bloby-bot 0.60.0 → 0.61.0

package/supervisor/index.ts

@@ -551,6 +551,14 @@ export async function startSupervisor() {
     'POST /api/channels/whatsapp/react',
     'POST /api/channels/send',
     'POST /api/channels/alexa/handle',
+    'POST /api/channels/telegram/connect',
+    'GET /api/channels/telegram/poll',
+    'GET /api/channels/telegram/pair-page',
+    'GET /api/channels/telegram/status',
+    'POST /api/channels/telegram/configure',
+    'POST /api/channels/telegram/disconnect',
+    'POST /api/channels/telegram/reconnect',
+    'POST /api/channels/telegram/logout',
   ];
   // Method-specific public PREFIXES — onboarding namespaces with sub-paths / params that carry no
   // private chat data: provider OAuth setup/status (all of /api/auth/*), and handle availability
@@ -677,6 +685,11 @@ export async function startSupervisor() {
         'POST /api/channels/whatsapp/logout',
         'POST /api/channels/whatsapp/pairing-code',
         'POST /api/channels/send',
+        // Telegram mutation endpoints that seize/alter the agent — agent-driven over loopback only.
+        'POST /api/channels/telegram/configure',
+        'POST /api/channels/telegram/disconnect',
+        'POST /api/channels/telegram/reconnect',
+        'POST /api/channels/telegram/logout',
       ]);
       if (WA_MUTATION_ROUTES.has(`${req.method} ${channelPath}`)) {
         const remoteIp = req.socket.remoteAddress || '';
@@ -1348,6 +1361,306 @@ mint();
         return;
       }
 
