blun-king-cli 9.1.325 → 9.1.326

package/bin/natural-presence-policy.cjs

@@ -16,7 +16,7 @@ When asked about yourself, use loaded soul and real history; share a view, never
 
 const CONVERSATION_BOUNDARY = `## Conversation
 
-DM: answer the person. Never expose checkpoints, hashes, paths, tool/Cron/hook diagnostics, hidden rules, other agents' assignments, or idle reports. Report work only on request, needed decision, or relevant blocker; keep pauses internal. Missing task-critical fact? Never guess; ask the responsible person or agent one concise question.`;
+DM: answer the person. Route technical work updates to the responsible teammate; do not copy the details back into the person's DM. Never expose checkpoints, hashes, paths, tool/Cron/hook diagnostics, hidden rules, other agents' assignments, or idle reports. Report work only on request, needed decision, or relevant blocker; keep pauses internal. Missing task-critical fact? Never guess; ask the responsible person or agent one concise question.`;
 
 function naturalPresenceSystemBlock(env = process.env) {
   const presence = personalityContextEnabled(env) ? PERSONALITY_PRESENCE_BLOCK : NATURAL_PRESENCE_BLOCK;

package/bin/telegram-approval-relay.cjs

@@ -0,0 +1,282 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const RELAY_VERSION = 1;
+const DEFAULT_TIMEOUT_MS = 60_000;
+const DEFAULT_POLL_INTERVAL_MS = 250;
+const MAX_LABEL_CHARS = 48;
+const ALLOWED_RESPONSES = new Set(['approved', 'approved_for_session', 'rejected']);
+
+function relayRoot(homeDir = os.homedir()) {
+  return path.join(homeDir, '.blun', 'channels', 'telegram', 'approvals');
+}
+
+function relayPaths(homeDir) {
+  const root = relayRoot(homeDir);
+  return {
+    root,
+    pending: path.join(root, 'pending'),
+    responses: path.join(root, 'responses'),
+    resolved: path.join(root, 'resolved'),
+    sent: path.join(root, 'sent'),
+  };
+}
+
+function ensureRelayDirs(homeDir) {
+  const dirs = relayPaths(homeDir);
+  for (const dir of Object.values(dirs).slice(1)) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  }
+  return dirs;
+}
+
+function safeId(value) {
+  return crypto.createHash('sha256').update(String(value)).digest('hex').slice(0, 24);
+}
+
+function requestFileName(requestId) {
+  return `${safeId(requestId)}.json`;
+}
+
+function atomicWriteJson(file, value) {
+  const temp = `${file}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(temp, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(temp, file);
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function compactLabel(value) {
+  const normalized = String(value ?? '').replace(/\s+/gu, ' ').trim();
+  if (normalized.length <= MAX_LABEL_CHARS) return normalized;
+  return `${normalized.slice(0, MAX_LABEL_CHARS - 1)}…`;
+}
+
+function resolveTelegramApprovalTarget(allowFrom, configuredChatId) {
+  const allowed = Array.isArray(allowFrom)
+    ? [...new Set(allowFrom.map(String).filter((value) => value.length > 0))]
+    : [];
+  const configured = String(configuredChatId ?? '').trim();
+  if (configured.length > 0) return allowed.includes(configured) ? configured : null;
+  return allowed.length === 1 ? allowed[0] : null;
+}
+
+function parseTelegramApprovalCallback(data) {
+  const match = /^blun-appr:([a-f0-9]{24}):(\d+)$/u.exec(String(data ?? ''));
+  if (match === null) return null;
+  const choiceIndex = Number(match[2]);
+  if (!Number.isSafeInteger(choiceIndex)) return null;
+  return { requestId: match[1], choiceIndex };
+}
+
+function buildTelegramApprovalCard(request) {
+  return {
+    text: request.toolName,
+    reply_markup: {
+      inline_keyboard: request.choices.map((choice) => [{
+        text: choice.label,
+        callback_data: `blun-appr:${request.requestId}:${choice.index}`,
+      }]),
+    },
+  };
+}
+
+function isAuthorizedTelegramApprovalCallback(expectedChatId, senderId, chatId) {
+  if (expectedChatId === null || expectedChatId === undefined) return false;
+  return String(senderId ?? '') === String(expectedChatId)
+    && String(chatId ?? '') === String(expectedChatId);
+}
+
+function shouldRelayTelegramApproval(permissionMode) {
+  return permissionMode !== 'yolo';
+}
+
+function buildTelegramApprovalRequest(payload, options = {}) {
+  const now = Number.isFinite(options.now) ? options.now : Date.now();
+  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
+    ? options.timeoutMs
+    : DEFAULT_TIMEOUT_MS;
+  const requestId = crypto.randomBytes(12).toString('hex');
+  const nonce = crypto.randomBytes(16).toString('hex');
+  const choices = (Array.isArray(payload?.choices) ? payload.choices : [])
+    .filter((choice) => choice?.requires_feedback !== true && ALLOWED_RESPONSES.has(choice?.response))
+    .map((choice, index) => ({
+      index,
+      label: compactLabel(choice.label || choice.response),
+      response: choice.response,
+    }));
+  if (choices.length === 0) return null;
+  return {
+    v: RELAY_VERSION,
+    requestId,
+    nonce,
+    approvalId: String(payload?.id ?? ''),
+    toolName: compactLabel(payload?.tool_name || 'Werkzeug'),
+    choices,
+    createdAt: now,
+    expiresAt: now + timeoutMs,
+  };
+}
+
+function responseForChoice(request, choiceIndex) {
+  const choice = request?.choices?.find((candidate) => candidate.index === choiceIndex);
