appback-remoteagent 0.23.5 → 0.23.6

package/README.md

@@ -122,8 +122,8 @@ Current command surface implemented in `src/bot.ts`:
 | `/bot remove <username\|id>` | Removes a configured Telegram bot, restarts the runtime, and confirms the result after restart |
 | `/bot reload` | Restarts the runtime and confirms the result after restart |
 | `/install codex\|claude` | Runs the configured provider install or update command for the bot owner |
-| `/login codex` | Starts the Codex device-auth login flow and returns a browser URL when available |
-| `/login claude [token]` | Starts or finishes the configured Claude Code login flow for the bot owner |
+| `/login` | Owner-only GitHub / Codex / Claude selection buttons; returns authentication URL and any device code, then reports completion |
+| `/login github\|codex\|claude` | Starts the selected login directly; `git` is an alias for `github` |
 | `/reset` | Clears the current chat binding |
 | `/batch start` | Starts manual batching of multiple text messages |
 | `/batch send` | Sends the collected batch |
@@ -186,7 +186,7 @@ Current Claude behavior:
 - fresh pairing from Telegram
 - attach to existing `session_id`
 - continue the same Claude Code session across turns
-- optional owner-only install/login flow through `/install claude` and `/login claude [token]`
+- owner-only installation through `/install claude` and browser authentication through `/login` → Claude
 
 ### 5. Telegram attachments
 
@@ -302,8 +302,7 @@ Recommended Linux hooks in this repo:
 - `CLAUDE_COMMAND`
 - `CLAUDE_PERMISSION_MODE`
 - `CLAUDE_INSTALL_COMMAND`
-- `CLAUDE_LOGIN_START_COMMAND`
-- `CLAUDE_LOGIN_FINISH_COMMAND`
+- `CLAUDE_LOGIN_FINISH_COMMAND` (legacy `/login claude <token>` compatibility only)
 - `REMOTEAGENT_SERVICE_NAME`
 - `BOT_RESTART_HELPER_PATH`
 - `LOCAL_UI_ENABLED`
@@ -387,15 +386,20 @@ Then open Telegram and start with one of these common flows. `/start` without a
 /start claude
 /install codex
 /install claude
+/login
+/login github
 /login codex
 /login claude
-/login claude <token>
 /attach codex <thread_id>
 /attach claude <session_id>
 ```
 
 Once a chat is bound, ordinary text messages continue the active session. Supported attachments can also be sent directly as normal Telegram messages.
 
+`/login` authenticates the server's RemoteAgent OS account without creating a new
+session or changing its model. Already authenticated accounts offer a **Log in
+again** button. See [Login guide](docs/LOGIN.md) for prerequisites and expiry.
+
 ## Architecture and operations
 
 High-level architecture: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)

package/dist/adapters/codex-adapter.js

@@ -194,16 +194,28 @@ export class CodexAdapter {
     formatProcessError(stdout, stderr, timedOut = false, code) {
         const structured = this.extractStructuredError(stdout, stderr);
         if (structured) {
-            return structured;
+            return this.addUpgradeGuidance(structured);
         }
         const text = this.extractPlainTextError(stdout, stderr);
         if (text) {
-            return text;
+            return this.addUpgradeGuidance(text);
         }
         return timedOut
             ? this.formatTimeoutError()
             : `Codex process exited with code ${code ?? "unknown"} without stdout/stderr.`;
     }
+    addUpgradeGuidance(message) {
+        if (!/requires a newer version of Codex/i.test(message)) {
+            return message;
+        }
+        return [
+            message,
+            "",
+            "현재 Codex 버전이 선택한 모델을 지원하지 않습니다.",
+            "Telegram에서 /install codex 를 실행하면 최신 버전으로 업데이트됩니다.",
+            "업데이트가 완료되면 같은 세션에서 요청을 다시 보내 주세요.",
+        ].join("\n");
+    }
     extractStructuredError(stdout, stderr) {
         const messages = [];
         for (const line of stdout.split(/\r?\n/)) {

package/dist/bot.js

@@ -9,6 +9,7 @@ import { promisify } from "node:util";
 import { Bot, GrammyError, HttpError } from "grammy";
 import { config } from "./config.js";
 import { ProviderSetupService } from "./services/provider-setup-service.js";
+import { LoginService } from "./services/login-service.js";
 import { RemoteShellService } from "./services/remote-shell-service.js";
 import { AgentMemoryService } from "./services/agent-memory-service.js";
 import { WorkspaceCleanupService } from "./services/workspace-cleanup-service.js";
@@ -47,8 +48,7 @@ const HELP_TEXT = [