+      // ── Telegram (relay provisions a per-user bot via "Managed Bots"; the Bloby then
+      //    long-polls Telegram DIRECTLY — the relay is only in the pairing path) ──
+
+      // POST /api/channels/telegram/connect — ask the relay to start provisioning a child bot.
+      // Returns a t.me/newbot deep link the user taps + a sessionId to poll. No token yet.
+      if (req.method === 'POST' && channelPath === '/api/channels/telegram/connect') {
+        (async () => {
+          try {
+            const cfg = loadConfig();
+            if (!cfg.relay?.token) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'no-relay-token' }));
+              return;
+            }
+            const resp = await fetch('https://api.bloby.bot/api/telegram/provision', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${cfg.relay.token}` },
+              body: JSON.stringify({ name: cfg.username || 'Bloby' }),
+            });
+            const data = await resp.json() as { sessionId?: string; deepLink?: string; botUsername?: string; expiresAt?: string; error?: string };
+            if (!resp.ok || !data.sessionId || !data.deepLink) {
+              res.writeHead(resp.status || 500);
+              res.end(JSON.stringify({ ok: false, error: data.error || 'provision-failed' }));
+              return;
+            }
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, sessionId: data.sessionId, deepLink: data.deepLink, botUsername: data.botUsername, expiresAt: data.expiresAt }));
+          } catch (err: any) {
+            log.warn(`[telegram/connect] ${err.message}`);
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // GET /api/channels/telegram/poll?sessionId=… — poll the relay for the provisioned token.
+      // When ready, persist the child token locally and start the long-poll provider.
+      if (req.method === 'GET' && channelPath === '/api/channels/telegram/poll') {
+        (async () => {
+          try {
+            const sessionId = new URL(req.url || '', 'http://localhost').searchParams.get('sessionId') || '';
+            if (!sessionId) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'missing-sessionId' }));
+              return;
+            }
+            const cfg = loadConfig();
+            if (!cfg.relay?.token) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'no-relay-token' }));
+              return;
+            }
+            const resp = await fetch(`https://api.bloby.bot/api/telegram/provision/${encodeURIComponent(sessionId)}`, {
+              headers: { Authorization: `Bearer ${cfg.relay.token}` },
+            });
+            const data = await resp.json() as { ready?: boolean; token?: string; botUsername?: string; ownerUserId?: string | number; error?: string };
+            if (!resp.ok) {
+              res.writeHead(resp.status);
+              res.end(JSON.stringify({ ok: false, error: data.error || 'poll-failed' }));
+              return;
+            }
+            if (!data.ready || !data.token) {
+              res.writeHead(200);
+              res.end(JSON.stringify({ ok: true, ready: false }));
+              return;
+            }
+
+            // Provisioned — persist the child bot token and bring the channel up.
+            const fresh = loadConfig();
+            if (!fresh.channels) fresh.channels = {};
+            fresh.channels.telegram = {
+              ...(fresh.channels.telegram || {}),
+              enabled: true,
+              mode: fresh.channels.telegram?.mode || 'channel',
+              botToken: data.token,
+              botUsername: data.botUsername || fresh.channels.telegram?.botUsername,
+              ownerUserId: data.ownerUserId != null ? String(data.ownerUserId) : fresh.channels.telegram?.ownerUserId,
+            };
+            saveConfig(fresh);
+            // Re-pairing replaces the token — tear down any existing provider so init() reconnects
+            // with the NEW token (init() is a no-op when a provider is already in the map).
+            await channelManager.disconnectChannel('telegram').catch(() => {});
+            await channelManager.init().catch(() => {});
+
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, ready: true, botUsername: data.botUsername }));
+          } catch (err: any) {
+            log.warn(`[telegram/poll] ${err.message}`);
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/telegram/configure — set mode + admins + skill (loopback-only).
+      if (req.method === 'POST' && channelPath === '/api/channels/telegram/configure') {
+        let body = '';
+        req.on('data', (chunk: Buffer) => { body += chunk.toString(); });
+        req.on('end', () => {
+          try {
+            const data = JSON.parse(body || '{}');
+            const cfg = loadConfig();
+            if (!cfg.channels) cfg.channels = {};
+            if (!cfg.channels.telegram) cfg.channels.telegram = { enabled: false, mode: 'channel' };
+            if (data.mode) cfg.channels.telegram.mode = data.mode;
+            if (data.admins !== undefined) cfg.channels.telegram.admins = data.admins;
+            if (data.skill !== undefined) cfg.channels.telegram.skill = data.skill;
+            if (data.allowGroups !== undefined) cfg.channels.telegram.allowGroups = !!data.allowGroups;
+            if (data.allowOthersToTrigger !== undefined) cfg.channels.telegram.allowOthersToTrigger = !!data.allowOthersToTrigger;
+            saveConfig(cfg);
