appback-remoteagent 0.20.1 → 0.21.1

package/README.md

@@ -325,7 +325,7 @@ remoteagent bot add
 remoteagent-start
 ```
 
-The command validates the BotFather token, stores the bot configuration, and configures the numeric Telegram owner user ID. Tokens are entered through a hidden prompt by default.
+The command validates the BotFather token and shows a one-time Telegram `/start` link. Open that link from the account that will own the installation; RemoteAgent detects the sender's numeric user ID and stores it as the owner automatically. The token is entered through a hidden prompt, and the owner ID does not need to be looked up or typed manually.
 
 To move installation-wide `/secret` values to another PC, export and import a password-encrypted bundle:
 

package/dist/adapters/runtime-env.js

@@ -1,5 +1,6 @@
 import os from "node:os";
 import path from "node:path";
+import process from "node:process";
 import { fileURLToPath } from "node:url";
 const CHILD_ENV_BLOCKED_PREFIXES = ["TELEGRAM_"];
 export function buildProviderEnv(extraEnv) {
@@ -15,11 +16,20 @@ export function buildProviderEnv(extraEnv) {
     env.DATA_DIR = dataDir;
     env.REMOTEAGENT_DATA_DIR = dataDir;
     env.REMOTEAGENT_SECRET_BIN = resolveSecretHelperPath();
+    env.PATH = buildRuntimePath(env.PATH);
     if (extraEnv) {
         Object.assign(env, extraEnv);
     }
     return env;
 }
+export function buildRuntimePath(existingPath = process.env.PATH, nodeExecutable = process.execPath, homeDir = os.homedir()) {
+    const entries = [
+        path.dirname(nodeExecutable),
+        path.join(homeDir, ".local", "bin"),
+        ...(existingPath ?? "").split(path.delimiter),
+    ].filter(Boolean);
+    return [...new Set(entries)].join(path.delimiter);
+}
 function resolveSecretHelperPath() {
     const adapterDir = path.dirname(fileURLToPath(import.meta.url));
     return path.resolve(adapterDir, "..", "secret-helper.js");

package/dist/cli.js

@@ -1,9 +1,9 @@
 import fs from "node:fs/promises";
+import { randomBytes } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import readline from "node:readline/promises";
-import { registerTelegramBot, readConfiguredOwnerId } from "./services/cli-config-service.js";
+import { fetchTelegramBotIdentity, registerTelegramBot, readConfiguredOwnerId, waitForTelegramOwner, } from "./services/cli-config-service.js";
 import { exportSecrets, importSecrets } from "./services/secret-transfer-service.js";
 async function main() {
     const args = process.argv.slice(2);
@@ -46,9 +46,27 @@ async function addBot(dataDir, args) {
     if (args.length > 0) {
         throw new Error(`Unexpected bot argument: ${args[0]}`);
     }
+    const identity = await fetchTelegramBotIdentity(token);
     const configuredOwner = await readConfiguredOwnerId(dataDir);
-    const ownerId = ownerOption || configuredOwner || await promptVisible("Telegram owner user ID: ");
-    const result = await registerTelegramBot({ dataDir, token, ownerId });
+    let ownerId = ownerOption || configuredOwner;
+    if (!ownerId) {
+        const startPayload = `ra_${randomBytes(8).toString("hex")}`;
+        console.log([
+            `Validated @${identity.username} (${identity.id}).`,
+            "",
+            "Open this Telegram link within 3 minutes to confirm the owner:",
+            `  https://t.me/${identity.username}?start=${startPayload}`,
+            "",
+            "Or send this exact command to the bot:",
+            `  /start ${startPayload}`,
+            "",
+            "Waiting for owner confirmation...",
+        ].join("\n"));
+        const owner = await waitForTelegramOwner(token, startPayload);
+        ownerId = owner.id;
+        console.log(`Detected Telegram owner: ${owner.displayName}${owner.username ? ` (@${owner.username})` : ""} (${owner.id})`);
+    }
+    const result = await registerTelegramBot({ dataDir, token, ownerId, identity });
     console.log([
         `${result.added ? "Registered" : "Updated"} @${result.identity.username} (${result.identity.id}).`,
         `Configured bots: ${result.botCount}`,
@@ -119,18 +137,6 @@ function takeFlag(args, name) {
     args.splice(index, 1);
     return true;
 }
-async function promptVisible(question) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new Error(`${question.trim()} is required as a command option in non-interactive mode.`);
-    }
-    const terminal = readline.createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        return (await terminal.question(question)).trim();
-    }
-    finally {
-        terminal.close();
-    }
-}
 async function promptHidden(question) {
     if (!process.stdin.isTTY || !process.stdout.isTTY || !process.stdin.setRawMode) {
         throw new Error("Interactive hidden input requires a TTY. Use the corresponding --*-file option instead.");

package/dist/index.js

@@ -19,6 +19,7 @@ import { BotPollingStateService } from "./services/bot-polling-state-service.js"
 import { ProviderRecoveryService } from "./services/provider-recovery-service.js";
 import { computePolicyPollIntervalMs, computeRecentMessageRanks } from "./services/polling-policy.js";
 import { terminateAllSpawnedExecutions } from "./adapters/windows-shell.js";
+import { buildProviderEnv } from "./adapters/runtime-env.js";