     "/bot remove <username|id>",
     "/bot reload",
     "/install codex|claude",
-    "/login codex",
-    "/login claude [token]",
+    "/login - choose GitHub, Codex or Claude",
     "/reset",
     "/! <command>",
     "/!cmd <command>",
@@ -1034,29 +1034,38 @@ ${bridge.formatStatus(mapping)}`);
             return { chunks: flattenChunks([result.output], 3900) };
         });
     });
+    const loginService = new LoginService(15 * 60_000, { codex: config.codexBin, claude: config.claudeBin });
+    const startLogin = async (ctx, target, force = false) => {
+        await ensureOwnerControlAccess(ctx);
+        if (!ctx.chat)
+            throw new Error("Telegram chat context is missing.");
+        const result = await loginService.start(target, force, async (text) => { await reply(ctx, text); });
+        await reply(ctx, result.text, result.alreadyLoggedIn ? keyboardOptions([[
+                actionButton(ctx, "Log in again", { kind: "login.start", target, force: true }),
+            ]]) : undefined);
+    };
     bot.command("login", async (ctx) => {
         await ensureOwnerControlAccess(ctx);
         const { args, rest } = parseCommand(ctx.message?.text, 1);
         const provider = args[0]?.toLowerCase();
-        if (provider === "codex") {
-            await runWithPendingAnimation(token, ctx.chat.id, async () => {
-                const output = await setupService.startCodexLogin();
-                await bridge.rememberDefaultStartMode("codex");
-                return { chunks: flattenChunks([output], 3900) };
-            });
+        if (!provider) {
+            await reply(ctx, "Choose an account to authenticate on this server. Authentication belongs to the OS account, not an individual session.", keyboardOptions([
+                [actionButton(ctx, "GitHub", { kind: "login.start", target: "github" })],
+                [actionButton(ctx, "Codex", { kind: "login.start", target: "codex" })],
+                [actionButton(ctx, "Claude", { kind: "login.start", target: "claude" })],
+            ]));
             return;
         }
-        if (provider !== "claude") {
-            await reply(ctx, "Usage: `/login codex` or `/login claude` or `/login claude <token>`", { parse_mode: "Markdown" });
+        if (provider === "claude" && rest?.trim()) {
+            await reply(ctx, await setupService.finishClaudeLogin(rest));
             return;
         }
-        await runWithPendingAnimation(token, ctx.chat.id, async () => {
-            const output = rest?.trim()
-                ? await setupService.finishClaudeLogin(rest)
-                : await setupService.startClaudeLogin();
-            await bridge.rememberDefaultStartMode("claude");
-            return { chunks: flattenChunks([output], 3900) };
-        });
+        const target = provider === "git" ? "github" : provider;
+        if (target !== "github" && target !== "codex" && target !== "claude") {
+            await reply(ctx, "Use /login to choose GitHub, Codex or Claude. Direct commands: /login github, /login codex, /login claude. /login git is a GitHub alias.");
+            return;
+        }
+        await startLogin(ctx, target);
     });
     const setChatSandbox = async (ctx, sandboxMode) => {
         if (!ctx.chat) {
@@ -1137,6 +1146,10 @@ ${bridge.formatStatus(mapping)}`);
             text: action.kind === "macro.run" ? "Macro selected." : "Applying...",
         });
         try {
+            if (action.kind === "login.start") {
+                await startLogin(ctx, action.target, action.force);
+                return;
+            }
             if (action.kind === "session.switch") {
                 await reply(ctx, await switchChatSession(ctx, action.selector));
                 return;

package/dist/services/login-service.js

@@ -0,0 +1,129 @@
+import { spawn } from "node:child_process";
+import os from "node:os";
+import { buildProviderEnv } from "../adapters/runtime-env.js";
+const commands = {
+    github: { bin: "gh", status: ["auth", "status", "--hostname", "github.com"], login: ["auth", "login", "--hostname", "github.com", "--git-protocol", "https", "--web"] },
+    codex: { bin: "codex", status: ["login", "status"], login: ["login", "--device-auth"] },
+    claude: { bin: "claude", status: ["auth", "status"], login: ["auth", "login"] },
+};
+// Shared across Telegram bots: authentication belongs to the OS account, not a chat.