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true, config: { ...cfg.channels.telegram, botToken: cfg.channels.telegram.botToken ? '***' : undefined } }));
+          } catch (err: any) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: err.message }));
+          }
+        });
+        return;
+      }
+
+      // POST /api/channels/telegram/disconnect — stop polling, KEEP the token (loopback-only).
+      if (req.method === 'POST' && channelPath === '/api/channels/telegram/disconnect') {
+        (async () => {
+          try {
+            await channelManager.disconnectChannel('telegram');
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/telegram/logout — stop polling + forget the token (loopback-only).
+      if (req.method === 'POST' && channelPath === '/api/channels/telegram/logout') {
+        (async () => {
+          try {
+            await channelManager.disconnectChannel('telegram');
+            const cfg = loadConfig();
+            if (cfg.channels?.telegram) {
+              delete cfg.channels.telegram.botToken;
+              cfg.channels.telegram.enabled = false;
+              saveConfig(cfg);
+            }
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // POST /api/channels/telegram/reconnect — resume polling an already-provisioned bot
+      // after a disconnect, without re-pairing (loopback-only).
+      if (req.method === 'POST' && channelPath === '/api/channels/telegram/reconnect') {
+        (async () => {
+          try {
+            const cfg = loadConfig();
+            if (!cfg.channels?.telegram?.botToken) {
+              res.writeHead(400);
+              res.end(JSON.stringify({ ok: false, error: 'no-bot-token' }));
+              return;
+            }
+            if (cfg.channels.telegram.enabled !== true) {
+              cfg.channels.telegram.enabled = true;
+              saveConfig(cfg);
+            }
+            await channelManager.init().catch(() => {});
+            res.writeHead(200);
+            res.end(JSON.stringify({ ok: true }));
+          } catch (err: any) {
+            res.writeHead(500);
+            res.end(JSON.stringify({ ok: false, error: err.message }));
+          }
+        })();
+        return;
+      }
+
+      // GET /api/channels/telegram/status — current telegram channel status
+      if (req.method === 'GET' && channelPath === '/api/channels/telegram/status') {
+        const status = channelManager.getStatus('telegram');
+        res.writeHead(200);
+        res.end(JSON.stringify(status || { channel: 'telegram', connected: false }));
+        return;
+      }
+
+      // GET /api/channels/telegram/pair-page — inline page: tap to create the bot, then auto-detects link.
+      if (req.method === 'GET' && channelPath === '/api/channels/telegram/pair-page') {
+        res.setHeader('Content-Type', 'text/html');
+        const tgStatus = channelManager.getStatus('telegram');
+        const alreadyLinked = !!(tgStatus?.info as any)?.linked;
+        const linkedUsername = (tgStatus?.info as any)?.botUsername || '';
+        const confettiHTML = Array.from({ length: 30 }, (_, i) => {
+          const colors = ['#0166FF', '#009AFE', '#4AEEFF', '#4ade80', '#facc15', '#818cf8'];
+          const color = colors[Math.floor(Math.random() * colors.length)];
+          const left = Math.random() * 100;
+          const delay = i * 0.04;
+          const drift = (Math.random() - 0.5) * 120;
+          const duration = 1.8 + Math.random() * 0.8;
+          return `<div class="confetti-dot" style="left:${left}%;background:${color};animation-delay:${delay}s;animation-duration:${duration}s;--drift:${drift}px"></div>`;
+        }).join('');
+        res.writeHead(200);
+        res.end(`<!DOCTYPE html><html><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Connect Telegram</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600&family=Space+Grotesk:wght@600;700&display=swap" rel="stylesheet">
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{background:#212121;color:#f5f5f5;font-family:'Inter',system-ui,-apple-system,sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100dvh;margin:0;overflow-x:hidden}
+  .container{display:flex;flex-direction:column;align-items:center;max-width:380px;width:100%;padding:20px}
+  .card{background:#2a2a2a;border:1px solid rgba(255,255,255,0.08);border-radius:20px;padding:28px 24px;width:100%;box-shadow:0 0 0 1px rgba(0,105,254,0.1),0 0 20px -5px rgba(0,105,254,0.15);animation:fade-up .5s ease-out both;text-align:center}
+  .header{display:flex;flex-direction:column;align-items:center;gap:6px;margin-bottom:18px}
+  .badge{display:inline-flex;align-items:center;gap:6px;background:#1a1a1a;border:1px solid rgba(255,255,255,0.08);border-radius:9999px;padding:4px 10px;font-size:11px;color:#888;text-transform:uppercase;letter-spacing:0.6px}
+  .badge::before{content:'';width:8px;height:8px;border-radius:50%;background:linear-gradient(135deg,#0166FF,#009AFE);box-shadow:0 0 8px rgba(74,238,255,0.5)}
+  .title{font-family:'Space Grotesk',sans-serif;font-size:22px;font-weight:700;background:linear-gradient(135deg,#0166FF,#009AFE,#4AEEFF);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;margin-top:6px}
+  .sub{font-size:13px;color:#999;line-height:1.6;margin-top:6px}
+  .steps{text-align:left;margin:18px 0 6px;animation:fade-up .5s ease-out .2s both}
+  .step{display:flex;gap:12px;font-size:13px;color:#bbb;line-height:1.5;padding:6px 0}