 import { setTelegramCommandMenu } from "./telegram-command-menu.js";
 import { buildBotInfoFromIdentity, buildFallbackBotInfo } from "./telegram-bot-identity.js";
 const execFileAsync = promisify(execFile);
@@ -528,9 +529,12 @@ function commandExists(command) {
         return fs.existsSync(trimmed);
     }
     if (process.platform === "win32") {
-        return spawnSync("where", [trimmed], { stdio: "ignore" }).status === 0;
+        return spawnSync("where", [trimmed], { stdio: "ignore", env: buildProviderEnv() }).status === 0;
     }
-    return spawnSync("sh", ["-lc", 'command -v "$0" >/dev/null 2>&1', trimmed], { stdio: "ignore" }).status === 0;
+    return spawnSync("sh", ["-lc", 'command -v "$0" >/dev/null 2>&1', trimmed], {
+        stdio: "ignore",
+        env: buildProviderEnv(),
+    }).status === 0;
 }
 async function acquireProcessLock(dataDir) {
     await fsp.mkdir(dataDir, { recursive: true });

package/dist/services/cli-config-service.js

@@ -101,6 +101,86 @@ export async function fetchTelegramBotIdentity(token) {
         username: payload.result.username,
     };
 }
+export async function waitForTelegramOwner(token, startPayload, timeoutMs = 180_000) {
+    assertBotToken(token);
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(startPayload)) {
+        throw new Error("Telegram start payload must use 1-64 URL-safe characters.");
+    }
+    const startedAt = Date.now();
+    let offset = await nextTelegramUpdateOffset(token);
+    while (Date.now() - startedAt < timeoutMs) {
+        const remainingMs = timeoutMs - (Date.now() - startedAt);
+        const pollSeconds = Math.max(1, Math.min(15, Math.floor(remainingMs / 1000)));
+        const updates = await getTelegramUpdates(token, offset, pollSeconds);
+        for (const update of updates) {
+            if (typeof update.update_id === "number") {
+                offset = Math.max(offset, update.update_id + 1);
+            }
+            const message = update.message;
+            const sender = message?.from;
+            if (message?.chat?.type !== "private"
+                || sender?.is_bot
+                || typeof sender?.id !== "number"
+                || message.text?.trim() !== `/start ${startPayload}`) {
+                continue;
+            }
+            return {
+                id: String(sender.id),
+                username: sender.username,
+                displayName: [sender.first_name, sender.last_name].filter(Boolean).join(" ") || sender.username || String(sender.id),
+            };
+        }
+    }
+    throw new Error("Timed out waiting for the Telegram owner confirmation. Run the command again and use the new /start link.");
+}
+async function nextTelegramUpdateOffset(token) {
+    const updates = await getTelegramUpdates(token, undefined, 0);
+    return updates.reduce((next, update) => typeof update.update_id === "number" ? Math.max(next, update.update_id + 1) : next, 0);
+}
+async function getTelegramUpdates(token, offset, timeoutSeconds) {
+    const args = [
+        "-4",
+        "-sS",
+        "--get",
+        "--connect-timeout",
+        "10",
+        "--max-time",
+        String(Math.max(20, timeoutSeconds + 10)),
+        "--data-urlencode",
+        `timeout=${timeoutSeconds}`,
+        "--data-urlencode",
+        "limit=100",
+        "--data-urlencode",
+        'allowed_updates=["message"]',
+    ];
+    if (offset !== undefined) {
+        args.push("--data-urlencode", `offset=${offset}`);
+    }
+    args.push(`https://api.telegram.org/bot${token}/getUpdates`);
+    let stdout;
+    try {
+        const result = await execFileAsync("curl", args);
+        stdout = result.stdout;
+        if (result.stderr?.trim()) {
+            console.error(`curl stderr for Telegram getUpdates: ${result.stderr.trim()}`);
+        }
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message.replace(token, "[redacted]") : String(error);
+        throw new Error(`Telegram getUpdates request failed over IPv4: ${detail}`);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error("Telegram getUpdates returned an invalid response.");
+    }
+    if (!payload.ok || !Array.isArray(payload.result)) {
+        throw new Error(payload.description || "Telegram rejected the getUpdates request.");
+    }
+    return payload.result;
+}
 function assertBotToken(token) {
     if (!isBotToken(token)) {
         throw new Error("Invalid Telegram bot token format.");

package/dist/services/provider-setup-service.js

@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import process from "node:process";
 import { spawn } from "node:child_process";
+import { buildProviderEnv } from "../adapters/runtime-env.js";
 export class ProviderSetupService {
     timeoutMs;
     isProviderAvailable;
@@ -224,10 +225,7 @@ export class ProviderSetupService {
         return new Promise((resolve, reject) => {
             const child = spawn(launcher.file, launcher.args, {
                 cwd: process.cwd(),
-                env: {
-                    ...process.env,
-                    ...extraEnv,
-                },
+                env: buildProviderEnv(extraEnv),
             });
             let stdout = "";
             let stderr = "";

package/docs/CLI_BOOTSTRAP_AND_SECRET_MIGRATION.md

@@ -11,9 +11,11 @@ remoteagent bot add
 remoteagent-start
 ```
 
