appback-remoteagent 0.13.4 → 0.13.6

package/dist/bot.js

@@ -9,6 +9,7 @@ import { config } from "./config.js";
 import { ProviderSetupService } from "./services/provider-setup-service.js";
 import { RemoteShellService } from "./services/remote-shell-service.js";
 import { AgentMemoryService } from "./services/agent-memory-service.js";
+import { deleteTelegramCommandMenu, setTelegramCommandMenu } from "./telegram-command-menu.js";
 const execFileAsync = promisify(execFile);
 const HELP_TEXT = [
     "Commands:",
@@ -24,7 +25,7 @@ const HELP_TEXT = [
     "/stop",
     "/sandbox codex <read-only|workspace-write|danger-full-access>",
     "/status",
-    "/option [retry <count>|timeout <seconds>|intent <count>]",
+    "/option [retry <count>|timeout <seconds>|intent <count>|command-menu <on|off|refresh>]",
     "/state [clear|note <text>]",
     "/artifacts list|cleanup <days>",
     "/secret set|list|remove",
@@ -484,8 +485,8 @@ ${bridge.formatStatus(mapping)}`);
             await reply(ctx, formatRuntimeOptions());
             return;
         }
-        if (option !== "retry" && option !== "timeout" && option !== "intent") {
-            await reply(ctx, "Usage: `/option retry <count>`, `/option timeout <seconds>`, or `/option intent <count>`\n\n`retry` controls automatic continuation turns. `timeout` controls one provider execution limit. `intent` controls retries for untagged intent-only provider replies.", {
+        if (option !== "retry" && option !== "timeout" && option !== "intent" && option !== "command-menu") {
+            await reply(ctx, "Usage: `/option retry <count>`, `/option timeout <seconds>`, `/option intent <count>`, or `/option command-menu <on|off|refresh>`\n\n`retry` controls automatic continuation turns. `timeout` controls one provider execution limit. `intent` controls retries for untagged intent-only provider replies. `command-menu` controls Telegram slash-command autocomplete for all configured bots.", {
                 parse_mode: "Markdown",
             });
             return;
@@ -495,12 +496,39 @@ ${bridge.formatStatus(mapping)}`);
                 ? `Current automatic continuation retry limit: ${formatRetryLimit(config.telegramAutoProgressMaxTurns)}\n\nUsage: \`/option retry <count>\``
                 : option === "intent"
                     ? `Current untagged intent retry limit: ${formatRetryLimit(config.telegramUntaggedIntentRetries)}\n\nUsage: \`/option intent <count>\``
-                    : `Current provider execution timeout: ${formatTimeoutSeconds(config.commandTimeoutMs)}\n\nUsage: \`/option timeout <seconds>\``;
+                    : option === "command-menu"
+                        ? `Current Telegram command menu: ${config.telegramCommandMenuEnabled ? "on" : "off"}\n\nUsage: \`/option command-menu on\`, \`/option command-menu off\`, or \`/option command-menu refresh\``
+                        : `Current provider execution timeout: ${formatTimeoutSeconds(config.commandTimeoutMs)}\n\nUsage: \`/option timeout <seconds>\``;
             await reply(ctx, current, {
                 parse_mode: "Markdown",
             });
             return;
         }
+        if (option === "command-menu") {
+            const action = value.toLowerCase();
+            if (!["on", "off", "refresh"].includes(action)) {
+                await reply(ctx, "Invalid command-menu option. Use `/option command-menu on`, `/option command-menu off`, or `/option command-menu refresh`.", {
+                    parse_mode: "Markdown",
+                });
+                return;
+            }
+            const enabled = action === "refresh" ? config.telegramCommandMenuEnabled : action === "on";
+            const result = await applyTelegramCommandMenuOption(enabled);
+            if (action !== "refresh") {
