-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA0B3D;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC7C,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAU3C"}

package/dist/agents/channels/telegram/approval-authorize.js

@@ -0,0 +1,69 @@
+/**
+ * Telegram inline-approval authorization.
+ *
+ * When an approval prompt is rendered as inline buttons, ANY member who can see
+ * the message could press a button. Brigade's central inbound pipeline already
+ * runs the access-control gate before a `callback_query` reaches the
+ * approval-callback path, so only an admitted (allow-listed / owner) peer gets
+ * here at all — but a SHARED group is the edge case: in a group the bot is in,
+ * an admitted member's button press should still be allowed only when that
+ * presser is an approved approver, not merely present in the room.
+ *
+ * This predicate is the channel's `approvalCapability.authorizeApprover`. It is
+ * invoked CENTRALLY by `tryConsumeChannelApprovalCallback` with the presser's
+ * `senderId`; returning `{ authorized: false, reason }` refuses the press
+ * without consuming the operator's pending approval (so the real operator can
+ * still answer). Policy:
+ *
+ *   - When the channel has an explicit allow-from list configured (the approved
+ *     senders), only those ids may approve.
+ *   - When NO allow-from list is configured, defer to the access gate that
+ *     already admitted the inbound and authorize the press (matches the text-
+ *     reply path, which has no extra approver gate).
+ *
+ * Pure + deterministic over its `cfg` + `senderId` inputs — no I/O.
+ */
+/** Read the channel's configured allow-from sender ids (string-normalized). */
+function configuredAllowFrom(cfg, accountId) {
+    const channels = cfg.channels;
+    const slot = channels?.telegram;
+    if (!slot)
+        return [];
+    const ids = [];
+    const push = (list) => {
+        for (const v of list ?? []) {
+            const s = String(v).trim();
+            if (s)
+                ids.push(s);
+        }
+    };
+    push(slot.allowFrom);
+    // Per-account allow-from (multi-account shape) when an accountId is supplied.
+    if (accountId && Array.isArray(slot.accounts)) {
+        for (const entry of slot.accounts) {
+            if (entry && typeof entry.id === "string" && entry.id.trim() === accountId.trim())
+                push(entry.allowFrom);
+        }
+    }
+    return ids;
+}
+/**
+ * Resolve whether `senderId` is allowed to answer a Telegram inline approval.
+ * Returns `{ authorized: true }` when no explicit allow-from gate applies (the
+ * central access gate already admitted the inbound), or when the presser is on
+ * the configured allow-from list. Otherwise refuses with a reason.
+ */
+export function resolveTelegramApprover(args) {
+    const allow = configuredAllowFrom(args.cfg, args.accountId);
+    // No explicit allow list → defer to the access gate that already ran.
+    if (allow.length === 0)
+        return { authorized: true };
+    const sender = (args.senderId ?? "").trim();
+    if (sender && allow.includes(sender))
+        return { authorized: true };
+    return {
+        authorized: false,
+        reason: "Only an approved sender can answer that approval.",
+    };
+}
+//# sourceMappingURL=approval-authorize.js.map

package/dist/agents/channels/telegram/approval-authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-authorize.js","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/approval-authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,+EAA+E;AAC/E,SAAS,mBAAmB,CAAC,GAAkB,EAAE,SAAkB;IAClE,MAAM,QAAQ,GAAI,GAA8C,CAAC,QAAQ,CAAC;IAC1E,MAAM,IAAI,GAAG,QAAQ,EAAE,QAEX,CAAC;IACb,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,IAA6B,EAAE,EAAE;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACF,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrB,8EAA8E;IAC9E,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1G,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACA,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO;QACN,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,mDAAmD;KAC3D,CAAC;AACH,CAAC"}