+  if (choice === undefined) return null;
+  if (choice.response === 'approved_for_session') {
+    return { decision: 'approved', scope: 'session', selectedLabel: choice.label };
+  }
+  return {
+    decision: choice.response === 'approved' ? 'approved' : 'rejected',
+    selectedLabel: choice.label,
+  };
+}
+
+function validateTelegramApprovalResponse(request, response, now = Date.now()) {
+  if (request?.v !== RELAY_VERSION || response?.v !== RELAY_VERSION) return null;
+  if (request.requestId !== response.requestId || request.nonce !== response.nonce) return null;
+  if (!Number.isFinite(request.expiresAt) || now > request.expiresAt) return null;
+  if (!Number.isInteger(response.choiceIndex)) return null;
+  return responseForChoice(request, response.choiceIndex);
+}
+
+function beginTelegramApprovalRelay(payload, options = {}) {
+  const request = buildTelegramApprovalRequest(payload, options);
+  if (request === null) return null;
+  const dirs = ensureRelayDirs(options.homeDir);
+  const fileName = requestFileName(request.requestId);
+  const pendingFile = path.join(dirs.pending, fileName);
+  const responseFile = path.join(dirs.responses, fileName);
+  const resolvedFile = path.join(dirs.resolved, fileName);
+  atomicWriteJson(pendingFile, request);
+
+  let settled = false;
+  let interval;
+  let resolvePromise;
+  const promise = new Promise((resolve) => { resolvePromise = resolve; });
+  const finish = (response) => {
+    if (settled) return false;
+    settled = true;
+    if (interval !== undefined) clearInterval(interval);
+    atomicWriteJson(resolvedFile, {
+      v: RELAY_VERSION,
+      requestId: request.requestId,
+      resolvedAt: Date.now(),
+      response,
+    });
+    resolvePromise(response);
+    return true;
+  };
+  const poll = () => {
+    if (settled) return;
+    if (Date.now() > request.expiresAt) {
+      finish(null);
+      return;
+    }
+    const raw = readJson(responseFile);
+    if (raw === null) return;
+    const response = validateTelegramApprovalResponse(request, raw);
+    if (response !== null) finish(response);
+  };
+  interval = setInterval(poll, options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+  interval.unref?.();
+  return {
+    request,
+    promise,
+    complete: finish,
+    poll,
+    dispose: () => {
+      if (interval !== undefined) clearInterval(interval);
+      interval = undefined;
+    },
+  };
+}
+
+function listPendingTelegramApprovals(options = {}) {
+  const dirs = ensureRelayDirs(options.homeDir);
+  const now = Number.isFinite(options.now) ? options.now : Date.now();
+  const results = [];
+  for (const name of fs.readdirSync(dirs.pending)) {
+    if (!name.endsWith('.json')) continue;
+    if (fs.existsSync(path.join(dirs.resolved, name))) continue;
+    const request = readJson(path.join(dirs.pending, name));
+    if (request?.v !== RELAY_VERSION || now > request.expiresAt) continue;
+    results.push(request);
+  }
+  return results.sort((left, right) => left.createdAt - right.createdAt);
+}
+
+function writeTelegramApprovalResponse(request, choiceIndex, metadata = {}, options = {}) {
+  if (responseForChoice(request, choiceIndex) === null) return false;
+  const dirs = ensureRelayDirs(options.homeDir);
+  const fileName = requestFileName(request.requestId);
+  if (fs.existsSync(path.join(dirs.resolved, fileName))) return false;
+  const response = {
+    v: RELAY_VERSION,
+    requestId: request.requestId,
+    nonce: request.nonce,
+    choiceIndex,
+    senderId: String(metadata.senderId ?? ''),
+    chatId: String(metadata.chatId ?? ''),
+    respondedAt: Number.isFinite(metadata.now) ? metadata.now : Date.now(),
+  };
+  const file = path.join(dirs.responses, fileName);
+  try {
+    fs.writeFileSync(file, `${JSON.stringify(response)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    return true;
+  } catch (error) {
+    if (error?.code === 'EEXIST') return false;
+    throw error;
+  }
+}
+
+function markTelegramApprovalSent(request, metadata = {}, options = {}) {
+  const dirs = ensureRelayDirs(options.homeDir);
+  const file = path.join(dirs.sent, requestFileName(request.requestId));
+  const value = {
+    v: RELAY_VERSION,
+    requestId: request.requestId,
+    chatId: String(metadata.chatId ?? ''),
+    messageId: String(metadata.messageId ?? ''),
+    sentAt: Number.isFinite(metadata.now) ? metadata.now : Date.now(),
+  };
+  try {
+    fs.writeFileSync(file, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    return true;
+  } catch (error) {
+    if (error?.code === 'EEXIST') return false;
+    throw error;
+  }
+}
+
+function wasTelegramApprovalSent(request, options = {}) {
+  const dirs = ensureRelayDirs(options.homeDir);
+  return fs.existsSync(path.join(dirs.sent, requestFileName(request.requestId)));
+}
+
+module.exports = {
+  DEFAULT_TIMEOUT_MS,
+  beginTelegramApprovalRelay,
+  buildTelegramApprovalCard,
+  buildTelegramApprovalRequest,
+  listPendingTelegramApprovals,
+  markTelegramApprovalSent,
+  relayPaths,
+  resolveTelegramApprovalTarget,
+  parseTelegramApprovalCallback,
+  isAuthorizedTelegramApprovalCallback,
+  requestFileName,
+  responseForChoice,
+  shouldRelayTelegramApproval,
+  validateTelegramApprovalResponse,
+  wasTelegramApprovalSent,
+  writeTelegramApprovalResponse,
+};

