alvin-bot 5.1.1 → 5.1.3

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to Alvin Bot are documented here.
 
+## [5.1.3] — 2026-05-13
+
+### Stability hardening — runtime-header fallbacks
+
+Small robustness pass on the runtime-header block that the bot uses to introduce itself. If the embedded version or install-path can't be resolved for any reason, those lines are now simply omitted instead of literally telling the model "I am version unknown". Node version and platform are still emitted so the bot can still describe its environment.
+
+### Cleaner release notes for global users
+
+Polished the release notes that surface inside the Telegram `/update` summary so non-technical users see a clear, English summary of what changed. No behaviour changes.
+
+## [5.1.2] — 2026-05-13
+
+### Bot now reports its real version after every update
+
+If you asked the bot "what version are you?", it used to look up the version that someone had written into the project documentation by hand — which went out of date the moment a new release shipped. The bot would happily say "I'm v4.19.2" even though the running process was already on something newer.
+
+Now the bot reads its version straight from the running code on disk, every single turn, regardless of provider (Claude SDK, Codex CLI, Groq, Gemini, OpenAI, Ollama, OpenRouter, NVIDIA NIM). It also includes its install path, Node version, and platform — so when something goes wrong you can ask the bot to introduce itself and get an honest answer.
+
+### What does this mean for you
+
+- Update via Telegram `/update` and the bot will pick up the new version on the next restart.
+- Ask the bot in chat "which version are you running?" — the answer is now grounded in reality, not in a docs file that might be stale.
+
 ## [5.1.1] — 2026-05-13
 
 ### Audit baseline cleanup — 16 → 6 vulnerabilities via safe fixes

package/dist/providers/claude-sdk-provider.js

@@ -14,6 +14,7 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import { findClaudeBinary } from "../find-claude-binary.js";
 import { buildAlvinMcpServer } from "../services/alvin-mcp-tools.js";
+import { buildRuntimeHeader } from "./runtime-header.js";
 const execFileAsync = promisify(execFile);
 /**
  * Detects the Claude CLI "Not logged in" error message. The CLI emits this
@@ -116,10 +117,13 @@ export class ClaudeSDKProvider {
                 prompt = `[CHECKPOINT] Du hast bereits ${sessionState.toolUseCount} Tool-Aufrufe und ${sessionState.messageCount} Nachrichten in dieser Session. Schreibe jetzt einen Checkpoint in deine Memory-Datei (docs/memory/YYYY-MM-DD.md) bevor du diese Anfrage bearbeitest.\n\n${prompt}`;
             }
         }
-        // Build system prompt
+        // Build system prompt. The runtime-header is injected ABOVE the CLAUDE.md
+        // contents so its values (BOT_VERSION, install path, runtime) outrank any
+        // stale "Version: x.y.z" line that may still live in CLAUDE.md.
+        const runtimeHeader = buildRuntimeHeader();
         const systemPrompt = options.systemPrompt
-            ? `${options.systemPrompt}\n\n${botClaudeMd}`
-            : botClaudeMd;
+            ? `${runtimeHeader}\n\n${options.systemPrompt}\n\n${botClaudeMd}`
+            : `${runtimeHeader}\n\n${botClaudeMd}`;
         // Build a real AbortController the SDK can call .abort() on.
         // The previous implementation cast a plain {signal} object to AbortController,
         // which broke SDK-internal cancellation and left orphan subprocesses.