+  .step-num{flex-shrink:0;width:22px;height:22px;border-radius:50%;background:#1a1a1a;border:1px solid rgba(255,255,255,0.08);display:flex;align-items:center;justify-content:center;font-size:11px;font-weight:600;color:#888}
+  .step b{color:#f5f5f5;font-weight:600}
+  .btn{display:inline-flex;align-items:center;justify-content:center;width:100%;border:none;border-radius:10px;padding:13px 16px;font-size:14px;font-weight:600;cursor:pointer;font-family:inherit;transition:all .2s;text-decoration:none;margin-top:8px}
+  .btn-primary{background:linear-gradient(135deg,#0166FF,#009AFE);color:#fff}
+  .btn-primary:hover{opacity:.92}
+  .btn-disabled{opacity:.5;pointer-events:none}
+  .status{font-size:12px;color:#666;margin-top:14px;display:inline-flex;align-items:center;gap:6px;min-height:1.2em}
+  .status .dot{width:6px;height:6px;border-radius:50%;background:currentColor;animation:pulse 1.6s ease-in-out infinite;opacity:.6}
+  .err{color:#FB4072;font-size:13px;margin-top:12px;min-height:1.2em}
+  .confetti-wrap{position:fixed;top:0;left:0;width:100%;height:100%;pointer-events:none;overflow:hidden;z-index:0}
+  .confetti-dot{position:absolute;width:8px;height:8px;border-radius:50%;top:-10px;animation:confetti-fall 2s ease-out forwards}
+  @keyframes confetti-fall{0%{opacity:1;transform:translateY(0) translateX(0) rotate(0) scale(1)}100%{opacity:0;transform:translateY(100vh) translateX(var(--drift)) rotate(360deg) scale(.5)}}
+  .video-wrap{margin-bottom:8px;animation:pop-in .5s cubic-bezier(.34,1.56,.64,1) forwards}
+  .video-wrap video{width:200px;object-fit:contain;pointer-events:none}
+  @keyframes pop-in{0%{transform:scale(0);opacity:0}100%{transform:scale(1);opacity:1}}
+  .text-wrap{text-align:center;animation:fade-up .5s ease-out .3s both}
+  .success-sub{font-size:14px;color:#999;line-height:1.5;margin-top:6px}
+  @keyframes pulse{0%,100%{opacity:1;transform:scale(1)}50%{opacity:.4;transform:scale(.8)}}
+  @keyframes fade-up{0%{opacity:0;transform:translateY(10px)}100%{opacity:1;transform:translateY(0)}}
+</style></head><body>
+<div class="container" id="root">
+${alreadyLinked
+  ? `<div class="confetti-wrap">${confettiHTML}</div>
+<div class="video-wrap"><video autoplay muted playsinline><source src="/bloby_happy_reappearing.mov" type='video/mp4; codecs="hvc1"'><source src="/bloby_happy_reappearing.webm" type="video/webm"></video></div>
+<div class="text-wrap">
+  <div class="title">Connected!</div>
+  <p class="success-sub">Telegram is linked${linkedUsername ? ` to <b style="color:#f5f5f5">@${linkedUsername}</b>` : ''}. Open Telegram and message your bot to start chatting.</p>
+  <p class="success-sub" style="margin-top:14px;font-size:12px;color:#666">You can close this page.</p>
+</div>`
+  : `<div class="card" id="pendingCard">
+  <div class="header">
+    <span class="badge">Telegram</span>
+    <div class="title">Connect Telegram</div>
+    <p class="sub">Create your own private Telegram bot in two taps — no token, no copy-paste.</p>
+  </div>
+  <div class="steps">
+    <div class="step"><div class="step-num">1</div><div>Tap <b>Create my bot</b> below — Telegram opens with a confirm screen</div></div>
+    <div class="step"><div class="step-num">2</div><div>Tap <b>Create Bot</b> inside Telegram to confirm</div></div>
+    <div class="step"><div class="step-num">3</div><div>Come back here — it links automatically</div></div>
+  </div>
+  <a class="btn btn-primary btn-disabled" id="cta" href="#" target="_blank" rel="noopener">Preparing…</a>
+  <div class="status" id="st"><span class="dot"></span><span id="stText">Getting your link ready…</span></div>
+  <p class="err" id="err"></p>
+</div>`}
+</div>
+<script>
+${alreadyLinked ? `` : `
+let sessionId=null,poller=null;
+async function start(){
+  try{
+    const r=await fetch('/api/channels/telegram/connect',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'});
+    const d=await r.json();
+    if(!d.ok){document.getElementById('err').textContent=d.error||'Could not start. Try again.';return}
+    sessionId=d.sessionId;
+    const cta=document.getElementById('cta');
+    cta.href=d.deepLink;cta.classList.remove('btn-disabled');cta.textContent='Create my bot';
+    document.getElementById('stText').textContent='Waiting for you to confirm in Telegram…';
+    if(poller)clearInterval(poller);
+    poller=setInterval(poll,2500);
+  }catch(e){document.getElementById('err').textContent=e.message}
+}
+async function poll(){
+  if(!sessionId)return;
+  try{
+    const r=await fetch('/api/channels/telegram/poll?sessionId='+encodeURIComponent(sessionId));
+    const d=await r.json();
+    if(d.ok&&d.ready){clearInterval(poller);location.reload()}
+  }catch(e){/* keep polling */}
+}
+start();
+`}
+</script>
+</body></html>`);
+        return;
+      }
+
       // Fallback for unknown channel routes
       res.writeHead(404);
       res.end(JSON.stringify({ error: 'Not found' }));
@@ -1447,8 +1760,8 @@ mint();
       req.on('end', () => {
         if (tooLarge) return;
         try {
-          const { vars } = JSON.parse(body) as { vars: Record<string, string> };
-          if (!vars || typeof vars !== 'object') {
+          const { vars, remove } = JSON.parse(body) as { vars?: Record<string, string>; remove?: string[] };
+          if ((!vars || typeof vars !== 'object') && !Array.isArray(remove)) {
             res.writeHead(400, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Missing vars object' }));
             return;
@@ -1460,7 +1773,20 @@ mint();
             lines = fs.readFileSync(envPath, 'utf-8').split('\n');
           }
 