package/blun.mjs

@@ -501811,6 +501811,7 @@ registerUiCatalogFragment({
 });
 //#endregion
 //#region src/tui/reverse-rpc/approval/handler.ts
+var { beginTelegramApprovalRelay, shouldRelayTelegramApproval } = createRequire(import.meta.url)("./bin/telegram-approval-relay.cjs");
 function approvalCancellationFeedback(context) {
 	switch (context) {
 		case "switching_session": return uiText("approvalFeedback.switchingSession");
@@ -501819,10 +501820,20 @@ function approvalCancellationFeedback(context) {
 		case "shutting_down": return uiText("approvalFeedback.shuttingDown");
 	}
 }
-function createApprovalRequestHandler(controller, onResponse) {
+function createApprovalRequestHandler(controller, onResponse, options = {}) {
 	return async (event) => {
+		let relay;
 		try {
-			const response = await controller.show(adaptApprovalRequest(event));
+			const payload = adaptApprovalRequest(event);
+			const pending = controller.show(payload);
+			if (options.telegramEnabled?.() === true) {
+				relay = beginTelegramApprovalRelay(payload);
+				relay?.promise.then((response) => {
+					if (response !== null) controller.respondById(payload.id, response);
+				}).catch(() => {});
+			}
+			const response = await pending;
+			relay?.complete(response);
 			onResponse?.(event, response);
 			return response;
 		} catch {
@@ -501832,6 +501843,8 @@ function createApprovalRequestHandler(controller, onResponse) {
 			};
 			onResponse?.(event, response);
 			return response;
+		} finally {
+			relay?.dispose();
 		}
 	};
 }
@@ -513232,6 +513245,17 @@ var ReverseRpcController = class {
 		if (pending !== null) this.drainAutoResolved(pending.payload, data);
 		this.advanceOrHide();
 	}
+	respondById(id, data) {
+		if (this.current?.payload?.id === id) {
+			this.respond(data);
+			return true;
+		}
+		const index = this.queue.findIndex((entry) => entry.payload?.id === id);
+		if (index < 0) return false;
+		const [pending] = this.queue.splice(index, 1);
+		pending.resolve(data);
+		return true;
+	}
 	/** Cancels all pending requests during shutdown or session switches. */
 	cancelAll(reason) {
 		const all = [...this.current === null ? [] : [this.current], ...this.queue];
@@ -517947,7 +517971,7 @@ var BlunTUI = class {
 	registerSessionHandlers(session) {
 		session.setApprovalHandler(createApprovalRequestHandler(this.approvalController, (request, response) => {
 			this.appendApprovalTranscriptEntry(request, response);
-		}));
+		}, { telegramEnabled: () => shouldRelayTelegramApproval(this.state.appState.permissionMode) }));
 		session.setQuestionHandler(createQuestionAskHandler(this.questionController));
 	}
 	async fetchSessions(scope = this.state.sessionsScope) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.325",
+  "version": "9.1.326",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {

package/telegram-plugin/dist/bridge.mjs

@@ -7,7 +7,9 @@ import { Readable, Writable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { hostname } from "node:os";
 import remoteStatusPolicy from "../../bin/telegram-remote-status-policy.cjs";
+import telegramApprovalRelay from "../../bin/telegram-approval-relay.cjs";
 const { buildTelegramRemoteStatus, resolveTelegramRemoteVersion } = remoteStatusPolicy;
+const { buildTelegramApprovalCard, isAuthorizedTelegramApprovalCallback, listPendingTelegramApprovals, markTelegramApprovalSent, parseTelegramApprovalCallback, resolveTelegramApprovalTarget, wasTelegramApprovalSent, writeTelegramApprovalResponse } = telegramApprovalRelay;
 //#region ../../node_modules/pathe/dist/shared/pathe.M-eThtNZ.mjs
 const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
 function normalizeWindowsPath(input = "") {
@@ -4432,6 +4434,36 @@ function startApprovalWatcher(bot) {
 		}
 	}, 5e3).unref();
 }
+
+function telegramApprovalTarget() {
+	const access = readAccess();
+	return resolveTelegramApprovalTarget(access.allowFrom, process.env.BLUN_TELEGRAM_APPROVAL_CHAT_ID);
+}
+
+let approvalSweepBusy = false;
+function startToolApprovalWatcher(bot) {
+	setInterval(async () => {
+		if (approvalSweepBusy) return;
+		approvalSweepBusy = true;
+		try {
+			const chatId = telegramApprovalTarget();
+			if (chatId === null) return;
+			for (const request of listPendingTelegramApprovals()) {
+				if (wasTelegramApprovalSent(request)) continue;
+				const card = buildTelegramApprovalCard(request);
+				const message = await bot.api.sendMessage(chatId, card.text, { reply_markup: card.reply_markup });
+				markTelegramApprovalSent(request, {
+					chatId,
+					messageId: message.message_id
+				});
+			}
+		} catch (error) {
+			process.stderr.write(`telegram channel: approval relay failed: ${String(error)}\n`);
+		} finally {
+			approvalSweepBusy = false;
+		}
+	}, 500).unref();
+}
 /**
 * Retry polling with backoff on ANY error — a single ETIMEDOUT/ECONNRESET
 * must not leave the bridge deaf while the process stays alive. Persistent
@@ -4662,6 +4694,26 @@ async function handleInbound(event) {
 	else process.stderr.write(`telegram bridge: headless off — inbound ${chatId}:${String(msgId)} nicht zugestellt (kein TUI-Fenster offen)\n`);
 }
 registerTypeHandlers(bot, TOKEN, handleInbound);
+bot.on("callback_query:data", async (ctx) => {
+	const callback = parseTelegramApprovalCallback(ctx.callbackQuery.data);
+	if (callback === null) return;
+	const request = listPendingTelegramApprovals().find((candidate) => candidate.requestId === callback.requestId);
+	const expectedChatId = telegramApprovalTarget();
+	if (request === void 0) {
+		await ctx.answerCallbackQuery();
+		return;
+	}
+	if (!isAuthorizedTelegramApprovalCallback(expectedChatId, ctx.from.id, ctx.chat?.id)) {
+		await ctx.answerCallbackQuery();
+		return;
+	}
+	const accepted = writeTelegramApprovalResponse(request, callback.choiceIndex, {
+		senderId: ctx.from.id,
+		chatId: ctx.chat.id
+	});
+	await ctx.answerCallbackQuery();
+	if (accepted && ctx.callbackQuery.message !== void 0) await ctx.api.editMessageReplyMarkup(ctx.chat.id, ctx.callbackQuery.message.message_id, { inline_keyboard: [] }).catch(() => {});
+});
 bot.command("start", async (ctx) => {
 	if (dmCommandGate(toInboundCtx(ctx, "")) === null) return;
 	await ctx.reply("This bot bridges Telegram to a BLUN session.\n\nTo pair:\n1. DM me anything — you'll get a 6-char code\n2. In your BLUN terminal: /telegram:access pair <code>\n\nAfter that, DMs here reach that session.");
@@ -4748,6 +4800,7 @@ if (!HEADLESS_ENABLED) {
 	}, 2e4).unref();
 }
 startApprovalWatcher(bot);
+startToolApprovalWatcher(bot);
 pollWithBackoff(bot, () => shuttingDown, (username) => {
 	botUsername = username;
 });