+const active = new Set();
+export function loginHints(raw) {
+    const text = raw.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+    const urls = [...new Set(text.match(/https?:\/\/[^\s<>"\x1b]+/g) ?? [])];
+    if (!urls.length)
+        return undefined;
+    const code = text.match(/(?:one[- ]time|device) code[^\n]*?\b([A-Z0-9]{4}-[A-Z0-9]{4,5})\b/i)?.[1]
+        ?? text.match(/\b([A-Z0-9]{4}-[A-Z0-9]{4,5})\b/)?.[1];
+    return [...urls, ...(code ? [`One-time code: ${code}`] : [])].join("\n");
+}
+export class LoginService {
+    lifetimeMs;
+    binaries;
+    constructor(lifetimeMs = 15 * 60_000, binaries = {}) {
+        this.lifetimeMs = lifetimeMs;
+        this.binaries = binaries;
+    }
+    unavailable(target) {
+        const guidance = target === "github" ? "Install GitHub CLI (gh) on this server."
+            : `Run /install ${target} first.`;
+        return `${commands[target].bin} could not start. ${guidance} If installed, check execution permissions.`;
+    }
+    async status(target) {
+        const command = commands[target];
+        return new Promise((resolve, reject) => {
+            const child = spawn(this.binaries[target] ?? command.bin, command.status, { cwd: os.homedir(), env: buildProviderEnv({}) });
+            let output = "";
+            const timer = setTimeout(() => child.kill("SIGKILL"), 10_000);
+            child.stdout.on("data", chunk => { output = (output + chunk).slice(-16_384); });
+            child.stderr.resume();
+            child.stdin.end();
+            child.on("error", () => { clearTimeout(timer); reject(new Error(this.unavailable(target))); });
+            child.on("close", code => {
+                clearTimeout(timer);
+                if (target === "claude") {
+                    try {
+                        resolve(code === 0 && JSON.parse(output).loggedIn === true);
+                    }
+                    catch {
+                        resolve(false);
+                    }
+                }
+                else
+                    resolve(code === 0);
+            });
+        });
+    }
+    async start(target, force, notify) {
+        if (active.has(target))
+            return { alreadyLoggedIn: false, text: `${target} login is already in progress on this machine.` };
+        active.add(target);
+        try {
+            if (!force && await this.status(target)) {
+                active.delete(target);
+                return { alreadyLoggedIn: true, text: `${target} is already authenticated for OS account ${os.userInfo().username}.` };
+            }
+        }
+        catch (error) {
+            active.delete(target);
+            throw error;
+        }
+        const command = commands[target];
+        return new Promise(resolve => {
+            const child = spawn(this.binaries[target] ?? command.bin, command.login, {
+                cwd: os.homedir(), env: buildProviderEnv({ BROWSER: "echo", GH_BROWSER: "echo" }),
+            });
+            const stopOnExit = () => { child.kill("SIGKILL"); };
+            process.once("exit", stopOnExit);
+            let raw = "";
+            let delivered = "";
+            let settled = false;
+            let expired = false;
+            let notifications = Promise.resolve();
+            const send = (text) => { notifications = notifications.then(() => notify(text)).catch(() => undefined); };
+            const finishStart = (text) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(initialTimer);
+                resolve({ alreadyLoggedIn: false, text });
+            };
+            const initialTimer = setTimeout(() => finishStart(`${target} login is waiting for an authentication URL. Completion or expiry will be reported here.`), 20_000);
+            const expiryTimer = setTimeout(() => { expired = true; child.kill("SIGKILL"); }, this.lifetimeMs);
+            const consume = (chunk) => {
+                raw = (raw + chunk.toString()).slice(-32_768);
+                const hints = loginHints(raw);
+                if (hints && hints !== delivered) {
+                    delivered = hints;
+                    const message = `${target} login (${os.userInfo().username}@${os.hostname()})\n${hints}\nComplete authentication in your browser. Existing sessions remain unchanged.`;
+                    if (settled)
+                        send(message);
+                    else
+                        finishStart(message);
+                }
+            };
+            child.stdout.on("data", consume);
+            child.stderr.on("data", consume);
+            child.stdin.on("error", () => undefined);
+            child.stdin.end("\n");
+            child.on("error", () => finishStart(this.unavailable(target)));