+                config.telegramCommandMenuEnabled = enabled;
+                await upsertInstalledEnvValue("TELEGRAM_COMMAND_MENU_ENABLED", String(enabled));
+            }
+            await bridge.logSystem(botId, chatId, `Runtime option TELEGRAM_COMMAND_MENU_ENABLED ${action === "refresh" ? "refreshed" : `set to ${enabled}`}. ${result.summary}`);
+            await reply(ctx, [
+                action === "refresh"
+                    ? `Refreshed Telegram command menu for configured bots.`
+                    : `Set Telegram command menu to ${enabled ? "on" : "off"}.`,
+                "",
+                result.summary,
+                action === "refresh" ? "" : `Saved: TELEGRAM_COMMAND_MENU_ENABLED=${enabled}`,
+            ].filter(Boolean).join("\n"));
+            return;
+        }
         const parsed = Number.parseInt(value, 10);
         if (!Number.isInteger(parsed) || parsed < 0 || String(parsed) !== value.trim()) {
             await reply(ctx, option === "retry"
@@ -1571,6 +1599,10 @@ function formatSecretHelp() {
         "```text",
         "node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>",
         "```",
+        "If an agent obtains a new secret value such as an OAuth refresh token, it can delegate storage without printing the value:",
+        "```text",
+        "printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>",
+        "```",
     ].join("\n");
 }
 function formatRuntimeOptions() {
@@ -1579,14 +1611,17 @@ function formatRuntimeOptions() {
         `- retry: ${formatRetryLimit(config.telegramAutoProgressMaxTurns)} (TELEGRAM_AUTO_PROGRESS_MAX_TURNS)`,
         `- timeout: ${formatTimeoutSeconds(config.commandTimeoutMs)} (COMMAND_TIMEOUT_MS)`,
         `- intent: ${formatRetryLimit(config.telegramUntaggedIntentRetries)} (TELEGRAM_UNTAGGED_INTENT_RETRIES)`,
+        `- command-menu: ${config.telegramCommandMenuEnabled ? "on" : "off"} (TELEGRAM_COMMAND_MENU_ENABLED)`,
         "",
         "Usage:",
         "/option retry <count>",
         "/option timeout <seconds>",
         "/option intent <count>",
+        "/option command-menu <on|off|refresh>",
         "",
         "`retry 0` disables the automatic continuation limit.",
         "`intent 0` disables untagged intent-only response retries.",
+        "`command-menu refresh` reapplies Telegram slash-command autocomplete without changing the saved option.",
     ].join("\n");
 }
 function formatRetryLimit(value) {
@@ -1616,6 +1651,34 @@ async function upsertInstalledEnvValue(key, value) {
     }
     await fs.writeFile(envPath, `${next.join("\n").replace(/\n+$/u, "")}\n`, "utf8");
 }
+async function applyTelegramCommandMenuOption(enabled) {
+    let applied = 0;
+    const failures = [];
+    for (const token of config.telegramBotTokens) {
+        const botLabel = await resolveTelegramBotLabel(token).catch(() => "unknown-bot");
+        try {
+            if (enabled) {
+                await setTelegramCommandMenu(token);
+            }
+            else {
+                await deleteTelegramCommandMenu(token);
+            }
+            applied += 1;
+        }
+        catch (error) {
+            failures.push(`${botLabel}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    const parts = [`applied=${applied}/${config.telegramBotTokens.length}`];
+    if (failures.length > 0) {
+        parts.push(`failed=${failures.length}`, ...failures.map((failure) => `- ${failure}`));
+    }
+    return { summary: parts.join("\n") };
+}
+async function resolveTelegramBotLabel(token) {
+    const payload = await callTelegramApi(token, "getMe", {});
+    return payload.username ? `@${payload.username}` : String(payload.id);
+}
 function chunkMessage(text, size) {
     if (text.length <= size) {
         return [text];