package/dist/agents/channels/telegram/approval-native.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Telegram inline-keyboard rendering for native approval prompts.
+ *
+ * When a channel-routed turn raises an exec/plugin approval AND the Telegram
+ * adapter has opted into `approvalCapability.sendApprovalPrompt`, the central
+ * approval-router asks this channel to render the question as native inline
+ * BUTTONS instead of the default "reply yes/no" text card. The button payloads
+ * are produced by the CENTRAL codec (`buildApprovalCallbackButtons`) so the
+ * press comes back as an `InboundMessage.callbackQuery` the central
+ * `tryConsumeChannelApprovalCallback` decodes + resolves — this file only maps
+ * the codec's `{ label, data }` specs onto Telegram's `InlineKeyboardMarkup`
+ * shape and assembles the prompt text.
+ *
+ * Layout mirrors the reference Telegram extension: buttons are laid out in rows
+ * of at most {@link TELEGRAM_INTERACTIVE_ROW_SIZE} (3). The standard approval has
+ * three buttons (Allow once / Allow always / Deny) so they sit on one row.
+ *
+ * SAFETY: every `callback_data` value here is the codec's output — versioned,
+ * base64url + printable-ASCII, already proven `<= 64` UTF-8 bytes by
+ * `encodeApprovalCallback`. This module never mints its own payloads, so no NUL
+ * / control byte can appear. `sanitizeTelegramCallbackData` is a defensive
+ * belt-and-braces clamp for any externally-supplied value.
+ */
+/** Telegram's `callback_data` hard cap (UTF-8 bytes). Matches the codec ceiling. */
+export declare const TELEGRAM_CALLBACK_DATA_MAX_BYTES = 64;
+/** Max inline buttons per keyboard row (reference parity). */
+export declare const TELEGRAM_INTERACTIVE_ROW_SIZE = 3;
+/** One Telegram inline button (the subset Brigade emits). */
+export interface TelegramInlineButton {
+    text: string;
+    callback_data: string;
+}
+/** Telegram `InlineKeyboardMarkup` — rows of buttons. */
+export interface TelegramInlineKeyboardMarkup {
+    inline_keyboard: TelegramInlineButton[][];
+}
+/**
+ * Clamp a callback-data string to Telegram's 64-byte budget and strip any
+ * control bytes. The codec already guarantees both, so this is purely defensive
+ * for a value that didn't come from the codec. Truncates on a UTF-8 boundary.
+ */
+export declare function sanitizeTelegramCallbackData(value: string): string;
+/**
+ * Build the inline keyboard for an approval prompt from the central codec.
+ * Returns `null` when fewer than two byte-safe buttons could be minted (a
+ * pathologically long approval id) — the caller then falls back to the text
+ * prompt rather than ship a half-rendered keyboard.
+ *
+ * `allowAlways: false` drops the "Allow always" button (approvals where
+ * persisting an allowlist entry doesn't apply).
+ */
+export declare function buildTelegramApprovalKeyboard(args: {
+    approvalId: string;
+    allowAlways?: boolean;
+}): TelegramInlineKeyboardMarkup | null;
+/**
+ * Compose the operator-facing approval question text rendered ABOVE the inline
+ * keyboard. Kept short + control-char-scrubbed; the buttons carry the action,
+ * so the text only needs the command preview + a one-line ask. The 🦁 mark is
+ * the Brigade brand-stamp so the operator recognises this as a Brigade prompt.
+ */
+export declare function buildTelegramApprovalText(args: {
+    command: string;
+    approvalKind: "exec" | "plugin";
+    toolName?: string;
+    agentId?: string;
+}): string;
+//# sourceMappingURL=approval-native.d.ts.map

package/dist/agents/channels/telegram/approval-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-native.d.ts","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/approval-native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,oFAAoF;AACpF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,8DAA8D;AAC9D,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAK/C,6DAA6D;AAC7D,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACtB;AAED,yDAAyD;AACzD,MAAM,WAAW,4BAA4B;IAC5C,eAAe,EAAE,oBAAoB,EAAE,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlE;AAWD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,4BAA4B,GAAG,IAAI,CAWtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,GAAG,QAAQ,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAWT"}