+            child.on("close", async (code) => {
+                process.removeListener("exit", stopOnExit);
+                clearTimeout(expiryTimer);
+                try {
+                    const authenticated = !expired && code === 0 && await this.status(target).catch(() => false);
+                    const message = authenticated ? `${target} login completed and authentication verified.`
+                        : expired ? `${target} login expired after ${Math.round(this.lifetimeMs / 60_000)} minutes. Run /login to retry.`
+                            : `${target} login did not complete (exit=${code}). Authentication was not confirmed. Run /login to retry.`;
+                    if (settled)
+                        send(message);
+                    else
+                        finishStart(message);
+                }
+                finally {
+                    active.delete(target);
+                }
+            });
+        });
+    }
+}

package/dist/services/provider-setup-service.js

@@ -141,13 +141,13 @@ export class ProviderSetupService {
                 if (/not logged in/i.test(statusText)) {
                     return [
                         "Codex is installed but not logged in yet.",
-                        "Next step: run `/login codex` in this chat.",
+                        "Next step: run /login and select Codex.",
                         "If you prefer machine-side auth, you can use `codex login --device-auth` and complete the login in your browser.",
                     ].join("\n");
                 }
             }
             catch {
-                return "Codex is installed. If this machine is not authenticated yet, run `/login codex` or use `codex login --device-auth` on the machine.";
+                return "Codex is installed. To authenticate this server account, run /login and select Codex.";
             }
         }
         if (provider === "claude") {
@@ -157,12 +157,12 @@ export class ProviderSetupService {
                 if (/not logged in|loggedIn:\s*false/i.test(statusText)) {
                     return [
                         "Claude Code is installed but not logged in yet.",
-                        "Next step: run `/login claude` or complete the configured Claude login flow on this machine.",
+                        "Next step: run /login and select Claude.",
                     ].join("\n");
                 }
             }
             catch {
-                return "Claude Code is installed. If this machine is not authenticated yet, run `/login claude` or complete the configured login flow.";
+                return "Claude Code is installed. To authenticate this server account, run /login and select Claude.";
             }
         }
         return undefined;

package/dist/telegram-command-menu.js

@@ -24,7 +24,7 @@ export const TELEGRAM_COMMAND_MENU = [
     { command: "bots", description: "List configured Telegram bots" },
     { command: "bot", description: "Manage Telegram bots" },
     { command: "install", description: "Install or update Codex or Claude" },
-    { command: "login", description: "Run provider login flow" },
+    { command: "login", description: "Choose GitHub, Codex or Claude login" },
     { command: "reset", description: "Clear this chat binding" },
     { command: "help", description: "Show command help" },
 ];

package/docs/LOGIN.md

@@ -0,0 +1,62 @@
+# Server Account Login
+
+Send `/login` in Telegram and select GitHub, Codex, or Claude.
+`/help` lists this entry once. Telegram's slash-command menu offers `/login`;
+provider names are chosen with buttons, not subcommand autocomplete.
+The login applies to the RemoteAgent OS account on that server. Existing
+Telegram sessions and their selected models remain unchanged.
+
+Direct commands:
+
+```text
+/login github
+/login git
+/login codex
+/login claude
+```
+
+GitHub uses `gh auth login --hostname github.com --git-protocol https --web`.
+Codex uses `codex login --device-auth`.
+Claude uses `claude auth login`.
+Install the selected CLI on the server first. For providers, use
+`/install codex` or `/install claude`; GitHub requires the GitHub CLI (`gh`).
+
+An authenticated account gets a "Log in again" button. A new flow reports
+URLs and one-time device codes emitted by the CLI, then checks authentication
+after a successful process exit. Complete the browser flow from your PC.
+One login per provider can run across all bots in the same RemoteAgent process.
+Flows expire after 15 minutes. Restarting RemoteAgent interrupts the flow;
+start `/login` again after a restart. Telegram delivery failure is not an
+authentication failure: `/login` checks the account again.