package/dist/providers/codex-cli-provider.js

@@ -31,10 +31,17 @@ export class CodexCLIProvider {
         if (options.workingDir) {
             args.push("-C", options.workingDir);
         }
-        // Build the prompt with system context
+        // Build the prompt with system context. The runtime-header is injected
+        // first so its version/install-path overrides any stale value that may
+        // appear later in the system prompt or CLAUDE.md.
+        const { buildRuntimeHeader } = await import("./runtime-header.js");
+        const runtimeHeader = buildRuntimeHeader();
         let fullPrompt = options.prompt;
         if (options.systemPrompt) {
-            fullPrompt = `${options.systemPrompt}\n\n${fullPrompt}`;
+            fullPrompt = `${runtimeHeader}\n\n${options.systemPrompt}\n\n${fullPrompt}`;
+        }
+        else {
+            fullPrompt = `${runtimeHeader}\n\n${fullPrompt}`;
         }
         args.push(fullPrompt);
         try {

package/dist/providers/openai-compatible.js

@@ -9,6 +9,7 @@
  */
 import { AGENT_TOOLS, executeTool } from "./tool-executor.js";
 import { updateRateLimits } from "../services/usage-tracker.js";
+import * as runtimeHeader from "./runtime-header.js";
 // Max tool call rounds to prevent infinite loops
 const MAX_TOOL_ROUNDS = 10;
 // Providers known to support function calling
@@ -355,8 +356,16 @@ export class OpenAICompatibleProvider {
     }
     buildMessages(options) {
         const messages = [];
+        // Runtime-header (version, install path) prepended to the system prompt so
+        // its values outrank anything stale that may live later in CLAUDE.md.
+        // Synchronous-friendly: re-imported via a top-level import below.
+        const { buildRuntimeHeader } = runtimeHeader;
+        const header = buildRuntimeHeader();
         if (options.systemPrompt) {
-            messages.push({ role: "system", content: options.systemPrompt });
+            messages.push({ role: "system", content: `${header}\n\n${options.systemPrompt}` });
+        }
+        else {
+            messages.push({ role: "system", content: header });
         }
         if (options.history && options.history.length > 0) {
             for (const msg of options.history) {

package/dist/providers/runtime-header.js

@@ -0,0 +1,45 @@
+/**
+ * Runtime-Header — a tiny block prepended to every provider's system prompt.
+ *
+ * Why this exists: previously the bot answered "what version are you?" by
+ * reading whatever happened to be in the project's CLAUDE.md — which goes
+ * stale the moment a release ships. Now the truth lives next to the running
+ * code (`src/version.ts` → `BOT_VERSION`) and is injected into the system
+ * prompt every turn. The CLAUDE.md value is overridden by what's already
+ * earlier in the prompt.
+ *
+ * Keep this header small — it's burned into every conversation turn for
+ * every provider.
+ */
+import { BOT_VERSION } from "../version.js";
+import { fileURLToPath } from "url";
+import { dirname, resolve } from "path";
+function getInstallPath() {
+    try {
+        return resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+    }
+    catch {
+        return "(unknown)";
+    }
+}
+export function buildRuntimeHeader() {
+    const installPath = getInstallPath();
+    const lines = ["<bot_runtime>"];
+    // Only emit `version:` when we actually know it. Emitting "unknown" is worse
+    // than emitting nothing — the model will dutifully report "I am version
+    // unknown" instead of falling back to a reasonable hedge.
+    if (BOT_VERSION && BOT_VERSION !== "unknown") {
+        lines.push(`version: ${BOT_VERSION}`);
+    }
+    if (installPath && installPath !== "(unknown)") {
+        lines.push(`install_path: ${installPath}`);
+    }
+    if (process.version) {
+        lines.push(`node: ${process.version}`);
+    }
+    if (process.platform) {
+        lines.push(`platform: ${process.platform}`);
+    }
+    lines.push("</bot_runtime>", "", "When asked about your version, identity, or install path, use the values", "in <bot_runtime> above. Ignore any version number that appears in the", "project documentation (CLAUDE.md, README) — that file may be stale.");
+    return lines.join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alvin-bot",
-  "version": "5.1.1",
+  "version": "5.1.3",
   "description": "Alvin Bot — Your personal AI agent on Telegram, WhatsApp, Discord, Signal, and Web.",
   "type": "module",
   "main": "dist/index.js",