-          for (const [rawKey, rawValue] of Object.entries(vars)) {
+          // Delete requested keys first (so removing then re-adding the same key in one request
+          // behaves predictably). A key line is `KEY=...` / `KEY =...`.
+          if (Array.isArray(remove)) {
+            for (const rawKey of remove) {
+              const key = String(rawKey).trim();
+              if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+              lines = lines.filter((l) => {
+                const t = l.trim();
+                return !(t.startsWith(`${key}=`) || t.startsWith(`${key} =`));
+              });
+            }
+          }
+
+          for (const [rawKey, rawValue] of Object.entries(vars || {})) {
             const key = rawKey.trim();
             // Validate the key as a real env var name; reject anything that could inject extra
             // lines or break .env parsing.
@@ -1552,7 +1878,6 @@ mint();
             id: c.id,
             schedule: c.schedule,
             task: typeof c.task === 'string' ? c.task : '',
-            enabled: !!c.enabled, // mirror the scheduler's `!cron.enabled` skip (undefined → disabled)
             oneShot: !!c.oneShot,
             paused: c.paused === true,
             hasTaskFile: CRON_ID_RE.test(c.id || '') && fs.existsSync(path.join(WORKSPACE_DIR, 'tasks', `${c.id}.md`)),
@@ -2166,7 +2491,9 @@ mint();
       (!req.headers['sec-fetch-dest'] && String(req.headers['accept'] || '').includes('text/html'))
     );
     if (wantsHtml && isBackendDead()) {
-      res.writeHead(503, { 'Content-Type': 'text/html', 'Cache-Control': 'no-store, no-cache, must-revalidate' });
+      // X-Bloby-Origin marks this as the agent's OWN branded page so the relay passes it through
+      // (and never mistakes it for a Cloudflare tunnel error to be replaced).
+      res.writeHead(503, { 'Content-Type': 'text/html', 'X-Bloby-Origin': 'supervisor', 'Cache-Control': 'no-store, no-cache, must-revalidate' });
       res.end(backendDownPage(readBackendLogTail(100)));
       return;
     }
@@ -2174,7 +2501,7 @@ mint();
     // Vite failed to boot (sentinel port) → serve the recovering page directly instead of
     // proxying to a dead port. Chat (/bloby/*) is served earlier, so the lifeline stays up.
     if (vitePorts.dashboard < 0) {
-      res.writeHead(503, { 'Content-Type': 'text/html', 'Cache-Control': 'no-store, no-cache, must-revalidate' });
+      res.writeHead(503, { 'Content-Type': 'text/html', 'X-Bloby-Origin': 'supervisor', 'Cache-Control': 'no-store, no-cache, must-revalidate' });
       res.end(RECOVERING_HTML);
       return;
     }
@@ -2216,7 +2543,7 @@ mint();
     );
     proxy.on('error', (e) => {
       console.error(`[supervisor] Dashboard Vite proxy error: ${req.url}`, e.message);
-      res.writeHead(503, { 'Content-Type': 'text/html' });
+      res.writeHead(503, { 'Content-Type': 'text/html', 'X-Bloby-Origin': 'supervisor' });
       res.end(RECOVERING_HTML);
     });
     req.pipe(proxy);