package/dist/config.js

@@ -130,7 +130,7 @@ const telegramBotUsernames = readTelegramBotUsernames();
 export const config = {
     telegramBotTokens,
     telegramBotUsernames,
-    telegramCommandMenuEnabled: readBoolean("TELEGRAM_COMMAND_MENU_ENABLED", false),
+    telegramCommandMenuEnabled: readBoolean("TELEGRAM_COMMAND_MENU_ENABLED", true),
     telegramPollingBackoffMinMs: readTimeout("TELEGRAM_POLLING_BACKOFF_MIN_MS", 60_000),
     telegramPollingBackoffMaxMs: readTimeout("TELEGRAM_POLLING_BACKOFF_MAX_MS", 900_000),
     telegramPollingMaxConcurrency: readTimeout("TELEGRAM_POLLING_MAX_CONCURRENCY", 3),

package/dist/index.js

@@ -15,6 +15,7 @@ import { BotManagementService } from "./services/bot-management-service.js";
 import { LocalUiService } from "./services/local-ui-service.js";
 import { AgentMemoryService } from "./services/agent-memory-service.js";
 import { terminateAllSpawnedExecutions } from "./adapters/windows-shell.js";
+import { setTelegramCommandMenu } from "./telegram-command-menu.js";
 const execFileAsync = promisify(execFile);
 const TELEGRAM_GET_UPDATES_HTTP_TIMEOUT_SECONDS = 30;
 const TELEGRAM_GET_UPDATES_CURL_TIMEOUT_SECONDS = 60;
@@ -107,23 +108,6 @@ function startArtifactCleanupSchedule(memoryService) {
     interval.unref();
 }
 async function configureTelegramCommandMenu(bot) {
-    const commands = [
-        { command: "start", description: "Start a new Codex or Claude session" },
-        { command: "list", description: "List sessions" },
-        { command: "switch", description: "Switch to a session" },
-        { command: "status", description: "Show current session status" },
-        { command: "state", description: "Show or edit session state notes" },
-        { command: "option", description: "Show or change runtime options" },
-        { command: "model", description: "Show or change provider model" },
-        { command: "stop", description: "Stop active work and clear queued messages" },
-        { command: "batch", description: "Collect and send a multi-message batch" },
-        { command: "bots", description: "List configured Telegram bots" },
-        { command: "bot", description: "Manage Telegram bots" },
-        { command: "install", description: "Install or update Codex or Claude" },
-        { command: "login", description: "Run provider login flow" },
-        { command: "reset", description: "Clear this chat binding" },
-        { command: "help", description: "Show command help" },
-    ];
     const token = bot.token;
     if (!token) {
         throw new Error("Telegram bot token is unavailable for command menu registration.");
@@ -131,7 +115,7 @@ async function configureTelegramCommandMenu(bot) {
     let lastError;
     for (let attempt = 1; attempt <= 3; attempt += 1) {
         try {
-            await setTelegramCommandsViaCurl(token, commands);
+            await setTelegramCommandMenu(token);
             return;
         }
         catch (error) {
@@ -143,51 +127,6 @@ async function configureTelegramCommandMenu(bot) {
     }
     throw lastError;
 }
-async function setTelegramCommandsViaCurl(token, commands) {
-    const url = `https://api.telegram.org/bot${token}/setMyCommands`;
-    const payload = JSON.stringify({ commands });
-    let stdout;
-    let stderr;
-    try {
-        const result = await execFileAsync("curl", [
-            "-sS",
-            "-4",
-            "--max-time",
-            "20",
-            "-H",
-            "Content-Type: application/json",
-            "-d",
-            payload,
-            url,
-        ]);
-        stdout = result.stdout;
-        stderr = result.stderr;
-    }
-    catch (error) {
-        throw new Error(`Telegram setMyCommands curl failed: ${formatCurlError(error)}`);
-    }
-    if (stderr?.trim()) {
-        console.error(`curl stderr for setMyCommands: ${stderr.trim()}`);
-    }
-    const parsed = JSON.parse(stdout);
-    if (!parsed.ok) {
-        throw new Error(parsed.description || "Telegram setMyCommands failed.");
-    }
-}
-function formatCurlError(error) {
-    if (!(error instanceof Error)) {
-        return String(error);
-    }
-    const code = typeof error === "object" && error !== null && "code" in error
-        ? String(error.code ?? "")
-        : "";
-    const stderr = typeof error === "object" && error !== null && "stderr" in error
-        ? String(error.stderr ?? "").trim()
-        : "";
-    return [code ? `code=${code}` : undefined, stderr || error.message]
-        .filter(Boolean)
-        .join(" ");
-}
 main().catch((error) => {
     console.error("RemoteAgent fatal error:", error);
     releaseProcessLockSync();

package/dist/secret-helper.js

@@ -2,17 +2,28 @@
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { readSecretValue } from "./services/agent-memory-service.js";
-function main() {
+import { readSecretValue, writeSecretValue } from "./services/agent-memory-service.js";
+async function main() {
     const [command, key] = process.argv.slice(2);
-    if (command !== "get" || !key) {
-        process.stderr.write("Usage: secret-helper get <KEY>\n");
+    if (!["get", "set"].includes(command ?? "") || !key) {
+        process.stderr.write("Usage: secret-helper get <KEY>\n       secret-helper set <KEY>  # reads value from stdin\n");
         process.exitCode = 2;
         return;
     }
     const dataDir = process.env.REMOTEAGENT_DATA_DIR?.trim()
         || process.env.DATA_DIR?.trim()
         || path.join(os.homedir(), ".remoteagent");
+    if (command === "set") {
+        const value = await readStdin();
+        if (!value) {
+            process.stderr.write("Secret value was empty.\n");
+            process.exitCode = 2;
+            return;
+        }
+        writeSecretValue(dataDir, key.trim(), value);
+        process.stdout.write(`Stored secret: ${key.trim()}\n`);
+        return;
+    }
     const value = readSecretValue(dataDir, key.trim());
     if (!value) {
         process.stderr.write(`Secret was not found: ${key}\n`);
@@ -21,4 +32,11 @@ function main() {
     }
     process.stdout.write(value);
 }
-main();
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+    }
+    return Buffer.concat(chunks).toString("utf8").trim();
+}
+void main();