+
+Raw CLI output is not forwarded. Only authentication URLs, device codes, and
+status messages are delivered. The legacy `/login claude <token>` command
+continues to use its configured finish hook. The button flow uses the native
+Claude CLI, not the old 15-second start hook.
+
+Local regression tests:
+
+```sh
+npm run build
+node scripts/selftest-login.mjs
+npm run selftest:telegram
+```
+
+CLI references: https://cli.github.com/manual/gh_auth_login and
+https://code.claude.com/docs/en/cli-reference.
+
+## Deploy to Server 50
+
+After committing changes, bump the version with `npm run release:version -- patch`,
+commit the version files, and push. Publish and deploy the exact version:
+
+```sh
+npm run release:publish
+npm run release:deploy -- 0.23.6 50
+```
+
+The 50 target uses root SSH to run npm and RemoteAgent as `daone`. It checks
+for active work, stops the runtime, updates the npm package, and restarts it
+from the account home directory. Existing configuration, secrets, and sessions
+remain in place. The existing npm launchers do not require installer regeneration.
+The historical `all` target remains 30/40/26; select 50 explicitly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appback-remoteagent",
-  "version": "0.23.5",
+  "version": "0.23.6",
   "description": "Personal installable session server for continuing local AI work across PC and Telegram",
   "license": "MIT",
   "type": "module",

package/scripts/release-deploy.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 usage() {
-  echo "Usage: npm run release:deploy -- <version> <30|40|26|all>" >&2
+  echo "Usage: npm run release:deploy -- <version> <30|40|26|50|all>" >&2
   echo "Example: npm run release:deploy -- 0.15.5 all" >&2
 }
 
@@ -20,7 +20,7 @@ if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 fi
 
 case "$TARGET" in
-  30|40|26|all)
+  30|40|26|50|all)
     ;;
   *)
     usage
@@ -192,6 +192,31 @@ fi
 REMOTE
 }
 
+deploy_50() {
+  ssh root@192.168.33.50 "runuser -u daone -- env VERSION=$VERSION PATH=/home/daone/.nvm/versions/node/v22.23.2/bin:/usr/local/bin:/usr/bin:/bin bash -s" <<'REMOTE'
+set -euo pipefail
+cd "$HOME"
+node --input-type=module - <<'NODE'
+import fs from 'node:fs';
+const state = JSON.parse(fs.readFileSync(`${process.env.HOME}/.remoteagent/bot-polling-state.json`, 'utf8'));
+if (Object.values(state.bots || {}).some(bot => bot.runningSessionIds?.length)) {
+  throw new Error('Active provider work; deployment aborted.');
+}
+NODE
+remoteagent-stop
+trap 'remoteagent-start' EXIT
+npm install -g "appback-remoteagent@$VERSION"
+test "$(node -p 'require(process.env.HOME + "/.nvm/versions/node/v22.23.2/lib/node_modules/appback-remoteagent/package.json").version')" = "$VERSION"
+# Existing npm installation keeps the same launcher and configuration paths.
+remoteagent-start
+trap - EXIT
+sleep 5
+kill -0 "$(cat "$HOME/.remoteagent/remoteagent.pid")"
+npm list -g appback-remoteagent --depth=0
+tail -n 12 "$HOME/.remoteagent/logs/agent.log"
+REMOTE
+}
+
 case "$TARGET" in
   30)
     deploy_30
@@ -202,6 +227,9 @@ case "$TARGET" in
   26)
     deploy_26
     ;;
+  50)
+    deploy_50
+    ;;
   all)
     deploy_30
     deploy_40

package/scripts/selftest-codex-stream.mjs

@@ -34,6 +34,13 @@ await fs.chmod(fakeCodex, 0o755);
 
 const { CodexAdapter } = await import(path.join(root, "dist", "adapters", "codex-adapter.js"));
 const adapter = new CodexAdapter(fakeCodex, 5000, "read-only");
+const upgradeError = "The 'gpt-6-astra' model requires a newer version of Codex. Please upgrade to the latest app or CLI and try again.";
+for (const raw of [upgradeError, JSON.stringify({type: "error", status: 400, error: {type: "invalid_request_error", message: upgradeError}})]) {
+  const formatted = adapter.formatProcessError(raw, "", false, 1);
+  if (!formatted.includes(upgradeError) || !formatted.includes("/install codex")) throw new Error("Missing Codex upgrade guidance");