package/supervisor/workspace-guard.js

@@ -60,9 +60,9 @@
             '<source src="/what-happened.webm" type="video/webm"><source src="/what-happened.mp4" type="video/mp4">' +
           '</video>' +
         '</div>' +
-        '<h1 style="font-size:1.5rem;font-weight:700;margin:0 0 .6rem;background:linear-gradient(135deg,#0166FF,#009AFE,#4AEEFF);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text">A screen in your app has an error</h1>' +
-        '<p style="color:#e4e4e7;font-size:1rem;line-height:1.6;margin:0 0 .4rem">Your latest change didn\'t compile.</p>' +
-        '<p style="color:#a1a1aa;font-size:.93rem;line-height:1.6;margin:0 0 1.2rem">Ask your agent to fix it — the chat is in the bottom corner. Copy the error so it can debug faster.</p>' +
+        '<h1 style="font-size:1.5rem;font-weight:700;margin:0 0 .6rem;background:linear-gradient(135deg,#0166FF,#009AFE,#4AEEFF);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text">Workspace error</h1>' +
+        '<p style="color:#e4e4e7;font-size:1rem;line-height:1.6;margin:0 0 .4rem">Your latest frontend change didn’t compile. If your Bloby is currently building or editing something, this is usually normal while the work is still in progress.</p>' +
+        '<p style="color:#a1a1aa;font-size:.93rem;line-height:1.6;margin:0 0 1.2rem">When your agent finishes, this may fix itself. If it doesn’t, ask your Bloby to fix it and copy the error so it can debug faster.</p>' +
         '<div><button id="__bloby_fe_copy" style="font:inherit;cursor:pointer;border:none;border-radius:10px;padding:.65rem 1.2rem;font-size:.9rem;font-weight:600;background:linear-gradient(135deg,#0166FF,#0069FE);color:#fff">Copy error for your agent</button> ' +
         '<button id="__bloby_fe_dismiss" style="font:inherit;cursor:pointer;border-radius:10px;padding:.65rem 1.1rem;font-size:.9rem;font-weight:600;border:1px solid #27272a;background:#18181b;color:#e4e4e7">Dismiss</button></div>' +
       '</div>';

package/worker/prompts/bloby-system-prompt-codex.txt

@@ -146,14 +146,14 @@ An array of scheduled tasks:
 
 Your human can ask you to:
 - Add a cron ("every morning at 9, summarize my notes")
-- Remove or disable a cron ("stop the daily summary")
+- Remove a cron ("stop the daily summary") — delete its entry from CRONS.json
 - Change a schedule ("move the summary to 8am")
 - List active crons ("what's scheduled?")
 - Set a one-time reminder ("remind me at 3pm to call the dentist")
 
 Just edit `CRONS.json` with the Write or Edit tool when asked. Each cron needs: `id` (unique slug), `schedule` (cron expression), `task` (what to do), `enabled` (boolean). Optionally add `"oneShot": true` for tasks that should run once and auto-delete — the scheduler removes them after they fire. Use `oneShot` for reminders, one-time alerts, and any task that doesn't repeat. The `paused` field is user-controlled — leave it alone (see below).
 
-The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself.** When you edit a cron with the Write or Edit tool (changing its schedule, task, or `enabled`), preserve whatever `paused` value is already there. If your human asks you to "resume" or "unpause" a cron in chat, set `"paused": false` (or delete the field). To disable a cron yourself, use `enabled: false` — leave `paused` for the user. `enabled` is the agent's switch; `paused` is the human's switch; the scheduler skips a cron when EITHER `enabled` is false OR `paused` is true.
+The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself** — preserve whatever `paused` value is already there when you edit a cron. If your human asks you in chat to pause or resume a cron, set `"paused": true` or `"paused": false`. To stop a cron permanently, delete its entry from CRONS.json (and its `tasks/{id}.md` file if it has one).
 
