arisa 4.2.4 → 4.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arisa",
-  "version": "4.2.4",
+  "version": "4.2.8",
   "description": "Telegram + Pi Agent modular assistant",
   "type": "module",
   "main": "src/index.js",
@@ -37,7 +37,7 @@
   },
   "homepage": "https://arisa.sh",
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "^0.79.9",
+    "@earendil-works/pi-coding-agent": "^0.80.6",
     "@sinclair/typebox": "^0.34.41",
     "grammy": "^1.42.0"
   },

package/pnpm-workspace.yaml

@@ -1,6 +1,12 @@
 allowBuilds:
   '@google/genai': false
 
+minimumReleaseAgeExclude:
+  - '@earendil-works/pi-agent-core@0.80.6'
+  - '@earendil-works/pi-ai@0.80.6'
+  - '@earendil-works/pi-coding-agent@0.80.6'
+  - '@earendil-works/pi-tui@0.80.6'
+
 overrides:
   '@protobufjs/utf8@<=1.1.0': '>=1.1.1'
   basic-ftp@<=5.2.1: '>=5.2.2'

package/src/core/agent/auth-flow.js

@@ -78,11 +78,11 @@ export function buildPiAuthTelegramMessage({ config, issue = null, verified = fa
   if (verified) {
     lines.push("No action needed.");
   } else if (!issue) {
-    lines.push("Run `/auth` to validate these credentials against the provider.");
+    lines.push("Run /auth to validate these credentials against the provider.");
   } else if (status.hasApiKey) {
     lines.push("A Pi API key is configured, but the provider rejected the current request. Update the key and restart Arisa.");
   } else if (status.supportsOAuth) {
-    lines.push("Run `/auth` here in Telegram to renew the Pi login.");
+    lines.push("Run /auth here in Telegram to renew the Pi login.");
   } else {
     lines.push("This provider needs a Pi API key. Re-run `arisa --bootstrap`, provide a key, and restart Arisa.");
   }
@@ -103,7 +103,7 @@ export function buildPiAuthRecoveryBlockedMessage({ config, issue = null, renewa
 
   lines.push(renewalActive
     ? "A Pi login is already in progress. Paste the redirect URL or code here when the provider gives it to you."
-    : "Send `/auth` to start Pi login from Telegram.");
+    : "Send /auth to start Pi login from Telegram.");
 
   return lines.join("\n");
 }

package/src/runtime/bootstrap.js

@@ -6,6 +6,7 @@ import { spawn } from "node:child_process";
 import { Bot } from "grammy";
 import { createPiOAuthLogin } from "../core/agent/pi-auth-login.js";
 import { createPiRuntime, hasProviderAuth, listPiProviders, listProviderModels, supportsProviderOAuth } from "../core/agent/pi-runtime.js";
+import { buildDeviceCodeTelegramMessage } from "../transport/telegram/device-code-message.js";
 import { configFile, ensureArisaHome } from "./paths.js";
 
 const ARISA_BANNER = [
@@ -424,8 +425,8 @@ async function runTelegramBootstrap({ telegramApiKey, setupToken, botInfo }) {
         ].join("\n"));
       },
       onDeviceCode: async ({ userCode, verificationUri, expiresInSeconds }) => {
-        const expiry = expiresInSeconds ? `\nExpires in ${Math.round(expiresInSeconds / 60)} minute(s).` : "";
-        await sendSetupMessage(`Open this URL: ${verificationUri}\nThen enter code: ${userCode}${expiry}`);
+        const { text, ...options } = buildDeviceCodeTelegramMessage({ userCode, verificationUri, expiresInSeconds });
+        await sendSetupMessage(text, options);
       },
       onPrompt: async ({ message, controller }) => {
         await sendSetupMessage(`${message}\nReply here with the value.`);

package/src/transport/telegram/bot.js

@@ -2,6 +2,7 @@ import { Bot, InputFile } from "grammy";
 import path from "node:path";
 import { authorizeChat } from "./auth.js";
 import { captureIncomingArtifact, formatLocationText } from "./media.js";
+import { buildDeviceCodeTelegramMessage } from "./device-code-message.js";
 import { renderTelegramHtml } from "./text-format.js";
 import { buildPiAuthRecoveryBlockedMessage, buildPiAuthTelegramMessage, getErrorMessage, getPiAuthIssue, getPiAuthStatus } from "../../core/agent/auth-flow.js";
 import { createPiOAuthLogin } from "../../core/agent/pi-auth-login.js";
@@ -365,8 +366,9 @@ export async function createTelegramBot({ config, artifactStore, toolRegistry, t
         ].join("\n"));
       },
       onDeviceCode: async ({ userCode, verificationUri, expiresInSeconds }) => {
-        const expiry = expiresInSeconds ? `\nExpires in ${Math.round(expiresInSeconds / 60)} minute(s).` : "";
-        await bot.api.sendMessage(chatId, `Open this URL: ${verificationUri}\nThen enter code: ${userCode}${expiry}`);
+        const payload = buildDeviceCodeTelegramMessage({ userCode, verificationUri, expiresInSeconds });
+        const { text, ...options } = payload;
+        await bot.api.sendMessage(chatId, text, options);
       },
       onPrompt: async ({ message, controller }) => {
         await bot.api.sendMessage(chatId, `${message}\nReply here with the value.`);