+}
+const unrelatedError = "This request was blocked by our safety systems. Reason: Potentially unintended activity.";
+if (adapter.formatProcessError(unrelatedError, "", false, 1) !== unrelatedError) throw new Error("Unrelated error was changed");
 for (const method of ["buildExecArgs", "buildResumeArgs"]) {
   for (const reasoningEffort of ["low", "medium", "high", "xhigh", "max"]) {
     const args = adapter[method]({model: "gpt-6-astra", reasoningEffort, cwd: tmp, sessionId: "stream-thread"}, path.join(tmp, "output"), "read-only");

package/scripts/selftest-login.mjs

@@ -0,0 +1,52 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { LoginService, loginHints } from '../dist/services/login-service.js';
+
+const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'ra-login-test-'));
+const bin = path.join(dir, 'fake-cli');
+const state = path.join(dir, 'authenticated');
+const notices = [];
+const waitFor = async predicate => {
+  for (let i = 0; i < 100; i++) {
+    if (predicate()) return;
+    await new Promise(resolve => setTimeout(resolve, 50));
+  }
+  throw new Error('Timed out waiting for test condition');
+};
+try {
+  await fs.writeFile(bin, `#!${process.execPath}
+const fs = require('node:fs');
+if (process.argv.includes('status')) {
+  console.log(JSON.stringify({loggedIn:fs.existsSync(${JSON.stringify(state)})}));
+  process.exit(fs.existsSync(${JSON.stringify(state)}) ? 0 : 1);
+}
+console.log('First copy your one-time code: ABCD-EFGH');
+console.log('https://github.com/login/device');
+console.log('ACCESS_TOKEN_MUST_NOT_LEAK');
+setTimeout(() => {fs.writeFileSync(${JSON.stringify(state)}, 'ok'); process.exit(0);}, 400);
+`, { mode: 0o700 });
+  const binaries = { github: bin, codex: bin, claude: bin };
+  const service = new LoginService(4000, binaries);
+  const notify = async text => { notices.push(text); };
+  const first = service.start('github', false, notify);
+  assert.match((await new LoginService(4000, binaries).start('github', false, notify)).text, /already in progress/);
+  assert.match((await first).text, /ABCD-EFGH/);
+  await waitFor(() => notices.some(text => text.includes('verified')));
+  assert.equal((await service.start('github', false, notify)).alreadyLoggedIn, true);
+  notices.length = 0;
+  assert.match((await service.start('github', true, notify)).text, /login\/device/);
+  await waitFor(() => notices.some(text => text.includes('verified')));
+  assert.ok(notices.every(text => !text.includes('ACCESS_TOKEN_MUST_NOT_LEAK')));
+  await fs.unlink(state);
+  notices.length = 0;
+  await new LoginService(100, binaries).start('claude', false, notify);
+  await waitFor(() => notices.some(text => text.includes('expired')));
+  await assert.rejects(new LoginService(100, { codex: path.join(dir, 'missing') }).start('codex', false, notify), /could not start/);
+  assert.equal(loginHints('secret token only'), undefined);
+  assert.match(loginHints('https://auth.openai.com/codex/device\nABCD-EFGHI'), /ABCD-EFGHI/);
+  console.log('PASS login: URL/code, status, cross-bot lock, reauthentication, completion, expiry, missing CLI, output filtering');
+} finally {
+  await fs.rm(dir, { recursive: true, force: true });
+}

package/scripts/selftest-telegram-update.mjs

@@ -527,6 +527,14 @@ if (calls.some((call) => /미완료 TODO|\/task|새 작업으로 접수/.test(ca
   throw new Error(`Task gate language leaked to Telegram replies. Calls: ${JSON.stringify(calls, null, 2)}`);
 }
 
+await send("/login");
+const loginMenu = await waitForTelegramCall(call => call.text.includes("Choose an account to authenticate"));
+for (const label of ["GitHub", "Codex", "Claude"]) {
+  if (!findInlineButton(loginMenu, label)?.callback_data?.startsWith("remoteagent:action:")) {
+    throw new Error(`Missing login button: ${label}`);
+  }
+}
+
 await send("/new");
 await send("/list");
 const sessionListCall = await waitForTelegramCall((call) => call.text.includes("Sessions (2/2)"));