package/dist/agents/channels/telegram/approval-native.js

@@ -0,0 +1,94 @@
+/**
+ * Telegram inline-keyboard rendering for native approval prompts.
+ *
+ * When a channel-routed turn raises an exec/plugin approval AND the Telegram
+ * adapter has opted into `approvalCapability.sendApprovalPrompt`, the central
+ * approval-router asks this channel to render the question as native inline
+ * BUTTONS instead of the default "reply yes/no" text card. The button payloads
+ * are produced by the CENTRAL codec (`buildApprovalCallbackButtons`) so the
+ * press comes back as an `InboundMessage.callbackQuery` the central
+ * `tryConsumeChannelApprovalCallback` decodes + resolves — this file only maps
+ * the codec's `{ label, data }` specs onto Telegram's `InlineKeyboardMarkup`
+ * shape and assembles the prompt text.
+ *
+ * Layout mirrors the reference Telegram extension: buttons are laid out in rows
+ * of at most {@link TELEGRAM_INTERACTIVE_ROW_SIZE} (3). The standard approval has
+ * three buttons (Allow once / Allow always / Deny) so they sit on one row.
+ *
+ * SAFETY: every `callback_data` value here is the codec's output — versioned,
+ * base64url + printable-ASCII, already proven `<= 64` UTF-8 bytes by
+ * `encodeApprovalCallback`. This module never mints its own payloads, so no NUL
+ * / control byte can appear. `sanitizeTelegramCallbackData` is a defensive
+ * belt-and-braces clamp for any externally-supplied value.
+ */
+import { buildApprovalCallbackButtons } from "../sdk.js";
+/** Telegram's `callback_data` hard cap (UTF-8 bytes). Matches the codec ceiling. */
+export const TELEGRAM_CALLBACK_DATA_MAX_BYTES = 64;
+/** Max inline buttons per keyboard row (reference parity). */
+export const TELEGRAM_INTERACTIVE_ROW_SIZE = 3;
+/** C0/C1 control-character class (incl. NUL) as printable hex escapes — never a raw control byte in source. */
+const CONTROL_CHARS_RE = /[\x00-\x1f\x7f-\x9f]/g;
+/**
+ * Clamp a callback-data string to Telegram's 64-byte budget and strip any
+ * control bytes. The codec already guarantees both, so this is purely defensive
+ * for a value that didn't come from the codec. Truncates on a UTF-8 boundary.
+ */
+export function sanitizeTelegramCallbackData(value) {
+    // Drop C0/C1 control chars (incl. NUL) — callback_data must be printable.
+    // oxlint-disable-next-line no-control-regex
+    const cleaned = value.replace(CONTROL_CHARS_RE, "");
+    if (Buffer.byteLength(cleaned, "utf8") <= TELEGRAM_CALLBACK_DATA_MAX_BYTES)
+        return cleaned;
+    // Truncate to the byte budget without splitting a multi-byte sequence.
+    const buf = Buffer.from(cleaned, "utf8").subarray(0, TELEGRAM_CALLBACK_DATA_MAX_BYTES);
+    return new TextDecoder("utf-8", { fatal: false }).decode(buf).replace(/�+$/g, "");
+}
+/** Chunk a flat button list into rows of at most `rowSize`. */
+function chunkIntoRows(buttons, rowSize) {
+    const rows = [];
+    for (let i = 0; i < buttons.length; i += rowSize) {
+        rows.push(buttons.slice(i, i + rowSize));
+    }
+    return rows;
+}
+/**
+ * Build the inline keyboard for an approval prompt from the central codec.
+ * Returns `null` when fewer than two byte-safe buttons could be minted (a
+ * pathologically long approval id) — the caller then falls back to the text
+ * prompt rather than ship a half-rendered keyboard.
+ *
+ * `allowAlways: false` drops the "Allow always" button (approvals where
+ * persisting an allowlist entry doesn't apply).
+ */
+export function buildTelegramApprovalKeyboard(args) {
+    const specs = buildApprovalCallbackButtons({
+        approvalId: args.approvalId,
+        ...(args.allowAlways === false ? { allowAlways: false } : {}),
+    });
+    if (specs.length < 2)
+        return null; // not enough buttons → caller uses text prompt
+    const buttons = specs.map((s) => ({
+        text: s.label,
+        callback_data: sanitizeTelegramCallbackData(s.data),
+    }));
+    return { inline_keyboard: chunkIntoRows(buttons, TELEGRAM_INTERACTIVE_ROW_SIZE) };
+}
+/**
+ * Compose the operator-facing approval question text rendered ABOVE the inline
+ * keyboard. Kept short + control-char-scrubbed; the buttons carry the action,
+ * so the text only needs the command preview + a one-line ask. The 🦁 mark is
+ * the Brigade brand-stamp so the operator recognises this as a Brigade prompt.
+ */
+export function buildTelegramApprovalText(args) {
+    const flat = args.command
+        .replace(/[\r\n]+/g, " ")
+        // oxlint-disable-next-line no-control-regex
+        .replace(CONTROL_CHARS_RE, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    const preview = flat.length <= 180 ? flat : `${flat.slice(0, 177)}…`;
+    const what = args.approvalKind === "plugin" ? "run a plugin action" : "run a shell command";
+    const lines = [`🦁 Brigade wants to ${what}:`, `\`${preview}\``, "", "Choose below — times out in 5 minutes."];
+    return lines.join("\n");
+}
+//# sourceMappingURL=approval-native.js.map