package/src/transport/telegram/device-code-message.js

@@ -0,0 +1,48 @@
+import { escapeHtml } from "./text-format.js";
+
+const maxCopyTextLength = 256;
+const maxButtonLabelLength = 64;
+
+function truncateButtonLabel(text = "") {
+  const source = String(text || "").trim();
+  if (source.length <= maxButtonLabelLength) return source;
+  return `${source.slice(0, maxButtonLabelLength - 1)}…`;
+}
+
+export function buildDeviceCodeTelegramMessage({ userCode, verificationUri, expiresInSeconds } = {}) {
+  const code = String(userCode || "").trim();
+  const uri = String(verificationUri || "").trim();
+  const expiry = expiresInSeconds
+    ? `\nExpires in ${Math.round(expiresInSeconds / 60)} minute(s).`
+    : "";
+
+  const lines = [
+    "Open this URL:",
+    uri ? `<a href="${escapeHtml(uri)}">${escapeHtml(uri)}</a>` : "",
+    "Then enter code:",
+    code ? `<code>${escapeHtml(code)}</code>` : "",
+    escapeHtml(expiry.trim())
+  ].filter(Boolean);
+
+  const payload = {
+    text: lines.join("\n"),
+    parse_mode: "HTML",
+    link_preview_options: { is_disabled: true }
+  };
+
+  const buttons = [];
+  if (code && code.length <= maxCopyTextLength) {
+    buttons.push({
+      text: truncateButtonLabel(`Copy code: ${code}`),
+      copy_text: { text: code }
+    });
+  }
+  if (uri) {
+    buttons.push({ text: "Open login page", url: uri });
+  }
+  if (buttons.length) {
+    payload.reply_markup = { inline_keyboard: [buttons] };
+  }
+
+  return payload;
+}

package/src/transport/telegram/text-format.js

@@ -1,4 +1,4 @@
-function escapeHtml(text = "") {
+export function escapeHtml(text = "") {
   return text
     .replace(/&/g, "&")
     .replace(/</g, "&lt;")

package/test/device-code-message.test.js

@@ -0,0 +1,42 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { buildDeviceCodeTelegramMessage } from "../src/transport/telegram/device-code-message.js";
+
+test("builds a copyable device-code Telegram message with HTML and inline buttons", () => {
+  const payload = buildDeviceCodeTelegramMessage({
+    userCode: "TR2S-K4GBZ",
+    verificationUri: "https://auth.openai.com/codex/device",
+    expiresInSeconds: 900
+  });
+
+  assert.equal(payload.parse_mode, "HTML");
+  assert.match(payload.text, /https:\/\/auth\.openai\.com\/codex\/device/);
+  assert.match(payload.text, /<code>TR2S-K4GBZ<\/code>/);
+  assert.match(payload.text, /Expires in 15 minute\(s\)\./);
+  assert.deepEqual(payload.reply_markup.inline_keyboard, [[
+    { text: "Copy code: TR2S-K4GBZ", copy_text: { text: "TR2S-K4GBZ" } },
+    { text: "Open login page", url: "https://auth.openai.com/codex/device" }
+  ]]);
+  assert.deepEqual(payload.link_preview_options, { is_disabled: true });
+});
+
+test("escapes HTML-sensitive device-code values", () => {
+  const payload = buildDeviceCodeTelegramMessage({
+    userCode: "A&B<1>",
+    verificationUri: "https://example.com/?q=\"x\""
+  });
+
+  assert.match(payload.text, /<code>A&amp;B&lt;1&gt;<\/code>/);
+  assert.match(payload.text, /href="https:\/\/example\.com\/\?q=&quot;x&quot;"/);
+  assert.equal(payload.reply_markup.inline_keyboard[0][0].copy_text.text, "A&B<1>");
+});
+
+test("omits copy button when code exceeds Telegram copy_text limit", () => {
+  const payload = buildDeviceCodeTelegramMessage({
+    userCode: "x".repeat(257),
+    verificationUri: "https://example.com/device"
+  });
+
+  assert.equal(payload.reply_markup.inline_keyboard[0].length, 1);
+  assert.equal(payload.reply_markup.inline_keyboard[0][0].text, "Open login page");
+});