package/dist/services/agent-memory-service.js

@@ -338,8 +338,16 @@ export class AgentMemoryService {
                 ? ["Document index:", ...docs.map((doc) => `- ${doc.keyword}: ${doc.targetPath}${doc.note ? ` (${doc.note})` : ""}`)].join("\n")
                 : undefined,
             secrets.length > 0
-                ? ["Secret keys available through `node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>`:", ...secrets.map((key) => `- ${key}`)].join("\n")
-                : undefined,
+                ? [
+                    "Secret keys available through `node \"$REMOTEAGENT_SECRET_BIN\" get <KEY>`:",
+                    ...secrets.map((key) => `- ${key}`),
+                    "If you generate a new secret value such as an OAuth refresh token, store it without printing it:",
+                    "`printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>`",
+                ].join("\n")
+                : [
+                    "Secrets can be stored without printing values:",
+                    "`printf '%s' \"$VALUE\" | node \"$REMOTEAGENT_SECRET_BIN\" set <KEY>`",
+                ].join("\n"),
             artifacts.length > 0
                 ? ["Recent session artifacts:", ...artifacts.map((artifact) => `- ${artifact.id} ${artifact.kind}: ${artifact.path}`)].join("\n")
                 : undefined,
@@ -735,3 +743,32 @@ export function readSecretValue(dataDir, key) {
         return undefined;
     }
 }
+export function writeSecretValue(dataDir, key, value) {
+    if (!/^[A-Z0-9_.-]{1,80}$/.test(key)) {
+        throw new Error("Secret key must be 1-80 chars using A-Z, 0-9, dot, underscore, or dash.");
+    }
+    const filePath = path.join(dataDir, "managed", "secrets.json");
+    fsSync.mkdirSync(path.dirname(filePath), { recursive: true });
+    let secrets = {};
+    try {
+        const raw = fsSync.readFileSync(filePath, "utf8");
+        secrets = JSON.parse(raw);
+    }
+    catch {
+        secrets = {};
+    }
+    const now = new Date().toISOString();
+    secrets[key] = {
+        key,
+        value,
+        createdAt: secrets[key]?.createdAt ?? now,
+        updatedAt: now,
+    };
+    fsSync.writeFileSync(filePath, `${JSON.stringify(secrets, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    try {
+        fsSync.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Best effort only; some platforms do not support chmod.
+    }
+}

package/dist/telegram-command-menu.js

@@ -0,0 +1,71 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export const TELEGRAM_COMMAND_MENU = [
+    { command: "start", description: "Start a new Codex or Claude session" },
+    { command: "list", description: "List sessions" },
+    { command: "switch", description: "Switch to a session" },
+    { command: "status", description: "Show current session status" },
+    { command: "state", description: "Show or edit session state notes" },
+    { command: "option", description: "Show or change runtime options" },
+    { command: "model", description: "Show or change provider model" },
+    { command: "stop", description: "Stop active work and clear queued messages" },
+    { command: "batch", description: "Collect and send a multi-message batch" },
+    { command: "bots", description: "List configured Telegram bots" },
+    { command: "bot", description: "Manage Telegram bots" },
+    { command: "install", description: "Install or update Codex or Claude" },
+    { command: "login", description: "Run provider login flow" },
+    { command: "reset", description: "Clear this chat binding" },
+    { command: "help", description: "Show command help" },
+];
+export async function setTelegramCommandMenu(token) {
+    await callTelegramCommandApi(token, "setMyCommands", {
+        commands: TELEGRAM_COMMAND_MENU,
+    });
+}
+export async function deleteTelegramCommandMenu(token) {
+    await callTelegramCommandApi(token, "deleteMyCommands", {});
+}
+async function callTelegramCommandApi(token, method, payload) {
+    let stdout;
+    let stderr;
+    try {
+        const result = await execFileAsync("curl", [
+            "-sS",
+            "-4",
+            "--max-time",
+            "20",
+            "-H",
+            "Content-Type: application/json",
+            "-d",
+            JSON.stringify(payload),
+            `https://api.telegram.org/bot${token}/${method}`,
+        ]);
+        stdout = result.stdout;
+        stderr = result.stderr;
+    }
+    catch (error) {
+        throw new Error(`Telegram ${method} curl failed: ${formatCurlError(error)}`);
+    }
+    if (stderr?.trim()) {
+        console.error(`curl stderr for ${method}: ${stderr.trim()}`);
+    }
+    const parsed = JSON.parse(stdout);
+    if (!parsed.ok) {
+        throw new Error(parsed.description || `Telegram ${method} failed.`);
+    }
+}
+function formatCurlError(error) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code ?? "")
+        : "";
+    const stderr = typeof error === "object" && error !== null && "stderr" in error
+        ? String(error.stderr ?? "").trim()
+        : "";
+    return [code ? `code=${code}` : undefined, stderr || error.message]
+        .filter(Boolean)
+        .join(" ");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appback-remoteagent",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "description": "Personal installable session server for continuing local AI work across PC and Telegram",
   "license": "MIT",
   "type": "module",