-`remoteagent bot add` asks for the BotFather token without echoing it and then asks for the numeric Telegram owner user ID. It validates the token with Telegram `getMe` before writing `~/.remoteagent/.env`.
+`remoteagent bot add` asks for the BotFather token without echoing it and validates the token with Telegram `getMe`. On the first registration it then prints a one-time Telegram `/start` link and waits up to three minutes. Open that link from the Telegram account that will own the installation; RemoteAgent detects and stores that account's numeric user ID automatically. No manual owner ID lookup or entry is required.
 
-For automation, keep sensitive values out of shell history by using a permission-restricted token file:
+The confirmation update is consumed by the setup command. After `remoteagent-start`, send `/start` to the bot normally to begin using RemoteAgent.
+
+For unattended automation, keep sensitive values out of shell history by using a permission-restricted token file and pass the already verified owner ID explicitly:
 
 ```bash
 chmod 600 /secure/path/telegram-token
@@ -30,6 +32,8 @@ remoteagent-start
 sudo systemctl restart remoteagent
 ```
 
+Provider install, login, and execution commands automatically prepend the directory of the Node executable running RemoteAgent and `~/.local/bin` to their child-process `PATH`. This keeps `/install codex`, `/install claude`, and `/login` working when RemoteAgent runs under systemd with Node installed through nvm, even if the service itself was started with a minimal system PATH.
+
 ## Secret migration
 
 RemoteAgent `/secret` values belong to the installation, not to an individual agent session. They are stored under `~/.remoteagent/managed/secrets.json`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appback-remoteagent",
-  "version": "0.20.1",
+  "version": "0.21.1",
   "description": "Personal installable session server for continuing local AI work across PC and Telegram",
   "license": "MIT",
   "type": "module",

package/scripts/selftest-cli.mjs

@@ -4,7 +4,12 @@ import assert from "node:assert/strict";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { fetchTelegramBotIdentity, registerTelegramBot } from "../dist/services/cli-config-service.js";
+import {
+  fetchTelegramBotIdentity,
+  registerTelegramBot,
+  waitForTelegramOwner,
+} from "../dist/services/cli-config-service.js";
+import { buildProviderEnv, buildRuntimePath } from "../dist/adapters/runtime-env.js";
 import { exportSecrets, importSecrets } from "../dist/services/secret-transfer-service.js";
 