package/dist/agents/channels/telegram/approval-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-native.js","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/approval-native.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AAEzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,+GAA+G;AAC/G,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAajD;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAa;IACzD,0EAA0E;IAC1E,4CAA4C;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,gCAAgC;QAAE,OAAO,OAAO,CAAC;IAC3F,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACvF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa,CAAC,OAA+B,EAAE,OAAe;IACtE,MAAM,IAAI,GAA6B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAG7C;IACA,MAAM,KAAK,GAAG,4BAA4B,CAAC;QAC1C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;IAClF,MAAM,OAAO,GAA2B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC,CAAC,KAAK;QACb,aAAa,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;KACnD,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,6BAA6B,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACA,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO;SACvB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;QACzB,4CAA4C;SAC3C,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,uBAAuB,IAAI,GAAG,EAAE,KAAK,OAAO,IAAI,EAAE,EAAE,EAAE,wCAAwC,CAAC,CAAC;IAC/G,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/agents/channels/telegram/command-menu.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Telegram native command menu — map Brigade's central channel commands onto
+ * the `setMyCommands` shape that populates Telegram's `/` quick-menu.
+ *
+ * Brigade owns the command set centrally (`buildBundledCommands` → `/help`,
+ * `/status`, `/allowlist`, `/agent`, `/agents`, `/whoami`, `/org`, plus any
+ * module-registered channel commands). On connect the Telegram channel mirrors
+ * that set into the bot's command menu so the operator sees the same commands
+ * surfaced as native `/` suggestions in the Telegram client.
+ *
+ * Telegram's constraints (enforced here so a malformed command never makes
+ * `setMyCommands` reject the WHOLE list):
+ *   - command name: 1–32 chars, lowercase `[a-z0-9_]` only (leading `/` stripped).
+ *   - description: 1–256 chars (clamped).
+ *   - at most 100 commands.
+ *
+ * Pure / deterministic — no I/O. Output is always printable ASCII command names
+ * (the regex strips everything else), so no NUL / control byte can appear.
+ */
+import type { ChannelCommand } from "../sdk.js";
+/** Telegram bot-command entry. */
+export interface TelegramBotCommand {
+    command: string;
+    description: string;
+}
+/** Normalize a command word to Telegram's `[a-z0-9_]{1,32}` shape, or null if unusable. */
+export declare function normalizeTelegramCommandName(raw: string): string | null;
+/**
+ * Build the Telegram command menu from Brigade's central channel commands.
+ * De-dupes by normalized name (first wins), drops unusable names, and caps at
+ * Telegram's 100-command ceiling. Returns `[]` when nothing maps (caller skips
+ * the `setMyCommands` call entirely).
+ */
+export declare function buildTelegramCommandMenu(commands: ReadonlyArray<ChannelCommand>): TelegramBotCommand[];
+//# sourceMappingURL=command-menu.d.ts.map