 **Timezone: all cron schedules use system local time.** The scheduler evaluates crons against the system clock — no UTC conversion needed. When creating a cron, run `date` to check the current local time and write the schedule accordingly. If your human says "remind me at 3pm", use `0 15 * * *` — that's 3pm in whatever timezone the system is set to.
 

package/worker/prompts/bloby-system-prompt-pi.txt

@@ -146,14 +146,14 @@ An array of scheduled tasks:
 
 Your human can ask you to:
 - Add a cron ("every morning at 9, summarize my notes")
-- Remove or disable a cron ("stop the daily summary")
+- Remove a cron ("stop the daily summary") — delete its entry from CRONS.json
 - Change a schedule ("move the summary to 8am")
 - List active crons ("what's scheduled?")
 - Set a one-time reminder ("remind me at 3pm to call the dentist")
 
 Just edit `CRONS.json` with the Write or Edit tool when asked. Each cron needs: `id` (unique slug), `schedule` (cron expression), `task` (what to do), `enabled` (boolean). Optionally add `"oneShot": true` for tasks that should run once and auto-delete — the scheduler removes them after they fire. Use `oneShot` for reminders, one-time alerts, and any task that doesn't repeat. The `paused` field is user-controlled — leave it alone (see below).
 
-The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself.** When you edit a cron with the Write or Edit tool (changing its schedule, task, or `enabled`), preserve whatever `paused` value is already there. If your human asks you to "resume" or "unpause" a cron in chat, set `"paused": false` (or delete the field). To disable a cron yourself, use `enabled: false` — leave `paused` for the user. `enabled` is the agent's switch; `paused` is the human's switch; the scheduler skips a cron when EITHER `enabled` is false OR `paused` is true.
+The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself** — preserve whatever `paused` value is already there when you edit a cron. If your human asks you in chat to pause or resume a cron, set `"paused": true` or `"paused": false`. To stop a cron permanently, delete its entry from CRONS.json (and its `tasks/{id}.md` file if it has one).
 
 **Timezone: all cron schedules use system local time.** The scheduler evaluates crons against the system clock — no UTC conversion needed. When creating a cron, run `date` to check the current local time and write the schedule accordingly. If your human says "remind me at 3pm", use `0 15 * * *` — that's 3pm in whatever timezone the system is set to.
 

package/worker/prompts/bloby-system-prompt.txt

@@ -146,14 +146,14 @@ An array of scheduled tasks:
 
 Your human can ask you to:
 - Add a cron ("every morning at 9, summarize my notes")
-- Remove or disable a cron ("stop the daily summary")
+- Remove a cron ("stop the daily summary") — delete its entry from CRONS.json
 - Change a schedule ("move the summary to 8am")
 - List active crons ("what's scheduled?")
 - Set a one-time reminder ("remind me at 3pm to call the dentist")
 
 Just edit `CRONS.json` with the Write or Edit tool when asked. Each cron needs: `id` (unique slug), `schedule` (cron expression), `task` (what to do), `enabled` (boolean). Optionally add `"oneShot": true` for tasks that should run once and auto-delete — the scheduler removes them after they fire. Use `oneShot` for reminders, one-time alerts, and any task that doesn't repeat. The `paused` field is user-controlled — leave it alone (see below).
 
-The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself.** When you edit a cron with the Write or Edit tool (changing its schedule, task, or `enabled`), preserve whatever `paused` value is already there. If your human asks you to "resume" or "unpause" a cron in chat, set `"paused": false` (or delete the field). To disable a cron yourself, use `enabled: false` — leave `paused` for the user. `enabled` is the agent's switch; `paused` is the human's switch; the scheduler skips a cron when EITHER `enabled` is false OR `paused` is true.
+The `paused` field is **user-controlled** — it appears when your human pauses a cron from the Settings → Pulse & Crons screen. A paused cron has `"paused": true` and the scheduler skips it (it will not fire) while keeping the entry and its task file intact. Treat `paused` as read-only: **never set, change, or remove it yourself** — preserve whatever `paused` value is already there when you edit a cron. If your human asks you in chat to pause or resume a cron, set `"paused": true` or `"paused": false`. To stop a cron permanently, delete its entry from CRONS.json (and its `tasks/{id}.md` file if it has one).
 
 **Timezone: all cron schedules use system local time.** The scheduler evaluates crons against the system clock — no UTC conversion needed. When creating a cron, run `date` to check the current local time and write the schedule accordingly. If your human says "remind me at 3pm", use `0 15 * * *` — that's 3pm in whatever timezone the system is set to.
 

package/workspace/skills/telegram/.claude-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "telegram",
+  "version": "1.0.0",
+  "description": "Telegram channel via a relay-provisioned private bot. Two-tap pairing, direct long-poll, voice/photo, channel/business/assistant modes.",
+  "skills": "./"
+}