 const root = await fs.mkdtemp(path.join(os.tmpdir(), "remoteagent-cli-selftest-"));
@@ -15,12 +20,44 @@ const selectedBundlePath = path.join(root, "selected-transfer.ra-secrets");
 const passphrase = "correct-horse-battery-staple";
 
 try {
+  const expectedNodeBin = path.join(root, "nvm", "bin");
+  const expectedHome = path.join(root, "home");
+  const runtimePath = buildRuntimePath(
+    ["/usr/local/bin", "/usr/bin", "/usr/bin"].join(path.delimiter),
+    path.join(expectedNodeBin, "node"),
+    expectedHome,
+  ).split(path.delimiter);
+  assert.deepEqual(runtimePath, [
+    expectedNodeBin,
+    path.join(expectedHome, ".local", "bin"),
+    "/usr/local/bin",
+    "/usr/bin",
+  ]);
+  const providerEnv = buildProviderEnv();
+  assert.equal(providerEnv.PATH?.split(path.delimiter)[0], path.dirname(process.execPath));
+  assert.ok(providerEnv.PATH?.split(path.delimiter).includes(path.join(os.homedir(), ".local", "bin")));
+
   const binDir = path.join(root, "bin");
   const curlArgsPath = path.join(root, "curl-args.txt");
+  const curlUpdateCallsPath = path.join(root, "curl-update-calls.txt");
   await fs.mkdir(binDir, { recursive: true });
   await fs.writeFile(path.join(binDir, "curl"), `#!/usr/bin/env bash
 printf '%s\\n' "$@" > ${JSON.stringify(curlArgsPath)}
-printf '{"ok":true,"result":{"id":100000,"username":"bootstrap_test_bot"}}'
+if printf '%s\\n' "$@" | grep -q '/getUpdates'; then
+  count=0
+  if [ -f ${JSON.stringify(curlUpdateCallsPath)} ]; then
+    count="$(cat ${JSON.stringify(curlUpdateCallsPath)})"
+  fi
+  count=$((count + 1))
+  printf '%s' "$count" > ${JSON.stringify(curlUpdateCallsPath)}
+  if [ "$count" -eq 1 ]; then
+    printf '{"ok":true,"result":[{"update_id":41,"message":{"text":"/start stale_payload","chat":{"id":777,"type":"private"},"from":{"id":777,"is_bot":false,"username":"stale"}}}]}'
+  else
+    printf '{"ok":true,"result":[{"update_id":42,"message":{"text":"/start ra_selftest","chat":{"id":8202993989,"type":"private"},"from":{"id":8202993989,"is_bot":false,"username":"roy","first_name":"Roy"}}}]}'
+  fi
+else
+  printf '{"ok":true,"result":{"id":100000,"username":"bootstrap_test_bot"}}'
+fi
 `, { mode: 0o755 });
   const originalPath = process.env.PATH;
   process.env.PATH = `${binDir}:${originalPath ?? ""}`;
@@ -29,6 +66,19 @@ printf '{"ok":true,"result":{"id":100000,"username":"bootstrap_test_bot"}}'
   const curlArgs = await fs.readFile(curlArgsPath, "utf8");
   assert.match(curlArgs, /^-4$/m);
   assert.match(curlArgs, /\/getMe$/m);
+  const detectedOwner = await waitForTelegramOwner(
+    "100000:abcdefghijklmnopqrstuvwxyz_123456",
+    "ra_selftest",
+    2_000,
+  );
+  assert.deepEqual(detectedOwner, {
+    id: "8202993989",
+    username: "roy",
+    displayName: "Roy",
+  });
+  const ownerCurlArgs = await fs.readFile(curlArgsPath, "utf8");
+  assert.match(ownerCurlArgs, /^-4$/m);
+  assert.match(ownerCurlArgs, /^offset=42$/m);
   process.env.PATH = originalPath;
 
   await fs.mkdir(sourceDataDir, { recursive: true });