package/dist/agents/channels/telegram/command-menu.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-menu.d.ts","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/command-menu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,kCAAkC;AAClC,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAQD,2FAA2F;AAC3F,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvE;AAQD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,kBAAkB,EAAE,CAWtG"}

package/dist/agents/channels/telegram/command-menu.js

@@ -0,0 +1,59 @@
+/**
+ * Telegram native command menu — map Brigade's central channel commands onto
+ * the `setMyCommands` shape that populates Telegram's `/` quick-menu.
+ *
+ * Brigade owns the command set centrally (`buildBundledCommands` → `/help`,
+ * `/status`, `/allowlist`, `/agent`, `/agents`, `/whoami`, `/org`, plus any
+ * module-registered channel commands). On connect the Telegram channel mirrors
+ * that set into the bot's command menu so the operator sees the same commands
+ * surfaced as native `/` suggestions in the Telegram client.
+ *
+ * Telegram's constraints (enforced here so a malformed command never makes
+ * `setMyCommands` reject the WHOLE list):
+ *   - command name: 1–32 chars, lowercase `[a-z0-9_]` only (leading `/` stripped).
+ *   - description: 1–256 chars (clamped).
+ *   - at most 100 commands.
+ *
+ * Pure / deterministic — no I/O. Output is always printable ASCII command names
+ * (the regex strips everything else), so no NUL / control byte can appear.
+ */
+/** Telegram limits. */
+const MAX_COMMANDS = 100;
+const MAX_NAME_LEN = 32;
+const MAX_DESC_LEN = 256;
+const COMMAND_NAME_RE = /^[a-z0-9_]{1,32}$/;
+/** Normalize a command word to Telegram's `[a-z0-9_]{1,32}` shape, or null if unusable. */
+export function normalizeTelegramCommandName(raw) {
+    const stripped = raw.trim().replace(/^\/+/, "").toLowerCase();
+    // Replace any disallowed char with nothing, then clamp length.
+    const cleaned = stripped.replace(/[^a-z0-9_]/g, "").slice(0, MAX_NAME_LEN);
+    if (!cleaned || !COMMAND_NAME_RE.test(cleaned))
+        return null;
+    return cleaned;
+}
+/** Clamp + flatten a description to a single printable line within Telegram's cap. */
+function normalizeDescription(desc, fallback) {
+    const raw = (desc ?? "").replace(/\s+/g, " ").trim() || fallback;
+    return raw.length > MAX_DESC_LEN ? `${raw.slice(0, MAX_DESC_LEN - 1)}…` : raw;
+}
+/**
+ * Build the Telegram command menu from Brigade's central channel commands.
+ * De-dupes by normalized name (first wins), drops unusable names, and caps at
+ * Telegram's 100-command ceiling. Returns `[]` when nothing maps (caller skips
+ * the `setMyCommands` call entirely).
+ */
+export function buildTelegramCommandMenu(commands) {
+    const out = [];
+    const seen = new Set();
+    for (const cmd of commands) {
+        if (out.length >= MAX_COMMANDS)
+            break;
+        const name = normalizeTelegramCommandName(cmd.name);
+        if (!name || seen.has(name))
+            continue;
+        seen.add(name);
+        out.push({ command: name, description: normalizeDescription(cmd.description, name) });
+    }
+    return out;
+}
+//# sourceMappingURL=command-menu.js.map

package/dist/agents/channels/telegram/command-menu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-menu.js","sourceRoot":"","sources":["../../../../src/agents/channels/telegram/command-menu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAUH,uBAAuB;AACvB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C,2FAA2F;AAC3F,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,+DAA+D;IAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,SAAS,oBAAoB,CAAC,IAAwB,EAAE,QAAgB;IACvE,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC;IACjE,OAAO,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAuC;IAC/E,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,IAAI,YAAY;YAAE,MAAM;QACtC,MAAM,IAAI,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}